Que faire après AdwCleaner ?

djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention   -  
loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   -
Bonjour,

J'ai lancé AdwCleaner. Voici le rapport ci dessous. Est ce que je dois faire autre chose ?

Merci.
Djami92

# AdwCleaner v3.018 - Rapport créé le 01/02/2014 à 07:48:13
# Mis à jour le 28/01/2014 par Xplode
# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)
# Nom d'utilisateur : DJAM - DJAM-09414A267C
# Exécuté depuis : C:\Documents and Settings\DJAM\Bureau\adwcleaner.exe
# Option : Nettoyer

***** [ Services ] *****

***** [ Fichiers / Dossiers ] *****

Dossier Supprimé : C:\Documents and Settings\All Users\Application Data\apn
Dossier Supprimé : C:\Documents and Settings\All Users\Application Data\Babylon
Dossier Supprimé : C:\Program Files\Plus-HD-2.6
Dossier Supprimé : C:\Documents and Settings\DJAM\Local Settings\Application Data\Freesofttoday
Dossier Supprimé : C:\DOCUME~1\DJAM\LOCALS~1\Temp\apn
Dossier Supprimé : C:\Documents and Settings\DJAM\Application Data\Babylon
Dossier Supprimé : C:\Documents and Settings\DJAM\Application Data\OpenCandy
Dossier Supprimé : C:\Documents and Settings\DJAM\Application Data\Mozilla\Firefox\Profiles\4rt64w5t.default\Extensions\7f404ccc-b0a9-4faf-b3c0-89ceea949aea@a6724a05-9380-4ebe-be02-e67e35a3402c.com
[!] Dossier Supprimé : C:\Documents and Settings\DJAM\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mpfeggemggokijeahnacacopejaabljl
[!] Dossier Supprimé : C:\Documents and Settings\DJAM\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mpfeggemggokijeahnacacopejaabljl
Fichier Supprimé : C:\Documents and Settings\DJAM\Application Data\Mozilla\Firefox\Profiles\4rt64w5t.default\searchplugins\softonic.xml
Fichier Supprimé : C:\WINDOWS\Tasks\Plus-HD-2.6-chromeinstaller.job
Fichier Supprimé : C:\WINDOWS\Tasks\Plus-HD-2.6-codedownloader.job
Fichier Supprimé : C:\WINDOWS\Tasks\Plus-HD-2.6-enabler.job
Fichier Supprimé : C:\WINDOWS\Tasks\Plus-HD-2.6-firefoxinstaller.job
Fichier Supprimé : C:\WINDOWS\Tasks\Plus-HD-2.6-updater.job

***** [ Raccourcis ] *****

***** [ Registre ] *****

Clé Supprimée : HKLM\SOFTWARE\Classes\Prod.cap
Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0033440.BHO
Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0033440.BHO.1
Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0033440.Sandbox
Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0033440.Sandbox.1
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311341140}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{33333333-3333-3333-3333-330033443379}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355345540}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066446679}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366346640}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{77777777-7777-7777-7777-770077447779}
Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440344344440}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311341140}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110311341140}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Valeur Supprimée : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{CCC7A320-B3CA-4199-B1A6-9F516DD69829}]
Clé Supprimée : HKCU\Software\Crossrider
Clé Supprimée : HKCU\Software\InstallCore
Clé Supprimée : HKCU\Software\installedbrowserextensions
Clé Supprimée : HKCU\Software\Plus-HD-2.6
Clé Supprimée : HKCU\Software\powerpack
Clé Supprimée : HKCU\Software\smartbar
Clé Supprimée : HKCU\Software\Tutorials
Clé Supprimée : HKCU\Software\TutoTag
Clé Supprimée : HKLM\Software\FreeSoftToday
Clé Supprimée : HKLM\Software\Plus-HD-2.6
Clé Supprimée : HKLM\Software\Tutorials
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Plus-HD-2.6
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{006E6A46-8D55-4F10-BBA8-2C9653B4278B}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Plus-HD-2.6

***** [ Navigateurs ] *****

-\\ Internet Explorer v8.0.6001.18702

Paramètre Restauré : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Paramètre Restauré : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]
Paramètre Restauré : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Paramètre Restauré : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Paramètre Restauré : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Paramètre Restauré : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

-\\ Mozilla Firefox v

[ Fichier : C:\Documents and Settings\DJAM\Application Data\Mozilla\Firefox\Profiles\4rt64w5t.default\prefs.js ]

Ligne Supprimée : user_pref("browser.search.defaultengine", "Ask.com Search");

-\\ Google Chrome v32.0.1700.102

[ Fichier : C:\Documents and Settings\DJAM\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]

Supprimée : homepage

*************************

AdwCleaner[R0].txt - [44453 octets] - [18/10/2013 12:30:09]
AdwCleaner[R1].txt - [8644 octets] - [01/02/2014 07:45:58]
AdwCleaner[S0].txt - [43322 octets] - [18/10/2013 12:31:49]
AdwCleaner[S1].txt - [6711 octets] - [01/02/2014 07:48:13]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [6771 octets] ##########

31 réponses

  • 1
  • 2
Résumé de la discussion

Le rapport AdwCleaner signale une présence d’adware et de programmes potentiellement indésirables, avec suppression de dossiers, extensions et clés de registre lors du nettoyage effectué. Plusieurs éléments recommandent des mesures complémentaires: utiliser ZHPDiag en diagnostic, puis transmettre les rapports et envisager Malwarebytes Anti-Malware pour une désinfection générale afin d'obtenir un rapport clair à partager. En parallèle, des conseils insistent sur la prudence lors de l’installation de logiciels gratuits et sur le débranchement des offres additionnelles proposées par certains installateurs. A noter que la procédure et les outils cités visent à nettoyer des composants publicitaires, mais le rapport RogueKiller évoqué montre des traces plus profondes sur Windows XP et nécessite une approche adaptée.

Généré automatiquement par IA
sur la base des meilleures réponses
  1. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
     
    Bonjour,

    Utilise ce logiciel de désinfection généraliste :

    ¶ Télécharge et installe Malwarebytes' Anti-Malware
    ¶ A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
    ¶ Lance MBAM et laisse les Mises à jour se télécharger (sinon fais les manuellement au lancement du programme)
    ¶ Puis va dans l'onglet "Recherche", coche "Exécuter un examen rapide" puis "Rechercher"
    ¶ A la fin de l'analyse, clique sur Afficher les résultats
    Coche tous les éléments détectés puis clique sur Supprimer la sélection
    ¶ Enregistre le rapport
    ¶ S'il t'est demandé de redémarrer l'ordinateur, clique sur Yes
    ¶ Poste dans ta prochaine réponse le rapport apparaissant après la suppression
    1
    1. djami92
       
      Merci. J ai fait. Il y a beaucoup moins de pub . Merci encore et bonne journée.
      0
    2. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
       
      Hello,

      J'attends le rapport ZHPDiag comme demandé ici, seul moyen pour contrôler et nettoyer correctement ton PC.
      0
      1. djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention   > loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention  
         
        Re bjr : j essaie fin de journée qd serai de retour maison. A tout à l'heure et merci encore. Djami82
        0
  2. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
     
    Ton ordinateur est infecté par des logiciels publicitaires...
    Pour éviter ce genre de problème :
    - Ne télécharge pas n'importe quel programme gratuit sans te renseigner dessus
    - Ne télécharge aucun programme proposé dans des publicités ou sur des sites suspects, préfère les sites connus ou le téléchargement directement sur le site de l'éditeur.
    - Lis attentivement lorsque tu installes un programme gratuit, et décoche tous les programmes additionnels qui sont proposés via l'installation de logiciel gratuit en général, ou certains sites de téléchargement comme Softonic ou 01Net.
    L'éditeur touche de l'argent à chaque installation réussie de ces programmes additionnels (un genre de sponsoring) !

    *Lire :
    -Stop les publicités intempestives adwares et programmes parasites
    -PUPs/LPIs
    _________________________________________________

    Ok, maintenant utilise ce logiciel de diagnostic :

    ¶ Télécharge ZHPDiag (de Nicolas Coolman) sur le bureau

    ¶ Sous Vista/Win7 et Win8, lancer l'installation par clic droit et "Exécuter en tant qu'administrateur"

    ¶ Suivre les étapes lors de l'installation, il se lancera automatiquement une fois terminée.
    (si ce n'est pas le cas, clique sur l'icône présente sur le bureau ZHPDiag (pour Vista/7/8 : clic droit et "exécuter en tant qu'administrateur")

    ¶ Une fois la fenêtre ouverte,

    ¶ Clique sur CONFIGURER
    ¶ Clique enfin sur la loupe en bas à gauche pour lancer l'analyse (sans le + ni le -)
    ¶ Clique sur OUI à la question "Voulez-vous un rapport full options"
    ¶ Patiente durant l'analyse
    (Il est possible que l'outil donne l'impression de ne pas avancer voir même d'être bloqué avec un message "ne répond pas", le laisser travailler)

    ¶ Une fois l'analyse terminée, un rapport sera créé. Ce rapport (ZHPDiag.txt) se trouve également sur ton bureau
    ¶ Pour transmettre le rapport clique sur ce lien: http://pjjoint.malekal.com/
    ¶ Clique sur Parcourir et cherche sur ton bureau le fichier ZHPDiag.txt
    ¶ Sélectionne le fichier ZHPDiag.txt. puis clique sur "Ouvrir"
    ¶ Ensuite Clique sur "Envoyer le fichier"
    ¶ Copie le lien obtenu dans ta réponse

    Pour t'aider
    1
    1. djami92
       
      Bonjour,
      Merci pour ta reponse.
      J essaierai lorsque je serais à la maison et te tiendrai au courant.
      Cdlt
      Djami92
      0
    2. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
       
      Ok ça marche, bonne journée ;)
      0
    3. djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention  
       
      bonjour loumax91,

      J'ai téléchargé et lancé comme indiqué ZHPDiag.

      Il m'est apparu à 20 % ; "violation d'accès à l'adresse 7C91225A dans le module rtdll.dll écriture à l'adresse 00407700.

      J'ai ensuite réessayé en supprimant Malwarebytes' Anti-Malware. Mais ça m'a refait la même chose (j'ai laissé toute la nuit la fonction ouverte, mais le lendemain je l'ai trouvée toujours à 20 %).

      Qu est ce que je peux faire ?

      Merci.
      Djami92
      0
    4. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
       
      Bonjour,

      Essaies en relançant ZHPDiag et clique directement sur "Rechercher"
      0
    5. djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention  
       
      Bjr Loumax91,

      J'ai refait avec rechercher mais ça me donne toujours la même chose à 20 % :

      "violation d'accès à l'adresse 7C91225A dans le module rtdll.dll écriture à l'adresse 00407700."

      qu'est ce que je peux faire ?

      Merci.
      Djami92
      0
  3. djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention  
     
    Bonjour,

    Merci bien pour votre réponse.

    Voici le rapport après suppression via Malwarebytes (ci dessous). Dois je faire autre chose ?

    Malwarebytes Anti-Malware 1.75.0.1300
    www.malwarebytes.org

    Version de la base de données: v2014.02.01.03

    Windows XP Service Pack 3 x86 NTFS
    Internet Explorer 8.0.6001.18702
    DJAM :: DJAM-09414A267C [administrateur]

    01/02/2014 08:55:55
    mbam-log-2014-02-01 (08-55-55).txt

    Type d'examen: Examen rapide
    Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
    Options d'examen désactivées: P2P
    Elément(s) analysé(s): 221834
    Temps écoulé: 12 minute(s), 54 seconde(s)

    Processus mémoire détecté(s): 0
    (Aucun élément nuisible détecté)

    Module(s) mémoire détecté(s): 0
    (Aucun élément nuisible détecté)

    Clé(s) du Registre détectée(s): 2
    HKCR\iMeshIEHelper.DNSGuard (PUP.Optional.iMeshMusicBoxTB.A) -> Mis en quarantaine et supprimé avec succès.
    HKCR\iMeshIEHelper.DNSGuard.1 (PUP.Optional.iMeshMusicBoxTB.A) -> Mis en quarantaine et supprimé avec succès.

    Valeur(s) du Registre détectée(s): 0
    (Aucun élément nuisible détecté)

    Elément(s) de données du Registre détecté(s): 0
    (Aucun élément nuisible détecté)

    Dossier(s) détecté(s): 0
    (Aucun élément nuisible détecté)

    Fichier(s) détecté(s): 7
    C:\Documents and Settings\DJAM\Mes documents\Downloads\libreoffice-4.1.3 (1).exe (PUP.Optional.OpenCandy) -> Mis en quarantaine et supprimé avec succès.
    C:\Documents and Settings\DJAM\Mes documents\Downloads\libreoffice-4.1.3.exe (PUP.Optional.OpenCandy) -> Mis en quarantaine et supprimé avec succès.
    C:\Documents and Settings\DJAM\Mes documents\Downloads\SoftonicDownloader_pour_videocacheview.exe (PUP.Optional.Softonic.A) -> Mis en quarantaine et supprimé avec succès.
    C:\Documents and Settings\DJAM\Local Settings\Temp\nsd1CE.tmp.exe (PUP.Optional.InstallMonetizer.A) -> Mis en quarantaine et supprimé avec succès.
    C:\Documents and Settings\DJAM\Local Settings\Temp\nse1F5.tmp.exe (Adware.Linkular) -> Mis en quarantaine et supprimé avec succès.
    C:\Documents and Settings\DJAM\Local Settings\Temp\nsl1C6.tmp.exe (PUP.Optional.Clickmein) -> Mis en quarantaine et supprimé avec succès.
    C:\Documents and Settings\DJAM\Local Settings\Temp\nst20A.tmp.exe (Adware.EoRezo) -> Mis en quarantaine et supprimé avec succès.

    (fin)
    0
  4. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
     
    Bonjour,

    On va utiliser un autre outil de diagnostic :

    ¶ Télécharge OTL sur ton Bureau.
    ¶ Lance le (si tu es sous Windows Vista ou Windows 7, fais le par un clic-droit --> Exécuter en temps qu'administrateur).
    ¶ Sous Personnalisation, copie-colle ce script :

    netsvcs
    msconfig
    safebootminimal
    safebootnetwork
    activex
    drivers32
    %ALLUSERSPROFILE\%Application Data\*.
    %ALLUSERSPROFILE%\Application Data\*.exe /s
    %APPDATA%\*.
    %APPDATA%\*.exe /s
    %SYSTEMDRIVE%\*.exe
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32drivers\*.sys /lockedfiles
    %systemroot%\System32config\*.sav
    /md5start
    explorer.exe
    winlogon.exe
    wininit.exe
    /md5stop

    ¶ Coche la case "tous les utilisateurs" puis clique sur le bouton "Analyse"
    ¶ Patiente pendant l'analyse jusqu'à l'apparition des deux rapports OTL.txt et Extras.txt
    ¶ Rends toi sur ce site, clique sur "Parcourir", sélectionne le rapport de OTL et clique sur Envoyer le fichier. Patiente pendant l'envoi du fichier, puis copie/colle le lien fourni dans ta prochaine réponse sur le forum.

    Il me faut les deux rapports OTL.txt et Extras.txt.
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention  
     
    Re,

    Voici :

    https://pjjoint.malekal.com/files.php?id=20140205_t11l9n12i11y9

    https://pjjoint.malekal.com/files.php?id=20140205_q6u9u6g13k6

    J'espère que c'est bon :)

    Merci pour tout.

    Djami92
    0
    1. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
       
      ° Rends-toi sur cette page

      ° Clique sur "Choisir un fichier"

      ° Vas sur ton disque chercher ce fichier à cet emplacement : 

      C:\WINDOWS\System32\drivers\3caedece970f494f.sys

      ° Clique ensuite sur le bouton "Analyser"

      ° Patiente le temps de l'analyse qui dépend de la taille du fichier

      ° Communique le lien de la page VirusTotal en le copiant dans la barre d'adresse et en le collant dans ta prochaine réponse :




      PS: Vais au boulot, te donne la suite ce soir.
      0
  7. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
     
    • Fait un double-clic sur l'icône d'OTL pour le lancer
    /!\ pour Vista/Seven/W8 fais un clic-droit sur l'icône d'OTL et choisis "Exécuter en tant qu'administrateur"

    • Assure toi d'avoir fermé toutes les applications en court de fonctionnement.

    • Quand la fenêtre d'OTL apparaît, assure toi que dans la section "Output" (Rapport) la case "minimal Output" (Rapport minimal) soit cochée.

    • Ouvre ce lien, sélectionne et copie toutes les lignes, colle les dans la partie inférieure d'OTL "Custom scan/fixes" (Personnalisation)



    • Cliques sur l'icône "Run Fix (Correction)"
    • Laisse le scan aller à son terme sans te servir du PC
    • A la fin du scan un rapport va s'ouvrir "OTL.Txt"
    • Copie et colle le rapport dans ta réponse stp...
    • Le rapport se trouve aussi dans le dossier C:\OTL ou sur ton bureau.
    0
  8. djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention  
     
    bonsoir,

    voici le rapport

    All processes killed
    ========== OTL ==========
    HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
    HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
    Registry key HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ not found.
    Registry key HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer\ deleted successfully.
    Registry value HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{9d480271-a3be-496c-b1fb-3ee970713e33} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d480271-a3be-496c-b1fb-3ee970713e33}\ not found.
    File C:\Program Files\SelectionTool\150.xpi [2014/02/03 13:22:45 | 000,007,052 | ---- | M] not found.
    Use Chrome's Settings page to change the HomePage.
    C:\Documents and Settings\DJAM\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\edjnbokkihlfclbddajclncbnmgggbie\1.150_0 folder moved successfully.
    File C:\Program Files\Software\Update\1.3.25.0\npSoftwareUpdate3.dll not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1533472a-9aff-42d2-be53-efe825bc964a}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1533472a-9aff-42d2-be53-efe825bc964a}\ deleted successfully.
    C:\Program Files\SelectionTool\150.dll moved successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EEDB912-C5FA-486F-8334-57288578C627}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EEDB912-C5FA-486F-8334-57288578C627}\ deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
    Registry value HKEY_USERS\S-1-5-21-1214440339-1993962763-725345543-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{00000000-0000-0000-0000-000000000000} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-0000-0000-0000-000000000000}\ not found.
    Registry value HKEY_USERS\S-1-5-21-1214440339-1993962763-725345543-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
    Registry value HKEY_USERS\S-1-5-21-1214440339-1993962763-725345543-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\upfst_fr_76.exe deleted successfully.
    C:\Documents and Settings\DJAM\Local Settings\Application Data\fst_fr_76\upfst_fr_76.exe moved successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\\Flags deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\\Title deleted successfully.
    Starting removal of ActiveX control {233C1507-6A77-46A4-9443-F871F945D258}
    C:\WINDOWS\Downloaded Program Files\swdir.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{233C1507-6A77-46A4-9443-F871F945D258}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{233C1507-6A77-46A4-9443-F871F945D258}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{233C1507-6A77-46A4-9443-F871F945D258}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{233C1507-6A77-46A4-9443-F871F945D258}\ not found.
    C:\WINDOWS\002573_.tmp deleted successfully.
    C:\WINDOWS\4E0C6314A8B84026AC15084E8B63AFB5.TMP\WiseCustomCall.dll deleted successfully.
    C:\WINDOWS\4E0C6314A8B84026AC15084E8B63AFB5.TMP\WiseCustomCalla.dll deleted successfully.
    C:\WINDOWS\4E0C6314A8B84026AC15084E8B63AFB5.TMP\WiseCustomCalla17.dll deleted successfully.
    C:\WINDOWS\4E0C6314A8B84026AC15084E8B63AFB5.TMP\WiseCustomCalla18.dll deleted successfully.
    C:\WINDOWS\4E0C6314A8B84026AC15084E8B63AFB5.TMP\WiseCustomCalla18.exe deleted successfully.
    C:\WINDOWS\4E0C6314A8B84026AC15084E8B63AFB5.TMP\WiseCustomCalla19.dll deleted successfully.
    C:\WINDOWS\4E0C6314A8B84026AC15084E8B63AFB5.TMP\WiseCustomCalla2.dll deleted successfully.
    C:\WINDOWS\4E0C6314A8B84026AC15084E8B63AFB5.TMP\WiseCustomCalla20.dll deleted successfully.
    C:\WINDOWS\4E0C6314A8B84026AC15084E8B63AFB5.TMP\WiseCustomCalla21.dll deleted successfully.
    C:\WINDOWS\4E0C6314A8B84026AC15084E8B63AFB5.TMP\WiseCustomCalla21.exe deleted successfully.
    C:\WINDOWS\4E0C6314A8B84026AC15084E8B63AFB5.TMP\WiseData.ini deleted successfully.
    C:\WINDOWS\4E0C6314A8B84026AC15084E8B63AFB5.TMP folder deleted successfully.
    C:\WINDOWS\msdownld.tmp folder deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3d.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dara.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dchs.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dcht.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dcsy.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3ddan.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3ddeu.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dell.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3deng.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3desm.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3desn.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dfin.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dfra.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dheb.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dhun.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dita.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3djpn.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dkor.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dnld.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dnor.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dplk.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dptb.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dptg.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3drus.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dsky.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dslv.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dsve.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dtha.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nv3dtrk.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcpl.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplara.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplchs.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplcht.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplcsy.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcpldan.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcpldeu.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplell.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcpleng.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplesm.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplesn.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplfin.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplfra.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplheb.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplhun.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplita.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcpljpn.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplkor.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplnld.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplnor.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplplk.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplptb.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplptg.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplrus.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplsky.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplslv.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcplsve.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcpltha.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvcpltrk.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdsp.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspara.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspchs.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspcht.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspcsy.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspdan.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspdeu.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspell.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspeng.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspesm.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspesn.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspfin.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspfra.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspheb.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdsphun.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspita.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspjpn.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspkor.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspnld.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspnor.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspplk.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspptb.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspptg.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdsprus.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspsky.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspslv.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdspsve.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdsptha.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvdsptrk.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmob.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobara.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobchs.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobcht.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobcsy.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobdan.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobdeu.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobell.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobeng.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobesm.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobesn.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobfin.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobfra.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobheb.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobhun.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobita.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobjpn.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobkor.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobnld.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobnor.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobplk.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobptb.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobptg.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobrus.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobsky.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobslv.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobsve.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobtha.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP\nvmobtrk.chm deleted successfully.
    C:\WINDOWS\NV28683168.TMP folder deleted successfully.
    C:\WINDOWS\SET3.tmp deleted successfully.
    C:\WINDOWS\SET4.tmp deleted successfully.
    C:\WINDOWS\SET8.tmp deleted successfully.
    C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
    C:\Program Files\SelectionTool folder moved successfully.
    C:\Program Files\SearchProtect\Main\rep folder moved successfully.
    C:\Program Files\SearchProtect\Main folder moved successfully.
    C:\Program Files\SearchProtect folder moved successfully.
    C:\Documents and Settings\DJAM\Local Settings\Application Data\SearchProtect\Logs folder moved successfully.
    C:\Documents and Settings\DJAM\Local Settings\Application Data\SearchProtect folder moved successfully.
    C:\Documents and Settings\DJAM\Local Settings\Application Data\AnyProtectScannerSetup.exe moved successfully.
    C:\Documents and Settings\All Users\Application Data\-dKQJcvEkRr7Jvtr moved successfully.
    C:\Documents and Settings\All Users\Application Data\-dKQJcvEkRr7Jvt moved successfully.
    C:\Documents and Settings\All Users\Application Data\dKQJcvEkRr7Jvt moved successfully.
    C:\Documents and Settings\DJAM\Y8Y8 moved successfully.
    C:\Documents and Settings\DJAM\Y;Y; moved successfully.
    C:\Documents and Settings\DJAM\Y9Y9 moved successfully.
    C:\Program Files\predm folder moved successfully.
    C:\WINDOWS\tasks\SelectionTool Update.job moved successfully.
    C:\WINDOWS\tasks\APSnotifierCA.job moved successfully.
    ========== FILES ==========
    C:\Documents and Settings\DJAM\Local Settings\Application Data\fst_fr_76\Download folder moved successfully.
    C:\Documents and Settings\DJAM\Local Settings\Application Data\fst_fr_76 folder moved successfully.
    C:\Program Files\fst_fr_76 folder moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: DJAM
    ->Temp folder emptied: 29533841 bytes
    ->Temporary Internet Files folder emptied: 2845808639 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 194998443 bytes
    ->Google Chrome cache emptied: 294469989 bytes
    ->Flash cache emptied: 2875325 bytes

    User: LocalService
    ->Temp folder emptied: 115616 bytes
    ->Temporary Internet Files folder emptied: 2778441 bytes

    User: NetworkService
    ->Temp folder emptied: 161578 bytes
    ->Temporary Internet Files folder emptied: 55396048 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 1345 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 847285186 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 360579729 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 4 419,00 mb

    OTL by OldTimer - Version 3.2.69.0 log created on 02062014_001717

    Files\Folders moved on Reboot...

    PendingFileRenameOperations files...

    Registry entries deleted on Reboot...

    Merci
    Djami92
    0
  9. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
     
    Bonjour,

    Comment va le PC ?

    A suivre :

    Télécharge Malwarebytes Anti-Rootkitl sur ton Bureau.
    • Décompresse le fichier mbar xxxxx.zip sur ton bureau (clic droit sur mbarxxx.zip et choisir décompresser ici).
    • Lance le en double-cliquant sur le fichier mbar.exe. (dans le répertoire mbar).
    Important: Sous Vista et Windows 7, il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur.
    • Fenêtre suivante, clique sur "Next".
    • Clique sur l'option de mise à jour "Update".
    • Patiente pendant la mise à jour, puis clique sur "Next".
    • Si ce n'est déjà fait, sélectionne les 3 cases: drivers, Sectors, System.
    • Afin de lancer la recherche, clique sur "Scan".

    Patiente............

    • Une fois le scan terminé, une fenêtre s'ouvre, clique sur </gras>OK</gras>. Deux possibilités s'offrent à toi :
    Si le programme n'a rien trouvé, clique sur "Exit".
    Si des infections sont présentes clique sur "Cleanup" et ton PC redémarrera plusieurs fois.
    • Deux Rapports sont générés et sont enregistrés dans le répertoire d'où tu as lancé Mbar.exe en général le Bureau.
    • Poste ces deux rapports dans ta réponse.
    0
    1. djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention  
       
      bonsoir loumax91,

      Voici les 2 rapports (j'ai du faire cleanup et le pac n'a pas redémarré) :

      1er fichier : mbar-log-2014-02-06 (22-17-49)

      Malwarebytes Anti-Rootkit BETA 1.07.0.1009
      www.malwarebytes.org

      Database version: v2014.02.06.08

      Windows XP Service Pack 3 x86 NTFS
      Internet Explorer 8.0.6001.18702
      :: DJAM-09414A267C [administrator]

      06/02/2014 22:17:49
      mbar-log-2014-02-06 (22-17-49).txt

      Scan type: Quick scan
      Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
      Scan options disabled:
      Objects scanned: 220281
      Time elapsed: 15 minute(s), 11 second(s)

      Memory Processes Detected: 0
      (No malicious items detected)

      Memory Modules Detected: 0
      (No malicious items detected)

      Registry Keys Detected: 0
      (No malicious items detected)

      Registry Values Detected: 0
      (No malicious items detected)

      Registry Data Items Detected: 0
      (No malicious items detected)

      Folders Detected: 1
      C:\WINDOWS\Installer\{e8a69fb3-1053-3099-cd54-4a7a5031d38a}\U (Backdoor.0Access) -> Delete on reboot.

      Files Detected: 0
      (No malicious items detected)

      Physical Sectors Detected: 0
      (No malicious items detected)

      (end)



      2ème fichier : system-log
      ---------------------------------------
      Malwarebytes Anti-Rootkit BETA 1.07.0.1009

      (c) Malwarebytes Corporation 2011-2012

      OS version: 5.1.2600 Windows XP Service Pack 3 x86

      Account is Administrative

      Internet Explorer version: 8.0.6001.18702

      File system is: NTFS
      Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
      CPU speed: 2.400000 GHz
      Memory total: 3488591872, free: 2280361984

      Downloaded database version: v2014.02.06.08
      Downloaded database version: v2013.12.18.01
      Initializing...
      ======================
      ------------ Kernel report ------------
      02/06/2014 22:17:40
      ------------ Loaded modules -----------
      \WINDOWS\system32\ntkrnlpa.exe
      \WINDOWS\system32\hal.dll
      \WINDOWS\system32\KDCOM.DLL
      \WINDOWS\system32\BOOTVID.dll
      ACPI.sys
      \WINDOWS\system32\DRIVERS\WMILIB.SYS
      pci.sys
      isapnp.sys
      ohci1394.sys
      \WINDOWS\system32\DRIVERS\1394BUS.SYS
      Wdf01000.sys
      \WINDOWS\system32\DRIVERS\WDFLDR.SYS
      pciide.sys
      \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
      MountMgr.sys
      ftdisk.sys
      PartMgr.sys
      sfsync03.sys
      VolSnap.sys
      atapi.sys
      mv61xx.sys
      \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
      disk.sys
      \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
      fltmgr.sys
      sr.sys
      MpFilter.sys
      PxHelp20.sys
      KSecDD.sys
      WudfPf.sys
      Ntfs.sys
      NDIS.sys
      sfhlp02.sys
      sfdrv01.sys
      Mup.sys
      \SystemRoot\system32\DRIVERS\tunmp.sys
      \SystemRoot\system32\DRIVERS\intelppm.sys
      \SystemRoot\system32\DRIVERS\nv4_mini.sys
      \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
      \SystemRoot\system32\DRIVERS\usbuhci.sys
      \SystemRoot\system32\DRIVERS\USBPORT.SYS
      \SystemRoot\system32\DRIVERS\usbehci.sys
      \SystemRoot\system32\DRIVERS\HDAudBus.sys
      \SystemRoot\system32\DRIVERS\yk51x86.sys
      \SystemRoot\system32\DRIVERS\RT2860.sys
      \SystemRoot\system32\DRIVERS\nic1394.sys
      \SystemRoot\system32\DRIVERS\fdc.sys
      \SystemRoot\system32\DRIVERS\ASACPI.sys
      \SystemRoot\system32\DRIVERS\serial.sys
      \SystemRoot\system32\DRIVERS\serenum.sys
      \SystemRoot\system32\DRIVERS\i8042prt.sys
      \SystemRoot\system32\DRIVERS\mouclass.sys
      \SystemRoot\system32\DRIVERS\imapi.sys
      \SystemRoot\System32\Drivers\ULCDRHlp.sys
      \SystemRoot\system32\DRIVERS\cdrom.sys
      \SystemRoot\system32\DRIVERS\redbook.sys
      \SystemRoot\system32\DRIVERS\ks.sys
      \SystemRoot\system32\DRIVERS\audstub.sys
      \SystemRoot\system32\drivers\km_filter.sys
      \SystemRoot\system32\DRIVERS\rasl2tp.sys
      \SystemRoot\system32\DRIVERS\ndistapi.sys
      \SystemRoot\system32\DRIVERS\ndiswan.sys
      \SystemRoot\system32\DRIVERS\raspppoe.sys
      \SystemRoot\system32\DRIVERS\raspptp.sys
      \SystemRoot\system32\DRIVERS\TDI.SYS
      \SystemRoot\system32\DRIVERS\psched.sys
      \SystemRoot\system32\DRIVERS\msgpc.sys
      \SystemRoot\system32\DRIVERS\ptilink.sys
      \SystemRoot\system32\DRIVERS\raspti.sys
      \SystemRoot\system32\DRIVERS\termdd.sys
      \SystemRoot\system32\DRIVERS\kbdclass.sys
      \SystemRoot\system32\DRIVERS\swenum.sys
      \SystemRoot\system32\DRIVERS\update.sys
      \SystemRoot\system32\DRIVERS\mssmbios.sys
      \SystemRoot\System32\Drivers\NDProxy.SYS
      \SystemRoot\system32\DRIVERS\usbhub.sys
      \SystemRoot\system32\DRIVERS\USBD.SYS
      \SystemRoot\system32\drivers\ADIHdAud.sys
      \SystemRoot\system32\drivers\portcls.sys
      \SystemRoot\system32\drivers\drmk.sys
      \SystemRoot\system32\drivers\AEAudio.sys
      \SystemRoot\system32\drivers\Senfilt.sys
      \SystemRoot\system32\DRIVERS\flpydisk.sys
      \SystemRoot\System32\Drivers\Fs_Rec.SYS
      \SystemRoot\System32\Drivers\Null.SYS
      \SystemRoot\System32\Drivers\Beep.SYS
      \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
      \SystemRoot\System32\drivers\vga.sys
      \SystemRoot\System32\Drivers\mnmdd.SYS
      \SystemRoot\System32\DRIVERS\RDPCDD.sys
      \SystemRoot\System32\Drivers\Msfs.SYS
      \SystemRoot\System32\Drivers\Npfs.SYS
      \SystemRoot\system32\DRIVERS\rasacd.sys
      \SystemRoot\system32\DRIVERS\ipsec.sys
      \SystemRoot\system32\DRIVERS\tcpip.sys
      \SystemRoot\system32\DRIVERS\netbt.sys
      \SystemRoot\system32\DRIVERS\wanarp.sys
      \SystemRoot\system32\DRIVERS\tcpip6.sys
      \SystemRoot\system32\DRIVERS\arp1394.sys
      \SystemRoot\System32\Drivers\nnrnstdi.SYS
      \SystemRoot\System32\drivers\afd.sys
      \SystemRoot\system32\DRIVERS\netbios.sys
      \SystemRoot\system32\DRIVERS\rdbss.sys
      \SystemRoot\system32\DRIVERS\mrxsmb.sys
      \SystemRoot\System32\Drivers\Fips.SYS
      \SystemRoot\system32\DRIVERS\hidusb.sys
      \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
      \SystemRoot\system32\drivers\AsIO.sys
      \SystemRoot\system32\DRIVERS\USBSTOR.SYS
      \SystemRoot\system32\DRIVERS\usbccgp.sys
      \SystemRoot\system32\DRIVERS\mouhid.sys
      \SystemRoot\system32\DRIVERS\kbdhid.sys
      \SystemRoot\System32\Drivers\Cdfs.SYS
      \SystemRoot\System32\Drivers\dump_atapi.sys
      \SystemRoot\System32\Drivers\dump_WMILIB.SYS
      \SystemRoot\System32\win32k.sys
      \SystemRoot\System32\drivers\Dxapi.sys
      \SystemRoot\System32\watchdog.sys
      \SystemRoot\System32\drivers\dxg.sys
      \SystemRoot\System32\drivers\dxgthk.sys
      \SystemRoot\System32\nv4_disp.dll
      \SystemRoot\System32\ATMFD.DLL
      \SystemRoot\system32\DRIVERS\AegisP.sys
      \SystemRoot\system32\DRIVERS\nwlnkipx.sys
      \SystemRoot\system32\DRIVERS\nwlnknb.sys
      \SystemRoot\system32\DRIVERS\nwlnkspx.sys
      \SystemRoot\system32\drivers\wdmaud.sys
      \SystemRoot\system32\drivers\sysaudio.sys
      \SystemRoot\system32\DRIVERS\mrxdav.sys
      \SystemRoot\System32\Drivers\HTTP.sys
      \SystemRoot\system32\DRIVERS\srv.sys
      \SystemRoot\system32\DRIVERS\usbscan.sys
      \SystemRoot\system32\DRIVERS\usbprint.sys
      \SystemRoot\system32\DRIVERS\HPZius12.sys
      \SystemRoot\system32\DRIVERS\HPZid412.sys
      \SystemRoot\system32\DRIVERS\HPZipr12.sys
      \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
      \??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
      \WINDOWS\system32\ntdll.dll
      ----------- End -----------
      Done!
      <<<1>>>
      Upper Device Name: \Device\Harddisk5\DR11
      Upper Device Object: 0xffffffff89143ab8
      Upper Device Driver Name: \Driver\Disk\
      Lower Device Name: \Device\0000009f\
      Lower Device Object: 0xffffffff895a38b0
      Lower Device Driver Name: \Driver\usbstor\
      <<<1>>>
      Upper Device Name: \Device\Harddisk4\DR6
      Upper Device Object: 0xffffffff89675618
      Upper Device Driver Name: \Driver\Disk\
      Lower Device Name: \Device\0000008f\
      Lower Device Object: 0xffffffff89f97908
      Lower Device Driver Name: \Driver\usbstor\
      <<<1>>>
      Upper Device Name: \Device\Harddisk3\DR5
      Upper Device Object: 0xffffffff89637ab8
      Upper Device Driver Name: \Driver\Disk\
      Lower Device Name: \Device\0000008e\
      Lower Device Object: 0xffffffff89664928
      Lower Device Driver Name: \Driver\usbstor\
      <<<1>>>
      Upper Device Name: \Device\Harddisk2\DR4
      Upper Device Object: 0xffffffff89fbd5c0
      Upper Device Driver Name: \Driver\Disk\
      Lower Device Name: \Device\0000008d\
      Lower Device Object: 0xffffffff896807b0
      Lower Device Driver Name: \Driver\usbstor\
      <<<1>>>
      Upper Device Name: \Device\Harddisk1\DR3
      Upper Device Object: 0xffffffff89642928
      Upper Device Driver Name: \Driver\Disk\
      Lower Device Name: \Device\0000008c\
      Lower Device Object: 0xffffffff89642ea0
      Lower Device Driver Name: \Driver\usbstor\
      <<<1>>>
      Upper Device Name: \Device\Harddisk0\DR0
      Upper Device Object: 0xffffffff8ae5aab8
      Upper Device Driver Name: \Driver\Disk\
      Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-4\
      Lower Device Object: 0xffffffff8ae5f940
      Lower Device Driver Name: \Driver\atapi\
      <<<2>>>
      Physical Sector Size: 512
      Drive: 0, DevicePointer: 0xffffffff8ae5aab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
      --------- Disk Stack ------
      DevicePointer: 0xffffffff8aed2af8, DeviceName: Unknown, DriverName: \Driver\PartMgr\
      DevicePointer: 0xffffffff8ae5aab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
      DevicePointer: 0xffffffff8ae9df18, DeviceName: \Device\0000007c\, DriverName: \Driver\ACPI\
      DevicePointer: 0xffffffff8ae5f940, DeviceName: \Device\Ide\IdeDeviceP0T0L0-4\, DriverName: \Driver\atapi\
      ------------ End ----------
      Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
      Upper DeviceData: 0x0, 0x0, 0x0
      Lower DeviceData: 0x0, 0x0, 0x0
      <<<3>>>
      Volume: C:
      File system type: NTFS
      SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
      <<<2>>>
      <<<3>>>
      Volume: C:
      File system type: NTFS
      SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
      Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
      <<<2>>>
      <<<3>>>
      Volume: C:
      File system type: NTFS
      SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
      The directory C:\WINDOWS\SYSTEM32\drivers seems inaccessible or encrypted.
      Drivers scan is aborted.
      Done!
      Drive 0
      Scanning MBR on drive 0...
      Inspecting partition table:
      MBR Signature: 55AA
      Disk Signature: C4E2C4E2

      Partition information:

      Partition 0 type is Primary (0x7)
      Partition is ACTIVE.
      Partition starts at LBA: 63 Numsec = 81915372
      Partition file system is NTFS
      Partition is bootable

      Partition 1 type is Extended with LBA (0xf)
      Partition is NOT ACTIVE.
      Partition starts at LBA: 81915435 Numsec = 894836565

      Partition 2 type is Empty (0x0)
      Partition is NOT ACTIVE.
      Partition starts at LBA: 0 Numsec = 0

      Partition 3 type is Empty (0x0)
      Partition is NOT ACTIVE.
      Partition starts at LBA: 0 Numsec = 0

      Disk Size: 500107862016 bytes
      Sector size: 512 bytes

      Scanning physical sectors of unpartitioned space on drive 0 (1-62-976753168-976773168)...
      Done!
      Physical Sector Size: 0
      Drive: 1, DevicePointer: 0xffffffff89642928, DeviceName: \Device\Harddisk1\DR3\, DriverName: \Driver\Disk\
      --------- Disk Stack ------
      DevicePointer: 0xffffffff89635020, DeviceName: Unknown, DriverName: \Driver\PartMgr\
      DevicePointer: 0xffffffff89642928, DeviceName: \Device\Harddisk1\DR3\, DriverName: \Driver\Disk\
      DevicePointer: 0xffffffff89642ea0, DeviceName: \Device\0000008c\, DriverName: \Driver\usbstor\
      ------------ End ----------
      Physical Sector Size: 0
      Drive: 2, DevicePointer: 0xffffffff89fbd5c0, DeviceName: \Device\Harddisk2\DR4\, DriverName: \Driver\Disk\
      --------- Disk Stack ------
      DevicePointer: 0xffffffff89645b50, DeviceName: Unknown, DriverName: \Driver\PartMgr\
      DevicePointer: 0xffffffff89fbd5c0, DeviceName: \Device\Harddisk2\DR4\, DriverName: \Driver\Disk\
      DevicePointer: 0xffffffff896807b0, DeviceName: \Device\0000008d\, DriverName: \Driver\usbstor\
      ------------ End ----------
      Physical Sector Size: 0
      Drive: 3, DevicePointer: 0xffffffff89637ab8, DeviceName: \Device\Harddisk3\DR5\, DriverName: \Driver\Disk\
      --------- Disk Stack ------
      DevicePointer: 0xffffffff89637890, DeviceName: Unknown, DriverName: \Driver\PartMgr\
      DevicePointer: 0xffffffff89637ab8, DeviceName: \Device\Harddisk3\DR5\, DriverName: \Driver\Disk\
      DevicePointer: 0xffffffff89664928, DeviceName: \Device\0000008e\, DriverName: \Driver\usbstor\
      ------------ End ----------
      Physical Sector Size: 0
      Drive: 4, DevicePointer: 0xffffffff89675618, DeviceName: \Device\Harddisk4\DR6\, DriverName: \Driver\Disk\
      --------- Disk Stack ------
      DevicePointer: 0xffffffff896753f0, DeviceName: Unknown, DriverName: \Driver\PartMgr\
      DevicePointer: 0xffffffff89675618, DeviceName: \Device\Harddisk4\DR6\, DriverName: \Driver\Disk\
      DevicePointer: 0xffffffff89f97908, DeviceName: \Device\0000008f\, DriverName: \Driver\usbstor\
      ------------ End ----------
      Physical Sector Size: 0
      Drive: 5, DevicePointer: 0xffffffff89143ab8, DeviceName: \Device\Harddisk5\DR11\, DriverName: \Driver\Disk\
      --------- Disk Stack ------
      DevicePointer: 0xffffffff88f2c020, DeviceName: Unknown, DriverName: \Driver\PartMgr\
      DevicePointer: 0xffffffff89143ab8, DeviceName: \Device\Harddisk5\DR11\, DriverName: \Driver\Disk\
      DevicePointer: 0xffffffff895a38b0, DeviceName: \Device\0000009f\, DriverName: \Driver\usbstor\
      ------------ End ----------
      Infected: C:\WINDOWS\Installer\{e8a69fb3-1053-3099-cd54-4a7a5031d38a}\U --> [Backdoor.0Access]
      Scan finished
      Creating System Restore point...
      Cleaning up...
      Executing an action fixdamage.exe...
      Success!
      Queuing an action fixdamage.exe
      Removal successful. No system shutdown is required.
      =======================================


      Removal queue found; removal started
      Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
      Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\VBR-0-0-63-i.mbam...
      Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
      Removal finished
      0
    2. djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention  
       
      pas le "pac" mais le pc n'a pas redémarré.
      Merci pour tout.
      A bientôt.
      Djami92
      0
  10. djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention  
     
    bonsoir loumax91,

    Eh bè, tu es un chef :) Il n'y a plus de pub à tout bout de champs !

    Je fais ce que tu me dis et t'enverrai les 2 rapports.

    A bientôt.
    Djami92
    0
  11. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
     
    Bonjour,

    Impeccable, fais redémarrer le PC.

    Utilise cet outil :

    • Va sur ce lien https://www.luanagames.com/index.fr.html
    • Clique sur l'icône qui correspond à ta version de Windows (32 bits) pour télécharger RogueKiller (de Tigzy) sur ton bureau


    • Quitte tous tes programmes en cours
    • Sous Vista/Seven , clique droit -> lancer en tant qu'administrateur
    • Patiente pendant le pre-scan, puis clique sur le bouton "Scan"
    • Un rapport (RKreport.txt) a dû se créer sur le bureau, poste-le.
    0
  12. djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention  
     
    bsr loumax,

    Voici le rapport RKreport.tx :

    RogueKiller V8.8.6 [Feb 7 2014] par Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Remontees : https://forum.adlice.com/
    Site Web : https://www.luanagames.com/index.fr.html
    Blog : https://www.adlice.com/

    Systeme d'exploitation : Windows XP (5.1.2600 Service Pack 3) 32 bits version
    Demarrage : Mode normal
    Utilisateur : DJAM [Droits d'admin]
    Mode : Recherche -- Date : 02/09/2014 23:18:34
    | ARK || FAK || MBR |

    ¤¤¤ Processus malicieux : 1 ¤¤¤
    [Root.Necurs][SERVICE] 3caedece970f494f -- C:\WINDOWS\C:\WINDOWS\System32\Drivers\3caedece970f494f.sys [x] -> STOPPÉ

    ¤¤¤ Entrees de registre : 8 ¤¤¤
    [SERVICE][Root.Necurs] HKLM\[...]\CCSet\[...]\Services : 3caedece970f494f (C:\WINDOWS\System32\Drivers\3caedece970f494f.sys [-]) -> TROUVÉ
    [SERVICE][Root.Necurs] HKLM\[...]\CS001\[...]\Services : 3caedece970f494f (C:\WINDOWS\System32\Drivers\3caedece970f494f.sys [-]) -> TROUVÉ
    [SERVICE][Root.Necurs] HKLM\[...]\CS003\[...]\Services : 3caedece970f494f (C:\WINDOWS\System32\Drivers\3caedece970f494f.sys [-]) -> TROUVÉ
    [HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> TROUVÉ
    [HJ POL][PUM] HKLM\[...]\System : DisableTaskMgr (0) -> TROUVÉ
    [HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ
    [HJ DESK][PUM] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ
    [WALLPAPER][PUM] HKCU\[...]\Desktop : Wallpaper () -> TROUVÉ

    ¤¤¤ Tâches planifiées : 0 ¤¤¤

    ¤¤¤ Entrées Startup : 0 ¤¤¤

    ¤¤¤ Navigateurs web : 0 ¤¤¤

    ¤¤¤ Addons navigateur : 0 ¤¤¤

    ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
    [ZeroAccess][Fichier] n : C:\WINDOWS\Installer\{e8a69fb3-1053-3099-cd54-4a7a5031d38a}\n [-] --> TROUVÉ

    ¤¤¤ Driver : [CHARGE] ¤¤¤
    [Address] IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : atapi.sys -> HOOKED (sfsync03.sys @ 0xBA0F995C)
    [Address] IAT @explorer.exe (LoadLibraryExA) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x02BC3010)
    [Address] IAT @explorer.exe (LoadLibraryExW) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x02BC3018)
    [Address] IAT @explorer.exe (LoadLibraryA) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x02BC3000)
    [Address] IAT @explorer.exe (LoadLibraryW) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x02BC3008)
    [Address] IAT @explorer.exe (GetProcAddress) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x02BC3020)

    ¤¤¤ Ruches Externes: ¤¤¤

    ¤¤¤ Infection : Root.Necurs|ZeroAccess ¤¤¤

    ¤¤¤ Fichier HOSTS: ¤¤¤
    --> %SystemRoot%\System32\drivers\etc\hosts

    127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
    127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
    127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
    127.0.0.1 2010-fr.com # hosts anti-adware / pups
    127.0.0.1 2012-new.biz # hosts anti-adware / pups
    127.0.0.1 212link.com # hosts anti-adware / pups
    127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
    127.0.0.1 24h00business.com # hosts anti-adware / pups
    127.0.0.1 a.adorika.net # hosts anti-adware / pups
    127.0.0.1 a.ad-sys.com # hosts anti-adware / pups
    127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups
    127.0.0.1 ad.adn360.com # hosts anti-adware / pups
    127.0.0.1 adeartss.eu # hosts anti-adware / pups
    127.0.0.1 adesoeasy.eu # hosts anti-adware / pups
    127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups
    127.0.0.1 adm.soft365.com # hosts anti-adware / pups
    127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups
    127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups
    127.0.0.1 ads.adplxmd.com # hosts anti-adware / pups
    127.0.0.1 ads.aff.co # hosts anti-adware / pups
    [...]

    ¤¤¤ MBR Verif: ¤¤¤

    +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST3500320AS +++++
    --- User ---
    [MBR] c4f8dd33e1c089ad7283c0603ff441ee
    [BSP] 5deefcd2449ac2283f5f4aad37adf97a : Windows XP MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 39997 Mo
    1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 81915435 | Size: 436931 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    Termine : << RKreport[0]_S_02092014_231834.txt >>

    Qu'est-ce que je fait maintenant ? Je supprime ?
    Merci.
    Djami
    0
  13. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
     
    Bonjour,

    • Quitte tous tes programmes en cours
    • Lance RogueKiller => Sous Vista/Seven , clique droit -> lancer en tant qu'administrateur
    • Patiente pendant le pre-scan, puis clique sur le bouton "Suppression"
    • Un rapport (RKreport.txt) a dû se créer sur le bureau, poste-le.

    *J'attends le rapport.
    0
  14. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
     
    Yop,

    Quand tu auras posté le rapport RogueKiller, fais ceci pour vérification :

    ¶ Télécharge TDSSKiller (de Kaspersky Labs) sur ton Bureau.
    ¶ Lance le (si tu utilises Windows Vista ou 7 : fais un clic-droit dessus et choisis "Exécuter en tant qu'administrateur")
    ¶ Clique sur Start Scan pour démarrer l'analyse.
    ¶ Si des éléments néfastes sont identifiés par l'outil, vérifie que Cure est bien coché. S'il indique "suspicious", laisse l'option Skip.
    ¶ Ensuite, clique sur Continue puis sur Reboot Now si nécessaire.
    ¶ Un rapport s'ouvrira au redémarrage de l'ordinateur.
    ¶ Copie/colle son contenu dans ta prochaine réponse (il se trouve également sous C:\TDSSKiller.N°deversion_Date_Heure_log.txt)
    0
    1. djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention  
       
      Et voici rapport TDSSKILLER. Encore merci.

      12:27:39.0578 0x0b88 TDSS rootkit removing tool 3.0.0.23 Feb 10 2014 23:32:41
      12:27:44.0156 0x0b88 ============================================================
      12:27:44.0156 0x0b88 Current date / time: 2014/02/11 12:27:44.0156
      12:27:44.0156 0x0b88 SystemInfo:
      12:27:44.0156 0x0b88
      12:27:44.0156 0x0b88 OS Version: 5.1.2600 ServicePack: 3.0
      12:27:44.0156 0x0b88 Product type: Workstation
      12:27:44.0156 0x0b88 ComputerName: DJAM-09414A267C
      12:27:44.0156 0x0b88 UserName: DJAM
      12:27:44.0156 0x0b88 Windows directory: C:\WINDOWS
      12:27:44.0156 0x0b88 System windows directory: C:\WINDOWS
      12:27:44.0156 0x0b88 Processor architecture: Intel x86
      12:27:44.0156 0x0b88 Number of processors: 4
      12:27:44.0156 0x0b88 Page size: 0x1000
      12:27:44.0156 0x0b88 Boot type: Normal boot
      12:27:44.0156 0x0b88 ============================================================
      12:27:47.0187 0x0b88 KLMD registered as C:\WINDOWS\system32\drivers\77555256.sys
      12:27:47.0437 0x0b88 System UUID: {6EDA7AF5-27C8-C28B-2DDF-3F8B4BFCE85F}
      12:27:48.0125 0x0b88 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
      12:27:48.0140 0x0b88 ============================================================
      12:27:48.0140 0x0b88 \Device\Harddisk0\DR0:
      12:27:48.0140 0x0b88 MBR partitions:
      12:27:48.0140 0x0b88 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4E1EDEC
      12:27:48.0156 0x0b88 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x4E1EE6A, BlocksNum 0x35561F16
      12:27:48.0156 0x0b88 ============================================================
      12:27:48.0187 0x0b88 C: <-> \Device\Harddisk0\DR0\Partition1
      12:27:48.0281 0x0b88 D: <-> \Device\Harddisk0\DR0\Partition2
      12:27:48.0281 0x0b88 ============================================================
      12:27:48.0281 0x0b88 Initialize success
      12:27:48.0281 0x0b88 ============================================================
      12:29:06.0390 0x0560 ============================================================
      12:29:06.0390 0x0560 Scan started
      12:29:06.0390 0x0560 Mode: Manual;
      12:29:06.0390 0x0560 ============================================================
      12:29:06.0390 0x0560 KSN ping started
      12:29:08.0843 0x0560 KSN ping finished: true
      12:29:09.0718 0x0560 ================ Scan system memory ========================
      12:29:09.0734 0x0560 System memory - ok
      12:29:09.0734 0x0560 ================ Scan services =============================
      12:29:09.0812 0x0560 [ 67927E41A89E6127836152417C5D4FCF, 98158AF771595CD8E224FEBE990F452DEF669FAA09E3CF71958AFC08AA07243B ] 6to4 C:\WINDOWS\System32\6to4svc.dll
      12:29:09.0812 0x0560 6to4 - ok
      12:29:09.0875 0x0560 Abiosdsk - ok
      12:29:09.0875 0x0560 abp480n5 - ok
      12:29:09.0906 0x0560 [ E5E6DBFC41EA8AAD005CB9A57A96B43B, A02A0EDC9F646406CA136ACE5A21E9FC7B70D21EC1440BDA4F98A95804EFCBD4 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
      12:29:09.0906 0x0560 ACPI - ok
      12:29:09.0937 0x0560 [ E4ABC1212B70BB03D35E60681C447210, 8EB16B67A6D44DA7A4C2090195F1A24A58CA97DA66F66958F5CD6C5695648F2F ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
      12:29:09.0953 0x0560 ACPIEC - ok
      12:29:09.0984 0x0560 [ F277C43C2E0672EED28CCA0D13CE175F, 4FA01D848AA4C6F5514522D54F72B173D3A59E4E2A05720802F9B3D1396E0977 ] ADIHdAudAddService C:\WINDOWS\system32\drivers\ADIHdAud.sys
      12:29:09.0984 0x0560 ADIHdAudAddService - ok
      12:29:10.0000 0x0560 adpu160m - ok
      12:29:10.0000 0x0560 [ FFF87A9B1AB36EE4B7BEC98A4CB01B79, EC11E349E6236E7384E689ED8CE2876DD358AF6E820F1D99B7E269AB6998C5D3 ] AEAudio C:\WINDOWS\system32\drivers\AEAudio.sys
      12:29:10.0015 0x0560 AEAudio - ok
      12:29:10.0015 0x0560 [ 8BED39E3C35D6A489438B8141717A557, 1B5796E56B0927360CE0759641B1151828BC0A9E45620D2B2D880491F5CE33D0 ] aec C:\WINDOWS\system32\drivers\aec.sys
      12:29:10.0031 0x0560 aec - ok
      12:29:10.0062 0x0560 [ 023867B6606FBABCDD52E089C4A507DA, 30BE26F63B7EC6C9607AB46A97ACE83DD8140191D28BAB9E6292DA835A922289 ] AegisP C:\WINDOWS\system32\DRIVERS\AegisP.sys
      12:29:10.0062 0x0560 AegisP - ok
      12:29:10.0125 0x0560 [ 1E44BC1E83D8FD2305F8D452DB109CF9, CF5EC07E0B589FA2A4701C6CFD69E893FC3ABF274AD57AE3C13FFE49063B02C8 ] AFD C:\WINDOWS\System32\drivers\afd.sys
      12:29:10.0125 0x0560 AFD - ok
      12:29:10.0140 0x0560 Aha154x - ok
      12:29:10.0140 0x0560 aic78u2 - ok
      12:29:10.0140 0x0560 aic78xx - ok
      12:29:10.0171 0x0560 [ 758FDC60D41716EF889D849989B4B1CD, 87D1D86D10ADADEB70F8F1AED738D31EFD30BF78886C4A33A9FA571B469A9F0F ] Alerter C:\WINDOWS\system32\alrsvc.dll
      12:29:10.0171 0x0560 Alerter - ok
      12:29:10.0187 0x0560 [ 5E9A6658A2A69AE7EB195113B7A2E7A9, AE32F1EB1BCA48D69FCD8C8739A8FAB2B9433B0765510D2A0AFDFB7E9D911A68 ] ALG C:\WINDOWS\System32\alg.exe
      12:29:10.0187 0x0560 ALG - ok
      12:29:10.0187 0x0560 AliIde - ok
      12:29:10.0203 0x0560 amsint - ok
      12:29:10.0203 0x0560 AppMgmt - ok
      12:29:10.0234 0x0560 [ B5B8A80875C1DEDEDA8B02765642C32F, AD0C71D73B1B8225351FBF4FFB43001A32B4DAE69504C59970CD2428BB33D4EF ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys
      12:29:10.0234 0x0560 Arp1394 - ok
      12:29:10.0234 0x0560 asc - ok
      12:29:10.0234 0x0560 asc3350p - ok
      12:29:10.0234 0x0560 asc3550 - ok
      12:29:10.0265 0x0560 [ 2B4E66FAC6503494A2C6F32BB6AB3826, 923EBBE8111E73D5B8ECC2DB10F8EA2629A3264C3A535D01C3C118A3B4C91782 ] AsIO C:\WINDOWS\system32\drivers\AsIO.sys
      12:29:10.0265 0x0560 AsIO - ok
      12:29:10.0328 0x0560 [ 0E5E4957549056E2BF2C49F4F6B601AD, F7F19FDC906B719A3516D30A9B4A2262C8CC5B36B94E3D4195C345EC4610FF2B ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
      12:29:10.0343 0x0560 aspnet_state - ok
      12:29:10.0343 0x0560 [ B153AFFAC761E7F5FCFA822B9C4E97BC, 7E60F572A6B3C6219E3C86225AA37243AFFD74337DB7F108B04778042E5CC959 ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
      12:29:10.0343 0x0560 AsyncMac - ok
      12:29:10.0375 0x0560 [ 9F3A2F5AA6875C72BF062C712CFA2674, B4DF1D2C56A593C6B54DE57395E3B51D288F547842893B32B0F59228A0CF70B9 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
      12:29:10.0375 0x0560 atapi - ok
      12:29:10.0375 0x0560 Atdisk - ok
      12:29:10.0390 0x0560 [ 9916C1225104BA14794209CFA8012159, 5D6F05F715C52A16D05CAE15C3DFE77A139A7F27F7AE710EC9A10F9EE05115A1 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
      12:29:10.0390 0x0560 Atmarpc - ok
      12:29:10.0390 0x0560 [ B4005AEF7873144634765B570DAC466E, 57D16C46EF3E94718E4789EDE3F7AE6477B8D1960C044C9A893D4C2F544BFE4B ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
      12:29:10.0390 0x0560 AudioSrv - ok
      12:29:10.0421 0x0560 [ D9F724AA26C010A217C97606B160ED68, 329B5118F2409731D06FDAE85B6ADD64A048292801BCB3546651CEB303111695 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
      12:29:10.0421 0x0560 audstub - ok
      12:29:10.0484 0x0560 [ DA1F27D85E0D1525F6621372E7B685E9, 5A81A46A3BDD19DAFC6C87D277267A5D44F3A1B5302F2CC1111D84B7BAD5610D ] Beep C:\WINDOWS\system32\drivers\Beep.sys
      12:29:10.0484 0x0560 Beep - ok
      12:29:10.0531 0x0560 [ BAA0B6E647C1AD593E9BAE5CC31BCFFB, B88506D2FE38238DCC2159996D167DABE3FF9B14192193E1DA72DA8E3872F4A4 ] BITS C:\WINDOWS\system32\qmgr.dll
      12:29:10.0593 0x0560 BITS - ok
      12:29:10.0625 0x0560 [ 952322AE7F95A21F3EEDA99C36C68663, 8369556005847E2DCDE313962FF4B229FB582F3CCADA2C8A656B751F68266B40 ] Browser C:\WINDOWS\System32\browser.dll
      12:29:10.0625 0x0560 Browser - ok
      12:29:10.0703 0x0560 [ 02B1721DA59C382F6F1C206B38E354C0, 28435DE6A27BFFE9E38B5F0D1D39B7A819F4A4A01B81C82816CCCA9178ABB3A1 ] BytelMediaServer C:\Program Files\media center Bouygues Telecom\MediaServer.exe
      12:29:10.0734 0x0560 BytelMediaServer - ok
      12:29:10.0750 0x0560 [ 90A673FC8E12A79AFBED2576F6A7AAF9, BDE7858A3457DB979FEDD8577FA6321BF72848E4A7BF9F173C78A6A10CBB3EBE ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
      12:29:10.0750 0x0560 cbidf2k - ok
      12:29:10.0765 0x0560 [ 0BE5AEF125BE881C4F854C554F2B025C, 1770DD70B3F115A0EF460907DEDC1E4B7241C08615A98F194D61A49C3E2BAA54 ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
      12:29:10.0765 0x0560 CCDECODE - ok
      12:29:10.0765 0x0560 cd20xrnt - ok
      12:29:10.0796 0x0560 [ C1B486A7658353D33A10CC15211A873B, AA4DD9E7AAE5AAB1146B360B17001F975D2F29A1281CF7B13E7136480410F347 ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
      12:29:10.0796 0x0560 Cdaudio - ok
      12:29:10.0812 0x0560 [ C885B02847F5D2FD45A24E219ED93B32, B26B2F8E3A831E2B65EB0C5195B0645CD50E22615CE79C9B0B391CD563B121DB ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
      12:29:10.0812 0x0560 Cdfs - ok
      12:29:10.0812 0x0560 [ 1F4260CC5B42272D71F79E570A27A4FE, B51C2A3ED3C309953D0EA45869C8E464C10F2533DADE9E0286AF674979098D1D ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
      12:29:10.0812 0x0560 Cdrom - ok
      12:29:10.0828 0x0560 Changer - ok
      12:29:10.0828 0x0560 [ 793EF38A5FD086C3C8E48A8A861562ED, D30E90FAEB2D583B92B17E3A8AE14B1ACD8BA876F1FB9331D019AD36EFC8B12F ] CiSvc C:\WINDOWS\system32\cisvc.exe
      12:29:10.0828 0x0560 CiSvc - ok
      12:29:10.0843 0x0560 [ 8B30CBB0C07D49B2658FB190946B0E7E, 23D4B368FA215DEF31E927D087260FC81DAB1AB7BBB995892990FE4A5CB5CDC0 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
      12:29:10.0843 0x0560 ClipSrv - ok
      12:29:10.0843 0x0560 [ D87ACAED61E417BBA546CED5E7E36D9C, 14AC6034A5BC0FB2A1AFDAD42BEF4DE641556E54AD30D0C46765660A4BE55462 ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
      12:29:10.0859 0x0560 clr_optimization_v2.0.50727_32 - ok
      12:29:10.0859 0x0560 CmdIde - ok
      12:29:10.0859 0x0560 COMSysApp - ok
      12:29:10.0859 0x0560 Cpqarray - ok
      12:29:10.0875 0x0560 [ 7A6D0B71035E123FDDA2156A25578AD3, 4893ADB1983E6C8E3BD94A1E29136C4BB60EE49017DF062FFD3701397413197C ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
      12:29:10.0875 0x0560 CryptSvc - ok
      12:29:10.0890 0x0560 dac2w2k - ok
      12:29:10.0890 0x0560 dac960nt - ok
      12:29:10.0921 0x0560 [ 0203B1AAD358F206CB0A3C1F93CCE17A, 1FA6D7713CA597F751CD84BD6694914273F297D5664AF9BE70875C3321C6C740 ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
      12:29:10.0921 0x0560 DcomLaunch - ok
      12:29:10.0937 0x0560 [ 318F535DC05551D96DEEB90B6D6904DE, 77856DFB059C1BD6D6B91120A66F0BDE960D78B135EB9DA2D704B73229A9779A ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
      12:29:10.0937 0x0560 Dhcp - ok
      12:29:10.0953 0x0560 [ 044452051F3E02E7963599FC8F4F3E25, 584BDDB074618BE76454CF90E74829CFF588B5B5FAEB793E2F7AAD26352DD689 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
      12:29:10.0968 0x0560 Disk - ok
      12:29:10.0968 0x0560 dmadmin - ok
      12:29:11.0000 0x0560 [ F5DEADD42335FB33EDCA74ECB2F36CBA, CCCCC041EFE49AEDE02A4EF05282EC3D2417D4B95511F8C5FB455A10AB9E9D78 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
      12:29:11.0015 0x0560 dmboot - ok
      12:29:11.0031 0x0560 [ 5A7C47C9B3F9FB92A66410A7509F0C71, 484612038BF8CF868D6EEBDA4EB0AB56EE317E78A33C9C1C0E8EA19D97F206E4 ] dmio C:\WINDOWS\system32\drivers\dmio.sys
      12:29:11.0031 0x0560 dmio - ok
      12:29:11.0031 0x0560 [ E9317282A63CA4D188C0DF5E09C6AC5F, D41E002F555FE9015EF620975255F58BB79198CA1FF0E09EC950CB450FF77CF7 ] dmload C:\WINDOWS\system32\drivers\dmload.sys
      12:29:11.0031 0x0560 dmload - ok
      12:29:11.0046 0x0560 [ 6797C23D6B79935482D7F0E8CA5E5B67, 3DBFD7A5261D2838453E85D20CBD1C599E9EB1AD5889AF9DBD51CC9E59230F2F ] dmserver C:\WINDOWS\System32\dmserver.dll
      12:29:11.0046 0x0560 dmserver - ok
      12:29:11.0093 0x0560 [ 8A208DFCF89792A484E76C40E5F50B45, 4E40E2EB38C6254E7CAA488200E89EE7DEBBBA773890BC6A84313CC68178D54F ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
      12:29:11.0093 0x0560 DMusic - ok
      12:29:11.0140 0x0560 [ 1A1E59377FB6CACD711CC5073C4A7D79, B586A60EB61D10E7503B8C02E4C19B8061AE731B281983D5455A8D4310DB1838 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
      12:29:11.0140 0x0560 Dnscache - ok
      12:29:11.0171 0x0560 [ 3FCF86F03D0302443C21CE6E5BBF7A25, C5F714B05BEF187804DD72910096870C613E6513CD876FAABA60F1E13F1A42A6 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
      12:29:11.0171 0x0560 Dot3svc - ok
      12:29:11.0171 0x0560 dpti2o - ok
      12:29:11.0187 0x0560 [ 8F5FCFF8E8848AFAC920905FBD9D33C8, C8C6FB97AB0871C8C88A2201525A5CF10D5131CB6980D32692ED7A8F58399AD5 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
      12:29:11.0187 0x0560 drmkaud - ok
      12:29:11.0234 0x0560 [ 8B5FC9087D2CAB110BC2ED5CC5E7B8AC, 7C1A295C283D98D25309CB78817A53ADC5509DCA75A3F390F286CA35F2F74A4F ] EapHost C:\WINDOWS\System32\eapsvc.dll
      12:29:11.0234 0x0560 EapHost - ok
      12:29:11.0250 0x0560 [ 94F948CB12C4D35483F1E815DEB16C7B, 87FC37F604FC27B8370B4383394559E249D9CFCF723D04533A78DC014C0361FB ] ERSvc C:\WINDOWS\System32\ersvc.dll
      12:29:11.0250 0x0560 ERSvc - ok
      12:29:11.0265 0x0560 esgiguard - ok
      12:29:11.0296 0x0560 [ C3FB1D70CB88722267949694BA51759E, 8CD60F76A91502A718E5371D4E94BF21ECA59F50307C783C27E316891504172D ] Eventlog C:\WINDOWS\system32\services.exe
      12:29:11.0296 0x0560 Eventlog - ok
      12:29:11.0312 0x0560 [ EC16AE9B37EACF871629227A3F3913FD, 522EB80A04ED2B42BC74509D796CC81B9279C862075B3FB9E6FC6A9BA9B2DF4A ] EventSystem C:\WINDOWS\system32\es.dll
      12:29:11.0312 0x0560 EventSystem - ok
      12:29:11.0328 0x0560 [ 38D332A6D56AF32635675F132548343E, E6909DB836AF679B4F4D62C7396D6C82769CC7ABB8C919C2AABFE934FCE268F6 ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
      12:29:11.0343 0x0560 Fastfat - ok
      12:29:11.0375 0x0560 [ 1B8542F338CDD86929A084A455837158, 91259E37DA2F8B0170E48D7880CF1B67B42B1486609417806E9D503899E1DEFA ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
      12:29:11.0375 0x0560 FastUserSwitchingCompatibility - ok
      12:29:11.0390 0x0560 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81, 8307A532AB4D05CBBCE206DC2759497708BF5AAA880BD00F0E4F281D8578A1F5 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
      12:29:11.0390 0x0560 Fdc - ok
      12:29:11.0406 0x0560 [ 31F923EB2170FC172C81ABDA0045D18C, 6201C05443ABCF4F16F1AA76B0C10C4A796C839DAA7BFEA903E2FBECD43ABD3D ] Fips C:\WINDOWS\system32\drivers\Fips.sys
      12:29:11.0406 0x0560 Fips - ok
      12:29:11.0406 0x0560 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0, 69C271AD5BCEBFD8AE5A769BDD7EC51256DA3A8ADAD5D12E5C0D13F4E82D8805 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
      12:29:11.0421 0x0560 Flpydisk - ok
      12:29:11.0421 0x0560 [ B2CF4B0786F8212CB92ED2B50C6DB6B0, 280F5CF8A90F7BEDE73ADD0DD0F8952088133A7CA9A3D3B7041957E33B36845D ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
      12:29:11.0421 0x0560 FltMgr - ok
      12:29:11.0468 0x0560 [ 8BA7C024070F2B7FDD98ED8A4BA41789, 47585006F86B2C6016EC54250A416794792D1E4024FF229C120BC25B684AF66A ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
      12:29:11.0468 0x0560 FontCache3.0.0.0 - ok
      12:29:11.0484 0x0560 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A, EC635E071201A766845D48973772CBE0958942B4162F3F5F70660D114CC877E0 ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
      12:29:11.0484 0x0560 Fs_Rec - ok
      12:29:11.0484 0x0560 [ A86859B77B908C18C2657F284AA29FE3, EB571928AC961B143A5A8D2DC95BFCFDC1DF35A9098401944F299DB98209E543 ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
      12:29:11.0484 0x0560 Ftdisk - ok
      12:29:11.0500 0x0560 [ 0A02C63C8B144BD8C86B103DEE7C86A2, 7A3235DD3E1995DD72B212FAEB3ECA2A974434DE9BF6D269EA11BA65A80E7E50 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
      12:29:11.0500 0x0560 Gpc - ok
      12:29:11.0546 0x0560 [ 626A24ED1228580B9518C01930936DF9, CBD94AB1E5477D7288799D17528CC43D572E711DA0F2B0C784A0B9FE105BF0F4 ] gupdate1ca84c51d9d43f0 C:\Program Files\Google\Update\GoogleUpdate.exe
      12:29:11.0562 0x0560 gupdate1ca84c51d9d43f0 - ok
      12:29:11.0562 0x0560 [ 626A24ED1228580B9518C01930936DF9, CBD94AB1E5477D7288799D17528CC43D572E711DA0F2B0C784A0B9FE105BF0F4 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
      12:29:11.0562 0x0560 gupdatem - ok
      12:29:11.0578 0x0560 [ 5D4BC124FAAE6730AC002CDB67BF1A1C, 00294F4DC7D17F6DD2A22B9C3299BED40146BA45C972367154D20DB502472551 ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      12:29:11.0593 0x0560 gusvc - ok
      12:29:11.0609 0x0560 [ 573C7D0A32852B48F3058CFD8026F511, BC384BBA394AFDCDA1A9ABC858C692AA84A1F0A31AF3DDF7F38D120C027927FB ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
      12:29:11.0609 0x0560 HDAudBus - ok
      12:29:11.0656 0x0560 [ 1247F83B705AF0E796330442F7967CF8, 3BD60DCD92AE83947BD8E2EE6A6B1AF9B5B32BFAAE25BB7C6529ECA11B0E99CF ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
      12:29:11.0656 0x0560 helpsvc - ok
      12:29:11.0656 0x0560 HerculesWiFi - ok
      12:29:11.0687 0x0560 [ A3B9B4A68BC839CE5A264D5908092261, 6591F9D66D748F5C3AAA6457C88B86DD90B33847AA217026D106130E114B0E68 ] HidServ C:\WINDOWS\System32\hidserv.dll
      12:29:11.0687 0x0560 HidServ - ok
      12:29:11.0703 0x0560 [ CCF82C5EC8A7326C3066DE870C06DAF1, 93395FA4C26B2E82DC8B7025ED3BCF583885E5D8C5F60CD6EEAA6335D6A126EC ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys
      12:29:11.0703 0x0560 hidusb - ok
      12:29:11.0718 0x0560 [ 17B3C3D40CDBA40C2E331D28BE4DE27F, 5B42F04392EDF09F03BACE8A254D8AC20E24C0327615E92E5A2027E2809AC19F ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
      12:29:11.0734 0x0560 hkmsvc - ok
      12:29:11.0734 0x0560 hpn - ok
      12:29:11.0750 0x0560 [ F50F7984FDD151EDD8A70A8DBD9E2A44, 45E7ECA40298B233D124993D6C9D4FBBF05E9A843F4DE089317342B3D8A83696 ] hpqcxs08 C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
      12:29:11.0828 0x0560 hpqcxs08 - ok
      12:29:11.0843 0x0560 [ DF446BA625CC441617843E87798CE048, B45C11EEA7EA792DE82E9BB283B9DCF30F891AAB8366075856BD84D10BCBCCD3 ] hpqddsvc C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
      12:29:11.0843 0x0560 hpqddsvc - ok
      12:29:11.0875 0x0560 [ D03D10F7DED688FECF50F8FBF1EA9B8A, C19A733571BA831E24EE45EDB730FFFDBA22638F138A32A794BEAB8D8B71D8DD ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys
      12:29:11.0875 0x0560 HPZid412 - ok
      12:29:11.0890 0x0560 [ 89F41658929393487B6B7D13C8528CE3, 5D06A11225A83F3F33417148BE53654080C88BFA876FEB486A7E43410AC99F23 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
      12:29:11.0890 0x0560 HPZipr12 - ok
      12:29:11.0906 0x0560 [ ABCB05CCDBF03000354B9553820E39F8, 6361B5A57CDE23AC5E987ACECF3BEE7AD51134C6E5BF4F833E512C9BC4B86877 ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys
      12:29:11.0906 0x0560 HPZius12 - ok
      12:29:11.0937 0x0560 [ F80A415EF82CD06FFAF0D971528EAD38, 524D9E9201572929522F6805011783711B7C0F76308B924C89CF75F4B7A1FDF3 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
      12:29:11.0937 0x0560 HTTP - ok
      12:29:11.0953 0x0560 [ BD31CFACE38D1800ABDB43F4260AF0D5, 244C853FCB6701CF1DB1496DDE8674C997FC8BE45EA0732332B3109F9886E0D0 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
      12:29:11.0953 0x0560 HTTPFilter - ok
      12:29:11.0968 0x0560 i2omgmt - ok
      12:29:11.0968 0x0560 i2omp - ok
      12:29:11.0984 0x0560 [ A09BDC4ED10E3B2E0EC27BB94AF32516, E6542BCAE854B23F76A476F529D12CCCA3B4681C56CFAE35D22736C257BF85FE ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
      12:29:11.0984 0x0560 i8042prt - ok
      12:29:12.0031 0x0560 [ C01AC32DC5C03076CFB852CB5DA5229C, A4D7749220B5BC965D96A267F1E02FE8284A230BA249109207BD4B9EA8DFAC96 ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
      12:29:12.0046 0x0560 idsvc - ok
      12:29:12.0062 0x0560 [ 083A052659F5310DD8B6A6CB05EDCF8E, 48D39B03FFB6FAA1529B774443BA12618AE3982D9F65A7B9D18F2269F78B31F4 ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
      12:29:12.0062 0x0560 Imapi - ok
      12:29:12.0140 0x0560 [ C4221678BBAA55239C23632875759961, 1229CF35731FDBB67974BCE9BDD09B9FC1B79D2A35DCE9CEF8AB3B17D714D97D ] ImapiService C:\WINDOWS\system32\imapi.exe
      12:29:12.0140 0x0560 ImapiService - ok
      12:29:12.0140 0x0560 ini910u - ok
      12:29:12.0156 0x0560 IntelIde - ok
      12:29:12.0171 0x0560 [ AD340800C35A42D4DE1641A37FEEA34C, 646EF8143C38D8CE937DD83FBFB3099B583F242B53B3DF85CFA20DE09263C7CC ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
      12:29:12.0171 0x0560 intelppm - ok
      12:29:12.0171 0x0560 [ 3BB22519A194418D5FEC05D800A19AD0, F6662F440950596DC1382DD1DB5D7891CCEA30A6062BEA942C18445B5F0D8B16 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
      12:29:12.0171 0x0560 Ip6Fw - ok
      12:29:12.0203 0x0560 [ 731F22BA402EE4B62748ADAF6363C182, 5C3BEBD008A5BE4DC2F92076FF41A10DDC01E10EC7E6552213CFA11970811848 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
      12:29:12.0203 0x0560 IpFilterDriver - ok
      12:29:12.0218 0x0560 [ B87AB476DCF76E72010632B5550955F5, E6E74D3A86A7917A8BAED44F8E97CCD2EB171E4E4B27E9907F60D1523FAF319A ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
      12:29:12.0218 0x0560 IpInIp - ok
      12:29:12.0234 0x0560 [ CC748EA12C6EFFDE940EE98098BF96BB, AF523E21C25D9A1715EFEA573E4F52AF5D4FC9F28A2D613F5DB629C186C439E0 ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
      12:29:12.0234 0x0560 IpNat - ok
      12:29:12.0250 0x0560 [ 23C74D75E36E7158768DD63D92789A91, 394D296F38E7D8EFD91A6EEC301D9CE6AF910E35EB9819F1A9E3363863AEDFDC ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
      12:29:12.0250 0x0560 IPSec - ok
      12:29:12.0265 0x0560 [ C93C9FF7B04D772627A3646D89F7BF89, 805FA48E7A46D4F10240BF880A2468F53DEA36E83004399228AB70DB7D20544A ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
      12:29:12.0265 0x0560 IRENUM - ok
      12:29:12.0281 0x0560 [ 355836975A67B6554BCA60328CD6CB74, 3B9A6E9F40A025D393B7F7226716909087D495B4B0E8472BB857F14D489D479D ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
      12:29:12.0281 0x0560 isapnp - ok
      12:29:12.0328 0x0560 [ B9436A665A8621073A12338B16D7BFD4, 1F1CB4758768BF7B7DDB27BF9DA944D869B561ABF7EC39CEC059044E10C1EA88 ] JavaQuickStarterService C:\Program Files\Java\jre7\bin\jqs.exe
      12:29:12.0343 0x0560 JavaQuickStarterService - ok
      12:29:12.0343 0x0560 [ 16813155807C6881F4BFBF6657424659, 5C0A3630E29B7FB9C1A8E9F06AD91A152CB189B0A4CBB2BA2557D937CA4B0AD6 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
      12:29:12.0343 0x0560 Kbdclass - ok
      12:29:12.0343 0x0560 [ 94C59CB884BA010C063687C3A50DCE8E, 7E3FBFCFB6BD428D0BFD05597AF3E90A59C947433F47F332BEE3806FD133A541 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
      12:29:12.0343 0x0560 kbdhid - ok
      12:29:12.0359 0x0560 kieyfzqp - ok
      12:29:12.0359 0x0560 [ 692BCF44383D056AED41B045A323D378, 1A99DEE83FFAF64E73067FC049C0A4CE07D94E4AE31EFA17B38CEFA9E41D67DC ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
      12:29:12.0375 0x0560 kmixer - ok
      12:29:12.0390 0x0560 [ 097BA59BA201C9270A704CC04670B553, 9C0D52F9609F72F21C6B290463FF054C2D4DBC99FC4E95D878958D376AEEAE37 ] km_filter C:\WINDOWS\system32\drivers\km_filter.sys
      12:29:12.0390 0x0560 km_filter - ok
      12:29:12.0421 0x0560 [ B467646C54CC746128904E1654C750C1, 3BD71BE3663EA23463D236D8A2A2E42DFA10C502BDB4B6E131FAF0FBA748219E ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
      12:29:12.0421 0x0560 KSecDD - ok
      12:29:12.0437 0x0560 [ 1DB8078A32E03AC8F5EB5E6DCAC2AA34, F795899595D4217322E9945ACCC99CA0DD2D6009354A4198092D706627EA2A1D ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
      12:29:12.0437 0x0560 lanmanserver - ok
      12:29:12.0468 0x0560 [ AD54EAD46D92F413BE189AABC1C59490, B73605718E40D5EA9323AD1DDEF4EC5827D3C71105FF8EA07E725DB1BD30678F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
      12:29:12.0468 0x0560 lanmanworkstation - ok
      12:29:12.0484 0x0560 lbrtfdc - ok
      12:29:12.0484 0x0560 [ 0F357C079AC529A844AB5B18E4EEF881, D1CF1AB2ABEA672AC1607608390A57C177EC0B9586115CA6A0CD919C7BC86E65 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
      12:29:12.0484 0x0560 LmHosts - ok
      12:29:12.0515 0x0560 [ B4B8B993A83084CE25DC776965903CE7, 42AB2F1A278FCE467C148450D66D98585A8B41A9760A39DD310D4DEFD6D02776 ] massfilter C:\WINDOWS\system32\DRIVERS\massfilter.sys
      12:29:12.0515 0x0560 massfilter - ok
      12:29:12.0562 0x0560 [ 7CF1B716372B89568AE4C0FE769F5869, 0D70A7A594BCFBB26D7249C0F4B0AF9EF874F2318B3FDCE44648CC61279594ED ] MDM C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
      12:29:12.0578 0x0560 MDM - ok
      12:29:12.0578 0x0560 [ E67A66A3781C1A483F0F8992664CBE0D, 9C90AB5CCB677E7E81C42A03526547F2ED29B009E0832E87EAC10E814F55FAB6 ] Messenger C:\WINDOWS\System32\msgsvc.dll
      12:29:12.0593 0x0560 Messenger - ok
      12:29:12.0609 0x0560 [ 4AE068242760A1FB6E1A44BF4E16AFA6, 1FB771162B96AAF787AC24867B818DF8511F0780BB094FA9A38C11D8DBFE68BC ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
      12:29:12.0609 0x0560 mnmdd - ok
      12:29:12.0625 0x0560 [ D3A2870CD96CDA7BCFF3DC54F64087AD, FF649A85E4EB9651D3B08C6B5B3EDD40569F22FD322A891E86345157DB053D3F ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
      12:29:12.0625 0x0560 mnmsrvc - ok
      12:29:12.0640 0x0560 [ 510ADE9327FE84C10254E1902697E25F, 2CDCE41F52BF4FC73C7689C371C401C2306FF128E8881C1B5CAAB3F8019F839A ] Modem C:\WINDOWS\system32\drivers\Modem.sys
      12:29:12.0640 0x0560 Modem - ok
      12:29:12.0656 0x0560 [ 027C01BD7EF3349AAEBC883D8A799EFB, 33EF2BF037B650C6EFC271EABAB241AF76B6826DA30B5FA158CC1B8E12DD52DE ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
      12:29:12.0656 0x0560 Mouclass - ok
      12:29:12.0656 0x0560 [ 124D6846040C79B9C997F78EF4B2A4E5, 2C0FA3B5F57D757CB4487F523CAB944E470256685F1C4AF4F06D0D27B67D5BEB ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
      12:29:12.0656 0x0560 mouhid - ok
      12:29:12.0687 0x0560 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD, 2A5E15ED2C24C6C65EF2F7E1FD93374774076C9D8D451E4422561F4D269C012F ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
      12:29:12.0687 0x0560 MountMgr - ok
      12:29:12.0703 0x0560 [ E77DC03DD3C8E5A388BF9EED2A28F3D1, ED0DAA975D1EC35CE036F02596218E15CC6A054167628D12A0A5AD91B841F422 ] MpFilter C:\WINDOWS\system32\DRIVERS\MpFilter.sys
      12:29:12.0718 0x0560 MpFilter - ok
      12:29:12.0796 0x0560 [ 06D4F934E09C359B0EFBFB3146F1D910, 484F57CD6F8757137F3B3491B8AC8ECF6C6385A666CD1671833DDD9E962AAB4A ] MpKsl4b30c1b7 C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9D2E209-9E44-44CA-9474-3A7874AEA18A}\MpKsl4b30c1b7.sys
      12:29:12.0796 0x0560 MpKsl4b30c1b7 - ok
      12:29:12.0796 0x0560 mraid35x - ok
      12:29:12.0812 0x0560 [ 11D42BB6206F33FBB3BA0288D3EF81BD, 76ABCFB62C5AC549F58C231F72A99882CDEB74928104B77FE52554765C2B1A22 ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
      12:29:12.0812 0x0560 MRxDAV - ok
      12:29:12.0843 0x0560 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0, DB9B186F7076D7B94F45041AF7B77C1AD2CAB504D683B459C6CB1C22840ED170 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
      12:29:12.0843 0x0560 MRxSmb - ok
      12:29:12.0859 0x0560 [ 8648D670AE0D95C95E7BBB5B80661796, 9CECF01E6D4A223E19676DC6C63A6396076FAFAC3502DB236096B04D8E38F0E5 ] MSDTC C:\WINDOWS\system32\msdtc.exe
      12:29:12.0859 0x0560 MSDTC - ok
      12:29:12.0859 0x0560 [ C941EA2454BA8350021D774DAF0F1027, C940E978C7B66A713A0FDAB54B5F995DF59D089AFCD96221DD3222948CD49BBD ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
      12:29:12.0859 0x0560 Msfs - ok
      12:29:12.0875 0x0560 MSIServer - ok
      12:29:12.0875 0x0560 [ D1575E71568F4D9E14CA56B7B0453BF1, 4ABE0E24786C0D39FA2B885447E56204CA6942FB175E534DCE675D7BCF0B176A ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
      12:29:12.0875 0x0560 MSKSSRV - ok
      12:29:12.0921 0x0560 [ B0F49DA36F30922F5DDC3B623B778FCE, EE025AEFA4A2095AFEABFB3A49639DA77D78068A3F5EEDA6C15D34853AFD5609 ] MsMpSvc C:\Program Files\Microsoft Security Client\MsMpEng.exe
      12:29:12.0921 0x0560 MsMpSvc - ok
      12:29:12.0937 0x0560 [ 325BB26842FC7CCC1FCCE2C457317F3E, C07BE560513B1FB91D756494F0BA4AEEB2E1998DE0E1C21EE83DB1183B0CEE91 ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
      12:29:12.0937 0x0560 MSPCLOCK - ok
      12:29:12.0953 0x0560 [ BAD59648BA099DA4A17680B39730CB3D, 9AD4C7C94C186C8815D0BC75DCAFB962158DA6935A244BA243EDDDEB33F9816C ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
      12:29:12.0953 0x0560 MSPQM - ok
      12:29:12.0953 0x0560 [ AF5F4F3F14A8EA2C26DE30F7A1E17136, AC93A1E4ABB0D038B772E429015567E44CC2EDB66C54DBE23A5F98176FAC1520 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
      12:29:12.0953 0x0560 mssmbios - ok
      12:29:12.0968 0x0560 [ E53736A9E30C45FA9E7B5EAC55056D1D, 38602F280BF69EBA3706AD175AFC1AEB561A8302B4B61E3FECB3C27D7A9BDB41 ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
      12:29:12.0968 0x0560 MSTEE - ok
      12:29:13.0000 0x0560 [ D48659BB24C48345D926ECB45C1EBDF5, EDEDE58316827530C25F8085F62AD48EA6D44B0F8AC1917B940F53B02CF72EA6 ] MTsensor C:\WINDOWS\system32\DRIVERS\ASACPI.sys
      12:29:13.0000 0x0560 MTsensor - ok
      12:29:13.0015 0x0560 [ DE6A75F5C270E756C5508D94B6CF68F5, FCC972DDC36C2C44D836913F10004C2C33B11C54DEFFF0C63E0FDF901D2F9261 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
      12:29:13.0015 0x0560 Mup - ok
      12:29:13.0046 0x0560 [ E6F48050AF7548E4BF775F0D83873794, CA40F7D5669D86F03152C84591E9D7B50F4DE0DD77ED3818AA340E439D8D7BDB ] mv61xx C:\WINDOWS\system32\DRIVERS\mv61xx.sys
      12:29:13.0046 0x0560 mv61xx - ok
      12:29:13.0125 0x0560 [ 5B50F1B2A2ED47D560577B221DA734DB, C16A554B6E1A7F5F98C94DFA88163E0F7426506BF2F51FD351B1A05FC0DB3BC5 ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
      12:29:13.0125 0x0560 NABTSFEC - ok
      12:29:13.0156 0x0560 [ 69E4FBBABAEEE1BFF422E091DA3171DA, DEA178FF8245C41B603C20069846D928381825DF7F29FE12899C0B68FBBE1A2C ] napagent C:\WINDOWS\System32\qagentrt.dll
      12:29:13.0171 0x0560 napagent - ok
      12:29:13.0171 0x0560 [ 1DF7F42665C94B825322FAE71721130D, FE0DCB728471465B39A42A7511F4133021FBA5DF88F88BCB5FE2FF34CFD713F9 ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
      12:29:13.0171 0x0560 NDIS - ok
      12:29:13.0203 0x0560 [ 7FF1F1FD8609C149AA432F95A8163D97, 18CD1FF5AC1EF8A38D1EC53014F2BADD28D9CDF4ECE2EBC2313D08903776F323 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
      12:29:13.0203 0x0560 NdisIP - ok
      12:29:13.0218 0x0560 [ 0109C4F3850DFBAB279542515386AE22, 4F6DB1E499AC853FD36FD603FBB6D3AC9BDCEB298C7FE1FB59A9236CB46729B2 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
      12:29:13.0218 0x0560 NdisTapi - ok
      12:29:13.0234 0x0560 [ F927A4434C5028758A842943EF1A3849, B1AA3AF150C05307461774925901789456B0CCCD03A5E71ADA4AB58455962BEE ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
      12:29:13.0234 0x0560 Ndisuio - ok
      12:29:13.0250 0x0560 [ EDC1531A49C80614B2CFDA43CA8659AB, 494042F790F33721328B4451E79842E21919681CC421A4F9633EC4D383E06097 ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
      12:29:13.0250 0x0560 NdisWan - ok
      12:29:13.0265 0x0560 [ 2F597BB467E05B1FE3830EABD821B8E0, 141497F5A49D47CCE3C9289644F4BD838DCB238F6D8E847FC006652E21FE02AC ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
      12:29:13.0265 0x0560 NDProxy - ok
      12:29:13.0296 0x0560 [ A081CB6FB9A12668F233EB5414BE3A0E, EE2A1311B51D1FEBAF79F45E568A927D8EA7704AFC8495AED2D26927566F61E3 ] Net Driver HPZ12 C:\WINDOWS\system32\HPZinw12.dll
      12:29:13.0296 0x0560 Net Driver HPZ12 - ok
      12:29:13.0312 0x0560 [ 5D81CF9A2F1A3A756B66CF684911CDF0, 7989C36607CAEA17AFA2C1C9904145CA0714A54B9F712D9D4C1AB140D0B2CC0C ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
      12:29:13.0312 0x0560 NetBIOS - ok
      12:29:13.0328 0x0560 [ 74B2B2F5BEA5E9A3DC021D685551BD3D, 7932B71F98B4122BE88F576BF6D745A757AE378A48924B7F4358837B75640A82 ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
      12:29:13.0328 0x0560 NetBT - ok
      12:29:13.0343 0x0560 [ 5C9B1D83755B36237B70F95DF3D46A52, D69F971102C6FBCC0BA2A043D31BBEAD6ADFC606A3E402436EF1A24240D0543A ] NetDDE C:\WINDOWS\system32\netdde.exe
      12:29:13.0343 0x0560 NetDDE - ok
      12:29:13.0359 0x0560 [ 5C9B1D83755B36237B70F95DF3D46A52, D69F971102C6FBCC0BA2A043D31BBEAD6ADFC606A3E402436EF1A24240D0543A ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
      12:29:13.0359 0x0560 NetDDEdsdm - ok
      12:29:13.0359 0x0560 [ 91E6024D6D4DCDECDB36C43ECF9BBECB, D288C5CD69B8E4612B689FB33B9CCD5594634D14C14D53A842DB742264A64D6B ] Netlogon C:\WINDOWS\system32\lsass.exe
      12:29:13.0359 0x0560 Netlogon - ok
      12:29:13.0375 0x0560 [ BE0CB143FA427D93440DED18DB8C918B, 9522756F22E37A2AAF443F486F7BB34C05A0788D213092C09A49EE44C47D79CA ] Netman C:\WINDOWS\System32\netman.dll
      12:29:13.0390 0x0560 Netman - ok
      12:29:13.0421 0x0560 [ D34612C5D02D026535B3095D620626AE, 1BBCCCBF49EB8807240A77DCB43C25C21682073CC5356594E2C4F53EF36BF657 ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
      12:29:13.0421 0x0560 NetTcpPortSharing - ok
      12:29:13.0421 0x0560 [ E9E47CFB2D461FA0FC75B7A74C6383EA, 544136F5BFD4DC23D45E90F12FA48B82FD9EAEA9EAF3E0F5F0BD27E23D672C3E ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys
      12:29:13.0421 0x0560 NIC1394 - ok
      12:29:13.0437 0x0560 NielGfx - ok
      12:29:13.0437 0x0560 nielprt - ok
      12:29:13.0546 0x0560 [ 6B5C3A21A3EEDFD49120264E57D388C7, AA8FBF9F69CD9AF0176D720539A82AFF2AF5AB1FCB4D926595E626411804D5B5 ] NielsenUpdate C:\Program Files\NetRatingsNetSight\NetSight\NielsenUpdate.exe
      12:29:13.0593 0x0560 NielsenUpdate - ok
      12:29:13.0625 0x0560 [ 6F5F546A92C7B6AE45DB1D6910781EB0, DB7BB1E58DCE13F23DD6DA4A56FC55306389A8CE30D68C57B6C92796601CF337 ] Nla C:\WINDOWS\System32\mswsock.dll
      12:29:13.0625 0x0560 Nla - ok
      12:29:13.0625 0x0560 [ 1E421A6BCF2203CC61B821ADA9DE878B, C658F1D5DCE7525CF929C65C46AB2881C99D89BF8F0F61C1D440C9D9BFB2F89F ] nm C:\WINDOWS\system32\DRIVERS\NMnt.sys
      12:29:13.0640 0x0560 nm - ok
      12:29:13.0656 0x0560 [ 471DB289EAD8B502D27EBE473D0A70FF, C1C4F860619F57570F59E6D903CCAD31820014D349280AB9413CC9B2848A8211 ] nnrnstdi C:\WINDOWS\system32\drivers\nnrnstdi.sys
      12:29:13.0656 0x0560 nnrnstdi - ok
      12:29:13.0656 0x0560 [ 3182D64AE053D6FB034F44B6DEF8034A, 4ADFC76965BA2A5F488E71789A4E4EA702A74AF42725F72130D1CA919406CF19 ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
      12:29:13.0656 0x0560 Npfs - ok
      12:29:13.0687 0x0560 [ 78A08DD6A8D65E697C18E1DB01C5CDCA, E0E6F3ED05068E32F1D5C2D2B38CDEF4536B8656DB6756C66CF6B40B60C8F3DA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
      12:29:13.0703 0x0560 Ntfs - ok
      12:29:13.0703 0x0560 [ 91E6024D6D4DCDECDB36C43ECF9BBECB, D288C5CD69B8E4612B689FB33B9CCD5594634D14C14D53A842DB742264A64D6B ] NtLmSsp C:\WINDOWS\system32\lsass.exe
      12:29:13.0703 0x0560 NtLmSsp - ok
      12:29:13.0718 0x0560 [ 037D92B3A7853A183FCAB77FB1D13D6C, 941CAD5CFB1EFFBD997A5694E281E8D63D007FC39907A1840FA966BDF77975A9 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
      12:29:13.0734 0x0560 NtmsSvc - ok
      12:29:13.0734 0x0560 [ 73C1E1F395918BC2C6DD67AF7591A3AD, B21133A75253EC15E2DFF66D3B480AB1A7E1A2360476C810E7AA55D0F0EB08D4 ] Null C:\WINDOWS\system32\drivers\Null.sys
      12:29:13.0734 0x0560 Null - ok
      12:29:13.0937 0x0560 [ 23B95A09677E62EC8D1641ECF39B9BFB, C690B047950FE0B22A3176031C229EB3DA8C756C613545FA23B25C906D3074EA ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
      12:29:14.0046 0x0560 nv - ok
      12:29:14.0125 0x0560 [ C501206816F35D20422B4C3F88D62860, BF815B59B3C6F26108AB349FA354236FE3782C18C43F9DDCD3574664F4E2F20F ] NVSvc C:\WINDOWS\system32\nvsvc32.exe
      12:29:14.0125 0x0560 NVSvc - ok
      12:29:14.0140 0x0560 [ B305F3FAD35083837EF46A0BBCE2FC57, 9D0E0E666D652D0FC9EAB97280A5D67AAF61D6B21929DF7CF8ED72A367720464 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
      12:29:14.0140 0x0560 NwlnkFlt - ok
      12:29:14.0156 0x0560 [ C99B3415198D1AAB7227F2C88FD664B9, DD8DA4B5E804F134AB9233859544C025062902DFC3E8FB8A09A67337A4E73F55 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
      12:29:14.0156 0x0560 NwlnkFwd - ok
      12:29:14.0171 0x0560 [ 8B8B1BE2DBA4025DA6786C645F77F123, E47D5EED2F3AF85E2332C325DA80AEF2C4EC989E38A175194EBBFA967BA8BF81 ] NwlnkIpx C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
      12:29:14.0171 0x0560 NwlnkIpx - ok
      12:29:14.0187 0x0560 [ 56D34A67C05E94E16377C60609741FF8, ABE48D3E7D38DB20E9D4884FC6FE42FAE0C5FAFD3AC86F1E585A4BB17C6F09C5 ] NwlnkNb C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
      12:29:14.0187 0x0560 NwlnkNb - ok
      12:29:14.0203 0x0560 [ C0BB7D1615E1ACBDC99757F6CEAF8CF0, 899905C0EB182ABCDAE0D0D749C0BC39CD231B9FAEE733D5DFDAE86EB8BC755B ] NwlnkSpx C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
      12:29:14.0203 0x0560 NwlnkSpx - ok
      12:29:14.0234 0x0560 [ A3C8A87D78C9B46385D67523F3D23EA5, 9858891F9219552347C785B1112A62A091FBFD4A8B1CDF90B503F4CECFCE08C8 ] NwSapAgent C:\WINDOWS\System32\ipxsap.dll
      12:29:14.0234 0x0560 NwSapAgent - ok
      12:29:14.0281 0x0560 [ 785F487A64950F3CB8E9F16253BA3B7B, 02445344BD214370A6D48B1CA04921D8EFCB13E676B5648266DD0E076C0822B6 ] odserv C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE
      12:29:14.0296 0x0560 odserv - ok
      12:29:14.0296 0x0560 [ CA33832DF41AFB202EE7AEB05145922F, 9DD0089C2E13C7F81214C3B5A4A61276292052F9BBFEA7FCD0F6AA27815D5F95 ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys
      12:29:14.0296 0x0560 ohci1394 - ok
      12:29:14.0328 0x0560 [ 5A432A042DAE460ABE7199B758E8606C, 6E5D1F477D290905BE27CEBF9572BAC6B05FFEF2FAD901D3C8E11F665F8B9A71 ] ose C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
      12:29:14.0328 0x0560 ose - ok
      12:29:14.0343 0x0560 [ 8FD0BDBEA875D06CCF6C945CA9ABAF75, 54964CD4C15B7EC4A037AA5E1200BD5C0B23B44EF12BABDA53D491AA23BA1FE6 ] Parport C:\WINDOWS\system32\drivers\Parport.sys
      12:29:14.0343 0x0560 Parport - ok
      12:29:14.0359 0x0560 Partizan - ok
      12:29:14.0375 0x0560 [ BEB3BA25197665D82EC7065B724171C6, 7E71C13BA30CD95CEE8A9CC85E6F48A01F30EDEAADEE69D80AE828BF97E5A5CA ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
      12:29:14.0375 0x0560 PartMgr - ok
      12:29:14.0390 0x0560 [ 9575C5630DB8FB804649A6959737154C, B73094C0043CC5CB97D7DF1243D30DF3E41C453F0721C7265F20B735AEF8E723 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
      12:29:14.0390 0x0560 ParVdm - ok
      12:29:14.0421 0x0560 [ FD2041E9BA03DB7764B2248F02475079, DECEED110524BF83B4097188BF24BF0DDE1CE838DF7748B0DC807ABE351EB20A ] pccsmcfd C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
      12:29:14.0421 0x0560 pccsmcfd - ok
      12:29:14.0453 0x0560 [ 043410877BDA580C528F45165F7125BC, 80B6997166866529F562135D333BA4787EBE466173C82958B28FAF9AD654090C ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
      12:29:14.0453 0x0560 PCI - ok
      12:29:14.0453 0x0560 PCIDump - ok
      12:29:14.0484 0x0560 [ F4BFDE7209C14A07AAA61E4D6AE69EAC, B67D87F22169572AD41884080FA9CBD5BABC248F40B71EA7297E516576982DD3 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
      12:29:14.0484 0x0560 PCIIde - ok
      12:29:14.0500 0x0560 [ F0406CBC60BDB0394A0E17FFB04CDD3D, 8167B46B5DD39E6CB1D49C64D9E88AD2A9C46D6C57B3A3A3F41B3BE18A4706CE ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
      12:29:14.0500 0x0560 Pcmcia - ok
      12:29:14.0500 0x0560 PCTINDIS5 - ok
      12:29:14.0500 0x0560 PDCOMP - ok
      12:29:14.0500 0x0560 PDFRAME - ok
      12:29:14.0500 0x0560 PDRELI - ok
      12:29:14.0500 0x0560 PDRFRAME - ok
      12:29:14.0500 0x0560 perc2 - ok
      12:29:14.0515 0x0560 perc2hib - ok
      12:29:14.0531 0x0560 [ C3FB1D70CB88722267949694BA51759E, 8CD60F76A91502A718E5371D4E94BF21ECA59F50307C783C27E316891504172D ] PlugPlay C:\WINDOWS\system32\services.exe
      12:29:14.0531 0x0560 PlugPlay - ok
      12:29:14.0546 0x0560 [ 65BC271F337637731D3C71455AE1F476, DAD32B61FE0147F8D2DA4C8F016920CD6BB2098F16E3CC2768009763E71DEFBC ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.dll
      12:29:14.0546 0x0560 Pml Driver HPZ12 - ok
      12:29:14.0562 0x0560 [ 91E6024D6D4DCDECDB36C43ECF9BBECB, D288C5CD69B8E4612B689FB33B9CCD5594634D14C14D53A842DB742264A64D6B ] PolicyAgent C:\WINDOWS\system32\lsass.exe
      12:29:14.0562 0x0560 PolicyAgent - ok
      12:29:14.0562 0x0560 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99, C5F0C8C66A3AF7E7BB04CEDE4AC5306F8387AB384A2107DC5BE413AAE968EFF1 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
      12:29:14.0562 0x0560 PptpMiniport - ok
      12:29:14.0578 0x0560 [ 91E6024D6D4DCDECDB36C43ECF9BBECB, D288C5CD69B8E4612B689FB33B9CCD5594634D14C14D53A842DB742264A64D6B ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
      12:29:14.0578 0x0560 ProtectedStorage - ok
      12:29:14.0593 0x0560 [ F115AF58ABE5605D7D709CBFBD83F418, 4855FCD6E455D6E374CE92E5B37D61E7E6D8A861BA76521E7CC2542621853471 ] ProtexisLicensing C:\WINDOWS\system32\PSIService.exe
      12:29:14.0609 0x0560 ProtexisLicensing - ok
      12:29:14.0609 0x0560 [ 09298EC810B07E5D582CB3A3F9255424, 35473A1BE25AC289474090EB0806AC6B3035DC33D1F3DF97A14BF1E361AC6AC3 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
      12:29:14.0609 0x0560 PSched - ok
      12:29:14.0625 0x0560 [ 80D317BD1C3DBC5D4FE7B1678C60CADD, DA76804B55D0CAB3DDD01EFC06673764AE4860693375C658B6063FB14AF7F12C ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
      12:29:14.0625 0x0560 Ptilink - ok
      12:29:14.0640 0x0560 [ 153D02480A0A2F45785522E814C634B6, 02B7590F2F4A8FA0B031CDA7A28BD55E7C04A080C1EA810BF3AC3212A62153A6 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys
      12:29:14.0640 0x0560 PxHelp20 - ok
      12:29:14.0656 0x0560 ql1080 - ok
      12:29:14.0656 0x0560 Ql10wnt - ok
      12:29:14.0656 0x0560 ql12160 - ok
      12:29:14.0656 0x0560 ql1240 - ok
      12:29:14.0656 0x0560 ql1280 - ok
      12:29:14.0671 0x0560 [ FE0D99D6F31E4FAD8159F690D68DED9C, 998685622ABE631984B7E4DBF91AB3594B1F574378D75EB9F6265F4650470692 ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
      12:29:14.0671 0x0560 RasAcd - ok
      12:29:14.0671 0x0560 [ 78DA9CCDAC683EF5AA87D1C919F6D221, C564185A684BAB97FBA7320273764DB8961B18D5AD5F1D6B741A6C385FC8717B ] RasAuto C:\WINDOWS\System32\rasauto.dll
      12:29:14.0687 0x0560 RasAuto - ok
      12:29:14.0687 0x0560 [ 11B4A627BC9614B885C4969BFA5FF8A6, EAE0A412A2B0F68919C32A96B3A08CC1A06585E4998819F5C9051745F63FF5AD ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
      12:29:14.0687 0x0560 Rasl2tp - ok
      12:29:14.0703 0x0560 [ 0A48DF90B4784F9B90A2671AF992C914, CA3696C6688F97D55E5302E5D3040899081FF48E41DF2138B48F405DDDE8AEA0 ] RasMan C:\WINDOWS\System32\rasmans.dll
      12:29:14.0718 0x0560 RasMan - ok
      12:29:14.0718 0x0560 [ 5BC962F2654137C9909C3D4603587DEE, A5CE5653D0105240F5E86CFAAB89E7917D42D939E2F27A5A7D6979289CA651B8 ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
      12:29:14.0718 0x0560 RasPppoe - ok
      12:29:14.0718 0x0560 [ FDBB1D60066FCFBB7452FD8F9829B242, 10A2DACF944BD000032EBA8C095CB3D879CC55B28C377ADF6E52E508E47444DB ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
      12:29:14.0718 0x0560 Raspti - ok
      12:29:14.0734 0x0560 [ 7AD224AD1A1437FE28D89CF22B17780A, 6645235CA27D671954E3557FA37082881C3D7D47492C71264CD8CB8D108EC801 ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
      12:29:14.0734 0x0560 Rdbss - ok
      12:29:14.0765 0x0560 [ 4912D5B403614CE99C28420F75353332, 975341ECD660209987B5E5171B8315E032439E408CBE8A5986E67AF767F373BB ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
      12:29:14.0765 0x0560 RDPCDD - ok
      12:29:14.0796 0x0560 [ 43AF5212BD8FB5BA6EED9754358BD8F7, AF330F61CECA4AFA359CEABC5EB3227E6B56A9A2DCE50701381D665122D7356D ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
      12:29:14.0796 0x0560 RDPWD - ok
      12:29:14.0812 0x0560 [ 9F63D9C5B238ED1C375D417EFF3D5BE7, 168BEA4CDE9A1C6A10998B4217626525C3C3F248956B946F1A2D51E807B0FEE4 ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
      12:29:14.0812 0x0560 RDSessMgr - ok
      12:29:14.0828 0x0560 [ D8EB2A7904DB6C916EB5361878DDCBAE, 3C6B04E18D5CE52777E349EFC213B8A570281F3192C491CCB6FA0593CC33B2A4 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
      12:29:14.0828 0x0560 redbook - ok
      12:29:14.0828 0x0560 [ 7DA370C31673C99497BD07068EE6E354, 159B25D0C4AF6C55658364B8DF74ADAE4DECA1B19D1F27D878C607AE29E47CB1 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
      12:29:14.0843 0x0560 RemoteAccess - ok
      12:29:14.0859 0x0560 [ 499C59A2584F6D4EA41E944DA571D993, 45291CBDCCA2B6217C442B788BDEB2202A11C9A51D08AA867F44008471A9C759 ] RpcLocator C:\WINDOWS\system32\locator.exe
      12:29:14.0859 0x0560 RpcLocator - ok
      12:29:14.0875 0x0560 [ 0203B1AAD358F206CB0A3C1F93CCE17A, 1FA6D7713CA597F751CD84BD6694914273F297D5664AF9BE70875C3321C6C740 ] RpcSs C:\WINDOWS\system32\rpcss.dll
      12:29:14.0890 0x0560 RpcSs - ok
      12:29:14.0906 0x0560 [ 414964844F4793ACB868D057E8ED997E, 843E0C7761AC001BF1169251167B08DA24E227F041F80586F2A54197A166FD13 ] RSVP C:\WINDOWS\system32\rsvp.exe
      12:29:14.0906 0x0560 RSVP - ok
      12:29:14.0968 0x0560 [ 671828423B5BF9DB4FC20AE337F2F893, 44DC1C522EFC96B17CCF53DC935F55C42655B5CBEB7E3F0C203E9C312BBA54AE ] RT80x86 C:\WINDOWS\system32\DRIVERS\RT2860.sys
      12:29:14.0984 0x0560 RT80x86 - ok
      12:29:14.0984 0x0560 [ 91E6024D6D4DCDECDB36C43ECF9BBECB, D288C5CD69B8E4612B689FB33B9CCD5594634D14C14D53A842DB742264A64D6B ] SamSs C:\WINDOWS\system32\lsass.exe
      12:29:14.0984 0x0560 SamSs - ok
      12:29:15.0015 0x0560 [ 67949CC8A865296C1333C96A4E1A2D66, 89BD385E3D6634557AE76D427A791A0D9DC4E3DD7DBE923A0A031F124BBC0ED6 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
      12:29:15.0015 0x0560 SCardSvr - ok
      12:29:15.0031 0x0560 [ 55F5C5C1BE1A78E285033E432BA01597, 6844EE76BF36FD88C61F7B312BB53C4C8F5BF328985E9D629CFF4D526C404DD3 ] Schedule C:\WINDOWS\system32\schedsvc.dll
      12:29:15.0031 0x0560 Schedule - ok
      12:29:15.0140 0x0560 [ 271077B91D7AD1B616F8AFDFE8E3F981, 1007314A72040A113AF2D7FE09139FD0E7E605CBFEC2287C0829FBE052A30882 ] SeaPort C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      12:29:15.0140 0x0560 SeaPort - ok
      12:29:15.0156 0x0560 [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
      12:29:15.0156 0x0560 Secdrv - ok
      12:29:15.0171 0x0560 [ 5AC311C0AF2AF5EC221670BB8DC479D3, C064CDDE7EAD4D387A7A78BF8AF6B47F1D028D5E57D1BAE3E74D4826B4C38F56 ] seclogon C:\WINDOWS\System32\seclogon.dll
      12:29:15.0171 0x0560 seclogon - ok
      12:29:15.0203 0x0560 [ B6A6B409FDA9D9EBD3AADB838D3D7173, 0A9A4C15C83AACBA9FC87B674CB17375DE988B41448A65101647AE67BDD15377 ] SenFiltService C:\WINDOWS\system32\drivers\Senfilt.sys
      12:29:15.0203 0x0560 SenFiltService - ok
      12:29:15.0218 0x0560 [ 3531366F38F453D08FE72E7B32DFE786, F040CE3C2D3E8A67D72DBD7A1BB0AB10576944CBAD930B24A5DA00225365EEFB ] SENS C:\WINDOWS\system32\sens.dll
      12:29:15.0218 0x0560 SENS - ok
      12:29:15.0250 0x0560 [ 0F29512CCD6BEAD730039FB4BD2C85CE, 4F98AE390D1B14A755700DD6CEFB9CF921F0404AF2145D2D7E5F52394F87C6A5 ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
      12:29:15.0250 0x0560 serenum - ok
      12:29:15.0250 0x0560 [ 93D313C31F7AD9EA2B75F26075413C7C, 7CBC2C8852D671100AE2EB6F09C416D30C2E65F5FF5D777E4AC133E4F7ACBA7B ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
      12:29:15.0250 0x0560 Serial - ok
      12:29:15.0312 0x0560 [ 668043F192AB9659761A349A4703600D, 44443E477A38913C6973817C06C25A776574F2C0F9F52609F070BAFA836EBE2E ] ServiceLayer C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      12:29:15.0328 0x0560 ServiceLayer - ok
      12:29:15.0343 0x0560 [ 4C0D673281178CB496011A2E28571FC8, 14CFB50F3EA987C4485475B2E5EC85C137949911495245F29FE64723C909C9E8 ] sfdrv01 C:\WINDOWS\system32\drivers\sfdrv01.sys
      12:29:15.0359 0x0560 sfdrv01 - ok
      12:29:15.0375 0x0560 [ 15BE2B5E4DC5B8623CF167720682ABC9, FAECDC0DCB6EACE8130B278E2FB84B9523AB10329A00B24043B9C76867B917F0 ] sfhlp02 C:\WINDOWS\system32\drivers\sfhlp02.sys
      12:29:15.0375 0x0560 sfhlp02 - ok
      12:29:15.0390 0x0560 [ 8E6B8C671615D126FDC553D1E2DE5562, CEEC0067514555D5CA489F50E3D7562FCA8DB8E952C3C878604C9277FC77959F ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
      12:29:15.0390 0x0560 Sfloppy - ok
      12:29:15.0390 0x0560 [ B27F70092A84B2A381D1FCDBBB82F876, FAC879875AD26F6B6BA70809F9C2FA60A1CDA410AAC6D4C831D8AE9D9465CF8A ] sfsync03 C:\WINDOWS\system32\drivers\sfsync03.sys
      12:29:15.0390 0x0560 sfsync03 - ok
      12:29:15.0421 0x0560 [ F4CE708A7D17A625DE6C0FD746D50E88, 9531A52B5049C9993930704BAAE2A15376274CAC4E98EBF6EA4C8AE3663957CD ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
      12:29:15.0421 0x0560 SharedAccess - ok
      12:29:15.0437 0x0560 [ 1B8542F338CDD86929A084A455837158, 91259E37DA2F8B0170E48D7880CF1B67B42B1486609417806E9D503899E1DEFA ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
      12:29:15.0437 0x0560 ShellHWDetection - ok
      12:29:15.0437 0x0560 Simbad - ok
      12:29:15.0468 0x0560 [ F9363FD8C8549F2B586602DE0956D21C, DABD016B266A71D1DD8BCF50850F5DEFD9FE0152531DE3DDEC50FA522195EBF1 ] SkLaggProtocol C:\WINDOWS\system32\DRIVERS\yk51x32l.sys
      12:29:15.0468 0x0560 SkLaggProtocol - ok
      12:29:15.0500 0x0560 [ 672D7481ADC1E1A149441FD0FE051B1E, 36EE3B693C5AEFB711AED48D3A699B0BB5CB44150E5CC52E4279F8AFC3C8069D ] SkVlanProtocol C:\WINDOWS\system32\DRIVERS\yk51x32v.sys
      12:29:15.0500 0x0560 SkVlanProtocol - ok
      12:29:15.0531 0x0560 [ 866D538EBE33709A5C9F5C62B73B7D14, BC94BEB7C17B4FCAC8B5D0D5006A203BC209E0504EECE149651D8691935696CD ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
      12:29:15.0531 0x0560 SLIP - ok
      12:29:15.0765 0x0560 [ 11BB0E11D42CC3A43D741D9B30839BE1, FDC35289D966A7CB318C5BD646148E1E2BCC0AB9F9FD4243C82FC567D72DDAE9 ] SNPSTD3 C:\WINDOWS\system32\DRIVERS\snpstd3.sys
      12:29:15.0937 0x0560 SNPSTD3 - ok
      12:29:15.0968 0x0560 Sparrow - ok
      12:29:15.0968 0x0560 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F, DD17733CBB370FCA08F0296704D7CBEACA3C8F76D0ABE4761C3B1FFDF7481D9E ] splitter C:\WINDOWS\system32\drivers\splitter.sys
      12:29:15.0968 0x0560 splitter - ok
      12:29:16.0015 0x0560 [ 60784F891563FB1B767F70117FC2428F, E0B07F08E60FFBAD36C2E58180F4B2A16DCA47716044CBE0213DF7B74D742F1F ] Spooler C:\WINDOWS\system32\spoolsv.exe
      12:29:16.0031 0x0560 Spooler - ok
      12:29:16.0031 0x0560 [ 39626E6DC1FB39434EC40C42722B660A, 4FB99976F0BFA14A176C25B47E55DA448773530018DA4C25DC237C4121DC0EFA ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
      12:29:16.0046 0x0560 sr - ok
      12:29:16.0062 0x0560 [ 6ED29124A1C83BD0CF6B26BD01CA6F6F, B88211872F43A0781EB5F12E19DEA319FEAC8C7F635774C6B59D73C16BF25B5D ] srservice C:\WINDOWS\system32\srsvc.dll
      12:29:16.0062 0x0560 srservice - ok
      12:29:16.0140 0x0560 [ 47DDFC2F003F7F9F0592C6874962A2E7, 17C643BD4EB09B5666FE41817DC785BE04A6E491CE79E8E5A702CDBD98E1BDD7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
      12:29:16.0140 0x0560 Srv - ok
      12:29:16.0156 0x0560 [ EA9E0DB8684CEF2FD3BADD671DF5A112, D822BE0278A8FF7DDD14428F6AA557EC581C2D33121777451D86920245FFC6F5 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
      12:29:16.0171 0x0560 SSDPSRV - ok
      12:29:16.0187 0x0560 [ D76B0E8A4ECAD1ADCC75FD14A7ACC54C, 9203AD97A96794DD93F7EEF8273CC9C421CDF7941937C6DDA82C1E14F697A7E0 ] stisvc C:\WINDOWS\system32\wiaservc.dll
      12:29:16.0187 0x0560 stisvc - ok
      12:29:16.0203 0x0560 [ 77813007BA6265C4B6098187E6ED79D2, 93939120E803C46FBFD577C8FC2E6C7E71C0460E01D25CB29579490640AB50C7 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
      12:29:16.0203 0x0560 streamip - ok
      12:29:16.0203 0x0560 [ 3941D127AEF12E93ADDF6FE6EE027E0F, EA1F0E32E1C5E90FA4AAC421DEBBE086512340758D3217A6334E886BCE638B51 ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
      12:29:16.0203 0x0560 swenum - ok
      12:29:16.0218 0x0560 [ 8CE882BCC6CF8A62F2B2323D95CB3D01, B408550A581F3DA222355964AFA4E976AD8471F0AA37573C42C4948AE5A23A3B ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
      12:29:16.0218 0x0560 swmidi - ok
      12:29:16.0218 0x0560 SwPrv - ok
      12:29:16.0218 0x0560 symc810 - ok
      12:29:16.0218 0x0560 symc8xx - ok
      12:29:16.0234 0x0560 sym_hi - ok
      12:29:16.0234 0x0560 sym_u3 - ok
      12:29:16.0234 0x0560 [ 8B83F3ED0F1688B4958F77CD6D2BF290, 546D3602183702B4F53E84413CFA2C933D64C8540378E54A8DCD148F3F36A2DA ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
      12:29:16.0234 0x0560 sysaudio - ok
      12:29:16.0250 0x0560 [ 0899061318A6B1D9596AABFC77F45E44, A331BD7AC6A7542DEE6478928D756E2E5BA6F957A369F830979A76ACB5E8D612 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
      12:29:16.0250 0x0560 SysmonLog - ok
      12:29:16.0281 0x0560 [ 8E5231171AD6595FF002E848CC54FCD7, C13AF616046C31BCC514B72160A366B0FFA376851C6F76445F03A86B81769670 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
      12:29:16.0281 0x0560 TapiSrv - ok
      12:29:16.0312 0x0560 [ 9AEFA14BD6B182D61E3119FA5F436D3D, EA29E49434585409272E7901AF89771FE9D6E911A7DC44AB3C7020CFF8A44552 ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
      12:29:16.0312 0x0560 Tcpip - ok
      12:29:16.0328 0x0560 [ 4E53BBCC4BE37D7A4BD6EF1098C89FF7, D084EFE07AC200672A1CE7BB8AE736612B3E353271188D26E29EC973E26E1F5F ] Tcpip6 C:\WINDOWS\system32\DRIVERS\tcpip6.sys
      12:29:16.0343 0x0560 Tcpip6 - ok
      12:29:16.0343 0x0560 [ 6471A66807F5E104E4885F5B67349397, F35CBFFB8BB235CCE30EF94A5273333900DD49FD506BF9D55D99A320B8A53A5A ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
      12:29:16.0343 0x0560 TDPIPE - ok
      12:29:16.0359 0x0560 [ C56B6D0402371CF3700EB322EF3AAF61, 7743FA4C734BCE38EFB1CA69BC17364D8421E2CD172F856F7E38E7AE1EE93F2F ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
      12:29:16.0359 0x0560 TDTCP - ok
      12:29:16.0359 0x0560 [ 88155247177638048422893737429D9E, B6D4E8691917946332C2208D01F8C8281978C1AD1E9951C5D99DF0D49AC34B3B ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
      12:29:16.0359 0x0560 TermDD - ok
      12:29:16.0375 0x0560 [ 710BC85A8C22626EE094439E3EA0D38C, B48ED980DBFADDA941170F54D62D6C4B1787435CC97E45D3B2DED9B73FE8F887 ] TermService C:\WINDOWS\System32\termsrv.dll
      12:29:16.0375 0x0560 TermService - ok
      12:29:16.0390 0x0560 [ 1B8542F338CDD86929A084A455837158, 91259E37DA2F8B0170E48D7880CF1B67B42B1486609417806E9D503899E1DEFA ] Themes C:\WINDOWS\System32\shsvcs.dll
      12:29:16.0390 0x0560 Themes - ok
      12:29:16.0406 0x0560 TosIde - ok
      12:29:16.0406 0x0560 [ E1A84A5067627407A53C2C4F8D8A1D2E, 23A082FEBB83F9211D63727A94499652CF03A3EE16B782EDFF3947978BC7685A ] TrkWks C:\WINDOWS\system32\trkwks.dll
      12:29:16.0406 0x0560 TrkWks - ok
      12:29:16.0421 0x0560 [ 8F861EDA21C05857EB8197300A92501C, 374FF9464F273610A051B9220C8D20F01FD4DD029095A7BE37244E20C5C8B5BB ] tunmp C:\WINDOWS\system32\DRIVERS\tunmp.sys
      12:29:16.0421 0x0560 tunmp - ok
      12:29:16.0437 0x0560 [ 5787B80C2E3C5E2F56C2A233D91FA2C9, 3774905CF77954DFCECDA5BCC7CDE3D0ED72712BFAAD85ADAE5246306447E46C ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
      12:29:16.0437 0x0560 Udfs - ok
      12:29:16.0453 0x0560 [ A4E07DA3AE2078BD96E84D4BAA07B71D, A5FABED4ED768F9AE6C8AE6C497B1C54C89FD88F081F24CDA138791A89ADDF90 ] ULCDRHlp C:\WINDOWS\system32\Drivers\ULCDRHlp.sys
      12:29:16.0453 0x0560 ULCDRHlp - ok
      12:29:16.0453 0x0560 ultra - ok
      12:29:16.0484 0x0560 [ 402DDC88356B1BAC0EE3DD1580C76A31, 32A686595710336A6BFD54C03F552AE39439611662F84EF5D24193AE5665C6F3 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
      12:29:16.0484 0x0560 Update - ok
      12:29:16.0500 0x0560 [ BD8166A495B02308F364B36249475F22, 62D71C84858CF8EC57A1A1899ABA0FC261880BA6D17B3685DD47BF560E14D11C ] upnphost C:\WINDOWS\System32\upnphost.dll
      12:29:16.0500 0x0560 upnphost - ok
      12:29:16.0515 0x0560 [ 1EDC93D7BD731B5CA6248AE245099B60, 1E2BEA04488C89BA45D54AC80DC44F7096946D325590B2BF774D86DE2CE2382C ] UPS C:\WINDOWS\System32\ups.exe
      12:29:16.0515 0x0560 UPS - ok
      12:29:16.0546 0x0560 [ 1B611611C28D2DF25BC057D79C6F13FC, B0D86F63E44B40413BBAE6402CC088046CFAE082D41BBC2ED5A916293356B846 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
      12:29:16.0546 0x0560 usbccgp - ok
      12:29:16.0546 0x0560 [ 4BAC8DF07F1D8434FC640E677A62204E, 76C1351AF6752224BF59DEEE0F8665FE699F3DFD679F5BCD01C7D9383E6402A4 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
      12:29:16.0546 0x0560 usbehci - ok
      12:29:16.0562 0x0560 [ 1AB3CDDE553B6E064D2E754EFE20285C, A99C4528C4227B1E96847614745AAFACD3C5F1BDFE435214DBF78740FFB300FE ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
      12:29:16.0562 0x0560 usbhub - ok
      12:29:16.0593 0x0560 [ A717C8721046828520C9EDF31288FC00, 1530BBE832EDBB0974AD89D723A03FF7A0094B368992D73C2C3E62A181DF1E0A ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
      12:29:16.0593 0x0560 usbprint - ok
      12:29:16.0609 0x0560 [ F8EDE2B6928970DCE3D5614C27D9E7F6, 6E5EBBC8B70C1D593634DAF0C190DEADFDA18C3CBC8F552A76F156F3869EF05B ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
      12:29:16.0609 0x0560 usbscan - ok
      12:29:16.0640 0x0560 [ 84C44D720655A8AA475E57A9E764D675, 2D450199338A217FBD951317812A74223E8B477974C7634667E8896316C3FEA0 ] usbser C:\WINDOWS\system32\drivers\usbser.sys
      12:29:16.0640 0x0560 usbser - ok
      12:29:16.0656 0x0560 [ A32426D9B14A089EAA1D922E0C5801A9, ED1DC52EE45F8EAD3AEC4B1F817BB25634141CF48295494C5947DCE6CF7A9817 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
      12:29:16.0656 0x0560 usbstor - ok
      12:29:16.0656 0x0560 [ 26496F9DEE2D787FC3E61AD54821FFE6, 8BE7FF647470B9A951CBB478FAF83D657A15CC78037F42348A6B738F21D523DA ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
      12:29:16.0656 0x0560 usbuhci - ok
      12:29:16.0687 0x0560 [ B4D7B7AD8A9F7C063C5CC3E2C1A0724E, CFA47A71403419CA7C94333B4F7766DFC97C5DCDBC3AD1B106044B93C979A5C5 ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys
      12:29:16.0687 0x0560 usb_rndisx - ok
      12:29:16.0687 0x0560 [ 0D3A8FAFCEACD8B7625CD549757A7DF1, B9CFDEFCD66AA139F3DC2F967B184669532922563AD5A71769BABDC4370D065E ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
      12:29:16.0687 0x0560 VgaSave - ok
      12:29:16.0687 0x0560 ViaIde - ok
      12:29:16.0703 0x0560 [ 46DE1126684369BACE4849E4FC8C43CA, 7D7B9B9C38D5E07D941B06DCDA8DC1CFFB80D2DD7717209E27A6AF7A9ACC51D4 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
      12:29:16.0703 0x0560 VolSnap - ok
      12:29:16.0734 0x0560 [ 5A4DA252B2C0550AB83D129C02CF6C19, FADE9EB68A47539F647BB5733836ABE73B69C8C43EA5AE4933A43343E459DD5D ] VSS C:\WINDOWS\System32\vssvc.exe
      12:29:16.0734 0x0560 VSS - ok
      12:29:16.0750 0x0560 [ C1F726EE0B043B074A68992BC4AEF8FD, 17C1AA49903E081CEF9DC240A8F897D6C97DAE1DE2CF1FD43D05DC6D46EAAA60 ] W32Time C:\WINDOWS\system32\w32time.dll
      12:29:16.0750 0x0560 W32Time - ok
      12:29:16.0765 0x0560 [ E20B95BAEDB550F32DD489265C1DA1F6, 5589B2067E6C9FBA290D8C5EADDC198EBAF39C50C3CD7D2BC5CDA7CBFBC445E5 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
      12:29:16.0765 0x0560 Wanarp - ok
      12:29:16.0796 0x0560 [ DC7F91B2ED24A738C807EA07F298928C, A4DCE890B7CC550B0DD3D7D4CDE01623B64C5688953CE386D9602CD542B261C9 ] wceusbsh C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
      12:29:16.0812 0x0560 wceusbsh - ok
      12:29:16.0828 0x0560 [ D918617B46457B9AC28027722E30F647, 407284D3055DC11944D4EE7E4357E7CF9CAF8CA40CA50633AB6FD4A82CB7EEA6 ] Wdf01000 C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
      12:29:16.0843 0x0560 Wdf01000 - ok
      12:29:16.0843 0x0560 WDICA - ok
      12:29:16.0859 0x0560 [ 6768ACF64B18196494413695F0C3A00F, 3A8F8586F1D997D19A8478345338D2AECD785AEABDB61531DD3F92003D3230A5 ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
      12:29:16.0859 0x0560 wdmaud - ok
      12:29:16.0875 0x0560 [ 714670E64FBE6D28D99871ED9A52A334, BDC9681A6BCF786C0AD9D999FE0AC16299D8F2486B2DF03962396942964CCCCB ] WebClient C:\WINDOWS\System32\webclnt.dll
      12:29:16.0875 0x0560 WebClient - ok
      12:29:16.0906 0x0560 [ 5E9DEAE9980FF34BCD6DDE2E9E2BF911, 1F6EACA551F4BB222A56CB450A529C001188F1DA46C9E59D9C2F12FA40B6B1E6 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
      12:29:16.0906 0x0560 winmgmt - ok
      12:29:16.0937 0x0560 [ C51B4A5C05A5475708E3C81C7765B71D, F776D2680BD3407307B7072626F78460361FC5BC38623C9E16F394D300AB25DE ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
      12:29:16.0953 0x0560 WmdmPmSN - ok
      12:29:16.0953 0x0560 [ 4E8E8A58F56B25D0795F484E5EB7F898, 32F8EC10A5992185C13304AAA532C638ECB709EF9D9D883F88032BB30E3AE098 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
      12:29:16.0968 0x0560 WmiApSrv - ok
      12:29:17.0000 0x0560 [ C9BEA742CE225CC993C9465FDDAE4656, AE33F1E433448379B8100C425FE72022A31BE6C09CB68833F0868249037F8182 ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
      12:29:17.0015 0x0560 WMPNetworkSvc - ok
      12:29:17.0031 0x0560 [ CF4DEF1BF66F06964DC0D91844239104, CC1D9CECE2056D29A9651D51BB57C3F4F9BF9E90A4808CF7496C683C874FBD51 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
      12:29:17.0031 0x0560 WpdUsb - ok
      12:29:17.0109 0x0560 [ 6ABE6E225ADB5A751622A9CC3BC19CE8, 4061C5D0F051DFF1730E2A3BFC1CCA97B29602FC50F10F6B44D93B0D28F42024 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys
      12:29:17.0109 0x0560 WS2IFSL - ok
      12:29:17.0156 0x0560 [ C1FD85DB4A80A98D60ECB7A828E77FE0, CFDADDD4C5355C9052431BFA579B8697A3F46A211E22EA03FDDD44C0D3F0A0CB ] wscsvc C:\WINDOWS\System32\wscsvc.dll
      12:29:17.0156 0x0560 wscsvc - ok
      12:29:17.0156 0x0560 WSearch - ok
      12:29:17.0187 0x0560 [ C98B39829C2BBD34E454150633C62C78, 71B60EA3AD0E2637917D528C6A9E7ECF2949E3E5E91036AA5BBADA95BD725511 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
      12:29:17.0187 0x0560 WSTCODEC - ok
      12:29:17.0203 0x0560 [ 75D6C5C3D2C93B1F9931E5DFB693AE2A, 793A4417D919EAC190428C3F29D387E67A62E120829463AE9FAF57D1ABCA75A7 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
      12:29:17.0203 0x0560 wuauserv - ok
      12:29:17.0234 0x0560 [ F15FEAFFFBB3644CCC80C5DA584E6311, 79B3E9AF35976CE49921E9BEA3BA3B4A8AF762FD3F284B62954038B5FFB32471 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
      12:29:17.0250 0x0560 WudfPf - ok
      12:29:17.0250 0x0560 [ 28B524262BCE6DE1F7EF9F510BA3985B, AEFF02B
      0
    2. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
       
      Il faut que tu héberge le rapport de TDSSKiller, trop volumineux pour tenir en entier.
      0
    3. djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention  
       
      OK. Mais peux tu m'indiquer comment je fais pour héberger TDSSKILLER ?
      0
    4. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
       
      Comment héberger un rapport sur ci-joint :

      • Clique sur ce lien : https://www.cjoint.com/
      • Clique sur Parcourir... et cherche le fichier du rapport que tu souhaites me transmettre.
      • Clique sur Ouvrir.
      • Clique sur "Créer le lien Cjoint" pour déposer le fichier.
      • Un lien de cette forme : 
      http://cjoint.com/?CFnaaobHAob
      est ajouté dans la nouvelle page.
      • Copie-colle ce lien dans ta réponse.

      Tuto pour t'aider
      0
  15. djami92 Messages postés 47 Date d'inscription   Statut Membre Dernière intervention  
     
    bjr Loumax91,

    J'ai fais Roguekiller et suppression. Ci-après le nouveau rapport RKreport.tX (j'ai du faire une mauvaise manip car je me suis retrouvée avec 2 rapports sur le bureau, pour être sure : j'ai copié le 3ème depuis Roguekiller :

    1ER RAPPORT :
    RogueKiller V8.8.7 [Feb 11 2014] par Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Remontees : https://forum.adlice.com/
    Site Web : https://www.luanagames.com/index.fr.html
    Blog : https://www.adlice.com/

    Systeme d'exploitation : Windows XP (5.1.2600 Service Pack 3) 32 bits version
    Demarrage : Mode normal
    Utilisateur : DJAM [Droits d'admin]
    Mode : Recherche -- Date : 02/11/2014 12:14:57
    | ARK || FAK || MBR |

    ¤¤¤ Processus malicieux : 0 ¤¤¤

    ¤¤¤ Entrees de registre : 0 ¤¤¤

    ¤¤¤ Tâches planifiées : 0 ¤¤¤

    ¤¤¤ Entrées Startup : 0 ¤¤¤

    ¤¤¤ Navigateurs web : 0 ¤¤¤

    ¤¤¤ Addons navigateur : 0 ¤¤¤

    ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

    ¤¤¤ Driver : [CHARGE] ¤¤¤
    [Address] IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : atapi.sys -> HOOKED (sfsync03.sys @ 0xBA0F995C)
    [Address] IAT @explorer.exe (LoadLibraryExA) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3010)
    [Address] IAT @explorer.exe (LoadLibraryExW) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3018)
    [Address] IAT @explorer.exe (LoadLibraryA) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3000)
    [Address] IAT @explorer.exe (LoadLibraryW) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3008)
    [Address] IAT @explorer.exe (GetProcAddress) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3020)

    ¤¤¤ Ruches Externes: ¤¤¤

    ¤¤¤ Infection : ¤¤¤

    ¤¤¤ Fichier HOSTS: ¤¤¤
    --> %SystemRoot%\System32\drivers\etc\hosts

    127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
    127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
    127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
    127.0.0.1 2010-fr.com # hosts anti-adware / pups
    127.0.0.1 2012-new.biz # hosts anti-adware / pups
    127.0.0.1 212link.com # hosts anti-adware / pups
    127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
    127.0.0.1 24h00business.com # hosts anti-adware / pups
    127.0.0.1 a.adorika.net # hosts anti-adware / pups
    127.0.0.1 a.ad-sys.com # hosts anti-adware / pups
    127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups
    127.0.0.1 ad.adn360.com # hosts anti-adware / pups
    127.0.0.1 adeartss.eu # hosts anti-adware / pups
    127.0.0.1 adesoeasy.eu # hosts anti-adware / pups
    127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups
    127.0.0.1 adm.soft365.com # hosts anti-adware / pups
    127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups
    127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups
    127.0.0.1 ads.adplxmd.com # hosts anti-adware / pups
    127.0.0.1 ads.aff.co # hosts anti-adware / pups
    [...]

    ¤¤¤ MBR Verif: ¤¤¤

    +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST3500320AS +++++
    --- User ---
    [MBR] c4f8dd33e1c089ad7283c0603ff441ee
    [BSP] 5deefcd2449ac2283f5f4aad37adf97a : Windows XP MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 39997 Mo
    1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 81915435 | Size: 436931 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    Termine : << RKreport[0]_S_02112014_121457.txt >>
    RKreport[0]_D_02102014_034547.txt;RKreport[0]_S_02092014_231834.txt

    2EME RAPPORT
    RogueKiller V8.8.7 [Feb 11 2014] par Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Remontees : https://forum.adlice.com/
    Site Web : https://www.luanagames.com/index.fr.html
    Blog : https://www.adlice.com/

    Systeme d'exploitation : Windows XP (5.1.2600 Service Pack 3) 32 bits version
    Demarrage : Mode normal
    Utilisateur : DJAM [Droits d'admin]
    Mode : Suppression -- Date : 02/11/2014 12:16:19
    | ARK || FAK || MBR |

    ¤¤¤ Processus malicieux : 0 ¤¤¤

    ¤¤¤ Entrees de registre : 0 ¤¤¤

    ¤¤¤ Tâches planifiées : 0 ¤¤¤

    ¤¤¤ Entrées Startup : 0 ¤¤¤

    ¤¤¤ Navigateurs web : 0 ¤¤¤

    ¤¤¤ Addons navigateur : 0 ¤¤¤

    ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

    ¤¤¤ Driver : [CHARGE] ¤¤¤
    [Address] IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : atapi.sys -> HOOKED (sfsync03.sys @ 0xBA0F995C)
    [Address] IAT @explorer.exe (LoadLibraryExA) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3010)
    [Address] IAT @explorer.exe (LoadLibraryExW) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3018)
    [Address] IAT @explorer.exe (LoadLibraryA) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3000)
    [Address] IAT @explorer.exe (LoadLibraryW) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3008)
    [Address] IAT @explorer.exe (GetProcAddress) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3020)

    ¤¤¤ Ruches Externes: ¤¤¤

    ¤¤¤ Infection : ¤¤¤

    ¤¤¤ Fichier HOSTS: ¤¤¤
    --> %SystemRoot%\System32\drivers\etc\hosts

    127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
    127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
    127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
    127.0.0.1 2010-fr.com # hosts anti-adware / pups
    127.0.0.1 2012-new.biz # hosts anti-adware / pups
    127.0.0.1 212link.com # hosts anti-adware / pups
    127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
    127.0.0.1 24h00business.com # hosts anti-adware / pups
    127.0.0.1 a.adorika.net # hosts anti-adware / pups
    127.0.0.1 a.ad-sys.com # hosts anti-adware / pups
    127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups
    127.0.0.1 ad.adn360.com # hosts anti-adware / pups
    127.0.0.1 adeartss.eu # hosts anti-adware / pups
    127.0.0.1 adesoeasy.eu # hosts anti-adware / pups
    127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups
    127.0.0.1 adm.soft365.com # hosts anti-adware / pups
    127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups
    127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups
    127.0.0.1 ads.adplxmd.com # hosts anti-adware / pups
    127.0.0.1 ads.aff.co # hosts anti-adware / pups
    [...]

    ¤¤¤ MBR Verif: ¤¤¤

    +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST3500320AS +++++
    --- User ---
    [MBR] c4f8dd33e1c089ad7283c0603ff441ee
    [BSP] 5deefcd2449ac2283f5f4aad37adf97a : Windows XP MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 39997 Mo
    1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 81915435 | Size: 436931 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    Termine : << RKreport[0]_D_02112014_121619.txt >>
    RKreport[0]_D_02102014_034547.txt;RKreport[0]_S_02092014_231834.txt;RKreport[0]_S_02112014_121457.txt

    3EME RAPPORT :
    RogueKiller V8.8.7 [Feb 11 2014] par Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Remontees : https://forum.adlice.com/
    Site Web : https://www.luanagames.com/index.fr.html
    Blog : https://www.adlice.com/

    Systeme d'exploitation : Windows XP (5.1.2600 Service Pack 3) 32 bits version
    Demarrage : Mode normal
    Utilisateur : DJAM [Droits d'admin]
    Mode : Suppression -- Date : 02/11/2014 12:16:19
    | ARK || FAK || MBR |

    ¤¤¤ Processus malicieux : 0 ¤¤¤

    ¤¤¤ Entrees de registre : 0 ¤¤¤

    ¤¤¤ Tâches planifiées : 0 ¤¤¤

    ¤¤¤ Entrées Startup : 0 ¤¤¤

    ¤¤¤ Navigateurs web : 0 ¤¤¤

    ¤¤¤ Addons navigateur : 0 ¤¤¤

    ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

    ¤¤¤ Driver : [CHARGE] ¤¤¤
    [Address] IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : atapi.sys -> HOOKED (sfsync03.sys @ 0xBA0F995C)
    [Address] IAT @explorer.exe (LoadLibraryExA) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3010)
    [Address] IAT @explorer.exe (LoadLibraryExW) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3018)
    [Address] IAT @explorer.exe (LoadLibraryA) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3000)
    [Address] IAT @explorer.exe (LoadLibraryW) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3008)
    [Address] IAT @explorer.exe (GetProcAddress) : KERNEL32.dll -> HOOKED (C:\Program Files\NetRatingsNetSight\NetSight\meter7\nphooks.dll @ 0x037B3020)

    ¤¤¤ Ruches Externes: ¤¤¤

    ¤¤¤ Infection : ¤¤¤

    ¤¤¤ Fichier HOSTS: ¤¤¤
    --> %SystemRoot%\System32\drivers\etc\hosts

    127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
    127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
    127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
    127.0.0.1 2010-fr.com # hosts anti-adware / pups
    127.0.0.1 2012-new.biz # hosts anti-adware / pups
    127.0.0.1 212link.com # hosts anti-adware / pups
    127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
    127.0.0.1 24h00business.com # hosts anti-adware / pups
    127.0.0.1 a.adorika.net # hosts anti-adware / pups
    127.0.0.1 a.ad-sys.com # hosts anti-adware / pups
    127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups
    127.0.0.1 ad.adn360.com # hosts anti-adware / pups
    127.0.0.1 adeartss.eu # hosts anti-adware / pups
    127.0.0.1 adesoeasy.eu # hosts anti-adware / pups
    127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups
    127.0.0.1 adm.soft365.com # hosts anti-adware / pups
    127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups
    127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups
    127.0.0.1 ads.adplxmd.com # hosts anti-adware / pups
    127.0.0.1 ads.aff.co # hosts anti-adware / pups
    [...]

    ¤¤¤ MBR Verif: ¤¤¤

    +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST3500320AS +++++
    --- User ---
    [MBR] c4f8dd33e1c089ad7283c0603ff441ee
    [BSP] 5deefcd2449ac2283f5f4aad37adf97a : Windows XP MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 39997 Mo
    1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 81915435 | Size: 436931 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    Termine : << RKreport[0]_D_02112014_121619.txt >>
    RKreport[0]_D_02102014_034547.txt;RKreport[0]_S_02092014_231834.txt;RKreport[0]_S_02112014_121457.txt

    Je fais TDSSKILLER et reviens vers toi.
    Merci.
    Djami92
    0
  16. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
     
    Bonjour,

    Attention : Désactiver tous tes logiciels de protection avant utilisation.

    ¶ Télécharge ComboFix (de sUBs) sur ton Bureau.
    ¶ Double-clique sur ComboFix.exe afin de le lancer.
    ¶ Si tu es sous Windows XP, il va te demander d'installer la console de récupération : tu dois absolument accepter.
    ¶ Ne touche à rien pendant le scan.
    ¶ Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

    Tutoriel officiel de Combofix : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
    0
    1. djami92
       
      Et voici le rapport (je ne trouve pas C:\Combofix.txt ; une page bloc note s'est mise sur mon bureau)

      ComboFix 14-02-16.01 - DJAM 18/02/2014 14:34:18.1.4 - x86
      Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.3327.1855 [GMT 1:00]
      Lancé depuis: c:\documents and settings\DJAM\Bureau\ComboFix.exe
      AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
      .
      .
      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      c:\documents and settings\DJAM\Local Settings\Application Data\assembly\tmp
      c:\documents and settings\LocalService\Local Settings\Application Data\assembly\tmp
      C:\Documents
      C:\END
      c:\windows\EventSystem.log
      c:\windows\system32\AegisI5Installer.exe
      c:\windows\wininit.ini
      D:\Autorun.inf
      .
      .
      ((((((((((((((((((((((((((((( Fichiers créés du 2014-01-18 au 2014-02-18 ))))))))))))))))))))))))))))))))))))
      .
      .
      2014-02-18 10:39 . 2014-02-06 07:08 7947048 -c--a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9E92F45D-0900-4DE1-9F69-DB4EAFA475D6}\mpengine.dll
      2014-02-17 06:31 . 2013-12-03 17:57 7760024 -c--a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
      2014-02-06 21:17 . 2014-02-06 21:48 -------- dc----w- c:\documents and settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
      2014-02-06 21:17 . 2014-02-06 21:17 107224 -c--a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
      2014-02-06 21:16 . 2014-02-06 21:16 52312 -c--a-w- c:\windows\system32\drivers\mbamchameleon.sys
      2014-02-05 23:17 . 2014-02-05 23:17 -------- dc----w- C:\_OTL
      2014-02-05 10:02 . 2014-02-05 10:03 -------- dc----w- c:\program files\Microsoft Security Client
      2014-02-04 03:22 . 2014-02-05 10:01 -------- dc----w- c:\documents and settings\DJAM\Application Data\ZHP
      2014-02-01 07:10 . 2014-02-01 07:10 -------- dc----w- c:\program files\Fichiers communs\Adobe
      2014-02-01 06:55 . 2014-02-01 06:55 -------- dc----w- c:\program files\Hosts_Anti_Adwares_PUPs
      .
      .
      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2014-02-05 23:20 . 2004-08-05 12:00 920064 -c--a-w- c:\windows\system32\wininet.dll
      2014-02-05 23:19 . 2004-08-05 12:00 43520 -c--a-w- c:\windows\system32\licmgr10.dll
      2014-02-05 23:19 . 2004-08-05 12:00 1469440 -c----w- c:\windows\system32\inetcpl.cpl
      2014-02-05 23:18 . 2004-08-05 12:00 18944 -c--a-w- c:\windows\system32\corpol.dll
      2014-02-05 22:25 . 2004-08-05 12:00 385024 -c--a-w- c:\windows\system32\html.iec
      2014-01-19 07:32 . 2012-07-12 09:45 231584 -c----w- c:\windows\system32\MpSigStub.exe
      2014-01-04 03:12 . 2004-08-05 12:00 420864 -c--a-w- c:\windows\system32\vbscript.dll
      2013-12-18 20:10 . 2014-01-16 22:20 94632 -c--a-w- c:\windows\system32\WindowsAccessBridge.dll
      2013-12-18 19:46 . 2014-01-16 22:20 145408 -c--a-w- c:\windows\system32\javacpl.cpl
      2013-12-18 09:09 . 2011-03-15 08:58 1112288 -c--a-w- c:\windows\system32\WdfCoInstaller01007.dll
      2013-12-05 11:26 . 2004-08-05 12:00 1172992 -c--a-w- c:\windows\system32\msxml3.dll
      2013-11-27 20:21 . 2004-08-05 12:00 40960 -c--a-w- c:\windows\system32\drivers\ndproxy.sys
      .
      .
      ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
      REGEDIT4
      .
      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-19 405583]
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "nwiz"="nwiz.exe" [2009-03-27 1657376]
      "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 86016]
      "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
      "Corel File Shell Monitor"="c:\program files\Corel\Corel MediaOne\CorelIOMonitor.exe" [2007-12-01 38400]
      "snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
      "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
      "NielsenOnline"="c:\program files\NetRatingsNetSight\NetSight\NielsenOnline.exe" [2013-10-09 75816]
      "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
      "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]
      "APSDaemon"="c:\program files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
      "TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2012-06-21 296056]
      "SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2013-07-02 254336]
      "Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
      "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 948440]
      .
      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
      .
      c:\documents and settings\DJAM\Menu Démarrer\Programmes\Démarrage\
      media center Bouygues Telecom.lnk - c:\program files\media center Bouygues Telecom\media center\external\MediaServerTray.exe [2012-7-30 638312]
      .
      c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\
      HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
      WiFi Station N.lnk - c:\program files\Hercules\WiFi Station N\WiFiN.exe -s [2009-9-26 25047040]
      Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe /startup [2008-5-26 123904]
      .
      [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
      "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
      @="Service"
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
      @="Driver"
      .
      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
      "EnableFirewall"= 0 (0x0)
      .
      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "c:\\Program Files\\media center Bouygues Telecom\\media center\\external\\MediaServerTray.exe"=
      "c:\\WINDOWS\\system32\\sessmgr.exe"=
      .
      R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [26/09/2009 21:07 150568]
      R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [06/12/2005 16:11 35328]
      R1 nnrnstdi;nnrnstdi;c:\windows\system32\drivers\nnrnstdi.sys [15/03/2011 10:09 15360]
      R2 BytelMediaServer;media center Bouygues Telecom;c:\program files\media center Bouygues Telecom\MediaServer.exe [30/09/2011 22:07 1437480]
      R2 NielsenUpdate;Nielsen Update;c:\program files\NetRatingsNetSight\NetSight\NielsenUpdate.exe [14/04/2011 09:45 2837032]
      R3 km_filter;km_filter;c:\windows\system32\drivers\km_filter.sys [15/03/2011 10:09 10368]
      R3 RT80x86;Hercules Wireless N LAN Driver;c:\windows\system32\drivers\rt2860.sys [26/09/2009 21:53 579456]
      S0 nielprt;Nielsen Patch Service;c:\windows\system32\DRIVERS\nielprt.sys --> c:\windows\system32\DRIVERS\nielprt.sys [?]
      S1 kieyfzqp;kieyfzqp;\??\c:\windows\system32\drivers\kieyfzqp.sys --> c:\windows\system32\drivers\kieyfzqp.sys [?]
      S2 gupdate1ca84c51d9d43f0;Service Google Update (gupdate1ca84c51d9d43f0);c:\program files\Google\Update\GoogleUpdate.exe [24/12/2009 19:15 133104]
      S2 HerculesWiFi;HerculesWiFi;c:\windows\system32\HerculesWiFiService.exe --> c:\windows\system32\HerculesWiFiService.exe [?]
      S3 esgiguard;esgiguard;\??\c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys --> c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [?]
      S3 massfilter;MBB Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [08/03/2011 15:37 9216]
      S3 NielGfx;Nielsen USB GFX;c:\windows\system32\drivers\nielgfx.sys --> c:\windows\system32\drivers\nielgfx.sys [?]
      S3 SkLaggProtocol;Marvell Link Aggregation Protocol;c:\windows\system32\drivers\yk51x32l.sys [14/12/2007 09:10 57344]
      S3 SkVlanProtocol;Marvell VLAN Protocol;c:\windows\system32\drivers\yk51x32v.sys [23/11/2007 09:10 20992]
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
      HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
      hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
      2014-02-04 22:18 1211720 -c--a-w- c:\program files\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe
      .
      Contenu du dossier 'Tâches planifiées'
      .
      2014-02-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
      - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 18:15]
      .
      2014-02-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
      - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 18:15]
      .
      2014-02-18 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1214440339-1993962763-725345543-1004.job
      - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 16:21]
      .
      2014-02-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1214440339-1993962763-725345543-1004.job
      - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 16:21]
      .
      .
      ------- Examen supplémentaire -------
      .
      uSearchMigratedDefaultURL = hxxp://www.google.com
      uStart Page = hxxp://www.google.com
      mStart Page = hxxp://www.google.com
      uSearchAssistant = hxxp://www.google.com
      uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
      Trusted Zone: expert-social.fr
      Trusted Zone: itool.com
      Trusted Zone: itool.net\asp
      TCP: DhcpNameServer = 192.168.1.254
      .
      - - - - ORPHELINS SUPPRIMES - - - -
      .
      HKLM-Run-fst_fr_76 - (no file)
      ShellExecuteHooks-{4F07DA45-8170-4859-9B5F-037EF2970034} - (no file)
      AddRemove-45bf90ea-b28f-4e57-a47d-c95d0176ea83 - c:\program files\SelectionTool\Uninstall.exe
      AddRemove-{20B30DC1-E423-4939-B51D-05C58B0F9BBB} - c:\program files\HP\Digital Imaging\{20B30DC1-E423-4939-B51D-05C58B0F9BBB}\setup\hpzscr01.exe
      .
      .
      .
      **************************************************************************
      .
      catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2014-02-18 14:37
      Windows 5.1.2600 Service Pack 3 NTFS
      .
      Recherche de processus cachés ...
      .
      Recherche d'éléments en démarrage automatique cachés ...
      .
      Recherche de fichiers cachés ...
      .
      Scan terminé avec succès
      Fichiers cachés: 0
      .
      **************************************************************************
      .
      --------------------- CLES DE REGISTRE BLOQUEES ---------------------
      .
      [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
      @Denied: (2) (LocalSystem)
      "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
      d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7e,6c,ad,38,23,01,4e,42,b6,13,f7,\
      "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
      d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7e,6c,ad,38,23,01,4e,42,b6,13,f7,\
      .
      [HKEY_USERS\S-1-5-21-1214440339-1993962763-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{29E2449C-97BF-E7EE-AA5D-A04B7493DC72}*]
      @Allowed: (Read) (RestrictedCode)
      @Allowed: (Read) (RestrictedCode)
      .
      Heure de fin: 2014-02-18 14:39:16
      ComboFix-quarantined-files.txt 2014-02-18 13:39
      .
      Avant-CF: 5 444 509 696 octets libres
      Après-CF: 5 434 638 336 octets libres
      .
      WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
      [boot loader]
      timeout=2
      default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
      [operating systems]
      c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
      UnsupportedDebug="do not select this" /debug
      multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
      .
      - - End Of File - - 7B8316E3B04AB955D71CAC07A3482183
      C99C3199CFAA4CBDCD91493F6D113A50

      Merci.
      Djami92
      0
  17. djami92
     
    Excuse moi j'ai été débordé.
    je le fais tout de suite.
    Merci.
    Djami
    0
  18. djami92
     
    bonjour Loumax 91,

    Je reposte le rapport Combofix :

    ComboFix 14-02-16.01 - DJAM 18/02/2014 14:34:18.1.4 - x86
    Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.3327.1855 [GMT 1:00]
    Lancé depuis: c:\documents and settings\DJAM\Bureau\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
    .
    .
    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\DJAM\Local Settings\Application Data\assembly\tmp
    c:\documents and settings\LocalService\Local Settings\Application Data\assembly\tmp
    C:\Documents
    C:\END
    c:\windows\EventSystem.log
    c:\windows\system32\AegisI5Installer.exe
    c:\windows\wininit.ini
    D:\Autorun.inf
    .
    .
    ((((((((((((((((((((((((((((( Fichiers créés du 2014-01-18 au 2014-02-18 ))))))))))))))))))))))))))))))))))))
    .
    .
    2014-02-18 10:39 . 2014-02-06 07:08 7947048 -c--a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9E92F45D-0900-4DE1-9F69-DB4EAFA475D6}\mpengine.dll
    2014-02-17 06:31 . 2013-12-03 17:57 7760024 -c--a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2014-02-06 21:17 . 2014-02-06 21:48 -------- dc----w- c:\documents and settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
    2014-02-06 21:17 . 2014-02-06 21:17 107224 -c--a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2014-02-06 21:16 . 2014-02-06 21:16 52312 -c--a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2014-02-05 23:17 . 2014-02-05 23:17 -------- dc----w- C:\_OTL
    2014-02-05 10:02 . 2014-02-05 10:03 -------- dc----w- c:\program files\Microsoft Security Client
    2014-02-04 03:22 . 2014-02-05 10:01 -------- dc----w- c:\documents and settings\DJAM\Application Data\ZHP
    2014-02-01 07:10 . 2014-02-01 07:10 -------- dc----w- c:\program files\Fichiers communs\Adobe
    2014-02-01 06:55 . 2014-02-01 06:55 -------- dc----w- c:\program files\Hosts_Anti_Adwares_PUPs
    .
    .
    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2014-02-05 23:20 . 2004-08-05 12:00 920064 -c--a-w- c:\windows\system32\wininet.dll
    2014-02-05 23:19 . 2004-08-05 12:00 43520 -c--a-w- c:\windows\system32\licmgr10.dll
    2014-02-05 23:19 . 2004-08-05 12:00 1469440 -c----w- c:\windows\system32\inetcpl.cpl
    2014-02-05 23:18 . 2004-08-05 12:00 18944 -c--a-w- c:\windows\system32\corpol.dll
    2014-02-05 22:25 . 2004-08-05 12:00 385024 -c--a-w- c:\windows\system32\html.iec
    2014-01-19 07:32 . 2012-07-12 09:45 231584 -c----w- c:\windows\system32\MpSigStub.exe
    2014-01-04 03:12 . 2004-08-05 12:00 420864 -c--a-w- c:\windows\system32\vbscript.dll
    2013-12-18 20:10 . 2014-01-16 22:20 94632 -c--a-w- c:\windows\system32\WindowsAccessBridge.dll
    2013-12-18 19:46 . 2014-01-16 22:20 145408 -c--a-w- c:\windows\system32\javacpl.cpl
    2013-12-18 09:09 . 2011-03-15 08:58 1112288 -c--a-w- c:\windows\system32\WdfCoInstaller01007.dll
    2013-12-05 11:26 . 2004-08-05 12:00 1172992 -c--a-w- c:\windows\system32\msxml3.dll
    2013-11-27 20:21 . 2004-08-05 12:00 40960 -c--a-w- c:\windows\system32\drivers\ndproxy.sys
    .
    .
    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-19 405583]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "nwiz"="nwiz.exe" [2009-03-27 1657376]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 86016]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
    "Corel File Shell Monitor"="c:\program files\Corel\Corel MediaOne\CorelIOMonitor.exe" [2007-12-01 38400]
    "snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
    "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
    "NielsenOnline"="c:\program files\NetRatingsNetSight\NetSight\NielsenOnline.exe" [2013-10-09 75816]
    "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]
    "APSDaemon"="c:\program files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
    "TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2012-06-21 296056]
    "SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2013-07-02 254336]
    "Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 948440]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    .
    c:\documents and settings\DJAM\Menu Démarrer\Programmes\Démarrage\
    media center Bouygues Telecom.lnk - c:\program files\media center Bouygues Telecom\media center\external\MediaServerTray.exe [2012-7-30 638312]
    .
    c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
    WiFi Station N.lnk - c:\program files\Hercules\WiFi Station N\WiFiN.exe -s [2009-9-26 25047040]
    Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe /startup [2008-5-26 123904]
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\Program Files\\media center Bouygues Telecom\\media center\\external\\MediaServerTray.exe"=
    "c:\\WINDOWS\\system32\\sessmgr.exe"=
    .
    R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [26/09/2009 21:07 150568]
    R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [06/12/2005 16:11 35328]
    R1 nnrnstdi;nnrnstdi;c:\windows\system32\drivers\nnrnstdi.sys [15/03/2011 10:09 15360]
    R2 BytelMediaServer;media center Bouygues Telecom;c:\program files\media center Bouygues Telecom\MediaServer.exe [30/09/2011 22:07 1437480]
    R2 NielsenUpdate;Nielsen Update;c:\program files\NetRatingsNetSight\NetSight\NielsenUpdate.exe [14/04/2011 09:45 2837032]
    R3 km_filter;km_filter;c:\windows\system32\drivers\km_filter.sys [15/03/2011 10:09 10368]
    R3 RT80x86;Hercules Wireless N LAN Driver;c:\windows\system32\drivers\rt2860.sys [26/09/2009 21:53 579456]
    S0 nielprt;Nielsen Patch Service;c:\windows\system32\DRIVERS\nielprt.sys --> c:\windows\system32\DRIVERS\nielprt.sys [?]
    S1 kieyfzqp;kieyfzqp;\??\c:\windows\system32\drivers\kieyfzqp.sys --> c:\windows\system32\drivers\kieyfzqp.sys [?]
    S2 gupdate1ca84c51d9d43f0;Service Google Update (gupdate1ca84c51d9d43f0);c:\program files\Google\Update\GoogleUpdate.exe [24/12/2009 19:15 133104]
    S2 HerculesWiFi;HerculesWiFi;c:\windows\system32\HerculesWiFiService.exe --> c:\windows\system32\HerculesWiFiService.exe [?]
    S3 esgiguard;esgiguard;\??\c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys --> c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [?]
    S3 massfilter;MBB Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [08/03/2011 15:37 9216]
    S3 NielGfx;Nielsen USB GFX;c:\windows\system32\drivers\nielgfx.sys --> c:\windows\system32\drivers\nielgfx.sys [?]
    S3 SkLaggProtocol;Marvell Link Aggregation Protocol;c:\windows\system32\drivers\yk51x32l.sys [14/12/2007 09:10 57344]
    S3 SkVlanProtocol;Marvell VLAN Protocol;c:\windows\system32\drivers\yk51x32v.sys [23/11/2007 09:10 20992]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2014-02-04 22:18 1211720 -c--a-w- c:\program files\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe
    .
    Contenu du dossier 'Tâches planifiées'
    .
    2014-02-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 18:15]
    .
    2014-02-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 18:15]
    .
    2014-02-18 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1214440339-1993962763-725345543-1004.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 16:21]
    .
    2014-02-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1214440339-1993962763-725345543-1004.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 16:21]
    .
    .
    ------- Examen supplémentaire -------
    .
    uSearchMigratedDefaultURL = hxxp://www.google.com
    uStart Page = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    uSearchAssistant = hxxp://www.google.com
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    Trusted Zone: expert-social.fr
    Trusted Zone: itool.com
    Trusted Zone: itool.net\asp
    TCP: DhcpNameServer = 192.168.1.254
    .
    - - - - ORPHELINS SUPPRIMES - - - -
    .
    HKLM-Run-fst_fr_76 - (no file)
    ShellExecuteHooks-{4F07DA45-8170-4859-9B5F-037EF2970034} - (no file)
    AddRemove-45bf90ea-b28f-4e57-a47d-c95d0176ea83 - c:\program files\SelectionTool\Uninstall.exe
    AddRemove-{20B30DC1-E423-4939-B51D-05C58B0F9BBB} - c:\program files\HP\Digital Imaging\{20B30DC1-E423-4939-B51D-05C58B0F9BBB}\setup\hpzscr01.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2014-02-18 14:37
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    Recherche de processus cachés ...
    .
    Recherche d'éléments en démarrage automatique cachés ...
    .
    Recherche de fichiers cachés ...
    .
    Scan terminé avec succès
    Fichiers cachés: 0
    .
    **************************************************************************
    .
    --------------------- CLES DE REGISTRE BLOQUEES ---------------------
    .
    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7e,6c,ad,38,23,01,4e,42,b6,13,f7,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7e,6c,ad,38,23,01,4e,42,b6,13,f7,\
    .
    [HKEY_USERS\S-1-5-21-1214440339-1993962763-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{29E2449C-97BF-E7EE-AA5D-A04B7493DC72}*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)
    .
    Heure de fin: 2014-02-18 14:39:16
    ComboFix-quarantined-files.txt 2014-02-18 13:39
    .
    Avant-CF: 5 444 509 696 octets libres
    Après-CF: 5 434 638 336 octets libres
    .
    WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
    .
    - - End Of File - - 7B8316E3B04AB955D71CAC07A3482183
    C99C3199CFAA4CBDCD91493F6D113A50
    0
  19. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
     
    Bonjour,

    Comment fonctionne le PC ?

    *Fais une analyse ZHPDiag comme expliqué ici, pense à héberger le rapport.
    0
  20. djami92
     
    Bsr Loumax91,

    Eh bien, le PC se porte bien. Est il encore infecté ?

    Ci-joint le lien pour visualiser le fichier zhpdiag :

    http://pjjoint.malekal.com/files.php?id=20140219_p11r15n13k8x5

    Merci.
    Djami92
    0
  21. loumax91 Messages postés 14 Date d'inscription   Statut Contributeur sécurité Dernière intervention   483
     
    Bonjour,

    ▶ Attention :

    /!\ Ce script est exclusivement réservé à l'utilisateur actuel du sujet, vous ne devez en aucun cas l'utiliser de votre propre chef sur un autre pc, sous risque d'endommager le système /!\


    ⇒ Ce script va cibler certains éléments à supprimer :

    ♦ Ferme toutes tes applications en cours
    ♦ Ouvre ce lien, sélectionne et copie toutes les lignes


    ♦ Lance ZHPFix via le raccourci sur ton Bureau, (Si tu es sous Vista ou Windows 7 ou Windows 8 n'oublie pas clic droit → en tant qu'administrateur")
    ♦ Si tu obtiens le message "Voulez-vous autoriser le programme suivant..."Tu réponds Oui"
    ♦ Clique sur le bouton "IMPORTER"
    ♦ Les lignes se collent automatiquement dans ZHPFix, sinon colle les lignes
    ♦ Clique sur le bouton « GO » pour le lancer le nettoyage
    ♦ A la demande, confirme le nettoyage des données en cliquant sur [OK]
    ♦ Patiente le temps du traitement.
    ♦ ZHPFix va te demander si tu souhaites vider ta corbeille, clique sur ton choix (le traitement peut être long suivant la quantité de données à supprimer)
    ♦ Un rapport nommé ZHPFixReport.txt sera créé et sauvegardé sur le bureau
    ♦ Fais redémarrer le PC
    ♦ Ce rapport se trouve aussi ici C:\ZHP\ZHPFix[R1].txt
    ♦ Copie/colle la totalité du rapport dans ta prochaine réponse
    ♦ Pour t'aider
    0
  • 1
  • 2

Discussions similaires

Adwcleaner Mac
Weel -
Michel -

21 réponses
Adwcleaner android
Tom -
bazfile -

5 réponses
ADW Cleaner, un substitut gratuit pour Mac ?
Fanny0604 -
bazfile -

1 réponse
adwcleaner pour mac
gepe5 -
princewill -

2 réponses
AdwCleaner pour android
christophe tremelo -
Manquant -

8 réponses