Forums Zebulon.fr: [Résolu] impossible de lancer kaspersky - Forums Zebulon.fr

bonjour,
je ne peux pas lancer kaspersky. j'ai pensé qu'il avait un raté donc du coup, je l'ai désinstallé puis j'ai relancé l'installation mais kaspersky ne s'ouvre même plus.
j'ai tenté une restauration système mais impossible. j'ai lancé malwarebytes mais il n'a rien trouvé. j'ai aussi lancé zhpdiag pour voir ce que ça donnais mais je ne sais pas le lire.
si vous pourriez m'aider car mes connaissance sont très limitées. je vous remercie par avance du temps que vous passerez à lire mon post, et de l'aide que vous pourrez m'apporter.

voici donc les rapports :

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 5751

Windows 6.1.7600
Internet Explorer 9.0.7930.16406

13/02/2011 07:50:39
mbam-log-2011-02-13 (07-50-39).txt

Type d'examen: Examen complet (C:\|)
Elément(s) analysé(s): 327714
Temps écoulé: 48 minute(s), 19 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)


et voici zhpdiag :
Rapport de ZHPDiag v1.27.1600 par Nicolas Coolman, Update du 10/02/2011
Run by kolchok at 13/02/2011 07:57:10
Web site : ZHPDiag Outil de diagnostic
Contact : nicolascoolman@yahoo.fr

---\\ Web Browser
MSIE: Internet Explorer v9.0.7930.16406

---\\ System Information
Windows 7 Ultimate Edition, 64-bit (Build 7600)
Processor: Intel64 Family 6 Model 15 Stepping 11, GenuineIntel
Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2750 MB (53% free)
System Restore: Activé (Enable)
System drive C: has 367 GB (78%) free of 466 GB

---\\ Logged in mode
Computer Name: LOKI
User Name: kolchok
All Users Names: kolchok, Guest, Administrator,
Unselected Option: O45,O61,O62,O65,O66,O82
Logged in as Administrator

---\\ Environnement Variables
%AppData%=C:\Users\kolchok\AppData\Roaming
%LocalAppData%=C:\Users\kolchok\AppData\Local
%StartMenu%=C:\Users\kolchok\AppData\Roaming\Microsoft\Windows\Start Menu

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 367 Go of 466 Go)
D:\ CD-ROM drive (Free 0 Go of 0 Go)
E:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
F:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
G:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
H:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
I:\ CD-ROM drive (Not Inserted)


---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] NoActiveDesktopChanges: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoFolderOptions: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSearch: OK


---\\ Recherche particulière de fichiers génériques
[MD5.9AAAEC8DAC27AA17B053E6352AD233AE] - (.Microsoft Corporation - Explorateur Windows.) (.31/10/2009 07:34:59.) -- C:\Windows\Explorer.exe [2870272]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 02:14:45.) -- C:\Windows\System32\Wininit.exe [96256]


---\\ Processus lancés
[MD5.93DB1FF92B03D24738A71E6E4992DFD3] - (.Sun Microsystems, Inc. - Java™ Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552]
[MD5.A58E05767687E1E636D160ECEA9BC8ED] - (.Pas de propriétaire - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1226608]
[MD5.57D8C4ED26DFD7EF0E2CB196FB8BFB54] - (.DivX, LLC - DivX Download Manager Service.) -- C:\Program Files (x86)\DivX\DivX Plus Web Player\DDMService.exe [63360]
[MD5.205E6E08B4921CE48B8E80A2D2FDE6F2] - (.Logitech Inc. - Logitech G-series Media Display.) -- C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe [522824]
[MD5.A0F1DFC9E47B2524213AFF32E26BE92D] - (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe [164864]
[MD5.C316AFAE719B1C1CE1B903673BC6A641] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe [77824]
[MD5.0E20A3213ED010FC4997D1EF48082ABC] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [912344]
[MD5.BA9A09CF1B9503C363617F3748F6D791] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe [16856]
[MD5.3A4C97796130037CBB555F5BC8419F28] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [630272]
[MD5.A63DC5C2EA944E6657203E0C8EDEAF61] - (.Microsoft Corporation - COM Surrogate.) -- C:\Windows\SysWOW64\DllHost.exe [7168]


---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
M3 - MFPP: Plugins - [kolchok] -- C:\Users\kolchok\AppData\Roaming\Mozilla\Firefox\Profiles\je2z1rt4.default\searchplugins\daemon-search.xml
P2 - FPN: [HKLM] [@java.com/JavaPlugin] - (.Sun Microsystems, Inc. - Next Generation Java Plug-in 1.6.0_22 for Mozilla browsers.) -- C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
P2 - FPN: [HKCU] [pandonetworks.com/PandoWebPlugin] - (.Pando Networks - Pando Web Plugin.) -- C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
M0 - MFSP: prefs.js [kolchok - je2z1rt4.default] http://my.daemon-sea...nfig.properties


---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook (R0,R1,R3)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Bing, Actualité et Sport
R0 - HKUS\S-1-5-21-1832532766-817392245-452576883-1000\Software\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Search Microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Search Microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Search Microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Search Microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R1 - HKUS\S-1-5-21-1832532766-817392245-452576883-1000\Software\Microsoft\Internet Explorer\Main,Search Page = Search Microsoft.com
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Navigateur Internet.) (9.00.7930.16406 (WIN7_IE9_Beta.100831-2345)) -- C:\Windows\System32\ieframe.dll


---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: VMApplet=C:\WINDOWS\system32\SystemPropertiesPerformance.exe


---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} . (.Kaspersky Lab ZAO - IE Virtual Keyboard.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\ievkbd.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Sun Microsystems, Inc. - Java™ Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} . (.Kaspersky Lab ZAO - WebToolBar component.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll


---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} . (.Pas de propriétaire - ToolBand Module.) -- C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll


---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] . (.Logitech, Inc. - Logitech KHAL Main Process.) -- C:\Windows\KHALMNPR.exe
O4 - HKLM\..\Run: [Launch LgDeviceAgent] . (.Logitech Inc. - Logitech GamePanel Agent.) -- C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe
O4 - HKLM\..\Run: [Launch LCDMon] . (.Logitech Inc. - Logitech LCD Manager.) -- C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
O4 - HKLM\..\Run: [Launch LGDCore] . (.Logitech Inc. - Logitech G-series Profiler.) -- C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java™ Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
O4 - HKLM\..\Wow6432Node\Run: [DivXUpdate] . (.Pas de propriétaire - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [DivX Download Manager] . (.DivX, LLC - DivX Download Manager Service.) -- C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe
O4 - HKLM\..\Wow6432Node\Run: [AVP] . (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
O4 - HKLM\..\Wow6432Node\RunOnce: [Malwarebytes' Anti-Malware] . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
O4 - HKUS\S-1-5-18\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKUS\S-1-5-18\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-21-1832532766-817392245-452576883-1000\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (.not file.)
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (.not file.)
O4 - Global Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk . (.Logitech, Inc..) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe


---\\ Autres liens utilisateurs (O4)
O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\kolchok\Desktop\DivX Movies.lnk . (.Pas de propriétaire.) -- C:\Users\kolchok\Videos\DivX Movies
O4 - Global Startup: C:\Users\kolchok\Desktop\Wow Cartographe.lnk . (.Pas de propriétaire.) -- C:\Program Files (x86)\WowCartographe\WowCartographe.exe
O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk . (.LIGHTNING UK!.) -- C:\Program Files (x86)\ImgBurn\ImgBurn.exe
O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Magelo Sync.lnk . (.Pas de propriétaire.) -- C:\Program Files (x86)\Magelo\Magelo Sync\MageloSync.exe
O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk . (.Mozilla Corporation.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk - Clé orpheline
O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk - Clé orpheline
O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk . (.BitTorrent, Inc..) -- C:\Program Files (x86)\uTorrent\uTorrent.exe


---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} . (.Pas de propriétaire - Pas de description.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\kbrd.ico
O9 - Extra button: Clavier &virtuel - {CCF151D8-D089-449F-A5A4-D9909053F20F} . (.Pas de propriétaire - Pas de description.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\logo.ico


---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\Windows\system32\NLAapi.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\Windows\system32\mswsock.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\Windows\system32\winrnr.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Fournisseur Shim d’affectation de noms de messagerie.) -- C:\Windows\system32\napinsp.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Fournisseur d’espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - Fournisseur d’espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000007\Winsock LSP File . (.Microsoft Corporation - Windows Sockets Helper DLL.) -- C:\Windows\system32\wshbth.dll


---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D0F607F-762B-4B93-9EBF-C2E7BB310AB9}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{8D0F607F-762B-4B93-9EBF-C2E7BB310AB9}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{8D0F607F-762B-4B93-9EBF-C2E7BB310AB9}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1


---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: klogon . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\klogon.dll (.not file.)
O20 - Winlogon Notify: LBTWlgn . (.Logitech, Inc. - Logitech Bluetooth Service.) -- c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll


---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (.Kaspersky Lab ZAO - Kaspersky OE plugin loader.) - C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll


---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.


---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: (AVP) . (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
O23 - Service: (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: (nvsvc) - Clé orpheline
O23 - Service: (sdmBackupIP) - Clé orpheline
O23 - Service: (Stereo Service) . (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe


---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(.Pas de propriétaire - Pas de description.) - (.not file.)


---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
[MD5.00000000000000000000000000000000] [APT] [Secunia PSI Logon Task] (.Pas de propriétaire.) -- C:\Program Files (x86)\Secunia\PSI\psi.exe (.not file.)
[MD5.6FBBB73BE9FB38389AB73F38828A9CAC] [APT] [{B41DF29A-980A-4266-92B4-52026DDD2B50}] (.Skype Technologies S.A..) -- C:\Program Files (x86)\Skype\Phone\Skype.exe


---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: C:\Windows\system32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\Windows\system32\drivers\afd.sys
O41 - Driver: (blbdrive) . (.Microsoft Corporation - BLB Drive Driver.) - C:\Windows\System32\DRIVERS\blbdrive.sys
O41 - Driver: (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\System32\DRIVERS\cdrom.sys
O41 - Driver: C:\Windows\system32\cscsvc.dll (CSC) . (.Microsoft Corporation - Windows Client Side Caching Driver.) - C:\Windows\System32\drivers\csc.sys
O41 - Driver: C:\Windows\system32\drivers\dfsc.sys (DfsC) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\System32\Drivers\dfsc.sys
O41 - Driver: C:\Windows\system32\drivers\discache.sys (discache) . (.Microsoft Corporation - System Indexer/Cache Driver.) - C:\Windows\System32\drivers\discache.sys
O41 - Driver: (dtsoftbus01) . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) - C:\Windows\System32\DRIVERS\dtsoftbus01.sys
O41 - Driver: (kl2) . (.Kaspersky Lab ZAO - Kaspersky Unified Driver.) - C:\Windows\System32\DRIVERS\kl2.sys
O41 - Driver: (KLIF) . (.Kaspersky Lab - Klif Mini-Filter [fre_wlh_AMD64].) - C:\Windows\System32\DRIVERS\klif.sys
O41 - Driver: (KLIM6) . (.Kaspersky Lab ZAO - Kaspersky Lab Intermediate Network Driver.) - C:\Windows\System32\DRIVERS\klim6.sys
O41 - Driver: (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\Windows\System32\DRIVERS\mssmbios.sys
O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\System32\DRIVERS\netbios.sys
O41 - Driver: C:\Windows\system32\drivers\netbt.sys (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\System32\DRIVERS\netbt.sys
O41 - Driver: C:\Windows\system32\drivers\nsiproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\System32\drivers\nsiproxy.sys
O41 - Driver: C:\Windows\system32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Planificateur de paquets QoS.) - C:\Windows\System32\DRIVERS\pacer.sys
O41 - Driver: C:\Windows\system32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Pilote du sous-système de mise en mémoire t.) - C:\Windows\System32\DRIVERS\rdbss.sys
O41 - Driver: C:\Windows\system32\DRIVERS\RDPCDD.sys (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\System32\DRIVERS\RDPCDD.sys
O41 - Driver: C:\Windows\system32\drivers\RDPENCDD.sys (RDPENCDD) . (.Microsoft Corporation - RDP Encoder Miniport.) - C:\Windows\System32\drivers\rdpencdd.sys
O41 - Driver: C:\Windows\system32\drivers\RdpRefMp.sys (RDPREFMP) . (.Microsoft Corporation - RDP Reflector Driver Miniport.) - C:\Windows\System32\drivers\rdprefmp.sys
O41 - Driver: C:\Windows\system32\tcpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\System32\DRIVERS\tdx.sys
O41 - Driver: (TermDD) . (.Microsoft Corporation - Remote Desktop Server Driver.) - C:\Windows\System32\DRIVERS\termdd.sys
O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\Windows\system32\drivers\vga.sys
O41 - Driver: C:\Windows\system32\rascfg.dll (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\System32\DRIVERS\wanarp.sys
O41 - Driver: (WfpLwf) . (.Microsoft Corporation - WFP NDIS 6.20 Lightweight Filter Driver.) - C:\Windows\System32\DRIVERS\wfplwf.sys
O41 - Driver: (Serial) . (.Microsoft Corporation - Pilote de périphérique série.) - C:\Windows\system32\DRIVERS\serial.sys


---\\ Logiciels installés (O42)
O42 - Logiciel: 7-Zip 9.20 (x64 edition) - (.Igor Pavlov.) [HKLM] -- {23170F69-40C1-2702-0920-000001000000}
O42 - Logiciel: Adobe Flash Player 10 ActiveX - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Flash Player 10 Plugin - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player Plugin
O42 - Logiciel: CDDRV_Installer - (.Logitech.) [HKLM] -- {0C826C5B-B131-423A-A229-C71B3CACCD6A}
O42 - Logiciel: Cisco EAP-FAST Module - (.Cisco Systems, Inc..) [HKLM][64Bits] -- {64BF0187-F3D2-498B-99EA-163AF9AE6EC9}
O42 - Logiciel: Cisco LEAP Module - (.Cisco Systems, Inc..) [HKLM][64Bits] -- {51C7AD07-C3F6-4635-8E8A-231306D810FE}
O42 - Logiciel: Cisco PEAP Module - (.Cisco Systems, Inc..) [HKLM][64Bits] -- {ED5776D5-59B4-46B7-AF81-5F2D94D7C640}
O42 - Logiciel: Configuration DivX - (.DivX, LLC.) [HKLM][64Bits] -- DivX Setup.divx.com
O42 - Logiciel: Counter-Strike: Source - (.Valve.) [HKLM][64Bits] -- {9580813D-94B1-4C28-9426-A441E2BB29A5}
O42 - Logiciel: Counter-Strike: Source Beta - (.Pas de propriétaire.) [HKLM][64Bits] -- Steam App 260
O42 - Logiciel: Curse Client - (.Curse.) [HKCU] -- 090215de958f1060
O42 - Logiciel: DAEMON Tools Lite - (.DT Soft Ltd.) [HKLM][64Bits] -- DAEMON Tools Lite
O42 - Logiciel: DAEMON Tools Toolbar - (.DT Soft Ltd.) [HKLM][64Bits] -- DAEMON Tools Toolbar
O42 - Logiciel: Day of Defeat: Source - (.Valve.) [HKLM][64Bits] -- Steam App 300
O42 - Logiciel: Feedback Tool - (.Microsoft Corporation.) [HKLM][64Bits] -- {90024193-9F13-4877-89D5-A1CDF0CBBF28}
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM][64Bits] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
O42 - Logiciel: Google Earth - (.Google.) [HKLM][64Bits] -- {4286E640-B5FB-11DF-AC4B-005056C00008}
O42 - Logiciel: ImgBurn - (.LIGHTNING UK!.) [HKLM][64Bits] -- ImgBurn
O42 - Logiciel: Java™ 6 Update 22 (64-bit) - (.Oracle.) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F86416022FF}
O42 - Logiciel: Java™ 6 Update 23 - (.Oracle.) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F83216023FF}
O42 - Logiciel: Kane & Lynch 2: Dog Days Demo - (.IO Interactive.) [HKLM][64Bits] -- Steam App 28020
O42 - Logiciel: Kaspersky Internet Security 2011 - (.Kaspersky Lab.) [HKLM][64Bits] -- InstallWIX_{66F1F013-008F-4875-B283-5A814B820347}
O42 - Logiciel: Kaspersky Internet Security 2011 - (.Kaspersky Lab.) [HKLM][64Bits] -- {66F1F013-008F-4875-B283-5A814B820347}
O42 - Logiciel: KhalInstallWrapper - (.Logitech.) [HKLM] -- {F3F18612-7B5D-4C05-86C9-AB50F6F71727}
O42 - Logiciel: League of Legends - (.Riot Games.) [HKLM][64Bits] -- {918A9082-6287-4D25-9002-5E5D5E4971CB}
O42 - Logiciel: Left 4 Dead 2 - (.Valve.) [HKLM][64Bits] -- Steam App 550
O42 - Logiciel: Logitech GamePanel Software 3.06.109 - (.Logitech Inc..) [HKLM] -- {A1E85B9A-AFAD-4D38-AF01-6B020DD5213A}
O42 - Logiciel: Logitech SetPoint - (.Logitech.) [HKLM][64Bits] -- {F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}
O42 - Logiciel: Magelo Sync (uninstall only) - (.Pas de propriétaire.) [HKLM][64Bits] -- Magelo Sync
O42 - Logiciel: Malwarebytes' Anti-Malware - (.Malwarebytes Corporation.) [HKLM][64Bits] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable (x64) - (.Microsoft Corporation.) [HKLM] -- {071c9b48-7c32-4621-a0ac-3f809523288f}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM][64Bits] -- {7299052b-02a4-4627-81f2-1818da5d550d}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 - (.Microsoft Corporation.) [HKLM] -- {8220EEFE-38CD-377E-8595-13398D740ACE}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 - (.Microsoft Corporation.) [HKLM][64Bits] -- {FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 - (.Microsoft Corporation.) [HKLM][64Bits] -- {9A25302D-30C0-39D9-BD6F-21E6EC160475}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM][64Bits] -- {1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
O42 - Logiciel: Mozilla Firefox (3.6.13) - (.Mozilla.) [HKLM][64Bits] -- Mozilla Firefox (3.6.13)
O42 - Logiciel: Mumble and Murmur - (.Mumble.) [HKLM][64Bits] -- Mumble
O42 - Logiciel: NVIDIA Logiciel système PhysX 9.10.0514 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX
O42 - Logiciel: NVIDIA PhysX - (.NVIDIA Corporation.) [HKLM][64Bits] -- {B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}
O42 - Logiciel: NVIDIA Pilote 3D Vision 260.99 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision
O42 - Logiciel: NVIDIA Pilote audio HD : 1.1.9.0 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver
O42 - Logiciel: NVIDIA Pilote graphique 260.99 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver
O42 - Logiciel: NVIDIA Stereoscopic 3D Driver - (.NVIDIA Corporation.) [HKLM][64Bits] -- NVIDIAStereo
O42 - Logiciel: OpenAL - (.Pas de propriétaire.) [HKLM][64Bits] -- OpenAL
O42 - Logiciel: PVSonyDll - (.NVIDIA Corporation.) [HKLM] -- {3D3E663D-4E7E-4577-A560-7ECDDD45548A}
O42 - Logiciel: Pando Media Booster - (.Pando Networks Inc..) [HKLM][64Bits] -- {980A182F-E0A2-4A40-94C1-AE0C1235902E}
O42 - Logiciel: REALTEK Wireless LAN Driver - (.REALTEK Semiconductor Corp..) [HKLM][64Bits] -- {9D3D8C60-A55F-4fed-B2B9-173F09590E16}
O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM][64Bits] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}
O42 - Logiciel: Realtek PCI Fast Ethernet Controller Driver For Vista and Win7 - (.Realtek.) [HKLM][64Bits] -- {AE46ABD3-D625-467F-B5A7-8D3FFF077F0D}
O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) - (.Microsoft Corporation.) [HKLM][64Bits] -- {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2160841
O42 - Logiciel: Skype™ 4.2 - (.Skype Technologies S.A..) [HKLM][64Bits] -- {D103C4BA-F905-437A-8049-DB24763BBE36}
O42 - Logiciel: Steam - (.Valve Corporation.) [HKLM][64Bits] -- {048298C9-A4D3-490B-9FF9-AB023A9238F3}
O42 - Logiciel: TeamSpeak 3 Client - (.TeamSpeak Systems GmbH.) [HKLM] -- TeamSpeak 3 Client
O42 - Logiciel: Update for Microsoft .NET Framework 4 Client Profile (KB2473228) - (.Microsoft Corporation.) [HKLM][64Bits] -- {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2473228
O42 - Logiciel: VC80CRTRedist - 8.0.50727.4053 - (.DivX, Inc.) [HKLM][64Bits] -- {5EE7D259-D137-4438-9A5F-42F432EC0421}
O42 - Logiciel: VIA Gestionnaire de périphériques de plate-forme - (.VIA Technologies, Inc..) [HKLM][64Bits] -- InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}
O42 - Logiciel: VLC media player 1.1.5 - (.VideoLAN.) [HKLM][64Bits] -- VLC media player
O42 - Logiciel: World of Warcraft - (.Blizzard Entertainment.) [HKLM][64Bits] -- World of Warcraft
O42 - Logiciel: Wow Cartographe 1.20 - (.Pas de propriétaire.) [HKLM][64Bits] -- Wow Cartographe
O42 - Logiciel: erLT - (.Logitech, Inc..) [HKLM][64Bits] -- {A498D9EB-927B-459B-85D6-DD6EF8C2C564}
O42 - Logiciel: installer - (.Install Pedia Limited.) [HKLM][64Bits] -- installer
O42 - Logiciel: µTorrent - (.Pas de propriétaire.) [HKLM][64Bits] -- uTorrent

---\\ HKCU & HKLM Software Keys
[HKCU\Software\ALWIL Software]
[HKCU\Software\AVG]
[HKCU\Software\AppDataLow\Software\Microsoft]
[HKCU\Software\AppDataLow\Software]
[HKCU\Software\AppDataLow]
[HKCU\Software\BitDefender]
[HKCU\Software\BitTorrent]
[HKCU\Software\Blizzard Entertainment]
[HKCU\Software\Bugsplat]
[HKCU\Software\ClassesB]
[HKCU\Software\Classes]
[HKCU\Software\Clients]
[HKCU\Software\CyberStep]
[HKCU\Software\DSS]
[HKCU\Software\DT Soft]
[HKCU\Software\DivXNetworks]
[HKCU\Software\DivX]
[HKCU\Software\Foxit Software]
[HKCU\Software\Froggie]
[HKCU\Software\Google]
[HKCU\Software\HookNetwork]
[HKCU\Software\IO Interactive]
[HKCU\Software\ImgBurn]
[HKCU\Software\JavaSoft]
[HKCU\Software\KasperskyLab]
[HKCU\Software\Leadertech]
[HKCU\Software\Local AppWizard-Generated Applications]
[HKCU\Software\Logitech]
[HKCU\Software\LowRegistry]
[HKCU\Software\Macromedia]
[HKCU\Software\Malwarebytes' Anti-Malware]
[HKCU\Software\MozillaPlugins]
[HKCU\Software\Mozilla]
[HKCU\Software\Mumble]
[HKCU\Software\NDOORS]
[HKCU\Software\NVIDIA Corporation]
[HKCU\Software\Netscape]
[HKCU\Software\Pando Networks]
[HKCU\Software\Policies]
[HKCU\Software\Realtek]
[HKCU\Software\Safer Networking Limited]
[HKCU\Software\Secunia]
[HKCU\Software\Skype]
[HKCU\Software\SteamPopCap]
[HKCU\Software\Trolltech]
[HKCU\Software\Valve]
[HKCU\Software\WinRAR SFX]
[HKCU\Software\Wow6432Node]
[HKCU\Software\YahooPartnerToolbar]
[HKCU\Software\cacaoweb]
[HKCU\Software\ej-technologies]
[HKCU\Software\ijji]
[HKLM\Software\7-Zip]
[HKLM\Software\AGEIA Technologies]
[HKLM\Software\ATI Technologies]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\DTS]
[HKLM\Software\DivX]
[HKLM\Software\Dolby]
[HKLM\Software\InfoWatch]
[HKLM\Software\Installer]
[HKLM\Software\Intel]
[HKLM\Software\JavaSoft]
[HKLM\Software\JreMetrics]
[HKLM\Software\KasperskyLab]
[HKLM\Software\Khronos]
[HKLM\Software\Logitech]
[HKLM\Software\MidasHeurScanner]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\NVIDIA Corporation]
[HKLM\Software\ODBC]
[HKLM\Software\Policies]
[HKLM\Software\RTLSetup]
[HKLM\Software\Realtek]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\SRS Labs]
[HKLM\Software\SonicFocus]
[HKLM\Software\Sonic]
[HKLM\Software\Waves Audio]
[HKLM\Software\Wow6432Node]


---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 05/10/2010 - 22:17:42 ----D- C:\Program Files\BitDefender
O43 - CFD: 05/10/2010 - 22:17:42 ----D- C:\Program Files\Common Files
O43 - CFD: 18/01/2011 - 10:18:20 ----D- C:\Program Files\DivX
O43 - CFD: 06/10/2010 - 02:19:24 ----D- C:\Program Files\DVD Maker
O43 - CFD: 14/12/2010 - 03:09:00 ----D- C:\Program Files\Internet Explorer
O43 - CFD: 14/12/2010 - 03:12:44 ----D- C:\Program Files\Java
O43 - CFD: 09/10/2010 - 18:17:26 ----D- C:\Program Files\Logitech
O43 - CFD: 14/07/2009 - 08:46:54 ----D- C:\Program Files\Microsoft Games
O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files\MSBuild
O43 - CFD: 10/12/2010 - 17:25:04 ----D- C:\Program Files\NVIDIA Corporation
O43 - CFD: 06/10/2010 - 16:08:16 ----D- C:\Program Files\Realtek
O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files\Reference Assemblies
O43 - CFD: 26/11/2010 - 09:16:08 ----D- C:\Program Files\TeamSpeak 3 Client
O43 - CFD: 14/07/2009 - 06:09:28 --H-D- C:\Program Files\Uninstall Information
O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files\Windows Defender
O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files\Windows Journal
O43 - CFD: 17/12/2010 - 03:02:14 ----D- C:\Program Files\Windows Mail
O43 - CFD: 14/10/2010 - 02:19:38 ----D- C:\Program Files\Windows Media Player
O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files\Windows NT
O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files\Windows Photo Viewer
O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files\Windows Portable Devices
O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files\Windows Sidebar
O43 - CFD: 05/10/2010 - 22:17:46 ----D- C:\Program Files\Common Files\BitDefender
O43 - CFD: 05/10/2010 - 21:40:10 ----D- C:\Program Files\Common Files\Logishrd
O43 - CFD: 05/10/2010 - 22:17:14 ----D- C:\Program Files\Common Files\Microsoft Shared
O43 - CFD: 14/07/2009 - 04:20:10 ----D- C:\Program Files\Common Files\Services
O43 - CFD: 14/07/2009 - 04:20:10 ----D- C:\Program Files\Common Files\SpeechEngines
O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files\Common Files\System
O43 - CFD: 14/07/2009 - 06:08:58 -SH-D- C:\ProgramData\Application Data
O43 - CFD: 05/10/2010 - 23:33:02 ----D- C:\ProgramData\BitDefender
O43 - CFD: 06/10/2010 - 03:54:28 ----D- C:\ProgramData\Blizzard
O43 - CFD: 16/10/2010 - 09:15:12 ----D- C:\ProgramData\Blizzard Entertainment
O43 - CFD: 13/02/2011 - 04:51:42 ----D- C:\ProgramData\DAEMON Tools Lite
O43 - CFD: 14/07/2009 - 06:08:58 -SH-D- C:\ProgramData\Desktop
O43 - CFD: 18/01/2011 - 10:19:04 ----D- C:\ProgramData\DivX
O43 - CFD: 14/07/2009 - 06:08:58 -SH-D- C:\ProgramData\Documents
O43 - CFD: 13/02/2011 - 05:11:32 -SH-D- C:\ProgramData\DSS
O43 - CFD: 14/07/2009 - 06:08:58 -SH-D- C:\ProgramData\Favorites
O43 - CFD: 13/02/2011 - 07:57:16 ----D- C:\ProgramData\Kaspersky Lab
O43 - CFD: 13/02/2011 - 06:47:04 ----D- C:\ProgramData\Kaspersky Lab Setup Files
O43 - CFD: 05/10/2010 - 21:40:22 ----D- C:\ProgramData\LogiShrd
O43 - CFD: 09/10/2010 - 18:17:26 ----D- C:\ProgramData\Logitech
O43 - CFD: 11/01/2011 - 10:54:18 ----D- C:\ProgramData\ma-config.com
O43 - CFD: 14/11/2010 - 19:03:40 ----D- C:\ProgramData\Malwarebytes
O43 - CFD: 21/10/2010 - 06:34:14 ----D- C:\ProgramData\McAfee
O43 - CFD: 06/10/2010 - 00:06:54 -S--D- C:\ProgramData\Microsoft
O43 - CFD: 13/02/2011 - 06:54:40 ----D- C:\ProgramData\NVIDIA
O43 - CFD: 05/10/2010 - 21:10:26 ----D- C:\ProgramData\NVIDIA Corporation
O43 - CFD: 14/10/2010 - 20:32:06 ----D- C:\ProgramData\PMB Files
O43 - CFD: 12/02/2011 - 10:25:20 ----D- C:\ProgramData\PopCap Games
O43 - CFD: 06/10/2010 - 06:45:50 ----D- C:\ProgramData\Skype
O43 - CFD: 14/12/2010 - 02:37:30 ----D- C:\ProgramData\Spybot - Search & Destroy
O43 - CFD: 14/07/2009 - 06:08:58 -SH-D- C:\ProgramData\Start Menu
O43 - CFD: 12/02/2011 - 10:24:50 ----D- C:\ProgramData\Steam
O43 - CFD: 05/10/2010 - 21:09:46 ----D- C:\ProgramData\Sun
O43 - CFD: 12/12/2010 - 05:32:22 ---AD- C:\ProgramData\TEMP
O43 - CFD: 14/07/2009 - 06:08:58 -SH-D- C:\ProgramData\Templates
O43 - CFD: 05/10/2010 - 20:59:08 ----D- C:\Users\kolchok\AppData\Roaming\Adobe
O43 - CFD: 19/11/2010 - 20:02:08 ----D- C:\Users\kolchok\AppData\Roaming\AVG
O43 - CFD: 05/10/2010 - 22:17:50 ----D- C:\Users\kolchok\AppData\Roaming\BitDefender
O43 - CFD: 13/02/2011 - 04:51:42 ----D- C:\Users\kolchok\AppData\Roaming\DAEMON Tools Lite
O43 - CFD: 19/01/2011 - 09:33:44 ----D- C:\Users\kolchok\AppData\Roaming\DivX
O43 - CFD: 11/01/2011 - 10:46:26 ----D- C:\Users\kolchok\AppData\Roaming\Easeware
O43 - CFD: 05/10/2010 - 20:56:14 ----D- C:\Users\kolchok\AppData\Roaming\Identities
O43 - CFD: 05/10/2010 - 21:40:14 ----D- C:\Users\kolchok\AppData\Roaming\Leadertech
O43 - CFD: 18/01/2011 - 10:19:02 ----D- C:\Users\kolchok\AppData\Roaming\Local
O43 - CFD: 05/10/2010 - 21:40:22 ----D- C:\Users\kolchok\AppData\Roaming\Logitech
O43 - CFD: 14/10/2010 - 22:01:02 ----D- C:\Users\kolchok\AppData\Roaming\LolClient
O43 - CFD: 05/10/2010 - 20:59:08 ----D- C:\Users\kolchok\AppData\Roaming\Macromedia
O43 - CFD: 14/11/2010 - 19:03:52 ----D- C:\Users\kolchok\AppData\Roaming\Malwarebytes
O43 - CFD: 14/07/2009 - 08:45:16 ----D- C:\Users\kolchok\AppData\Roaming\Media Center Programs
O43 - CFD: 15/11/2010 - 03:25:56 -S--D- C:\Users\kolchok\AppData\Roaming\Microsoft
O43 - CFD: 18/12/2010 - 15:57:36 ----D- C:\Users\kolchok\AppData\Roaming\Mozilla
O43 - CFD: 12/02/2011 - 18:07:44 ----D- C:\Users\kolchok\AppData\Roaming\Mumble
O43 - CFD: 10/12/2010 - 17:25:06 ----D- C:\Users\kolchok\AppData\Roaming\QuickScan
O43 - CFD: 07/02/2011 - 04:29:04 ----D- C:\Users\kolchok\AppData\Roaming\Skype
O43 - CFD: 07/02/2011 - 02:25:58 ----D- C:\Users\kolchok\AppData\Roaming\skypePM
O43 - CFD: 26/11/2010 - 09:15:44 ----D- C:\Users\kolchok\AppData\Roaming\TS3Client
O43 - CFD: 13/02/2011 - 06:30:04 ----D- C:\Users\kolchok\AppData\Roaming\uTorrent
O43 - CFD: 13/02/2011 - 06:30:04 ----D- C:\Users\kolchok\AppData\Roaming\vlc
O43 - CFD: 18/12/2010 - 16:23:00 ----D- C:\Program Files (x86)\7-Zip
O43 - CFD: 06/10/2010 - 01:03:54 ----D- C:\Program Files (x86)\AVG
O43 - CFD: 06/10/2010 - 14:36:44 ----D- C:\Program Files (x86)\Cisco
O43 - CFD: 13/02/2011 - 06:30:08 ----D- C:\Program Files (x86)\Common Files
O43 - CFD: 13/02/2011 - 06:30:08 ----D- C:\Program Files (x86)\DAEMON Tools Lite
O43 - CFD: 13/02/2011 - 06:30:08 ----D- C:\Program Files (x86)\DAEMON Tools Toolbar
O43 - CFD: 18/01/2011 - 10:19:04 ----D- C:\Program Files (x86)\DivX
O43 - CFD: 14/12/2010 - 03:00:40 ----D- C:\Program Files (x86)\Feedback Tool
O43 - CFD: 11/01/2011 - 10:20:54 ----D- C:\Program Files (x86)\FileHippo.com
O43 - CFD: 18/12/2010 - 15:55:30 ----D- C:\Program Files (x86)\Google
O43 - CFD: 05/10/2010 - 20:54:56 ----D- C:\Program Files (x86)\ImgBurn
O43 - CFD: 11/01/2011 - 12:01:24 --H-D- C:\Program Files (x86)\InstallShield Installation Information
O43 - CFD: 14/12/2010 - 03:09:00 ----D- C:\Program Files (x86)\Internet Explorer
O43 - CFD: 30/12/2010 - 01:35:32 ----D- C:\Program Files (x86)\Java
O43 - CFD: 13/02/2011 - 06:48:28 ----D- C:\Program Files (x86)\Kaspersky Lab
O43 - CFD: 09/10/2010 - 18:17:26 ----D- C:\Program Files (x86)\Logitech
O43 - CFD: 24/11/2010 - 23:18:14 ----D- C:\Program Files (x86)\Magelo
O43 - CFD: 13/02/2011 - 07:01:40 ----D- C:\Program Files (x86)\Malwarebytes' Anti-Malware
O43 - CFD: 18/12/2010 - 01:36:24 ----D- C:\Program Files (x86)\Microsoft.NET
O43 - CFD: 18/12/2010 - 15:57:24 ----D- C:\Program Files (x86)\Mozilla Firefox
O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files (x86)\MSBuild
O43 - CFD: 22/11/2010 - 14:24:04 ----D- C:\Program Files (x86)\Mumble
O43 - CFD: 10/12/2010 - 17:24:16 ----D- C:\Program Files (x86)\NVIDIA Corporation
O43 - CFD: 20/10/2010 - 22:11:54 ----D- C:\Program Files (x86)\OpenAL
O43 - CFD: 14/10/2010 - 20:28:30 ----D- C:\Program Files (x86)\Pando Networks
O43 - CFD: 17/11/2010 - 03:27:12 ----D- C:\Program Files (x86)\REACTOR
O43 - CFD: 11/01/2011 - 12:01:26 ----D- C:\Program Files (x86)\Realtek
O43 - CFD: 06/10/2010 - 14:36:22 ----D- C:\Program Files (x86)\REALTEK PCIE Wireless LAN Driver
O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files (x86)\Reference Assemblies
O43 - CFD: 14/12/2010 - 02:57:44 R---D- C:\Program Files (x86)\Skype
O43 - CFD: 14/12/2010 - 02:37:32 ----D- C:\Program Files (x86)\Spybot - Search & Destroy
O43 - CFD: 13/02/2011 - 06:30:06 ----D- C:\Program Files (x86)\Steam
O43 - CFD: 11/01/2011 - 12:02:36 --H-D- C:\Program Files (x86)\Temp
O43 - CFD: 14/07/2009 - 05:57:08 --H-D- C:\Program Files (x86)\Uninstall Information
O43 - CFD: 13/02/2011 - 06:30:06 ----D- C:\Program Files (x86)\uTorrent
O43 - CFD: 05/10/2010 - 21:24:10 ----D- C:\Program Files (x86)\VIA
O43 - CFD: 06/10/2010 - 04:14:46 ----D- C:\Program Files (x86)\VideoLAN
O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files (x86)\Windows Defender
O43 - CFD: 17/12/2010 - 03:02:14 ----D- C:\Program Files (x86)\Windows Mail
O43 - CFD: 14/10/2010 - 02:19:38 ----D- C:\Program Files (x86)\Windows Media Player
O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files (x86)\Windows NT
O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files (x86)\Windows Photo Viewer
O43 - CFD: 14/07/2009 - 06:32:42 ----D- C:\Program Files (x86)\Windows Portable Devices
O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files (x86)\Windows Sidebar
O43 - CFD: 13/02/2011 - 06:30:06 ----D- C:\Program Files (x86)\World of Warcraft
O43 - CFD: 10/12/2010 - 17:25:04 ----D- C:\Program Files (x86)\WowCartographe
O43 - CFD: 13/02/2011 - 07:57:16 ----D- C:\Program Files (x86)\ZHPDiag
O43 - CFD: 05/10/2010 - 22:17:46 ----D- C:\Program Files\Common Files\BitDefender
O43 - CFD: 05/10/2010 - 21:40:10 ----D- C:\Program Files\Common Files\Logishrd
O43 - CFD: 05/10/2010 - 22:17:14 ----D- C:\Program Files\Common Files\Microsoft Shared
O43 - CFD: 14/07/2009 - 04:20:10 ----D- C:\Program Files\Common Files\Services
O43 - CFD: 14/07/2009 - 04:20:10 ----D- C:\Program Files\Common Files\SpeechEngines
O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files\Common Files\System


---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.6E6AB42B1E46515E74F4B174EE301133] - 13/02/2011 - 06:59:44 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\PerfStringBackup.INI [1549700]
O44 - LFC:[MD5.09C4D7263A582415887DFB85C56CE9FE] - 13/02/2011 - 06:59:44 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\perfc009.dat [106190]
O44 - LFC:[MD5.1B6566646D9386D0FA3A4084953783C3] - 13/02/2011 - 06:59:44 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\perfc00C.dat [130068]
O44 - LFC:[MD5.2DEFBD5D5B5C7007305612987CE8BB6D] - 13/02/2011 - 06:59:44 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\perfh009.dat [615810]
O44 - LFC:[MD5.A417B7FEAFB73ED5E7F90E70E4326FE3] - 13/02/2011 - 06:59:44 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\perfh00C.dat [702362]
O44 - LFC:[MD5.05000000000000000000000088ED1800] - 13/02/2011 - 06:57:58 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\WindowsUpdate.log [2054767]
O44 - LFC:[MD5.96F0D920EB5C0D5410172989BCAE0B2A] - 13/02/2011 - 06:54:29 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\setupact.log [5604]
O44 - LFC:[MD5.633A96C2BFF6469084C564A640027134] - 13/02/2011 - 06:54:18 -S-A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\bootstat.dat [67584]
O44 - LFC:[MD5.55DF0BB289FDC8FF2D50424B4F8D9C7A] - 13/02/2011 - 06:42:34 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\PFRO.log [38792]
O44 - LFC:[MD5.B26A8BFA9D56E1959EF0FA108E0163AA] - 13/02/2011 - 05:00:14 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\DirectX.log [24866]
O44 - LFC:[MD5.7CE5DA32084FB3098D1D3C052B4E4315] - 09/02/2011 - 12:24:11 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\FNTCACHE.DAT [274464]
O44 - LFC:[MD5.158D85C26868E8A9903A726CE145F66B] - 09/02/2011 - 00:51:03 ---A- . (.Adobe Systems - Windows NT OpenType/Type 1 API Library..) -- C:\Windows\SysNative\atmlib.dll [46080]
O44 - LFC:[MD5.158D85C26868E8A9903A726CE145F66B] - 09/02/2011 - 00:51:03 ---A- . (.Adobe Systems - Windows NT OpenType/Type 1 API Library..) -- C:\Windows\System32\atmlib.dll [34304]
O44 - LFC:[MD5.BF973CEDCD012D23F194BBF0A9B218E6] - 09/02/2011 - 00:51:03 ---A- . (.Adobe Systems Incorporated - Windows NT OpenType/Type 1 Font Driver.) -- C:\Windows\SysNative\atmfd.dll [366080]
O44 - LFC:[MD5.BF973CEDCD012D23F194BBF0A9B218E6] - 09/02/2011 - 00:51:03 ---A- . (.Adobe Systems Incorporated - Windows NT OpenType/Type 1 Font Driver.) -- C:\Windows\System32\atmfd.dll [294400]
O44 - LFC:[MD5.31EC5484E49027D8718FA3C4EA9A148A] - 07/02/2011 - 22:54:59 --HA- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [16848]
O44 - LFC:[MD5.31EC5484E49027D8718FA3C4EA9A148A] - 07/02/2011 - 22:54:59 --HA- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [16848]


---\\ Trojan Driver Search Data (HKLM) (O52)
O52 - TDSD: \Drivers32\"msacm.l3acm"="C:\Windows\System32\l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm
O52 - TDSD: \drivers.desc\"C:\Windows\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm


---\\ Microsoft Control Security Providers (O54)
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\system32\credssp.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\system32\credssp.dll


---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorAdmin"=5
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=3
O55 - MWPS:[HKLM\...\Policies\System] - "EnableInstallerDetection"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableSecureUIAPaths"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableVirtualization"=1
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=1
O55 - MWPS:[HKLM\...\Policies\System] - "ValidateAdminCodeSignatures"=0
O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=
O55 - MWPS:[HKLM\...\Policies\System] - "scforceoption"=0
O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "VerboseStatus"=1


---\\ Microsoft Windows Policies Explorer (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoLowDiskSpaceChecks"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "LinkResolveIgnoreLinkInfo"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoResolveSearch"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoResolveTrack"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoInternetOpenWith"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveTypeAutoRun"=255
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoSMBalloonTip"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktop"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "ForceActiveDesktopOn"=0
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDriveTypeAutoRun"=255


---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.2F6B34B83843F0C5118B63AC634F5BF4] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\system32\drivers\adp94xx.sys [491088]
O58 - SDL:[MD5.597F78224EE9224EA1A13D6350CED962] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SATA Storport Driver.) -- C:\Windows\system32\drivers\adpahci.sys [339536]
O58 - SDL:[MD5.E109549C90F62FB570B9540C4B148E54] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec StorPort Ultra320 SCSI Driver (X64).) -- C:\Windows\system32\drivers\adpu320.sys [182864]
O58 - SDL:[MD5.5812713A477A3AD7363C7438CA2EE038] - 14/07/2009 - 02:52:21 ---A- . (.Acer Laboratories Inc. - ALi mini IDE Driver.) -- C:\Windows\system32\drivers\aliide.sys [15440]
O58 - SDL:[MD5.7A4B413614C055935567CF88A9734D38] - 14/07/2009 - 02:52:21 ---A- . (.Advanced Micro Devices - AHCI 1.2 Device Driver.) -- C:\Windows\system32\drivers\amdsata.sys [106576]
O58 - SDL:[MD5.F67F933E79241ED32FF46A4F29B5120B] - 14/07/2009 - 02:52:20 ---A- . (.AMD Technologies Inc. - AMD Technology AHCI Compatible Controller Driver for Windows -.) -- C:\Windows\system32\drivers\amdsbs.sys [194128]
O58 - SDL:[MD5.B4AD0CACBAB298671DD6F6EF7E20679D] - 14/07/2009 - 02:52:21 ---A- . (.Advanced Micro Devices - Storage Filter Driver.) -- C:\Windows\system32\drivers\amdxata.sys [28752]
O58 - SDL:[MD5.C484F8CEB1717C540242531DB7845C4E] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec RAID Storport Driver.) -- C:\Windows\system32\drivers\arc.sys [87632]
O58 - SDL:[MD5.019AF6924AEFE7839F61C830227FE79C] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec SAS RAID WS03 Driver.) -- C:\Windows\system32\drivers\arcsas.sys [97856]
O58 - SDL:[MD5.B5ACE6968304A3900EEB1EBFD9622DF2] - 10/06/2009 - 21:34:23 ---A- . (.Broadcom Corporation - Broadcom NetXtreme Gigabit Ethernet NDIS6.x Unified Driver..) -- C:\Windows\system32\drivers\b57nd60a.sys [270848]
O58 - SDL:[MD5.F09EEE9EDC320B5E1501F749FDE686C8] - 10/06/2009 - 21:41:06 ---A- . (.Brother Industries, Ltd. - Windows ME USB Mass-Storage Bulk-Only Lower Filter Driver.) -- C:\Windows\system32\drivers\BrFiltLo.sys [18432]
O58 - SDL:[MD5.B114D3098E9BDB8BEA8B053685831BE6] - 10/06/2009 - 21:41:06 ---A- . (.Brother Industries, Ltd. - Windows ME USB Mass-Storage Bulk-Only Upper Filter Driver.) -- C:\Windows\system32\drivers\BrFiltUp.sys [8704]
O58 - SDL:[MD5.43BEA8D483BF1870F018E2D02E06A5BD] - 14/07/2009 - 02:19:07 ---A- . (.Brother Industries Ltd. - Pilote Brother Série I/F (WDM).) -- C:\Windows\system32\drivers\BrSerId.sys [286720]
O58 - SDL:[MD5.A6ECA2151B08A09CACECA35C07F05B42] - 10/06/2009 - 21:41:10 ---A- . (.Brother Industries Ltd. - Brother Serial driver (WDM version).) -- C:\Windows\system32\drivers\BrSerWdm.sys [47104]
O58 - SDL:[MD5.B79968002C277E869CF38BD22CD61524] - 10/06/2009 - 21:41:10 ---A- . (.Brother Industries Ltd. - Brother USB MDM Driver.) -- C:\Windows\system32\drivers\BrUsbMdm.sys [14976]
O58 - SDL:[MD5.A87528880231C54E75EA7A44943B38BF] - 10/06/2009 - 21:41:10 ---A- . (.Brother Industries Ltd. - Brother USB Serial Driver.) -- C:\Windows\system32\drivers\BrUsbSer.sys [14720]
O58 - SDL:[MD5.3E5B191307609F7514148C6832BB0842] - 10/06/2009 - 21:34:28 ---A- . (.Broadcom Corporation - Broadcom NetXtreme II GigE VBD.) -- C:\Windows\system32\drivers\bxvbda.sys [468480]
O58 - SDL:[MD5.E19D3F095812725D88F9001985B94EDD] - 14/07/2009 - 02:52:31 ---A- . (.CMD Technology, Inc. - CMD PCI IDE Bus Driver.) -- C:\Windows\system32\drivers\cmdide.sys [17488]
O58 - SDL:[MD5.AB1201F8DE199E764DA9A32ABF71049C] - 14/12/2009 - 11:44:24 ---A- . (.Infowatch - Cryptographic Algorithm Lib Driver..) -- C:\Windows\system32\drivers\CSCrySec.sys [85048]
O58 - SDL:[MD5.A6EED705BB510FA6B0F9F097165A3395] - 14/12/2009 - 11:44:24 ---A- . (.Infowatch - Virtual Volume Container Driver (wnet).) -- C:\Windows\system32\drivers\CSVirtualDiskDrv.sys [66104]
O58 - SDL:[MD5.FB9BEF3401EE5ECC2603311B9C64F44A] - 13/02/2011 - 04:49:37 ---A- . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) -- C:\Windows\system32\drivers\dtsoftbus01.sys [254528]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\system32\drivers\elxstor.sys [530496]
O58 - SDL:[MD5.DC5D737F51BE844D8C82C695EB17372F] - 10/06/2009 - 21:34:33 ---A- . (.Broadcom Corporation - Broadcom NetXtreme II 10 GigE VBD.) -- C:\Windows\system32\drivers\evbda.sys [3286016]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\system32\drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.0886D440058F203EBA0E1825E4355914] - 14/07/2009 - 02:47:48 ---A- . (.Hewlett-Packard Company - Smart Array SAS/SATA Controller Media Driver.) -- C:\Windows\system32\drivers\HpSAMD.sys [77888]
O58 - SDL:[MD5.D83EFB6FD45DF9D55E9A1AFC63640D50] - 14/07/2009 - 02:48:04 ---A- . (.Intel Corporation - Intel Matrix Storage Manager driver - x64.) -- C:\Windows\system32\drivers\iaStorV.sys [410688]
O58 - SDL:[MD5.5C18831C61933628F5BB0EA2675B9D21] - 14/07/2009 - 02:48:04 ---A- . (.Intel Corp./ICP vortex GmbH - Intel/ICP Raid Storport Driver.) -- C:\Windows\system32\drivers\iirsp.sys [44112]
O58 - SDL:[MD5.8D7120743A0973CEAB548B475C9D4289] - 09/06/2010 - 17:43:56 ---A- . (.Kaspersky Lab ZAO - Kaspersky Unified Driver.) -- C:\Windows\system32\drivers\kl1.sys [460888]
O58 - SDL:[MD5.CD146D8E525D6EEBDCAF24120A8AB9CE] - 09/06/2010 - 17:44:00 ---A- . (.Kaspersky Lab ZAO - Kaspersky Unified Driver.) -- C:\Windows\system32\drivers\kl2.sys [11864]
O58 - SDL:[MD5.AC8EEDF4D19A9A346EAB696FCE3C36B3] - 13/02/2011 - 06:48:17 ---A- . (.Kaspersky Lab - Klif Mini-Filter [fre_wlh_AMD64].) -- C:\Windows\system32\drivers\klif.sys [563288]
O58 - SDL:[MD5.2A64B3A9EED93A2E96537B67C079FC96] - 22/04/2010 - 19:07:36 ---A- . (.Kaspersky Lab ZAO - Kaspersky Lab Intermediate Network Driver.) -- C:\Windows\system32\drivers\klim6.sys [27736]
O58 - SDL:[MD5.9468D07E91BA136D82415F5DFC1FE168] - 02/11/2009 - 20:27:10 ---A- . (.Kaspersky Lab - KLMOUFLT Mouse Device Filter [fre_wlh_AMD64].) -- C:\Windows\system32\drivers\klmouflt.sys [22544]
O58 - SDL:[MD5.FA529FB35694C24BF98A9EF67C1CD9D0] - 23/11/2009 - 16:37:50 ---A- . (.Logitech Inc. - Logitech WingMan Virtual Bus Enumerator Driver.) -- C:\Windows\system32\drivers\LGBusEnum.sys [22408]
O58 - SDL:[MD5.94B29CE153765E768F004FB3440BE2B0] - 23/11/2009 - 16:38:00 ---A- . (.Logitech Inc. - Logitech GamePanel Virtual Hid Device Driver.) -- C:\Windows\system32\drivers\LGVirHid.sys [16008]
O58 - SDL:[MD5.B6552D382FF070B4ED34CBD6737277C0] - 17/06/2009 - 17:54:22 ---A- . (.Logitech, Inc. - Logitech HID Filter Driver..) -- C:\Windows\system32\drivers\LHidFilt.Sys [55312]
O58 - SDL:[MD5.73C1F563AB73D459DFFE682D66476558] - 17/06/2009 - 17:54:30 ---A- . (.Logitech, Inc. - Logitech Mouse Filter Driver..) -- C:\Windows\system32\drivers\LMouFilt.Sys [57872]
O58 - SDL:[MD5.1A93E54EB0ECE102495A51266DCDB6A6] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - LSI Fusion-MPT FC Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_fc.sys [114752]
O58 - SDL:[MD5.1047184A9FDC8BDBFF857175875EE810] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - LSI Fusion-MPT SAS Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_sas.sys [106560]
O58 - SDL:[MD5.30F5C0DE1EE8B5BC9306C1F0E4A75F93] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - LSI SAS Gen2 Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_sas2.sys [65600]
O58 - SDL:[MD5.0504EACAFF0D3C8AED161C4B0D369D4A] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - LSI Fusion-MPT SCSI Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_scsi.sys [115776]
O58 - SDL:[MD5.3D3C4B63F11F63F50253E734F0ACE9F2] - 20/12/2010 - 18:08:40 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Windows\system32\drivers\mbam.sys [24152]
O58 - SDL:[MD5.A55805F747C6EDB6A9080D7C633BD0F4] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - MEGASAS RAID Controller Driver for Windows 7\Server 2008 R2 for.) -- C:\Windows\system32\drivers\megasas.sys [35392]
O58 - SDL:[MD5.BAF74CE0072480C3B6B7C13B2A94D6B3] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation, Inc. - LSI MegaRAID Software RAID Driver.) -- C:\Windows\system32\drivers\MegaSR.sys [284736]
O58 - SDL:[MD5.77889813BE4D166CDAB78DDBA990DA92] - 14/07/2009 - 02:48:26 ---A- . (.IBM Corporation - IBM ServeRAID Controller Driver.) -- C:\Windows\system32\drivers\nfrd960.sys [51264]
O58 - SDL:[MD5.ED9380F201C8126425C09BED96DBE1E5] - 07/09/2010 - 21:08:55 ---A- . (.NVIDIA Corporation - NVIDIA HDMI Audio Driver.) -- C:\Windows\system32\drivers\nvhda64v.sys [155752]
O58 - SDL:[MD5.BBE872A814B00798C2D568D46C42A71B] - 22/10/2010 - 07:23:15 ---A- . (.NVIDIA Corporation - NVIDIA Windows Kernel Mode Driver, Version 260.99.) -- C:\Windows\system32\drivers\nvlddmkm.sys [12432616]
O58 - SDL:[MD5.3E38712941E9BB4DDBEE00AFFE3FED3D] - 14/07/2009 - 02:48:27 ---A- . (.NVIDIA Corporation - NVIDIA® nForce™ RAID Driver.) -- C:\Windows\system32\drivers\nvraid.sys [149056]
O58 - SDL:[MD5.477DC4D6DEB99BE37084C9AC6D013DA1] - 14/07/2009 - 02:45:45 ---A- . (.NVIDIA Corporation - NVIDIA® nForce™ Sata Performance Driver.) -- C:\Windows\system32\drivers\nvstor.sys [167488]
O58 - SDL:[MD5.A53A15A11EBFD21077463EE2C7AFEEF0] - 14/07/2009 - 02:45:46 ---A- . (.QLogic Corporation - QLogic Fibre Channel Stor Miniport Driver.) -- C:\Windows\system32\drivers\ql2300.sys [1524816]
O58 - SDL:[MD5.4F6D12B51DE1AAEFF7DC58C4D75423C8] - 14/07/2009 - 02:45:45 ---A- . (.QLogic Corporation - QLogic iSCSI Storport Miniport Driver.) -- C:\Windows\system32\drivers\ql40xx.sys [128592]
O58 - SDL:[MD5.0B21B66574E5478FA10CCA2D36694C2D] - 30/12/2010 - 11:59:18 ---A- . (.Realtek Semiconductor Corp. - Realtek® High Definition Audio Function Driver.) -- C:\Windows\system32\drivers\RTKVHD64.sys [2690280]
O58 - SDL:[MD5.183C4139EC67E7506927DE5EAD28CAAE] - 06/10/2010 - 14:34:28 ---A- . (.Realtek Semiconductor Corporation - Realtek RTL81892SE NDIS Driverr.) -- C:\Windows\system32\drivers\rtl8192se.sys [1108000]
O58 - SDL:[MD5.04C2D5BD8D0776320230978A0AEC3BD0] - 23/07/2009 - 21:03:10 ---A- . (.Realtek Semiconductor Corporation - Realtek 10/100 X64 Driver.) -- C:\Windows\system32\drivers\Rtnic64.sys [52736]
O58 - SDL:[MD5.3EA8A16169C26AFBEB544E0E48421186] - 10/06/2009 - 21:37:19 ---A- . (.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) -- C:\Windows\system32\drivers\secdrv.sys [23040]
O58 - SDL:[MD5.843CAF1E5FDE1FFD5FF768F23A51E2E1] - 14/07/2009 - 02:45:45 ---A- . (.Silicon Integrated Systems Corp. - SiS RAID Stor Miniport Driver.) -- C:\Windows\system32\drivers\sisraid2.sys [43584]
O58 - SDL:[MD5.6A6C106D42E9FFFF8B9FCB4F754F6DA4] - 14/07/2009 - 02:45:46 ---A- . (.Silicon Integrated Systems - SiS AHCI Stor-Miniport Driver.) -- C:\Windows\system32\drivers\sisraid4.sys [80464]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\system32\drivers\stexstor.sys [24656]
O58 - SDL:[MD5.E5689D93FFE4E5D66C0178761240DD54] - 14/07/2009 - 02:45:55 ---A- . (.VIA Technologies, Inc. - VIA Generic PCI IDE Bus Driver.) -- C:\Windows\system32\drivers\viaide.sys [17488]
O58 - SDL:[MD5.FB2643A01A538C2E4625CDE64E51680F] - 11/02/2010 - 11:00:22 ---A- . (.VIA Technologies, Inc. - VIA Generic PCI IDE Bus Driver.) -- C:\Windows\system32\drivers\videX64.sys [15000]
O58 - SDL:[MD5.5E2016EA6EBACA03C04FEAC5F330D997] - 14/07/2009 - 02:45:55 ---A- . (.VIA Technologies Inc.,Ltd - VIA RAID DRIVER FOR AMD-X86-64.) -- C:\Windows\system32\drivers\vsmraid.sys [161872]
O58 - SDL:[MD5.FE48AE43D06C1CF6EC1244FA3562D203] - 11/02/2010 - 11:01:20 ---A- . (.VIA Technologies, Inc. - ATA/ATAPI devices Hot-Plug/DIPM monitor.) -- C:\Windows\system32\drivers\xfiltx64.sys [26776]
O58 - SDL:[MD5.D68E165C3123ABA3B1282EDDB4213BD8] - 20/12/2010 - 18:09:00 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Windows\SysWOW64\drivers\mbamswissarmy.sys [38224]


---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 1.27 - (.Nicolas Coolman.) [HKLM][64Bits] -- ZHPDiag_is1


---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.bat> <batfile>[HKLM\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.cpl> <cplfile>[HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\Windows\System32\control.exe
O67 - Shell Spawning: <.cmd> <cmdfile>[HKLM\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.com> <comfile>[HKLM\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.exe> <exefile>[HKLM\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKLM\..\open\Command] (.Not Key.)
O67 - Shell Spawning: <.js> <JSFile>[HKLM\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\WScript.exe
O67 - Shell Spawning: <.reg> <regfile>[HKLM\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\Windows\regedit.exe
O67 - Shell Spawning: <.html> <FirefoxHTML>[HKCU\..\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O67 - Shell Spawning: <.bat> <batfile>[HKCR\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.cpl> <cplfile>[HKCR\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\Windows\System32\control.exe
O67 - Shell Spawning: <.cmd> <cmdfile>[HKCR\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.com> <comfile>[HKCR\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.exe> <exefile>[HKCR\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.html> <FirefoxHTML>[HKCR\..\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O67 - Shell Spawning: <.js> <JSFile>[HKCR\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\WScript.exe
O67 - Shell Spawning: <.reg> <regfile>[HKCR\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\Windows\regedit.exe


---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe


---\\ Search Browser Infection (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - Bing
O69 - SBI: SearchScopes [HKCU] {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} [DefaultScope] - (DAEMON Search) - DAEMON-Search.com :: EXPLORE


---\\ Firewall Active Exception List (FirewallRules) (O87)
O87 - FAEL: "FPS-SpoolSvc-In-TCP-NoScope" |In - Domain - P6 - FALSE | .(...) -- C:\Windows\system32\spoolsv.exe (.not file.)
O87 - FAEL: "FPS-SpoolSvc-In-TCP" |In - Public - P6 - FALSE | .(...) -- C:\Windows\system32\spoolsv.exe (.not file.)
O87 - FAEL: "CoreNet-GP-LSASS-Out-TCP" |Out - Domain - P6 - TRUE | .(...) -- C:\Windows\system32\lsass.exe (.not file.)
O87 - FAEL: "RemoteSvcAdmin-In-TCP-NoScope" |In - Domain - P6 - FALSE | .(...) -- C:\Windows\system32\services.exe (.not file.)
O87 - FAEL: "RemoteSvcAdmin-In-TCP" |In - Public - P6 - FALSE | .(...) -- C:\Windows\system32\services.exe (.not file.)
O87 - FAEL: "NetPres-In-TCP-NoScope" |In - Domain - P6 - FALSE | .(...) -- C:\Windows\system32\netproj.exe (.not file.)
O87 - FAEL: "NetPres-Out-TCP-NoScope" |Out - Domain - P6 - FALSE | .(...) -- C:\Windows\system32\netproj.exe (.not file.)
O87 - FAEL: "NetPres-WSD-In-UDP" |In - None - P17 - FALSE | .(...) -- C:\Windows\system32\netproj.exe (.not file.)
O87 - FAEL: "NetPres-WSD-Out-UDP" |Out - None - P17 - FALSE | .(...) -- C:\Windows\system32\netproj.exe (.not file.)
O87 - FAEL: "NetPres-In-TCP" |In - Public - P6 - FALSE | .(...) -- C:\Windows\system32\netproj.exe (.not file.)
O87 - FAEL: "NetPres-Out-TCP" |Out - Public - P6 - FALSE | .(...) -- C:\Windows\system32\netproj.exe (.not file.)
O87 - FAEL: "MCX-Prov-Out-TCP" | Out - None - P6 - FALSE | .(.Microsoft Corporation - MCX2 Provisioning library.) -- C:\Windows\ehome\mcx2prov.exe
O87 - FAEL: "MCX-McrMgr-Out-TCP" | Out - None - P6 - FALSE | .(.Microsoft Corporation - Media Center Extender Manager.) -- C:\Windows\ehome\mcrmgr.exe
O87 - FAEL: "{8226F8FC-1EF9-45B8-A528-ED7463CE3DE7}" | In - None - P6 - TRUE | .(.BitTorrent, Inc. - µTorrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe
O87 - FAEL: "{80DD08FC-AB3E-402B-A344-6EE05AA49D05}" | In - None - P17 - TRUE | .(.BitTorrent, Inc. - µTorrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe
O87 - FAEL: "{816932D7-6388-4B9A-B5CE-A812F91E3B45}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{D65BEE89-49A0-484E-9A59-6E5A3C9DD37D}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{BB8B5F75-B581-4C65-AD88-CE1279CA6DDA}" | In - Domain - P17 - TRUE | .(.Skype Technologies - Skype Extras Manager.) -- C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
O87 - FAEL: "{B91E3B28-0137-4571-913C-178849AEE400}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{4864F99A-C150-48F2-92AA-BA880B8ACD59}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{419B3769-1057-4B54-B166-26E160056FF8}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{FB8A6CA6-55B0-4DFF-BD6A-6E5066339210}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{B13FA055-828A-44A7-A4E3-CA12F002FCEA}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{9571BD49-B29A-43B0-88A8-D2CE930104C8}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{7C889E97-7570-4112-ACDE-EE5BEC3E7466}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{887948E1-0EC8-4D37-BC80-90EE6AB1E71E}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{12552D8C-3B68-4E69-B041-0E4B2BCFBA20}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{CAF43C23-9FDE-4686-93BF-2D3E99E4EF9F}" | In - Domain - P6 - TRUE | .(.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O87 - FAEL: "{55D0A426-256A-4FAF-A420-27838F58EA7F}" | In - Domain - P17 - TRUE | .(.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O87 - FAEL: "{51A06FB7-74A8-44D0-9062-C7372BDD0D90}" | In - Private - P6 - TRUE | .(.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O87 - FAEL: "{8124EB78-9C20-49E8-8AD7-9548B61916FC}" | In - Private - P17 - TRUE | .(.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O87 - FAEL: "{7935A6D6-B921-414A-8876-73AA209DC65A}" | In - None - P17 - TRUE | .(.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O87 - FAEL: "{06498012-F5CE-4B32-83AE-4D70A9CF71B1}" | In - Public - P6 - TRUE | .(.Adobe Systems Inc. - Adobe AIR Debug Launcher.) -- C:\Riot Games\League of Legends\air\LolClient.exe
O87 - FAEL: "{676ED253-51E2-44D4-8163-5EA3A05DE596}" | In - Public - P17 - TRUE | .(.Adobe Systems Inc. - Adobe AIR Debug Launcher.) -- C:\Riot Games\League of Legends\air\LolClient.exe
O87 - FAEL: "{0782F6F4-D750-40C6-AAB3-ED27AC358398}" | In - Public - P6 - TRUE | .(.Pas de propriétaire - League of Legends ™ Client.) -- C:\Riot Games\League of Legends\game\League of Legends.exe
O87 - FAEL: "{125EED06-EF83-4F4C-B33B-901A7AA6C7C3}" | In - Public - P17 - TRUE | .(.Pas de propriétaire - League of Legends ™ Client.) -- C:\Riot Games\League of Legends\game\League of Legends.exe
O87 - FAEL: "{018C3AF2-9AD4-4A17-A5DC-D563CD98CA66}" | In - Public - P6 - TRUE | .(.Valve Corporation - Steam.) -- C:\Program Files (x86)\Steam\Steam.exe
O87 - FAEL: "{E3C67465-44C7-4944-B2D1-F6BEED19AFFF}" | In - Public - P17 - TRUE | .(.Valve Corporation - Steam.) -- C:\Program Files (x86)\Steam\Steam.exe
O87 - FAEL: "{705E3883-0961-430F-A57B-78449F23F0FE}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{3E55B250-BD09-4471-89A5-AE3B42E445A6}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{205FE13D-4BAC-4BBF-A8C8-F1F31796768F}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{CCA7BE9A-2EC4-4799-BB78-1872B7F4927D}" | In - Public - P6 - TRUE | .(.Io Interactive A/S - Kane & Lynch 2: Dog Days.) -- C:\Program Files (x86)\Steam\SteamApps\common\kane & lynch 2 - dog days demo\kl2.exe
O87 - FAEL: "{989FCCC8-D09E-42D9-8569-834857C195FC}" | In - Public - P17 - TRUE | .(.Io Interactive A/S - Kane & Lynch 2: Dog Days.) -- C:\Program Files (x86)\Steam\SteamApps\common\kane & lynch 2 - dog days demo\kl2.exe
O87 - FAEL: "{4FF8B30C-EE6A-48D1-B20E-1A130CA16B26}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{B824D521-FA78-4A8A-8212-E9F7F72D9A85}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{6BE36013-A091-43D5-98D3-A6B7B90333A1}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{E68B9DBE-03E3-4731-89CB-F1152854A808}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{443CA10C-F050-48AD-AAC9-1157FFA1CEE4}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{B615AAE5-9D3C-43AD-AADD-9160F01BEB83}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{F00E58C9-4413-4677-84B1-97C0A9DD28CD}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{8BFB8740-9288-49DE-9184-06A0C9E21062}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O87 - FAEL: "{C4B7101A-38F5-4192-AA70-CFB540C77CC2}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\ma-config.com\x64\maconfservice.exe (.not file.)
O87 - FAEL: "{AC8680A1-26D7-47DD-A584-81FC574C348A}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\ma-config.com\x64\maconfservice.exe (.not file.)
O87 - FAEL: "{DA6A5838-8D11-40CA-962C-A10E10F14370}" | In - Public - P6 - TRUE | .(...) -- C:\Program Files (x86)\Steam\SteamApps\alshimiste\counter-strike source\hl2.exe
O87 - FAEL: "{02AA838A-0E59-45DE-BFA4-D2BA187A91C3}" | In - Public - P17 - TRUE | .(...) -- C:\Program Files (x86)\Steam\SteamApps\alshimiste\counter-strike source\hl2.exe
O87 - FAEL: "{24A24142-5057-4246-B029-BDBAFEC07079}" | In - Public - P6 - TRUE | .(...) -- C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2.exe
O87 - FAEL: "{D9EA94CE-6204-45C4-AA51-7B59661E18AA}" | In - Public - P17 - TRUE | .(...) -- C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2.exe


---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Auto 18/11/2010 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 20/07/2009 160784 | (LBTServ) . (.Logitech, Inc..) - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
SR - | Auto 20/07/2009 0 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SS - | Auto 20/07/2009 0 | (sdmBackupIP) . (.Pas de propriétaire.) - C:\Windows\BackupIP\service.exe
SS - | Demand 12/02/2011 407336 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
SR - | Auto 16/10/2010 369256 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
SR - | Auto 14/07/2009 20992 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\system32\svchost.exe


---\\ Recherche Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.1 by Gmer, GMER - Rootkit Detector and Remover
Run by kolchok at 13/02/2011 07:58:16

device: opened successfully
user: error reading MBR

Disk trace:
error: Read Descripteur non valide
kernel: error reading MBR


---\\ Recherche Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by kolchok at 13/02/2011 07:58:16
Use the desktop link 'MBRCheck' to have full report




---\\ Liste des émulateurs de CD/DVD (Hook du MBR)
O42 - Logiciel: DAEMON Tools Lite - (.DT Soft Ltd.) [HKLM][64Bits] -- DAEMON Tools Lite
O42 - Logiciel: DAEMON Tools Toolbar - (.DT Soft Ltd.) [HKLM][64Bits] -- DAEMON Tools Toolbar



End of the scan (779 lines in 01mn 06s)(0)

Ce message a été modifié par kolchok - 19 février 2011 - 06:30 .

Téléchargez AD-Remover sur le bureau


Déconnectez-vous et fermez toutes les applications en cours
Cliquer sur "Ad-R.exe" pour lancer l'installation et laisser les paramètres par défaut .
Une fenêtre s'affichera Vous prévenant des risques de l'utilisation de ce logiciel
Cliquez sur "OUI"
Double cliquer sur l'icône Ad-remover sur le bureau

Au menu principal choisir l'optionScanner et Validez

Patientez pendant le travail de l'outil.
Poster le rapport qui apparait à la fin .
Il est sauvegardé aussi sous C:\Ad-report.log

Ensuite

Relancer Ad- remover , choisir l'option Nettoyer

Il y aura 2 rapports à poster après :Scanner et Nettoyer

Pour désinstaller AD-Remover, lancez avec l'option D puis supprimer l'icône du bureau.

Télécharger Rogue Killer par Tigzy sur le bureau
Sous Vista/Seven , clic droit -> lancer en tant qu'administrateur
Si le porgramme bloque, cliquez droit sur le lien ci-dessus->Enregistrer sous..
Dans la fenêtre qui s'ouvre renommez Roguekiller ->Winlogon.exe
Quittez tous tes programmes en cours et lancez le
Quand on vous le demande, tapez 1 et valider
Un rapport (RKreport.txt) apparait sur le bureau
montrant les processus infectieux tués
Copier/Coller son contenu dans la réponse


Nettoyage du registre ou suppression d'un proxy Passer en Mode 2

Si votre fichier HOSTS est corrompu (Section HOSTS du rapport), relancer RogueKiller en mode 3 pour en restaurer une copie saine

Lancez Mbam, mettez à jour et faites une recherche approfondie.

Ce message a été modifié par pear - 13 février 2011 - 04:20 .

bonsoir, voici les rapports

======= REPORT FROM AD-REMOVER 2.0.0.2,E | ONLY XP/VISTA/7 =======

Updated by TeamXscript on 08/02/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
website: TeamXscript : AD-Remover - FindyKill - UsbFix - SEAF

C:\Program Files (x86)\Ad-Remover\main.exe (SCAN [1]) -> Launched at 21:05:01 on 13/02/2011, Normal boot

Microsoft Windows 7 Édition Intégrale (X64)
kolchok@LOKI (Packard Bell BV iXtreme X9777)

============== SEARCH ==============

Service: "sdmBackupIP" Service found

File found: C:\Windows\SysWOW64\Utils.dll

Key found: HKLM\Software\Install Pedia Limited


============== ADDITIONNAL SCAN ==============

**** Mozilla Firefox Version [3.6.13 (fr)] ****

HKLM_MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0 (x)
HKLM_MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0 (x)
HKLM_MozillaPlugins\@nvidia.com/3DVision (x)
HKLM_MozillaPlugins\@nvidia.com/3DVisionStreaming (x)
HKLM_MozillaPlugins\@pandonetworks.com/PandoWebPlugin (x)
HKCU_MozillaPlugins\pandonetworks.com/PandoWebPlugin (x)
Extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} (Skype extension for Firefox )
HKLM_Extensions|FFToolbar@bitdefender.com - C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\ (x)
HKLM_Extensions|{23fcfd51-4958-4f00-80a3-ae97e717ed8b} - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video
HKLM_Extensions|{6904342A-8307-11DF-A508-4AE2DFD72085} - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa

-- C:\Users\kolchok\AppData\Roaming\Mozilla\FireFox\Profiles\je2z1rt4.default --
Searchplugins\daemon-search.xml (hxxp://www.daemon-search.com/search/web?q={searchTerms}/)
Prefs.js - browser.download.lastDir, C:\\Users\\kolchok\\Pictures
Prefs.js - browser.startup.homepage, hxxp://my.daemon-search.com/startpage|resource:/browserconfig.properties
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.13

========================================

**** Internet Explorer Version [9.0.7930.16406] ****

HKCU_Main|Search Page - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=69157
HKLM_Main|Default_Search_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Search Page - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Start Page - hxxp://go.microsoft.com/fwlink/?LinkId=69157
HKCU_SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} - "DAEMON Search" (hxxp://www.daemon-search.com/search/web?q={searchTerms})
HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\SysWOW64\wpcer.exe (x)
HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\SysWOW64\winfxdocobj.exe (x)
HKLM_ElevationPolicy\{5F17E524-3447-4c7d-8E5F-4EFF31CDE3B7} - C:\Program Files (x86)\DivX\DivX Plus Web Player\DDMService.exe (DivX, LLC)
HKLM_ElevationPolicy\{64903E32-AE0B-408D-909C-09A08791F28D} - C:\Program Files (x86)\DivX\DivX Plus Web Player\dwpBroker.exe (DivX, LLC)
HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files (x86)\Internet Explorer\iedw.exe (x)
HKLM_ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01} - C:\Windows\system32\TSWbPrxy.exe (x)
HKLM_ElevationPolicy\{D802E3EF-2513-4661-972E-BAD737EFBA88} - C:\Program Files (x86)\DivX\DivX OVS Helper\OVSHelperBroker.exe (DivX, LLC.)
BHO\{326E768D-4182-46FD-9C16-1449A49795F4} - "DivX Plus Web Player HTML5 <video>" (C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll)
BHO\{593DDEC6-7468-4cdd-90E1-42DADAA222E9} - "DivX HiQ" (C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll)

========================================

C:\Program Files (x86)\Ad-Remover\Quarantine: 0 File(s)
C:\Program Files (x86)\Ad-Remover\Backup: 1 File(s)

C:\Ad-Report-SCAN[1].txt - 13/02/2011 (3743 Byte(s))

End at: 21:05:42, 13/02/2011

============== E.O.F ==============



======= REPORT FROM AD-REMOVER 2.0.0.2,E | ONLY XP/VISTA/7 =======

Updated by TeamXscript on 08/02/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
website: TeamXscript : AD-Remover - FindyKill - UsbFix - SEAF

C:\Program Files (x86)\Ad-Remover\main.exe (CLEAN [1]) -> Launched at 22:03:18 on 13/02/2011, Normal boot

Microsoft Windows 7 Édition Intégrale (X64)
kolchok@LOKI (Packard Bell BV iXtreme X9777)

============== ACTION(S) ==============

Service: "sdmBackupIP" Service stopped and deleted

File deleted: C:\Windows\SysWOW64\Utils.dll

(!) -- Temporary files deleted.


Key deleted: HKLM\Software\Install Pedia Limited


============== ADDITIONNAL SCAN ==============

**** Mozilla Firefox Version [3.6.13 (fr)] ****

HKLM_MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0 (x)
HKLM_MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0 (x)
HKLM_MozillaPlugins\@nvidia.com/3DVision (x)
HKLM_MozillaPlugins\@nvidia.com/3DVisionStreaming (x)
HKLM_MozillaPlugins\@pandonetworks.com/PandoWebPlugin (x)
HKCU_MozillaPlugins\pandonetworks.com/PandoWebPlugin (x)
Extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} (Skype extension for Firefox )
HKLM_Extensions|FFToolbar@bitdefender.com - C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\ (x)
HKLM_Extensions|{23fcfd51-4958-4f00-80a3-ae97e717ed8b} - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video
HKLM_Extensions|{6904342A-8307-11DF-A508-4AE2DFD72085} - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa

-- C:\Users\kolchok\AppData\Roaming\Mozilla\FireFox\Profiles\je2z1rt4.default --
Searchplugins\daemon-search.xml (hxxp://www.daemon-search.com/search/web?q={searchTerms}/)
Prefs.js - browser.download.lastDir, C:\\Users\\kolchok\\Pictures
Prefs.js - browser.startup.homepage, hxxp://my.daemon-search.com/startpage|resource:/browserconfig.properties
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.13

========================================

**** Internet Explorer Version [9.0.7930.16406] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} - "DAEMON Search" (hxxp://www.daemon-search.com/search/web?q={searchTerms})
HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\SysWOW64\wpcer.exe (x)
HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\SysWOW64\winfxdocobj.exe (x)
HKLM_ElevationPolicy\{5F17E524-3447-4c7d-8E5F-4EFF31CDE3B7} - C:\Program Files (x86)\DivX\DivX Plus Web Player\DDMService.exe (DivX, LLC)
HKLM_ElevationPolicy\{64903E32-AE0B-408D-909C-09A08791F28D} - C:\Program Files (x86)\DivX\DivX Plus Web Player\dwpBroker.exe (DivX, LLC)
HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files (x86)\Internet Explorer\iedw.exe (x)
HKLM_ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01} - C:\Windows\system32\TSWbPrxy.exe (x)
HKLM_ElevationPolicy\{D802E3EF-2513-4661-972E-BAD737EFBA88} - C:\Program Files (x86)\DivX\DivX OVS Helper\OVSHelperBroker.exe (DivX, LLC.)
BHO\{326E768D-4182-46FD-9C16-1449A49795F4} - "DivX Plus Web Player HTML5 <video>" (C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll)
BHO\{593DDEC6-7468-4cdd-90E1-42DADAA222E9} - "DivX HiQ" (C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll)

========================================

C:\Program Files (x86)\Ad-Remover\Quarantine: 1 File(s)
C:\Program Files (x86)\Ad-Remover\Backup: 16 File(s)

C:\Ad-Report-CLEAN[1].txt - 13/02/2011 (4095 Byte(s))
C:\Ad-Report-SCAN[1].txt - 13/02/2011 (3872 Byte(s))

End at: 22:04:24, 13/02/2011

============== E.O.F ==============


RogueKiller V3.10.0 by Tigzy
contact at Forum Sciences / Forum Informatique - Sur la Toile (SLT)
mail: tigzyRK<at>gmail<dot>com
Feedback: [RogueKiller] Remontées (1/9)

Operating System: Windows 7 (6.1.7600 ) 64 bits version
Started in : Normal mode
User: kolchok [Admin rights]
Mode: HOSTSFix -- Time : 13/02/2011 21:09:03

Bad processes:

HOSTS File:
ÿþ1

Resetted HOSTS:
127.0.0.1 localhost

Finished




RogueKiller V3.10.0 by Tigzy
contact at Forum Sciences / Forum Informatique - Sur la Toile (SLT)
mail: tigzyRK<at>gmail<dot>com
Feedback: [RogueKiller] Remontées (1/9)

Operating System: Windows 7 (6.1.7600 ) 64 bits version
Started in : Normal mode
User: kolchok [Admin rights]
Mode: Scan -- Time : 13/02/2011 21:09:35

Bad processes:

Found:

HOSTS File:
127.0.0.1 localhost


Finished




RogueKiller V3.10.0 by Tigzy
contact at Forum Sciences / Forum Informatique - Sur la Toile (SLT)
mail: tigzyRK<at>gmail<dot>com
Feedback: [RogueKiller] Remontées (1/9)

Operating System: Windows 7 (6.1.7600 ) 64 bits version
Started in : Normal mode
User: kolchok [Admin rights]
Mode: Scan -- Time : 13/02/2011 22:00:55

Bad processes:

Found:

HOSTS File:
127.0.0.1 localhost


Finished

mbam n'a toujours rien trouvé.

Bonjour,

Télécharger GMER
clic sur "Download EXE" et télécharger le fichier sur le bureau.

Désactiver les protection (antivirus, antispyware etc) et fermer tous les programmes ouverts.
Double-clic sur le fichier GMER téléchargé.
- Dans la section de droite de la fenêtre de l'outil, Vérifiez que soient décochées :
Show All
Une fois lancé, clic droit sur le fond blanc et clic sur "Only Non MS files"
Clic en bas à droite sur le bouton "Scan" pour lancer le scan.



Lorsque le scan est terminé, clic sur "Copy"

Il peut arriver que GMER plante sans raison apparente.
Vous pouvez essayer ceci : décocher "Devices" dans un premier temps et repasser l'outil ;
si ça coince toujours, décocher en plus "Files" et ré-essayez un scan.
Lorsque les informations sur le scan s'affichent , les éléments détectés comme rootkit apparaissent en rouge dans chaque section.


Ouvrez le bloc-note et clic sur le Menu Edition / Coller
Le rapport doit alors apparaître.
Enregistrer le fichier sur le bureau et copier/coller le contenu.

bonsoir,
désolé de mettre su temps avant de répondre, mais il n'y à pas que mon pc qui à un virus. Enfin bref, voici le rapport GMER :

GMER 1.0.15.15530 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-02-14 18:09:49
Windows 6.1.7600
Running: fs4ro8rf.exe


---- Modules - GMER 1.0.15 ----

Module \SystemRoot\system32\DRIVERS\viaide.sys (VIA Generic PCI IDE Bus Driver/VIA Technologies, Inc.) 00FF5000-00FFD000 (32768 bytes)
Module \SystemRoot\system32\DRIVERS\videX64.sys (VIA Generic PCI IDE Bus Driver/VIA Technologies, Inc.) 00C6C000-00C74000 (32768 bytes)
Module \SystemRoot\system32\DRIVERS\amdxata.sys (Storage Filter Driver/Advanced Micro Devices) 00DF3000-00DFE000 (45056 bytes)
Module \SystemRoot\system32\DRIVERS\xfiltx64.sys (ATA/ATAPI devices Hot-Plug/DIPM monitor/VIA Technologies, Inc.) 01147000-01151000 (40960 bytes)
Module \SystemRoot\system32\DRIVERS\nvlddmkm.sys (NVIDIA Windows Kernel Mode Driver, Version 260.99 /NVIDIA Corporation) 0481A000-053F4000 (12427264 bytes)
Module \SystemRoot\system32\DRIVERS\nvBridge.kmd (NVIDIA Compatible Windows Vista Kernel Mode Driver, Version 260.99 /NVIDIA Corporation) 053F4000-053F6000 (8192 bytes)
Module \SystemRoot\system32\DRIVERS\Rtnic64.sys (Realtek 10/100 X64 Driver /Realtek Semiconductor Corporation ) 04267000-04279000 (73728 bytes)
Module \SystemRoot\system32\drivers\LGBusEnum.sys (Logitech WingMan Virtual Bus Enumerator Driver/Logitech Inc.) 043F6000-043FA000 (16384 bytes)
Module \SystemRoot\system32\drivers\nvhda64v.sys (NVIDIA HDMI Audio Driver/NVIDIA Corporation) 05753000-0577C000 (167936 bytes)
Module \SystemRoot\system32\drivers\RTKVHD64.sys (Realtek® High Definition Audio Function Driver/Realtek Semiconductor Corp.) 0586B000-05AFB000 (2686976 bytes)
Module \SystemRoot\system32\DRIVERS\LHidFilt.Sys (Logitech HID Filter Driver./Logitech, Inc.) 05BE0000-05BF3000 (77824 bytes)
Module \SystemRoot\system32\DRIVERS\LMouFilt.Sys (Logitech Mouse Filter Driver./Logitech, Inc.) 05800000-05814000 (81920 bytes)
Module \SystemRoot\System32\Drivers\secdrv.SYS (Macrovision SECURITY Driver/Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) 05D0B000-05D16000 (45056 bytes)
Module \SystemRoot\system32\drivers\LGVirHid.sys (Logitech GamePanel Virtual Hid Device Driver/Logitech Inc.) 05EE6000-05EE9000 (12288 bytes)
Module \Windows\System32\usp10.dll (Uniscribe Unicode script processor/Microsoft Corporation) FF5B0000-FF67A000 (827392 bytes)

---- Processes - GMER 1.0.15 ----

Process fs4ro8rf.exe 600
Process nvvsvc.exe (NVIDIA Driver Helper Service, Version 260.99/NVIDIA Corporation) 760
Process NvXDSync.exe 1152
Process nvvsvc.exe (NVIDIA Driver Helper Service, Version 260.99/NVIDIA Corporation) 1164
Process KHALMNPR.exe (Logitech KHAL Main Process/Logitech, Inc.) 1580
Process nvSCPAPISvr.exe 1648
Process GoogleUpdate.exe 1708
Process SetPoint32.exe 2576
Process LGDevAgt.exe 2580
Process LCDMon.exe 2588
Process LGDCore.exe 2596
Process RAVCpl64.exe 2608
Process jusched.exe 2708
Process SetPoint.exe 2740
Process DivXUpdate.exe 2772
Process DDMService.exe 2780
Process LCDClock.exe 2888
Process LCDCountdown.exe 2932
Process LCDMedia.exe 2940
Process LCDPop3.exe 2948
Process LCDRSS.exe 2956
Process WMPSideShowGadget.exe 3512
Process wmplayer.exe 3640

---- Services - GMER 1.0.15 ----

Service system32\DRIVERS\adp94xx.sys (Adaptec Windows SAS/SATA Storport Driver/Adaptec, Inc.) [MANUAL] adp94xx
Service system32\DRIVERS\adpahci.sys (Adaptec Windows SATA Storport Driver/Adaptec, Inc.) [MANUAL] adpahci
Service system32\DRIVERS\adpu320.sys (Adaptec StorPort Ultra320 SCSI Driver (X64)/Adaptec, Inc.) [MANUAL] adpu320
Service system32\DRIVERS\aliide.sys (ALi mini IDE Driver/Acer Laboratories Inc.) [MANUAL] aliide
Service system32\DRIVERS\amdsata.sys (AHCI 1.2 Device Driver/Advanced Micro Devices) [MANUAL] amdsata
Service system32\DRIVERS\amdsbs.sys (AMD Technology AHCI Compatible Controller Driver for Windows - AMD64 platform/AMD Technologies Inc.) [MANUAL] amdsbs
Service system32\DRIVERS\amdxata.sys (Storage Filter Driver/Advanced Micro Devices) [BOOT] amdxata
Service system32\DRIVERS\arc.sys (Adaptec RAID Storport Driver/Adaptec, Inc.) [MANUAL] arc
Service system32\DRIVERS\arcsas.sys (Adaptec SAS RAID WS03 Driver/Adaptec, Inc.) [MANUAL] arcsas
Service system32\DRIVERS\bxvbda.sys (Broadcom NetXtreme II GigE VBD/Broadcom Corporation) [MANUAL] b06bdrv
Service system32\DRIVERS\b57nd60a.sys (Broadcom NetXtreme Gigabit Ethernet NDIS6.x Unified Driver./Broadcom Corporation) [MANUAL] b57nd60a
Service system32\DRIVERS\BrFiltLo.sys (Windows ME USB Mass-Storage Bulk-Only Lower Filter Driver/Brother Industries, Ltd.) [MANUAL] BrFiltLo
Service system32\DRIVERS\BrFiltUp.sys (Windows ME USB Mass-Storage Bulk-Only Upper Filter Driver/Brother Industries, Ltd.) [MANUAL] BrFiltUp
Service System32\Drivers\Brserid.sys (Pilote Brother Série I/F (WDM)/Brother Industries Ltd.) [MANUAL] Brserid
Service System32\Drivers\BrSerWdm.sys (Brother Serial driver (WDM version)/Brother Industries Ltd.) [MANUAL] BrSerWdm
Service System32\Drivers\BrUsbMdm.sys (Brother USB MDM Driver /Brother Industries Ltd.) [MANUAL] BrUsbMdm
Service System32\Drivers\BrUsbSer.sys (Brother USB Serial Driver/Brother Industries Ltd.) [MANUAL] BrUsbSer
Service system32\DRIVERS\cmdide.sys (CMD PCI IDE Bus Driver/CMD Technology, Inc.) [MANUAL] cmdide
Service system32\DRIVERS\evbda.sys (Broadcom NetXtreme II 10 GigE VBD/Broadcom Corporation) [MANUAL] ebdrv
Service system32\DRIVERS\elxstor.sys (Storport Miniport Driver for LightPulse HBAs/Emulex) [MANUAL] elxstor
Service C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (Programme d'installation de Google/Google Inc.) [AUTO] gupdate
Service system32\drivers\hcw85cir.sys (Hauppauge WinTV 885 Consumer IR Driver for eHome/Hauppauge Computer Works, Inc.) [MANUAL] hcw85cir
Service system32\DRIVERS\HpSAMD.sys (Smart Array SAS/SATA Controller Media Driver/Hewlett-Packard Company) [MANUAL] HpSAMD
Service system32\DRIVERS\iaStorV.sys (Intel Matrix Storage Manager driver - x64/Intel Corporation) [MANUAL] iaStorV
Service system32\DRIVERS\iirsp.sys (Intel/ICP Raid Storport Driver/Intel Corp./ICP vortex GmbH) [MANUAL] iirsp
Service system32\drivers\RTKVHD64.sys (Realtek® High Definition Audio Function Driver/Realtek Semiconductor Corp.) [MANUAL] IntcAzAudAddService
Service C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech Bluetooth Service/Logitech, Inc.) [MANUAL] LBTServ
Service system32\drivers\LGBusEnum.sys (Logitech WingMan Virtual Bus Enumerator Driver/Logitech Inc.) [MANUAL] LGBusEnum
Service system32\drivers\LGVirHid.sys (Logitech GamePanel Virtual Hid Device Driver/Logitech Inc.) [MANUAL] LGVirHid
Service system32\DRIVERS\LHidFilt.Sys (Logitech HID Filter Driver./Logitech, Inc.) [MANUAL] LHidFilt
Service system32\DRIVERS\LMouFilt.Sys (Logitech Mouse Filter Driver./Logitech, Inc.) [MANUAL] LMouFilt
Service system32\DRIVERS\lsi_fc.sys (LSI Fusion-MPT FC Driver (StorPort)/LSI Corporation) [MANUAL] LSI_FC
Service system32\DRIVERS\lsi_sas.sys (LSI Fusion-MPT SAS Driver (StorPort)/LSI Corporation) [MANUAL] LSI_SAS
Service system32\DRIVERS\lsi_sas2.sys (LSI SAS Gen2 Driver (StorPort)/LSI Corporation) [MANUAL] LSI_SAS2
Service system32\DRIVERS\lsi_scsi.sys (LSI Fusion-MPT SCSI Driver (StorPort)/LSI Corporation) [MANUAL] LSI_SCSI
Service system32\DRIVERS\megasas.sys (MEGASAS RAID Controller Driver for Windows 7\Server 2008 R2 for x64/LSI Corporation) [MANUAL] megasas
Service system32\DRIVERS\MegaSR.sys (LSI MegaRAID Software RAID Driver/LSI Corporation, Inc.) [MANUAL] MegaSR
Service MSDTC Bridge 3.0.0.0
Service MSDTC Bridge 4.0.0.0
Service system32\DRIVERS\nfrd960.sys (IBM ServeRAID Controller Driver/IBM Corporation) [MANUAL] nfrd960
Service system32\drivers\nvhda64v.sys (NVIDIA HDMI Audio Driver/NVIDIA Corporation) [MANUAL] NVHDA
Service system32\DRIVERS\nvlddmkm.sys (NVIDIA Windows Kernel Mode Driver, Version 260.99 /NVIDIA Corporation) [MANUAL] nvlddmkm
Service system32\DRIVERS\nvraid.sys (NVIDIA® nForce™ RAID Driver/NVIDIA Corporation) [MANUAL] nvraid
Service system32\DRIVERS\nvstor.sys (NVIDIA® nForce™ Sata Performance Driver/NVIDIA Corporation) [MANUAL] nvstor
Service C:\Windows\system32\nvvsvc.exe (NVIDIA Driver Helper Service, Version 260.99/NVIDIA Corporation) [AUTO] nvsvc
Service system32\DRIVERS\ql2300.sys (QLogic Fibre Channel Stor Miniport Driver/QLogic Corporation) [MANUAL] ql2300
Service system32\DRIVERS\ql40xx.sys (QLogic iSCSI Storport Miniport Driver/QLogic Corporation) [MANUAL] ql40xx
Service system32\DRIVERS\Rtnic64.sys (Realtek 10/100 X64 Driver /Realtek Semiconductor Corporation ) [MANUAL] RTL8023x64
Service (Macrovision SECURITY Driver/Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [AUTO] secdrv
Service ServiceModelEndpoint 3.0.0.0
Service ServiceModelOperation 3.0.0.0
Service ServiceModelService 3.0.0.0
Service system32\DRIVERS\SiSRaid2.sys (SiS RAID Stor Miniport Driver/Silicon Integrated Systems Corp.) [MANUAL] SiSRaid2
Service system32\DRIVERS\sisraid4.sys (SiS AHCI Stor-Miniport Driver/Silicon Integrated Systems) [MANUAL] SiSRaid4
Service SMSvcHost 3.0.0.0
Service SMSvcHost 4.0.0.0
Service C:\Program [MANUAL] Steam Client Service
Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Stereo Vision Control Panel API Server/NVIDIA Corporation) [AUTO] Stereo Service
Service system32\DRIVERS\stexstor.sys (Promise SuperTrak EX Series Driver for Windows /Promise Technology) [MANUAL] stexstor
Service TCPIP6TUNNEL
Service TCPIPTUNNEL
Service system32\DRIVERS\viaide.sys (VIA Generic PCI IDE Bus Driver/VIA Technologies, Inc.) [BOOT] viaide
Service system32\DRIVERS\videX64.sys (VIA Generic PCI IDE Bus Driver/VIA Technologies, Inc.) [BOOT] videX64
Service system32\DRIVERS\vsmraid.sys (VIA RAID DRIVER FOR AMD-X86-64/VIA Technologies Inc.,Ltd) [MANUAL] vsmraid
Service Windows Workflow Foundation 3.0.0.0
Service C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe [MANUAL] WMPNetworkSvc
Service WSearchIdxPi
Service system32\DRIVERS\xfiltx64.sys (ATA/ATAPI devices Hot-Plug/DIPM monitor/VIA Technologies, Inc.) [BOOT] xfiltx64

---- EOF - GMER 1.0.15 ----

merci encore de prendre de vôtre temps et de vous penchez sur mon problème. A bientôt.

Bonjour,

Tutoriel par Nardino

Télécharger SEAF de C_XX
Double-cliquer sur le fichier SEAF.exe
Suivre les instructions à cocher sur cette fenêtre:

Occurences à rechercher ->
Taper
fs4ro8rf.exe


Cocher"Chercher également dans le régistre"
Calculer le cheksum:Md5 .
Cocher Informations suppémentaires
la recherche dure quelques minutes et produit un rapport C:\SEAFlog.txt à poster

bonjour, voici le rapport :

1. ========================= SEAF 1.0.1.0 - C_XX
2.
3. Commencé à: 14:30:45 le 15/02/2011
4.
5. Valeur(s) recherchée(s):
6. fs4ro8rf.exe
7.
8. Légende: TC => Date de création, TM => Date de modification, DA => Dernier accès
9.
10. (!) --- Calcul du Hash "MD5"
11. (!) --- Informations supplémentaires
12. (!) --- Recherche registre
13.
14. ====== Fichier(s) ======
15.
16.
17. "C:\Users\kolchok\Desktop\fs4ro8rf.exe" [ ARCHIVE | 296 Ko ]
18. TC: 14/02/2011,10:56:09 | TM: 14/02/2011,10:56:09 | DA: 14/02/2011,10:56:07
19.
20. Hash MD5: DF7501A91A7C99CC3F0269080748EE61
21.
22. FileVersion: 1, 0, 15, 15530
23.
24. =========================
25.
26.
27. "C:\Windows\Prefetch\FS4RO8RF.EXE-E9B2CAF4.pf" [ NOT_CONTENT_INDEXED|ARCHIVE | 90 Ko ]
28. TC: 14/02/2011,11:00:31 | TM: 14/02/2011,18:13:53 | DA: 14/02/2011,11:00:31
29.
30. Hash MD5: 2F5CF39E23BC90A4A03B091D04410EF0
31.
32.
33. =========================
34.
35.
36.
37. ====== Entrée(s) du registre ======
38.
39. Aucun élément dans le registre trouvé
40.
41. =========================
42.
43. Fin à: 14:33:37 le 15/02/2011
44. 508148 Éléments analysés
45.
46. =========================
47. E.O.F

Poste de travail->Outils ->Options des dossiers ->Affichage
Cocher "Afficher les dossiers cachés"
Décocher" Masquer les extension des fichiers dont le type est connus "ainsi que "Masquer les fichiers protégés du système d exploitation"
--> un message dit que cela peut endommager le système, ne pas en tenir compte, valider par oui.

Rendez vous à cette adresse:
Cliquez sur parcourir pour trouver ces fichiers
C:\Users\kolchok\Desktop\fs4ro8rf.exe

et cliquez sur "envoyer le fichier"
Copiez /collez la réponse dans votre prochain message.
Note: il peut arriver que le fichier ait déjà été analysé. Si c'est le cas, cliquez sur le bouton Reanalyse file now

bonsoir,
Après avoir cherché comment mettre les fichiers cachés (merci google) voici le rapport :
File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis:
MD5: df7501a91a7c99cc3f0269080748ee61
Date first seen: 2010-11-08 10:48:02 (UTC)
Date last seen: 2011-02-15 18:05:05 (UTC)
Detection ratio: 0/42

Bonjourr,



Combofix est un logiciel très puissant qui ne doit pas être utilisé sans une aide compétente sous peine de risquer des dommages irréversibles.
Veuillez noter que ce logiciel est régulièrement mis à jour et que la version téléchargée sera obsolète dans quelques jours.

Télécharger combofix.exe de sUBs
et sauvegardez le sur le bureau


La console de Récupération
Tout d'abord, Combofix vérifie si la Console de récupération est installée et vous propose de le faire dans le cas contraire.
Certaines infections comme braviax empêcheront son installation.
La Console de récupération Windows vous permettra de démarrer dans un mode spécial de récupération (réparation).
Elle peut être nécessaire si votre ordinateur rencontre un problème après une tentative de nettoyage
C'est une procédure simple, qui ne vous prendra que peu de temps et pourra peut-être un jour vous sauver la mise.
Certaines infections (Rootkit en Mbr)ne peuvent être traitées qu'en utilisant la Console de Récupération,
D'importantes procédures que Combofix est susceptible de lancer ne fonctionneront qu'à la condition que la console de récupération(Sous Xp) soit installée
C'est pourquoi il vous est vivement conseillé d' installer d'abord la Console de Récupération sur le pc .

Les utilisateurs de Windows Vista peuvent utiliser leur CD Windows pour démarrer en mode Vista Recovery Environment (Environnement de réparation Vista)
Cela permettra de réparer le système au cas ou le pc ne redémarrerait plus suite à la désinfection.
Après avoir cliqué sur le lien correspondant à votre version de Windows, vous serez dirigé sur une page:
cliquez sur le bouton Télécharger afin de récupérer le package d'installation sur leBureau:
Ne modifiez pas le nom du fichier
Windows XP Service Pack 2 (SP2) > Microsoft Windows XP Professionnel SP2
Faites un glisser/déposer de ce fichier sur le fichier ComboFix.exe


Suivre les indications à l'écran pour lancer ComboFix et lorsqu'on le demande, accepter le Contrat de Licence d'Utilisateur Final pour installer la Console de Récupération Microsoft.
Après installation,vous devriez voir ce message:
The Recovery Console was successfully installed. puis un rapport nommé CF_RC.txt va s'afficher:


Fermez ou désactivez tous les programmes Antivirus, Antispyware, Pare-feu actifs car ils pourraient perturber le fonctionnement de cet outil
Pour cela:
Démarrer->Exécuter->Msconfig->Démarrage : décochez les protections Antivirus, Antispyware,Teatimer

Cela est absolument nécessaire au succès de la procédure.
Bien évidemment, vous les rétablirez ensuite.


Vous avez téléchargé Combofix.
Double cliquer sur combofix.exe pour le lancer.
Ne pas fermer la fenêtre qui vient de s'ouvrir , le bureau serait vide et cela pourrait entraîner un plantage du programme!
Pour lancer le scan
Connecter tous les disques amovibles (disque dur externe, clé USB…).
Taper sur la touche 1 pour démarrer le scan.
Si pour une raison quelconque, combofix ne se lançait pas,
Sous Vista, désactivez l'UAC
Démarrez en mode sans échec, choisissez le compte Administrateur, lancez Combofix
Si vous avez un message de Combofix disant que votre antivirus est actif alors que vous l'avez désactivé, recommencez la procédure en mode sans échec
Lorsque ComboFix tourne, ne touchez plus du tout à votre ordinateur, vous risqueriez de planter le programme.

Le scan pourrait prendre un certain temps, il y a 50 procédures successives:
Patientez au moins 30 minutes pendant l'analyse.
Si le programme gèle (+ de 30 minutes), fermez le en cliquant le "X" au haut à droite de la fenêtre.
A la fin,,un rapport sera généré : postez en le contenu dans un prochain message.
Si le rapport est trop long, postez le en deux fois.
Il se trouve à c:\combofix.txt