Alureon-CY
Résolu
Bonjour,
Mon PC est infecté parAlureon-CY et manifestement, je en vais pas arriver à m'en débarrasser tout seul (il infeste Avast, empêche la mise à jour d'Avira, m'oblige à démarrer en mode sans échec sur base de la dernière configuration connue, etc.).
Toute aide sera très appréciée.
Comme j'ai vu qu'on commençait généralement par demander le résultat de HijackThis, voilà :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:52:51, on 18/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\nvraidservice.exe
C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Belgium Identity Card\beid35gui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot SD\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Benoit\Desktop\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O4 - HKLM\..\Run: [Apanel] C:\ACERSW\config\SetApanel.cmd
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [NVRaidService] C:\Windows\system32\nvraidservice.exe
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [NeroCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\Windows\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [beid] "C:\Program Files\Belgium Identity Card\beid35gui.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot SD\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ASETRES.EXE
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Service Google Update (gupdate1c9a5714e0d1af8) (gupdate1c9a5714e0d1af8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\Windows\system32\drivers\pclepci.sys
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot SD\SDWinSec.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
--
End of file - 10927 bytes
Mon PC est infecté parAlureon-CY et manifestement, je en vais pas arriver à m'en débarrasser tout seul (il infeste Avast, empêche la mise à jour d'Avira, m'oblige à démarrer en mode sans échec sur base de la dernière configuration connue, etc.).
Toute aide sera très appréciée.
Comme j'ai vu qu'on commençait généralement par demander le résultat de HijackThis, voilà :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:52:51, on 18/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\nvraidservice.exe
C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Belgium Identity Card\beid35gui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot SD\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Benoit\Desktop\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O4 - HKLM\..\Run: [Apanel] C:\ACERSW\config\SetApanel.cmd
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [NVRaidService] C:\Windows\system32\nvraidservice.exe
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [NeroCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\Windows\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [beid] "C:\Program Files\Belgium Identity Card\beid35gui.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot SD\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ASETRES.EXE
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Service Google Update (gupdate1c9a5714e0d1af8) (gupdate1c9a5714e0d1af8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\Windows\system32\drivers\pclepci.sys
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot SD\SDWinSec.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
--
End of file - 10927 bytes
Configuration: Windows Vista Firefox 3.0.6
43 réponses
Résumé de la discussion
Infection par Alureon-CY et contraintes associées, comme l'impossibilité de mettre à jour Avast et le démarrage en mode sans échec, motivent la demande d'aide et l'examen d'un log HijackThis. Le sujet inclut le besoin de comprendre le contenu du log et les mesures initiales possibles, notamment l'identification des éléments suspectés comme responsables de la persistance de l'infection. Des conseils typiques évoqués dans ce contexte visent à désactiver les éléments de démarrage suspects, réaliser des analyses et effectuer des nettoyages croisés entre Avast et BitDefender. D'autres éléments de la discussion soulignent l'importance de confirmer l'infection par des outils spécialisés et de considérer une réinstallation propre en dernier recours lorsque les solutions logicielles ne suffisent pas.
-
Contributeur===> Telecharge AVZ http://z-oleg.com/avz4.zip
- extrait sur ton bureau
- ouvre le dossier AVZ4
- double clique sur avz.exe
- clique sur file (en haut à gauche)
- dans la liste choisie Custom scripts
- dans le carré qui apparait colle ce qui est en gras dessous
- puis clique sur Run
- valide le message, ton PC va redémarrer
- une fois redémarrer ouvre le dossier AVZ4
- poste le contenu de AvzBootCleaner.log
var
service, driverfile, AvzDir : string;
begin
AvzDir:=GetAVZDirectory;
service:=('gasfkyjipxbmhq');
driverfile:=('gasfkyircnrcqe.sys');
ShowMessage('Le PC va redémarrer.');
SearchRootKit(true,true);
SetAVZGuardStatus(true);
BC_QrFile('%System32%\Drivers\'+driverfile);
BC_DeleteSvc(service);
BC_LogFile(AvzDir + 'AvzBootCleaner.log');
BC_Activate;
RebootWindows(true);
end. -
-
Et il ne semble plus rien trouver.
-
Contributeur* Pour terminer, utilise ToolsCleaner! (de A.Rothstein et Dj Quiou) http://pc-system.fr/ pour nettoyer les utilitaires téléchargés,
* Désactive la restauration système, redémarre l'ordinateur, puis réactive-la, en procédant comme indiqué ici http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20020830101856924
* Lance le nettoyage avec CCleaner et fais ce scan en ligne : https://forum.pcastuces.com/sujet.asp?f=25&s=31584&page=1
* Visite régulièrement le site http://www.update.microsoft.com/windowsupdate/v6/default.aspx afin d'avoir un système toujours actualisé.
* Utilise hebdomadairement ce petit programme http://alt-shift-return.org/Info/Update_Checker.html pour effectuer tes mises à jour logicielles.
* N'installe jamais un programme sans avoir entièrement lu et compris les termes de son contrat d'utilisation, ou sans être définitivement certain qu'il n'installe pas discrètement un logiciel publicitaire (renseigne-toi sur Google ou sur les forums)
* Préfère l'utilisation de logiciels libres https://fr.wikipedia.org/wiki/Logiciel_libre : ils sont transparents et plus sécurisés, à l'inverse des logiciels propriétaires https://fr.wikipedia.org/wiki/Logiciel_propri%C3%A9taire ; Firefox, Thunderbird, OpenOffice, VLC... en font partie.
* A ce moment là, tu pourras marquer ton sujet "résolu" si tu estimes que c'est le cas
* Note importante : il est fortement conseillé d'utiliser un compte limité pour une utilisation classique d'un ordinateur afin de minimiser très siginificativement les risques d'infection.
Mode d'emploi : https://www.microsoft.com/de-ch
à+
-
Contributeurtu as encore des soucis?
-
Contributeurdes soucis?
-
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
esets_scanner_update returned -1 esets_gle=53251
# version=6
# IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6050
# api_version=3.0.2
# EOSSerial=1031714fc7855440ab5c55035a0a52bc
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2009-09-18 10:39:24
# local_time=2009-09-19 12:39:24 (+0100, Paris, Madrid (heure d'été))
# country="Belgium"
# lang=1036
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=769 61 100 100 53743235884
# compatibility_mode=1797 62 50 100 44570638914797
# compatibility_mode=5889 61 66 100 524313515602509
# scanned=73591
# found=0
# cleaned=0
# scan_time=1821 -
Contributeurfait le en mode sans echec avec prise en charge reseau
-
Je vais devoir le faire tout à l'heure, je dois partir au boulot (retour vers 21h).
-
Contributeursupprime avz, sysprot aussi
# Etape 1/ Télécharge :
ToolsCleaner! http://pc-system.fr/ (A.Rothstein & Dj QUIOU) sur ton Bureau.
# Etape 2/
- Double-clique sur ToolsCleaner2.exe pour le lancer.
- Clique sur Recherche et laisse le scan agir.
- Clique sur Suppression pour finaliser.
- Tu peux, si tu le souhaites, te servir des Options Facultatives.
- Clique sur Quitter pour obtenir le rapport C:\TCleaner.txt
# Etape 3/
Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
- coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
C:\Program Files\EsetOnlineScanner\log.txt
-
[ Rapport ToolsCleaner version 2.3.10 (par A.Rothstein & dj QUIOU) ]
--> Recherche:
C:\Combofix.txt: trouvé !
C:\TB.txt: trouvé !
C:\Rustbfix: trouvé !
C:\GenProc: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\GenProc\Genproc.exe: trouvé !
C:\GenProc\Page\GenProc[*].html: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\FindyKill: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FindyKill: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\Rustbfix\avenger.exe: trouvé !
C:\Rustbfix\pelog.txt: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\FindyKill: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\FindyKill: trouvé !
C:\Users\Benoit\AppData\Local\VirtualStore\Program Files\FindyKill: trouvé !
C:\Users\Benoit\Desktop\rustbfix.exe: trouvé !
C:\Users\Benoit\Desktop\Gmer.zip: trouvé !
C:\Users\Benoit\Desktop\ComboFix.exe: trouvé !
C:\Users\Benoit\Desktop\HijackThis.exe: trouvé !
C:\Users\Benoit\Desktop\ToolBarSD.exe: trouvé !
C:\Users\Benoit\Desktop\hijackthis.log: trouvé !
C:\Users\Benoit\Desktop\Rsit.exe: trouvé !
C:\Users\Benoit\Desktop\Bagle\ComboFix.exe: trouvé !
C:\Users\Benoit\Documents\DOCUMENTS XP\Docs\HJTInstall.exe: trouvé !
---------------------------------
--> Suppression:
C:\Rustbfix\avenger.exe: supprimé !
C:\Users\Benoit\Desktop\rustbfix.exe: supprimé !
C:\Users\Benoit\Desktop\Gmer.zip: supprimé !
C:\Users\Benoit\Desktop\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Users\Benoit\Desktop\HijackThis.exe: supprimé !
C:\Users\Benoit\Desktop\ToolBarSD.exe: supprimé !
C:\Users\Benoit\Desktop\Bagle\ComboFix.exe: supprimé !
C:\Users\Benoit\Documents\DOCUMENTS XP\Docs\HJTInstall.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\TB.txt: supprimé !
C:\GenProc\Genproc.exe: supprimé !
C:\GenProc\Page\GenProc[*].html: ERREUR DE SUPPRESSION !!
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\Rustbfix\pelog.txt: supprimé !
C:\Users\Benoit\Desktop\hijackthis.log: supprimé !
C:\Users\Benoit\Desktop\Rsit.exe: supprimé !
C:\Rustbfix: supprimé !
C:\GenProc: supprimé !
C:\Qoobox: supprimé !
C:\Toolbar SD: supprimé !
C:\Rsit: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\FindyKill: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FindyKill: supprimé !
C:\Users\Benoit\AppData\Local\VirtualStore\Program Files\FindyKill: supprimé ! -
-
-
Contributeurfait donc "exécuter en tant qu'administrateur" sur le raccourci
poste le rapport-
Rapport GenProc 2.627 [5] - ven. 18/09/2009 à 15:38:34
@ Windows Vista Service Pack 1 - Mode normal
@ Internet Explorer (8.0.6001.18813) [Navigateur par défaut]
# Etape 1/ Télécharge :
- rustbfix http://uploads.ejvindh.andymanchesta.com/RustbFix.exe ( (ejvindh) et sauvegarde-le sur ton Bureau.
- Double clique sur rustbfix.exe afin de lancer l'outil.
- Si une infection Rustock.b est détectée, une invite t'indiquera qu'il est nécessaire de redémarrer l'ordi.
- Ce redémarrage pourrait être plus long que d'habitude, et il est possible que deux redémarrages soient requis. Tout cela se fera automatiquement.
- Suite au(x) redémarrage(s), deux rapports s'ouvriront : (C:\avenger.txt & C:\rustbfix\pelog.txt).
- Poste le contenu de ces deux rapports, ainsi qu'un rapport HijackThis
~~ Arguments de la procédure ~~
# Détections [1] GenProc 2.627 ven. 18/09/2009 à 10:46:00
TDSS:le ven. 18/09/2009 à 10:46:17 PFROP gasfky*
# Détections [2] GenProc 2.627 ven. 18/09/2009 à 15:18:33
Rustock: le ven. 18/09/2009 à 15:18:59 "pe386" present
# Détections [3] GenProc 2.627 ven. 18/09/2009 à 15:24:48
Rustock: le ven. 18/09/2009 à 15:25:13 "pe386" present
# Détections [4] GenProc 2.627 ven. 18/09/2009 à 15:30:19
Rustock: le ven. 18/09/2009 à 15:30:44 "pe386" present
# Détections [5] GenProc 2.627 ven. 18/09/2009 à 15:38:36
Rustock: le ven. 18/09/2009 à 15:39:01 "pe386" present
----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------
~~ Fin à 15:39:01 ~~
-
-
Contributeurtu dit Par raccourci mais pas en admin.
sur tu autorise tes en admin -
Contributeurtu double clique dessus et?
tu as un message autoriser ou bloquer?
t'as fait comment explique stp -
Contributeurtu as lancé genproc comment?
-
Pelog, pas d'avenger.
************************* Rustock.b-fix v. 1.01 -- By ejvindh *************************
ven. 18/09/2009 15:20:20,54
No Rustock.b-rootkits found
******************************* End of Logfile ******************************** -
Rapport GenProc 2.627 [2] - ven. 18/09/2009 à 15:18:31
@ Windows Vista Service Pack 1 - Mode normal
@ Internet Explorer (8.0.6001.18813) [Navigateur par défaut]
~~ "C:\Windows\sed.exe" a été renommé sed.exe_RenameGenProc ~~
~~ "C:\Windows\grep.exe" a été renommé grep.exe_RenameGenProc ~~
# Etape 1/ Télécharge :
- rustbfix http://uploads.ejvindh.andymanchesta.com/RustbFix.exe ( (ejvindh) et sauvegarde-le sur ton Bureau.
- Double clique sur rustbfix.exe afin de lancer l'outil.
- Si une infection Rustock.b est détectée, une invite t'indiquera qu'il est nécessaire de redémarrer l'ordi.
- Ce redémarrage pourrait être plus long que d'habitude, et il est possible que deux redémarrages soient requis. Tout cela se fera automatiquement.
- Suite au(x) redémarrage(s), deux rapports s'ouvriront : (C:\avenger.txt & C:\rustbfix\pelog.txt).
- Poste le contenu de ces deux rapports, ainsi qu'un rapport HijackThis
~~ Arguments de la procédure ~~
# Détections [1] GenProc 2.627 ven. 18/09/2009 à 10:46:00
TDSS:le ven. 18/09/2009 à 10:46:17 PFROP gasfky*
# Détections [2] GenProc 2.627 ven. 18/09/2009 à 15:18:33
Rustock: le ven. 18/09/2009 à 15:18:59 "pe386" present
----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------
~~ Fin à 15:18:59 ~~ -
Contributeurrelance genproc a l'aide du raccourci sur ton bureau
poste le rapport. -
Contributeurniquel
supprime ton combofix
télécharge le, lance le-
ComboFix 09-09-17.04 - Benoit 18/09/2009 14:54.1.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.32.1036.18.3070.1725 [GMT 2:00]
Lancé depuis: c:\users\Benoit\Desktop\ComboFix.exe
SP: Lavasoft Ad-Watch Live! *enabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: SUPERAntiSpyware *enabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
[i] ADS - Windows: deleted 48 bytes in 1 streams. /i
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\InfoSat.txt
C:\Muestras
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ASETRES.EXE
c:\users\Benoit\AppData\Roaming\inst.exe
c:\windows\system32\drivers\gasfkytqxtfrxs.sys
c:\windows\system32\gasfkybjvpywcu.dll
c:\windows\system32\gasfkycbqkbtpd.dll
c:\windows\system32\gasfkyfitnxpji.dat
c:\windows\system32\gasfkyfqyexaos.dll
c:\windows\system32\gasfkyfsipwxsm.dll
c:\windows\system32\gasfkymytwqxeu.dll
c:\windows\system32\gasfkyoxmiufps.dll
c:\windows\system32\gasfkypxesqinj.dll
c:\windows\system32\gasfkyqdaxpfeq.dll
c:\windows\system32\gasfkyqupfetrt.dat
c:\windows\system32\gasfkysfqxiiri.dll
c:\windows\system32\gasfkyuiiqsvwu.dll
c:\windows\system32\gasfkyviktssjn.dll
c:\windows\system32\gasfkyyncfwbce.dll
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SK9OU0S
-------\Legacy_SROSA
-------\Service_gasfkyjipxbmhq
((((((((((((((((((((((((((((( Fichiers créés du 2009-08-18 au 2009-09-18 ))))))))))))))))))))))))))))))))))))
.
2009-09-18 13:05 . 2009-09-18 13:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-09-18 10:46 . 2009-09-18 10:48 -------- d-----w- C:\tib
2009-09-18 09:02 . 2009-09-18 09:02 -------- d-----w- C:\%APPDATA%
2009-09-18 08:54 . 2009-09-18 08:54 -------- d-----w- c:\program files\CCleaner
2009-09-18 08:45 . 2009-09-18 08:45 -------- d-----w- C:\GenProc
2009-09-18 08:33 . 2009-09-18 08:33 -------- d-----w- C:\rsit
2009-09-18 08:28 . 2009-09-18 08:30 -------- d-----w- C:\ToolBar SD
2009-09-18 07:26 . 2009-07-28 14:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-09-18 07:26 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-09-18 07:26 . 2009-09-18 07:26 -------- d-----w- c:\programdata\Avira
2009-09-17 21:54 . 2009-09-17 21:54 -------- d-----w- c:\program files\Avira
2009-09-17 12:25 . 2009-09-17 12:25 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2009-09-17 12:25 . 2009-09-18 07:08 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-09-17 12:25 . 2009-09-17 12:25 -------- d-----w- c:\users\Benoit\AppData\Roaming\SUPERAntiSpyware.com
2009-09-17 11:31 . 2009-09-17 11:31 -------- d-----w- c:\users\Benoit\AppData\Roaming\Babylon
2009-09-17 11:31 . 2009-09-17 11:31 -------- d-----w- c:\programdata\Babylon
2009-09-09 12:17 . 2009-09-09 12:17 -------- d-----w- c:\users\Benoit\AppData\Roaming\gtk-2.0
2009-09-09 12:17 . 2009-09-09 12:17 -------- d-----w- c:\users\Benoit\.thumbnails
2009-09-09 08:21 . 2009-09-09 12:19 -------- d-----w- c:\users\Benoit\.gimp-2.6
2009-09-09 08:21 . 2009-09-09 08:21 -------- d-----w- c:\program files\GIMP
2009-09-02 22:31 . 2009-08-28 12:39 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-09-02 22:31 . 2009-08-28 10:15 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 20:25 . 2009-01-22 12:28 290816 ----a-w- c:\windows\system32\decdll.dll
2009-08-29 20:25 . 2009-08-29 20:25 -------- d-----w- c:\program files\Free Video Converter
2009-08-26 08:04 . 2009-06-22 10:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-08-22 09:58 . 2009-08-22 09:58 -------- d-----w- c:\program files\AVI Trimmer
2009-08-22 09:58 . 2009-08-22 09:58 -------- d-----w- c:\program files\Common Files\Solveig Multimedia
2009-08-20 12:51 . 2009-08-20 12:51 -------- d-----w- c:\program files\QuickTime
2009-08-20 12:51 . 2009-08-20 12:51 -------- d-----w- c:\programdata\Apple Computer
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-18 13:07 . 2009-05-31 15:22 48318 ----a-w- c:\programdata\nvModes.dat
2009-09-18 12:49 . 2009-02-16 01:20 -------- d-----w- c:\users\Benoit\AppData\Roaming\MailWasherPro
2009-09-18 09:21 . 2009-03-28 13:03 -------- d-----w- c:\program files\Common Files\Softwin
2009-09-18 09:20 . 2009-03-28 13:09 81984 ----a-w- c:\windows\system32\bdod.bin
2009-09-17 21:39 . 2009-03-15 13:22 -------- d-----w- c:\programdata\Google Updater
2009-09-17 12:25 . 2009-05-31 15:18 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-14 18:50 . 2008-01-21 08:40 669328 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-14 18:50 . 2008-01-21 08:40 123350 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-10 04:53 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-08-30 18:25 . 2009-02-16 11:01 -------- d-----w- c:\program files\Java
2009-08-23 09:47 . 2009-03-26 15:30 -------- d-----w- c:\program files\Spybot SD
2009-08-20 14:11 . 2008-03-21 11:10 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-19 21:57 . 2009-03-15 13:22 -------- d-----w- c:\program files\Google
2009-08-19 21:57 . 2009-07-18 19:05 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2009-08-17 16:10 . 2009-03-28 09:04 1279456 ----a-w- c:\windows\system32\aswBoot.exe
2009-08-17 16:05 . 2009-03-28 09:04 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-08-17 16:05 . 2009-03-28 09:04 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-08-17 16:05 . 2009-03-28 09:04 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-08-17 16:04 . 2009-03-28 09:04 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-08-17 16:04 . 2009-03-28 09:04 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-08-17 16:02 . 2009-03-28 09:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-08-14 17:07 . 2009-09-09 05:37 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-09-09 05:37 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-09-09 05:37 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-09-09 05:37 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-09 05:37 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-09 05:37 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-09 05:37 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-09 05:37 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-09 05:37 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-09 05:37 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-03 10:59 . 2009-06-22 10:58 25440 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\savapibridge.dll
2009-08-03 10:59 . 2009-06-22 10:58 1630560 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Resources.dll
2009-08-03 10:59 . 2009-06-22 10:58 2353480 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-07-26 02:27 . 2009-02-12 15:12 73840 ----a-w- c:\users\Benoit\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-26 02:25 . 2009-03-26 08:54 -------- d-----w- c:\program files\Pinnacle
2009-07-25 11:17 . 2009-03-30 10:29 -------- d-----w- c:\users\Benoit\AppData\Roaming\proDAD
2009-07-25 11:14 . 2009-07-25 11:14 -------- d-----w- c:\users\Benoit\AppData\Roaming\InstallShield
2009-07-25 11:11 . 2009-02-27 11:14 -------- d-----w- c:\program files\AVS4YOU
2009-07-25 03:23 . 2009-02-17 07:05 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-23 16:06 . 2009-07-23 16:06 -------- d--h--w- c:\program files\Common Files\InternalLib
2009-07-21 21:52 . 2009-07-29 17:27 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 17:27 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 17:27 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 17:27 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-18 19:17 . 2009-02-17 20:28 1356 ----a-w- c:\users\Benoit\AppData\Local\d3d9caps.dat
2009-07-17 14:35 . 2009-08-12 04:04 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-14 13:00 . 2009-08-12 04:04 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-14 12:59 . 2009-08-12 04:04 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-07-14 12:58 . 2009-08-12 04:04 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-07-14 10:59 . 2009-08-12 04:04 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-07-12 06:58 . 2009-07-12 06:58 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-07-12 06:58 . 2009-07-12 06:58 47360 ----a-w- c:\users\Benoit\AppData\Roaming\pcouffin.sys
2009-07-11 19:32 . 2009-09-09 05:37 513024 ----a-w- c:\windows\system32\wlansvc.dll
2009-07-11 19:32 . 2009-09-09 05:37 302592 ----a-w- c:\windows\system32\wlansec.dll
2009-07-11 19:32 . 2009-09-09 05:37 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2009-07-11 19:29 . 2009-09-09 05:37 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2009-07-06 11:03 . 2009-06-01 10:59 84832 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-07-06 07:36 . 2009-07-06 07:36 35712 ----a-w- c:\windows\system32\drivers\a38usb.sys
2009-07-06 07:36 . 2009-07-06 07:36 110592 ----a-w- c:\windows\system32\usbr38.dll
2009-06-29 11:06 . 2009-06-22 10:58 314712 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\threatwork.exe
2009-06-29 11:06 . 2009-06-22 10:58 169312 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\lavamessage.dll
2009-06-29 11:06 . 2009-06-22 10:58 348496 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\lavalicense.dll
2009-06-29 11:05 . 2009-06-22 10:58 298336 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2009-06-29 11:02 . 2009-06-01 10:58 246128 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-06-29 11:02 . 2009-06-01 10:58 40288 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-06-29 11:02 . 2009-06-22 10:58 85352 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Drivers\32\AAWDriverTool.exe
2009-06-29 11:02 . 2009-06-22 10:58 664424 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-06-29 11:01 . 2009-06-22 10:58 563064 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-06-29 11:01 . 2009-06-22 10:58 566632 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-06-29 11:00 . 2009-06-22 10:58 629072 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AAWWSC.exe
2009-06-29 11:00 . 2009-06-22 10:58 520024 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-06-29 11:00 . 2009-06-22 10:58 1029456 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AAWService.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-03-04 22:38 121392 ----a-w- c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"Gadwin PrintScreen"="c:\program files\Gadwin Systems\PrintScreen\PrintScreen.exe" [2008-12-09 495616]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-09-18 1998576]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"PCMMediaSharing"="c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe" [2008-01-25 204908]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2008-06-06 203296]
"diagnostics"="c:\program files\Thomson\ST330\diagnostics\diagnostics.exe" [2009-02-15 557149]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2005-09-25 155648]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2005-09-25 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-29 520024]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 57344]
"USB2Check"="c:\windows\system32\PCLECoInst.dll" [2006-11-06 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-30 13781536]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-19 198160]
"beid"="c:\program files\Belgium Identity Card\beid35gui.exe" [2009-06-04 2056192]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-03-26 5369856]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-2-22 113664]
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2008-3-21 535336]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3488268135-2175185307-3815600139-1000]
"EnableNotificationsRef"=dword:00000004
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{0590D135-20CF-4616-83A2-B4D64D7A7ADC}"= c:\program files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live
"{40F60C6C-DD8E-40B8-AB34-5061C567E010}"= c:\program files\Acer Arcade Live\Acer DVDivine\Acer DVDivine.exe:Acer DVDivine
"{EC714915-D3A6-43D3-B785-23155F4ED9A6}"= c:\program files\Acer Arcade Live\Acer HomeMedia\Acer HomeMedia.exe:Acer HomeMedia
"{8FB6D042-3CF4-407D-A2E9-A1CE05C41456}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Acer HomeMedia Connect.exe:Acer HomeMedia Connect
"{542BA28B-703D-48DB-B83F-94E757E578BF}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:Acer HomeMedia Connect Service
"{B34DAF09-668F-41FD-94EB-A7A892360F5C}"= c:\program files\Acer Arcade Live\Acer SlideShow DVD\Acer SlideShow DVD.exe:Acer SlideShow DVD
"{A924C65E-76C0-4E34-9E09-9FC3F7E6691A}"= c:\program files\Acer Arcade Live\Acer VideoMagician\Acer VideoMagician.exe:Acer VideoMagician
"{F051E17E-51EF-4830-B367-F6DA497077E5}"= c:\program files\Acer Arcade Live\Acer HomeMedia Trial Creator\Acer HomeMedia Trial Creator.exe:Acer HomeMedia Trial Creator
"{F158742F-48F9-4833-8369-7CBA8CC22457}"= c:\program files\Acer Arcade Live\Acer DV Magician\Acer DV Magician.exe:Acer DV Magician
"{8395E389-1529-4E85-9B07-6EAB09AB92C0}"= UDP:c:\users\Benoit\AppData\Local\Temp\Installer.exe:SpeedTouch Home Install Wizard
"{1FB351B9-0D2A-4734-90A9-1E1D13DF16DA}"= TCP:c:\users\Benoit\AppData\Local\Temp\Installer.exe:SpeedTouch Home Install Wizard
"{1AF2D2CF-E89E-44DC-A97F-781F672709E2}"= UDP:h:\sthiwv\stInstall.exe:SpeedTouch Home Install Wizard
"{91176656-8D2C-4EFF-86A6-DB49643C9CF7}"= TCP:h:\sthiwv\stInstall.exe:SpeedTouch Home Install Wizard
"{07192DEC-439A-4DBA-BF9D-A5DDEFF13AA8}"= UDP:c:\program files\Thomson\ST330\service\st330service.exe:ST330 service
"{E2A5857D-5864-4483-A1F8-64EA89340D16}"= TCP:c:\program files\Thomson\ST330\service\st330service.exe:ST330 service
"TCP Query User{F9A795DF-DD1C-48B0-B5A2-2F5F8260EA38}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{A5F1BDF1-5B6B-42D6-9216-2ED9BD7EB0A5}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{CA75E8AB-DCF7-4D8B-9245-589CA698155C}c:\\program files\\tale of tales\\the endless forest 3\\forestviewer.exe"= UDP:c:\program files\tale of tales\the endless forest 3\forestviewer.exe:ForestViewer
"UDP Query User{7A403F75-2C01-442A-9990-204F6D820EBB}c:\\program files\\tale of tales\\the endless forest 3\\forestviewer.exe"= TCP:c:\program files\tale of tales\the endless forest 3\forestviewer.exe:ForestViewer
"TCP Query User{3D01DB23-E439-45FE-A216-F277D1201F10}c:\\program files\\vuze\\azureus.exe"= UDP:c:\program files\vuze\azureus.exe:Azureus
"UDP Query User{4E8C5A7B-8276-4344-A9A8-2AACCD6DFE3C}c:\\program files\\vuze\\azureus.exe"= TCP:c:\program files\vuze\azureus.exe:Azureus
"{1A71C1C2-130E-4709-B4EE-EE496D9B5463}"= UDP:c:\program files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{DE7C7766-0F1A-4066-B735-3777E912B093}"= TCP:c:\program files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{14E749F5-A3DC-4561-812E-A089DF90DD5F}"= UDP:c:\program files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{64218170-CBA2-4A96-B9A0-BB9AEB2C380C}"= TCP:c:\program files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{2CF9EF73-AB43-4C5E-B899-DAC8EF316212}"= UDP:c:\program files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{18F41CBC-F492-490C-AF1D-70AC41400DE4}"= TCP:c:\program files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{BB058F28-86D9-4798-8F48-463F6E3A6D1E}"= UDP:c:\program files\Pinnacle\Studio 11\programs\umi.exe:umi
"{A49686F7-D5AF-4534-B443-234E9DE9910B}"= TCP:c:\program files\Pinnacle\Studio 11\programs\umi.exe:umi
R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [27/04/2009 12:58 64160]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [28/03/2009 11:04 114768]
R1 ISODisk;ISODisk;c:\windows\System32\drivers\ISODisk.sys [27/02/2009 12:29 9600]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [4/09/2009 14:50 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/09/2009 14:49 74480]
R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [21/03/2008 13:34 269448]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [28/03/2009 11:04 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [28/03/2009 11:04 53328]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 1029456]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot SD\SDWinSec.exe [26/03/2009 17:30 1153368]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [13/02/2009 1:51 42528]
S2 gupdate1c9a5714e0d1af8;Service Google Update (gupdate1c9a5714e0d1af8);c:\program files\Google\Update\GoogleUpdate.exe [15/03/2009 15:24 133104]
S3 ACSSCR;ACR38 Smart Card Reader;c:\windows\System32\drivers\a38usb.sys [6/07/2009 9:36 35712]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [6/11/2007 22:22 34064]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [4/09/2009 14:50 7408]
S3 ST330;ST330;c:\windows\System32\drivers\st330.sys [14/02/2009 14:29 30464]
S3 STBUS;STBUS;c:\windows\System32\drivers\stbus.sys [14/02/2009 14:29 12672]
S3 stppp;Speedtouch PPP Adapter Adapter;c:\windows\System32\drivers\stppp.sys [14/02/2009 14:29 35328]
S3 V0010bVd;Creative WebCam Vista #2;c:\windows\System32\drivers\V0010bVd.sys [15/02/2009 17:01 186551]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'
2009-09-14 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 11:01]
2009-09-18 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-15 07:47]
2009-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-15 13:23]
2009-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-15 13:23]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://fr.fr.acer.yahoo.com
mWindow Title =
FF - ProfilePath - c:\users\Benoit\AppData\Roaming\Mozilla\Firefox\Profiles\vwx85phz.default\
FF - prefs.js: browser.startup.homepage - file:///D:/WEBSITES/internal/internal2009.html
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKLM-Run-Acer Empowering Technology Monitor - c:\acer\Empowering Technology\SysMonitor.exe
HKLM-Run-eDataSecurity Loader - c:\acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
HKLM-Run-Apanel - c:\acersw\config\SetApanel.cmd
HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
HKLM-Run-eRecoveryService - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-18 15:07
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet013\Services\st330service]
"ImagePath"="C:\Program Files/Thomson/ST330/service/st330service.exe -service"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,bb,52,7c,0f,09,
93,26,61,c8,28,51,af,b0,29,a3,98,3a,75,08,70,5b,20,5c,f6,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,84,b5,31,6e,51,
5c,52,e0,71,3b,04,66,8b,46,0d,96,43,ff,d2,29,3c,3b,b1,b4,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,27,52,a8,17,14,
6a,ef,1f,25,da,ec,7e,55,20,c9,26,9b,27,11,9c,53,a4,18,cd,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,a0,7b,90,bc,d4,
6d,f5,10,3e,1e,9e,e0,57,5a,93,61,b5,b5,70,35,ff,d9,02,bd,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,ca,d8,7b,f0,6c,
d1,3d,20,cd,44,cd,b9,a6,33,6c,cd,b2,62,11,5a,c7,a1,f1,13,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,8d,7b,fa,d4,6a,
88,fa,4e,b0,18,ed,a7,3f,8d,37,a4,11,9d,a9,54,c6,e0,3b,3d,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,38,9f,f7,78,f8,
87,9e,e6,31,77,e1,ba,b1,f8,68,02,43,d6,6c,78,e3,b7,96,fd,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,30,51,92,2b,be,
e0,46,f8,83,6c,56,8b,a0,85,96,ab,2f,9c,28,cc,34,b0,f5,88,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,10,ae,54,22,1b,
4e,3b,e8,51,fa,6e,91,28,9e,14,cc,70,8b,73,48,e5,14,04,3a,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,cb,ff,f2,f2,65,
e4,f9,84,b1,cd,45,5a,a8,c4,f8,b9,eb,97,27,e2,6d,1b,a3,65,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,e3,0d,bd,d9,9d,
7e,6e,11,e3,0e,66,d5,eb,bc,2f,6b,82,f7,60,68,65,6a,91,5f,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,22,b8,ea,58,a5,
0b,1a,66,fa,ea,66,7f,d4,3b,6b,70,6b,af,bb,65,a9,38,7f,85,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'Explorer.exe'(3856)
c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\program files\Thomson\ST330\service\st330service.exe
c:\windows\System32\nvvsvc.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\acer\Empowering Technology\eSettings\Service\capuserv.exe
c:\windows\System32\WUDFHost.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Heure de fin: 2009-09-18 15:11 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-09-18 13:11
Avant-CF: 91.029.274.624 octets libres
Après-CF: 90.828.562.432 octets libres
380
-
-
Contributeurrenomme avz et
recommence en mode sans echec-
Quarantine path: \??\C:\Users\Benoit\Desktop\avz4\avz4\Quarantine\2009-09-18\
QuarantineFile \??\C:\Windows\system32\Drivers\gasfkyircnrcqe.sys - succeeded
Delete File \systemroot\system32\drivers\gasfkyircnrcqe.sys - succeeded
Delete Service & File gasfkyjipxbmhq - failed (0xC0000022)
-- End --
Mais des gasf*(.dll), avast m'en a annoncé pas mal.
-
-
Contributeurmais non, on va réussir;)
télécharge sysprot https://3c416dfc-a-62cb3a1a-s-sites.googlegroups.com/site/sysprotantirootkit/Home/SysProt.zip?attachauth=ANoY7cqxnzQSAOweMB1j1RjBx63qHLQnx1RrB041ebnNnUkA2E7iUZlFXPn94FP1IUHBJSwoSr5WblYwsVBjiyaDOKhebdI3IV9oewennApIgI_z92W9PJmfwsnozJcQn66wJBG1RP0eCl1Xv_HZjeP-n-Pf2uHskwiOLYePagIzgigsE9RUmK40KwAL0DRxju5sEcAU_uOSbkivGezpyqu7eDpAxIo2TUMVmuDywLmABSKQ80dw0gw%3D&attredirects=2
extrait le
ouvre le dossier clique droit sur sysprot.exe choisie exécuter en tant qu'administrateur
une fenêtre s'ouvre, va dans l'onglet log
coche kermel modules
clique sur create log en bas à droite
au message created succcessfully clique ok
le rapport est crée a coté de sysprot.exe, poste le-
SysProt AntiRootkit v1.0.1.0
by swatkat
******************************************************************************************
******************************************************************************************
******************************************************************************************
******************************************************************************************
Kernel Modules:
Module Name: \systemroot\system32\drivers\gasfkyircnrcqe.sys
Service Name: gasfkyjipxbmhq
Module Base: ---
Module End: ---
Hidden: Yes
Module Name: \??\C:\Users\Benoit\Desktop\SysProtDrv.sys
Service Name: SysProtDrv.sys
Module Base: A854C000
Module End: A8557000
Hidden: No
Module Name: C:\Windows\system32\ntkrnlpa.exe
Service Name: ---
Module Base: 82A13000
Module End: 82DCC000
Hidden: No
Module Name: C:\Windows\system32\hal.dll
Service Name: ---
Module Base: 82DCC000
Module End: 82DFF000
Hidden: No
Module Name: C:\Windows\system32\kdcom.dll
Service Name: ---
Module Base: 80604000
Module End: 8060C000
Hidden: No
Module Name: C:\Windows\system32\mcupdate_GenuineIntel.dll
Service Name: ---
Module Base: 8060C000
Module End: 8066C000
Hidden: No
Module Name: C:\Windows\system32\PSHED.dll
Service Name: ---
Module Base: 8066C000
Module End: 8067D000
Hidden: No
Module Name: C:\Windows\system32\BOOTVID.dll
Service Name: ---
Module Base: 8067D000
Module End: 80685000
Hidden: No
Module Name: C:\Windows\system32\CLFS.SYS
Service Name: CLFS
Module Base: 80685000
Module End: 806C6000
Hidden: No
Module Name: C:\Windows\system32\CI.dll
Service Name: ---
Module Base: 806C6000
Module End: 807A6000
Hidden: No
Module Name: C:\Windows\system32\drivers\Wdf01000.sys
Service Name: Wdf01000
Module Base: 8A80C000
Module End: 8A888000
Hidden: No
Module Name: C:\Windows\system32\drivers\WDFLDR.SYS
Service Name: ---
Module Base: 8A888000
Module End: 8A895000
Hidden: No
Module Name: C:\Windows\system32\drivers\acpi.sys
Service Name: ACPI
Module Base: 8A895000
Module End: 8A8DB000
Hidden: No
Module Name: C:\Windows\system32\drivers\WMILIB.SYS
Service Name: ---
Module Base: 8A8DB000
Module End: 8A8E4000
Hidden: No
Module Name: C:\Windows\system32\drivers\msisadrv.sys
Service Name: msisadrv
Module Base: 8A8E4000
Module End: 8A8EC000
Hidden: No
Module Name: C:\Windows\system32\drivers\pci.sys
Service Name: pci
Module Base: 8A8EC000
Module End: 8A913000
Hidden: No
Module Name: C:\Windows\System32\drivers\partmgr.sys
Service Name: partmgr
Module Base: 8A913000
Module End: 8A922000
Hidden: No
Module Name: C:\Windows\system32\drivers\volmgr.sys
Service Name: volmgr
Module Base: 8A922000
Module End: 8A931000
Hidden: No
Module Name: C:\Windows\System32\drivers\volmgrx.sys
Service Name: volmgrx
Module Base: 8A931000
Module End: 8A97B000
Hidden: No
Module Name: C:\Windows\system32\drivers\nvrd32.sys
Service Name: nvrd32
Module Base: 8A97B000
Module End: 8A99F000
Hidden: No
Module Name: C:\Windows\system32\drivers\CLASSPNP.SYS
Service Name: ---
Module Base: 8A99F000
Module End: 8A9C0000
Hidden: No
Module Name: C:\Windows\system32\drivers\pciide.sys
Service Name: pciide
Module Base: 8A9C0000
Module End: 8A9C7000
Hidden: No
Module Name: C:\Windows\system32\drivers\PCIIDEX.SYS
Service Name: ---
Module Base: 8A9C7000
Module End: 8A9D5000
Hidden: No
Module Name: C:\Windows\System32\drivers\mountmgr.sys
Service Name: MountMgr
Module Base: 8A9D5000
Module End: 8A9E5000
Hidden: No
Module Name: C:\Windows\system32\drivers\nvraid.sys
Service Name: nvraid
Module Base: 8A9E5000
Module End: 8AA00000
Hidden: No
Module Name: C:\Windows\system32\drivers\atapi.sys
Service Name: atapi
Module Base: 8A800000
Module End: 8A808000
Hidden: No
Module Name: C:\Windows\system32\drivers\ataport.SYS
Service Name: ---
Module Base: 807A6000
Module End: 807C4000
Hidden: No
Module Name: C:\Windows\system32\drivers\nvstor32.sys
Service Name: nvstor32
Module Base: 807C4000
Module End: 807E9000
Hidden: No
Module Name: C:\Windows\system32\drivers\storport.sys
Service Name: ---
Module Base: 8AA0F000
Module End: 8AA50000
Hidden: No
Module Name: C:\Windows\system32\drivers\fltmgr.sys
Service Name: FltMgr
Module Base: 8AA50000
Module End: 8AA82000
Hidden: No
Module Name: C:\Windows\system32\drivers\fileinfo.sys
Service Name: FileInfo
Module Base: 8AA82000
Module End: 8AA92000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\psdfilter.sys
Service Name: PSDFilter
Module Base: 8AA92000
Module End: 8AA9B000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\Lbd.sys
Service Name: Lbd
Module Base: 8AA9B000
Module End: 8AAAA000
Hidden: No
Module Name: C:\Windows\System32\Drivers\ksecdd.sys
Service Name: KSecDD
Module Base: 8AAAA000
Module End: 8AB1B000
Hidden: No
Module Name: C:\Windows\system32\drivers\ndis.sys
Service Name: NDIS
Module Base: 8AC0D000
Module End: 8AD18000
Hidden: No
Module Name: C:\Windows\system32\drivers\msrpc.sys
Service Name: MsRPC
Module Base: 8AD18000
Module End: 8AD43000
Hidden: No
Module Name: C:\Windows\system32\drivers\NETIO.SYS
Service Name: ---
Module Base: 8AD43000
Module End: 8AD7D000
Hidden: No
Module Name: C:\Windows\System32\Drivers\Ntfs.sys
Service Name: Ntfs
Module Base: 8AE07000
Module End: 8AF16000
Hidden: No
Module Name: C:\Windows\system32\drivers\wd.sys
Service Name: Wd
Module Base: 8AF16000
Module End: 8AF1E000
Hidden: No
Module Name: C:\Windows\system32\drivers\volsnap.sys
Service Name: volsnap
Module Base: 8AF1E000
Module End: 8AF57000
Hidden: No
Module Name: C:\Windows\System32\Drivers\spldr.sys
Service Name: spldr
Module Base: 8AF57000
Module End: 8AF5F000
Hidden: No
Module Name: C:\Windows\System32\Drivers\mup.sys
Service Name: Mup
Module Base: 8AF5F000
Module End: 8AF6E000
Hidden: No
Module Name: C:\Windows\System32\drivers\ecache.sys
Service Name: Ecache
Module Base: 8AF6E000
Module End: 8AF95000
Hidden: No
Module Name: C:\Windows\system32\drivers\disk.sys
Service Name: disk
Module Base: 8AF95000
Module End: 8AFA6000
Hidden: No
Module Name: C:\Windows\system32\drivers\crcdisk.sys
Service Name: crcdisk
Module Base: 8AFA6000
Module End: 8AFAF000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\tunnel.sys
Service Name: tunnel
Module Base: 8AFEB000
Module End: 8AFF6000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\tunmp.sys
Service Name: tunmp
Module Base: 8AFF6000
Module End: 8AFFF000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\intelppm.sys
Service Name: intelppm
Module Base: 8AD7D000
Module End: 8AD8C000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\serial.sys
Service Name: Serial
Module Base: 8AD8C000
Module End: 8ADA6000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\serenum.sys
Service Name: Serenum
Module Base: 8ADA6000
Module End: 8ADB0000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\i8042prt.sys
Service Name: i8042prt
Module Base: 8ADB0000
Module End: 8ADC3000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\kbdclass.sys
Service Name: kbdclass
Module Base: 8ADC3000
Module End: 8ADCE000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\mouclass.sys
Service Name: mouclass
Module Base: 8ADCE000
Module End: 8ADD9000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\nvsmu.sys
Service Name: nvsmu
Module Base: 8AE00000
Module End: 8AE03000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\usbohci.sys
Service Name: usbohci
Module Base: 8ADD9000
Module End: 8ADE3000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\USBPORT.SYS
Service Name: ---
Module Base: 8AB1B000
Module End: 8AB59000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\usbehci.sys
Service Name: usbehci
Module Base: 8ADE3000
Module End: 8ADF2000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\HDAudBus.sys
Service Name: HDAudBus
Module Base: 8AB59000
Module End: 8AB6B000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\ohci1394.sys
Service Name: ohci1394
Module Base: 8AB6B000
Module End: 8AB7B000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\1394BUS.SYS
Service Name: ---
Module Base: 8ADF2000
Module End: 8AE00000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\nvlddmkm.sys
Service Name: nvlddmkm
Module Base: 90405000
Module End: 90D6A000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\nvBridge.kmd
Service Name: ---
Module Base: 90D6A000
Module End: 90D6C000
Hidden: No
Module Name: C:\Windows\System32\drivers\dxgkrnl.sys
Service Name: DXGKrnl
Module Base: 92800000
Module End: 9289F000
Hidden: No
Module Name: C:\Windows\System32\drivers\watchdog.sys
Service Name: ---
Module Base: 9289F000
Module End: 928AC000
Hidden: No
Module Name: C:\Windows\System32\Drivers\ElbyCDFL.sys
Service Name: ElbyCDFL
Module Base: 928AC000
Module End: 928B3000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\cdrom.sys
Service Name: cdrom
Module Base: 928B3000
Module End: 928CB000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\NTIDrvr.sys
Service Name: NTIDrvr
Module Base: 928CB000
Module End: 928CD000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\nvmfdx32.sys
Service Name: NVENETFD
Module Base: 928CD000
Module End: 929CA000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\wmiacpi.sys
Service Name: WmiAcpi
Module Base: 929CA000
Module End: 929D3000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\msiscsi.sys
Service Name: iScsiPrt
Module Base: 90D6C000
Module End: 90D9A000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\TDI.SYS
Service Name: ---
Module Base: 929D3000
Module End: 929DE000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\rasl2tp.sys
Service Name: Rasl2tp
Module Base: 929DE000
Module End: 929F5000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\ndistapi.sys
Service Name: NdisTapi
Module Base: 929F5000
Module End: 92A00000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\ndiswan.sys
Service Name: NdisWan
Module Base: 90D9A000
Module End: 90DBD000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\raspppoe.sys
Service Name: RasPppoe
Module Base: 90DBD000
Module End: 90DCC000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\raspptp.sys
Service Name: PptpMiniport
Module Base: 90DCC000
Module End: 90DE0000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\rassstp.sys
Service Name: RasSstp
Module Base: 90DE0000
Module End: 90DF5000
Hidden: No
Module Name: C:\Windows\System32\Drivers\pcouffin.sys
Service Name: pcouffin
Module Base: 8AC00000
Module End: 8AC0C000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\termdd.sys
Service Name: TermDD
Module Base: 8AB7B000
Module End: 8AB8B000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\swenum.sys
Service Name: swenum
Module Base: 90DF5000
Module End: 90DF7000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\ks.sys
Service Name: ---
Module Base: 8AB8B000
Module End: 8ABB5000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\MarvinBus.sys
Service Name: MarvinBus
Module Base: 8ABB5000
Module End: 8ABE3000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\mssmbios.sys
Service Name: mssmbios
Module Base: 8ABE3000
Module End: 8ABED000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\umbus.sys
Service Name: umbus
Module Base: 8ABED000
Module End: 8ABFA000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\usbhub.sys
Service Name: usbhub
Module Base: 94A07000
Module End: 94A3B000
Hidden: No
Module Name: C:\Windows\System32\Drivers\NDProxy.SYS
Service Name: NDProxy
Module Base: 94A3B000
Module End: 94A4C000
Hidden: No
Module Name: C:\Windows\system32\drivers\RTKVHDA.sys
Service Name: IntcAzAudAddService
Module Base: 95202000
Module End: 95403000
Hidden: No
Module Name: C:\Windows\system32\drivers\portcls.sys
Service Name: ---
Module Base: 95403000
Module End: 95430000
Hidden: No
Module Name: C:\Windows\system32\drivers\drmk.sys
Service Name: ---
Module Base: 95430000
Module End: 95455000
Hidden: No
Module Name: C:\Windows\system32\drivers\nvhda32v.sys
Service Name: NVHDA
Module Base: 95455000
Module End: 95463000
Hidden: No
Module Name: C:\Windows\System32\Drivers\Fs_Rec.SYS
Service Name: Fs_Rec
Module Base: 95463000
Module End: 9546C000
Hidden: No
Module Name: C:\Windows\System32\Drivers\Null.SYS
Service Name: Null
Module Base: 9546C000
Module End: 95473000
Hidden: No
Module Name: C:\Windows\System32\Drivers\Beep.SYS
Service Name: Beep
Module Base: 95473000
Module End: 9547A000
Hidden: No
Module Name: C:\Windows\System32\drivers\vga.sys
Service Name: vga
Module Base: 9547A000
Module End: 95486000
Hidden: No
Module Name: C:\Windows\System32\drivers\VIDEOPRT.SYS
Service Name: ---
Module Base: 95486000
Module End: 954A7000
Hidden: No
Module Name: C:\Windows\System32\DRIVERS\RDPCDD.sys
Service Name: RDPCDD
Module Base: 954A7000
Module End: 954AF000
Hidden: No
Module Name: C:\Windows\system32\drivers\rdpencdd.sys
Service Name: RDPENCDD
Module Base: 954AF000
Module End: 954B7000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Service Name: USBSTOR
Module Base: 954D8000
Module End: 954EA000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\USBD.SYS
Service Name: ---
Module Base: 954EA000
Module End: 954EC000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\hidusb.sys
Service Name: HidUsb
Module Base: 954EC000
Module End: 954F5000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\HIDCLASS.SYS
Service Name: ---
Module Base: 954F5000
Module End: 95505000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\HIDPARSE.SYS
Service Name: ---
Module Base: 95505000
Module End: 9550C000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\dot4usb.sys
Service Name: dot4usb
Module Base: 9550C000
Module End: 95519000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\Dot4.sys
Service Name: dot4
Module Base: 95519000
Module End: 9553E000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\mouhid.sys
Service Name: mouhid
Module Base: 9553E000
Module End: 95546000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\NuidFltr.sys
Service Name: NuidFltr
Module Base: 95546000
Module End: 9554D000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\Dot4Prt.sys
Service Name: Dot4Print
Module Base: 9554D000
Module End: 95556000
Hidden: No
Module Name: C:\Windows\System32\Drivers\Msfs.SYS
Service Name: Msfs
Module Base: 95556000
Module End: 95561000
Hidden: No
Module Name: C:\Windows\System32\Drivers\Npfs.SYS
Service Name: Npfs
Module Base: 95561000
Module End: 9556F000
Hidden: No
Module Name: C:\Windows\System32\DRIVERS\rasacd.sys
Service Name: RasAcd
Module Base: 9556F000
Module End: 95578000
Hidden: No
Module Name: C:\Windows\System32\drivers\tcpip.sys
Service Name: Tcpip
Module Base: 94A4C000
Module End: 94B35000
Hidden: No
Module Name: C:\Windows\System32\drivers\fwpkclnt.sys
Service Name: ---
Module Base: 95578000
Module End: 95593000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\tdx.sys
Service Name: tdx
Module Base: 95593000
Module End: 955A9000
Hidden: No
Module Name: C:\Windows\System32\Drivers\aswTdi.SYS
Service Name: aswTdi
Module Base: 955A9000
Module End: 955B4000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\smb.sys
Service Name: Smb
Module Base: 955B4000
Module End: 955C8000
Hidden: No
Module Name: C:\Windows\system32\drivers\afd.sys
Service Name: AFD
Module Base: 94B35000
Module End: 94B7D000
Hidden: No
Module Name: C:\Windows\System32\Drivers\aswRdr.SYS
Service Name: aswRdr
Module Base: 955C8000
Module End: 955CC000
Hidden: No
Module Name: C:\Windows\System32\DRIVERS\netbt.sys
Service Name: netbt
Module Base: 955CC000
Module End: 955FE000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\pacer.sys
Service Name: PSched
Module Base: 94B7D000
Module End: 94B93000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\netbios.sys
Service Name: NetBIOS
Module Base: 94B93000
Module End: 94BA1000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\wanarp.sys
Service Name: Wanarp
Module Base: 94BA1000
Module End: 94BB4000
Hidden: No
Module Name: \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
Service Name: SASKUTIL
Module Base: 94BB4000
Module End: 94BD9000
Hidden: No
Module Name: \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
Service Name: SASDIFSV
Module Base: 94BD9000
Module End: 94BDF000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\rdbss.sys
Service Name: rdbss
Module Base: 96806000
Module End: 96842000
Hidden: No
Module Name: C:\Windows\system32\drivers\nsiproxy.sys
Service Name: nsiproxy
Module Base: 96842000
Module End: 9684C000
Hidden: No
Module Name: C:\Windows\System32\Drivers\ISODisk.SYS
Service Name: ISODisk
Module Base: 9684C000
Module End: 9684F000
Hidden: No
Module Name: C:\Windows\System32\Drivers\ElbyCDIO.sys
Service Name: ElbyCDIO
Module Base: 9684F000
Module End: 96854000
Hidden: No
Module Name: C:\Windows\System32\Drivers\dfsc.sys
Service Name: DfsC
Module Base: 96854000
Module End: 9686B000
Hidden: No
Module Name: C:\Windows\System32\Drivers\aswSP.SYS
Service Name: aswSP
Module Base: 9686B000
Module End: 9688C000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\cdfs.sys
Service Name: cdfs
Module Base: 9688C000
Module End: 968A2000
Hidden: No
Module Name: C:\Windows\System32\Drivers\crashdmp.sys
Service Name: ---
Module Base: 968A2000
Module End: 968AF000
Hidden: No
Module Name: \SystemRoot\System32\Drivers\dump_diskdump.sys
Service Name: ---
Module Base: 968AF000
Module End: 968B9000
Hidden: Yes
Module Name: \SystemRoot\System32\Drivers\dump_nvstor32.sys
Service Name: ---
Module Base: 968B9000
Module End: 968DE000
Hidden: Yes
Module Name: C:\Windows\System32\drivers\Dxapi.sys
Service Name: ---
Module Base: 968DE000
Module End: 968E8000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\monitor.sys
Service Name: monitor
Module Base: 968E8000
Module End: 968F7000
Hidden: No
Module Name: C:\Windows\system32\drivers\luafv.sys
Service Name: luafv
Module Base: 968F7000
Module End: 96912000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\aswMonFlt.sys
Service Name: aswMonFlt
Module Base: 96912000
Module End: 96929000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\aswFsBlk.sys
Service Name: aswFsBlk
Module Base: 96929000
Module End: 96931000
Hidden: No
Module Name: C:\Windows\system32\drivers\spsys.sys
Service Name: ---
Module Base: 96931000
Module End: 969E0000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\lltdio.sys
Service Name: lltdio
Module Base: 969E0000
Module End: 969F0000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\rspndr.sys
Service Name: rspndr
Module Base: 94BDF000
Module End: 94BF2000
Hidden: No
Module Name: C:\Windows\system32\drivers\HTTP.sys
Service Name: HTTP
Module Base: A3C06000
Module End: A3C71000
Hidden: No
Module Name: C:\Windows\System32\DRIVERS\srvnet.sys
Service Name: srvnet
Module Base: A3C71000
Module End: A3C8E000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\bowser.sys
Service Name: bowser
Module Base: A3C8E000
Module End: A3CA7000
Hidden: No
Module Name: C:\Windows\system32\drivers\mrxdav.sys
Service Name: MRxDAV
Module Base: A3CA7000
Module End: A3CC7000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\mrxsmb.sys
Service Name: mrxsmb
Module Base: A3CC7000
Module End: A3CE6000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\mrxsmb10.sys
Service Name: mrxsmb10
Module Base: A3CE6000
Module End: A3D1F000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\mrxsmb20.sys
Service Name: mrxsmb20
Module Base: A3D1F000
Module End: A3D37000
Hidden: No
Module Name: C:\Windows\System32\DRIVERS\srv2.sys
Service Name: srv2
Module Base: A3D37000
Module End: A3D5E000
Hidden: No
Module Name: C:\Windows\System32\DRIVERS\srv.sys
Service Name: srv
Module Base: A3D5E000
Module End: A3DAA000
Hidden: No
Module Name: \??\C:\Acer\Empowering Technology\eRecovery\int15.sys
Service Name: int15
Module Base: A3DAA000
Module End: A3DB1000
Hidden: No
Module Name: C:\Windows\system32\drivers\peauth.sys
Service Name: PEAUTH
Module Base: A840D000
Module End: A84EB000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\PSDNServ.sys
Service Name: PSDNServ
Module Base: A84EB000
Module End: A84F4000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\PSDVdisk.sys
Service Name: psdvdisk
Module Base: A84F4000
Module End: A8506000
Hidden: No
Module Name: C:\Windows\System32\Drivers\secdrv.SYS
Service Name: secdrv
Module Base: A8506000
Module End: A8510000
Hidden: No
Module Name: C:\Windows\System32\drivers\tcpipreg.sys
Service Name: tcpipreg
Module Base: A8510000
Module End: A851C000
Hidden: No
Module Name: \??\C:\Windows\system32\drivers\tvicport.sys
Service Name: tvicport
Module Base: A851C000
Module End: A851F000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\WUDFRd.sys
Service Name: WUDFRd
Module Base: A851F000
Module End: A8534000
Hidden: No
Module Name: C:\Windows\system32\DRIVERS\WUDFPf.sys
Service Name: ---
Module Base: A8534000
Module End: A8546000
Hidden: No
Module Name: \??\C:\Windows\system32\drivers\zntport.sys
Service Name: zntport
Module Base: A8546000
Module End: A8547000
Hidden: No
Module Name: \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
Service Name: SASENUM
Module Base: A8547000
Module End: A854C000
Hidden: No
-
- 1
- 2
- 3
Suivant
