Suppression Antivir Pro 2010

Question

Bonjour,
Je viens vous demander de l'aide car mon père a été infecté par un logiciel qui s'appelle "Antivirus pro 2010".
J'ai lu certains sujets sur le forum, mais il semble que la désinstallation de ce log soit assez complexe et demande notamment l'utilisation de logiciels relativement complexes.
Pourriez vous m'aider s'il vous plait ?
Merci

Xplode · Answer

Salut, commence par faire ceci pour un diagnostic complet du PC :

-+-+-+->  RSIT <-+-+-+-


[x] Télécharge Random's System Information Tool à cette adresse : http://images.malwareremoval.com/random/RSIT.exe

[x] Double clique sur " RSIT.exe ".

[x] Clique sur " Continue ".

[x] Si hijackthis n'est pas présent il sera automatiquement téléchargé et tu devras accepter la license.

[x] Une fois l'analyse finie, deux fichiers ( info.txt & log.txt ) s'ouvriront.

[x] Copie colle le contenu des deux rapports dans ton prochain message

[o] Si jamais tu as fermé les rapports sans faire attention, ils sont sous C:\rsit

Stong · Answer

Merci, voici les deux fichiers. Entre temps, j'ai consulté les réponses d'une question du même type que la mienne et ait lancé combofix... 

INFO.TXT


info.txt logfile of random's system information tool 1.06 2009-10-04 22:54:01

======Uninstall list======

-->C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
7-Zip 4.57-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.6 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81300000003}
Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Client de clichés instantanés-->MsiExec.exe /I{23E5032B-56CA-4C19-A72E-B50161DB82CA}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Windows XP (KB915800-v4)-->"C:\WINDOWS\$NtUninstallKB915800-v4$\spuninst\spuninst.exe"
Hotfix pour Microsoft .NET Framework 2.0 (KB926776)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {BA8E6AD7-3834-4BAD-9CC2-5171E45E3C6E} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
HP Color LaserJet 2820/2830/2840 2.0-->"C:\Program Files\HP\Digital Imaging\{1030DCDC-2425-407d-BEE1-13558B837FCA}\setup\hpzscr01.exe" -datfile hppscr01.dat
HP Image Zone 4.7-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP Software Update-->MsiExec.exe /X{64FC0C98-B035-4530-B15D-3D30610B6DF1}
IMAPSize 0.3.6-->"C:\Program Files\IMAPSize\unins000.exe"
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
LUMIX Simple Viewer-->C:\Program Files\InstallShield Installation Information\{2CDCCE7E-55D5-40CC-AEA0-ABA54713501F}\setup.exe -runfromtemp -l0x040c -removeonly
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Module de compatibilité pour Microsoft Office System 2007-->MsiExec.exe /X{90120000-0020-040C-0000-0000000FF1CE}
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Mozilla Firefox (3.0.14)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Firefox (3.5.3)-->C:\Documents and Settings\All Users\Application Data\Mozilla Firefox\uninstall\helper.exe
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers-->C:\WINDOWS\system32\NVUNINST.EXE UninstallGUI
NVIDIA ForceWare Network Access Manager-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{1F6423DE-7959-4178-80E0-023C7EAA5347} /l1036 
NvMixer-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D7A6C517-11F2-419F-B5BB-27772B939698}\Setup.exe"  -uninstall
PDFCreator-->C:\Program Files\PDFCreator\unins000.exe
PHOTOfunSTUDIO -viewer--->C:\Program Files\InstallShield Installation Information\{9A9DBEBC-C800-4776-A970-D76D6AA405B1}\Setup.exe -runfromtemp -l0x040cPackage -removeonly
PL-2303 USB-to-Serial-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setup.exe" -l0x9 Installed
PowerQuest PartitionMagic 8.0-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{6BE2A4A4-99FB-48ED-AE1E-4E850389F804} 
QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0
Security Update pour Microsoft .NET Framework 2.0 (KB917283)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {967B098A-042D-4367-BAC9-8BC11684174F} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
TeamViewer 4-->C:\Program Files\TeamViewer\Version4\uninstall.exe
Trend Micro Client/Server Security Agent-->"C:\Program Files\Trend Micro\Client Server Security Agent
trmv.exe"
Unlocker 1.8.5-->C:\Program Files\Unlocker\uninst.exe
VNC Free Edition 4.1.2-->"C:\Program Files\RealVNC\VNC4\unins000.exe"
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Search 4.0-->"C:\WINDOWS\$NtUninstallKB940157$\spuninst\spuninst.exe"
Winmail Reader 1.1.12-->"C:\Program Files\Winmail Reader\unins000.exe"

======Hosts File======

127.0.0.1 	localhost
192.168.1.12 	npi8c44a3

Securitycenter WMI appears to be broken

======System event log======

Computer Name: PC-SECRETARIAT1
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Gestion d'applications.

Record Number: 25232
Source Name: Service Control Manager
Time Written: 20090813161014.000000+120
Event Type: Informations
User: CAVESDUCHATEAU\cdc

Computer Name: PC-SECRETARIAT1
Event Code: 35
Message: Le service de temps synchronise maintenant l'heure système avec la
source de temps time.nist.gov (ntp.m|0x1|192.168.1.12:123->192.43.244.18:123).

Record Number: 25231
Source Name: W32Time
Time Written: 20090813155640.000000+120
Event Type: Informations
User: 

Computer Name: PC-SECRETARIAT1
Event Code: 7036
Message: Le service Pml Driver HPZ12 est entré dans l'état : arrêté.

Record Number: 25230
Source Name: Service Control Manager
Time Written: 20090813151424.000000+120
Event Type: Informations
User: 

Computer Name: PC-SECRETARIAT1
Event Code: 7036
Message: Le service Pml Driver HPZ12 est entré dans l'état : en cours d'exécution.

Record Number: 25229
Source Name: Service Control Manager
Time Written: 20090813151352.000000+120
Event Type: Informations
User: 

Computer Name: PC-SECRETARIAT1
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Pml Driver HPZ12.

Record Number: 25228
Source Name: Service Control Manager
Time Written: 20090813151352.000000+120
Event Type: Informations
User: CAVESDUCHATEAU\cdc

=====Application event log=====

Computer Name: TRYITFOR-0E0AE1
Event Code: 1904
Message: 
Record Number: 7916
Source Name: HHCTRL
Time Written: 20090604144736.000000+120
Event Type: Informations
User: 

Computer Name: TRYITFOR-0E0AE1
Event Code: 1904
Message: 
Record Number: 7915
Source Name: HHCTRL
Time Written: 20090604144736.000000+120
Event Type: Informations
User: 

Computer Name: TRYITFOR-0E0AE1
Event Code: 1904
Message: 
Record Number: 7914
Source Name: HHCTRL
Time Written: 20090604144736.000000+120
Event Type: Informations
User: 

Computer Name: TRYITFOR-0E0AE1
Event Code: 1904
Message: 
Record Number: 7913
Source Name: HHCTRL
Time Written: 20090604144736.000000+120
Event Type: Informations
User: 

Computer Name: TRYITFOR-0E0AE1
Event Code: 1904
Message: 
Record Number: 7912
Source Name: HHCTRL
Time Written: 20090604144736.000000+120
Event Type: Informations
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\QuickTime\QTSystem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 47 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=2f02
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"SBSSERVER"=server2003

-----------------EOF-----------------


LOG.TXT

Logfile of random's system information tool 1.06 (written by random/random)
Run by cdc at 2009-10-04 22:53:22
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 70 GB (69%) free of 100 GB
Total RAM: 1023 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:54:00, on 04/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20627)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\Trend Micro\Client Server Security Agent\TmPfw.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\PROGRA~1\HEWLET~1\Toolbox\STATUS~1\STATUS~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\Program Files\Trend Micro\Client Server Security Agent	mlisten.exe
C:\Program Files\Trend Micro\Client Server Security Agent
trtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\TmProxy.exe
C:\Program Files\Trend Micro\Client Server Security Agent\CNTAoSMgr.exe
C:\WINDOWS\explorer.exe
\server2003\commun\désinstaller antivirus pro 2010r\RSIT.exe
C:\Program Files	rend micro\cdc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - (no file)
O2 - BHO: Microsoft Online Helper! - {C2A4E1E2-9183-4F26-8D6E-43FC5424E6B2} - %SystemRoot%\system32\gqcsbmzej.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - (no file)
O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O3 - Toolbar: (no name) - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - (no file)
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [OE] C:\Program Files\Trend Micro\Client Server Security Agent\TMAS_OE\TMAS_OEMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O16 - DPF: {485D813E-EE26-4DF8-9FAF-DEDF2885306E} (NSHelp Class) - http://server2003/connectcomputer/nshelp.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cavesduchateau.local
O17 - HKLM\Software\..\Telephony: DomainName = cavesduchateau.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cavesduchateau.local
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: ClipSrv - Unknown owner - C:\WINDOWS\system32\clipsrv.exe (file missing)
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
O23 - Service: Scan en temps réel Trend Micro Client/Server Security Agent (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent
trtscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Unknown owner - C:\WINDOWS\system32\IoctlSvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent	mlisten.exe
O23 - Service: Pare-feu personnel Trend Micro Client/Server Security Agent (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\TmPfw.exe
O23 - Service: Service proxy Trend Micro Client/Server Security Agent (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\TmProxy.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

Stong · Answer

Alors, il y a un problème quelque part ?

Xplode · Answer

Fais maintenant ceci :

-+-+-+-> Malwarebyte's Anti-Malware <-+-+-+-


[x] Télécharge Malwarebyte's anti-malware (MBAM) à cette adresse : http://www.malwarebytes.org/mbam/program/mbam-setup.exe

[x] Installe le.

[x] Met le à jour.

[x] Coche bien tout les éléments trouvés et supprime les !

[x] Un tutoriel pour son utilisation est disponible ici : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

[x] Suis les indications données sur le lien précédent puis copie/colle le rapport généré dans ton prochain message

--------------

Je reviens vers 18h

Stong · Answer

Bonjour,

Merci de m'intéresser à mon problème.
N'ayant pas eu de réponse hier soir, j'ai passé Malwarebytes 2 fois cette nuit (j'ai vu sur un autre topic que ça pouvait être utile).
Je met les deux rapports en deux messages.

PREMIER RAPPORT

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2907
Windows 5.1.2600 Service Pack 2

05/10/2009 01:42:47
mbam-log-2009-10-05 (01-42-47).txt

Type de recherche: Examen rapide
Eléments examinés: 115884
Temps écoulé: 5 minute(s), 51 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c2a4e1e2-9183-4f26-8d6e-43fc5424e6b2} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c2a4e1e2-9183-4f26-8d6e-43fc5424e6b2} (Trojan.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Stong · Answer

SECOND RAPPORT

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2907
Windows 5.1.2600 Service Pack 2

05/10/2009 01:59:29
mbam-log-2009-10-05 (01-59-29).txt

Type de recherche: Examen rapide
Eléments examinés: 115877
Temps écoulé: 4 minute(s), 7 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Stong · Answer

Re,

Evidemment cette nuit je n'avais pas lu le tuto pour malwarebytes.
Donc je l'ai relancé en mode sans échec et j'ai fait un examen complet.
Voici le rapport :

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2907
Windows 5.1.2600 Service Pack 2 (Safe Mode)

05/10/2009 15:23:26
mbam-log-2009-10-05 (15-23-26).txt

Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 291383
Temps écoulé: 39 minute(s), 16 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 8

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\Documents and Settings\cdc\Application Data\lizkavd.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\frjacnwrm.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{37E2C924-BC8C-428B-95FC-F695CE13D2C1}\RP91\A0040797.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{37E2C924-BC8C-428B-95FC-F695CE13D2C1}\RP91\A0040801.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{37E2C924-BC8C-428B-95FC-F695CE13D2C1}\RP91\A0040802.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{37E2C924-BC8C-428B-95FC-F695CE13D2C1}\RP91\A0040826.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{37E2C924-BC8C-428B-95FC-F695CE13D2C1}\RP91\A0040829.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{37E2C924-BC8C-428B-95FC-F695CE13D2C1}\RP91\A0040852.sys (Worm.Agent) -> Quarantined and deleted successfully.


Merci à toi Xplode

Xplode · Answer

Ok bien,

-+-+-+-> Lop S&D <-+-+-+-


[x] Télécharge Lop S&D (par Eric_71 & Angeldark) à cette adresse : https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

[x] /!\ Désactive les protections résidentes : Antivirus, antispywares, controleurs d'intégrité, etc... pour que l'outil puisse s'exécuter correctement. 

[x] Double clique sur " LopSD.exe " ( Vista : Clique droit -> Executer en tant qu'administrateur )

[x] Choisis l'option F pour français

[x] Ensuite, Choisis l'option 1 ( Recherche )

[x] Laisse l'outil travailler

[x] Copie/Colle le contenu du rapport qui s'ouvrira et poste le dans ton prochain message.

Stong · Answer

Re, voici le rapport :


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
   BIOS : Phoenix - Award BIOS v6.00PG
   USER : cdc ( Not Administrator ! )
   BOOT : Fail-safe with network boot
   C:\ (Local Disk) - NTFS - Total:97 Go (Free:67 Go)
   D:\ (CD or DVD)
   E:\ (Local Disk) - NTFS - Total:134 Go (Free:103 Go)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (USB)
   K:\ (USB)
   L:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 05/10/2009|18:37 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [22/12/2008|11:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{B73EC431-2F59-4E5E-9CEA-001681A75E3E}
   [24/10/2008|23:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{C64B6487-9111-44B8-AC48-B2B39A99239F}
   [07/11/2008|10:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [27/12/2007|21:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Anonymizer
   [21/12/2007|03:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [15/09/2008|23:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [15/09/2009|18:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DAEMON Tools Lite
   [22/12/2008|11:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Dynacom
   [17/07/2009|10:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [10/04/2008|13:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard
   [21/12/2007|12:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [05/10/2009|01:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [19/09/2009|19:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [30/09/2009|21:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [19/09/2009|21:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mozilla Firefox
   [01/05/2008|20:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
   [21/07/2008|16:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [27/04/2008|09:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [19/09/2009|19:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skyline
   [04/10/2009|19:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [24/10/2008|23:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [17/07/2009|12:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trend Micro
   [19/09/2009|19:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip

   [20/07/2009|16:59] C:\DOCUME~1\cdc\APPLIC~1\Adobe
   [19/09/2009|17:48] C:\DOCUME~1\cdc\APPLIC~1\Apple Computer
   [15/09/2009|18:04] C:\DOCUME~1\cdc\APPLIC~1\DAEMON Tools Lite
   [15/09/2009|17:52] C:\DOCUME~1\cdc\APPLIC~1\Download Manager
   [02/08/2009|21:42] C:\DOCUME~1\cdc\APPLIC~1\Google
   [28/07/2009|10:05] C:\DOCUME~1\cdc\APPLIC~1\Help
   [17/07/2009|12:18] C:\DOCUME~1\cdc\APPLIC~1\Identities
   [17/07/2009|12:20] C:\DOCUME~1\cdc\APPLIC~1\InstallShield
   [17/07/2009|15:43] C:\DOCUME~1\cdc\APPLIC~1\Macromedia
   [25/07/2009|09:53] C:\DOCUME~1\cdc\APPLIC~1\MailWasherFree
   [05/10/2009|01:31] C:\DOCUME~1\cdc\APPLIC~1\Malwarebytes
   [21/09/2009|14:15] C:\DOCUME~1\cdc\APPLIC~1\Microsoft
   [17/07/2009|12:40] C:\DOCUME~1\cdc\APPLIC~1\Mozilla
   [30/07/2009|15:42] C:\DOCUME~1\cdc\APPLIC~1\Panasonic
   [13/08/2009|09:58] C:\DOCUME~1\cdc\APPLIC~1\Real
   [26/07/2009|11:29] C:\DOCUME~1\cdc\APPLIC~1\Sun
   [18/09/2009|14:49] C:\DOCUME~1\cdc\APPLIC~1\TeamViewer
   [17/07/2009|13:09] C:\DOCUME~1\cdc\APPLIC~1\Thunderbird
   [19/09/2009|19:44] C:\DOCUME~1\cdc\APPLIC~1\Vso
   [19/09/2009|19:06] C:\DOCUME~1\cdc\APPLIC~1\Windows Desktop Search
   [13/08/2009|11:23] C:\DOCUME~1\cdc\APPLIC~1\WinRAR

   [19/12/2007|20:46] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [19/12/2007|20:46] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [27/04/2008|09:06] C:\DOCUME~1\LOCALS~1\APPLIC~1\Mozilla
   [27/04/2008|09:07] C:\DOCUME~1\LOCALS~1\APPLIC~1\Real

   [19/12/2007|20:46] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft


   [19/12/2007|20:46] C:\DOCUME~1\WTRUST~2\APPLIC~1\Microsoft

   [21/12/2007|20:27] C:\DOCUME~1\WTRUST~1\APPLIC~1\Adobe
   [20/12/2007|15:58] C:\DOCUME~1\WTRUST~1\APPLIC~1\Ahead
   [27/12/2007|21:40] C:\DOCUME~1\WTRUST~1\APPLIC~1\Anonymizer
   [15/09/2008|23:58] C:\DOCUME~1\WTRUST~1\APPLIC~1\Apple Computer
   [25/09/2008|10:20] C:\DOCUME~1\WTRUST~1\APPLIC~1\ArcSoft
   [01/05/2008|20:46] C:\DOCUME~1\WTRUST~1\APPLIC~1\CopyToDvd
   [22/12/2008|11:41] C:\DOCUME~1\WTRUST~1\APPLIC~1\Dynacom
   [25/12/2007|11:50] C:\DOCUME~1\WTRUST~1\APPLIC~1\Google
   [08/05/2008|20:50] C:\DOCUME~1\WTRUST~1\APPLIC~1\Help
   [15/04/2009|12:04] C:\DOCUME~1\WTRUST~1\APPLIC~1\Icone
   [19/12/2007|20:55] C:\DOCUME~1\WTRUST~1\APPLIC~1\Identities
   [14/08/2008|18:57] C:\DOCUME~1\WTRUST~1\APPLIC~1\InstallShield
   [01/03/2008|17:58] C:\DOCUME~1\WTRUST~1\APPLIC~1\Leadertech
   [20/12/2007|12:52] C:\DOCUME~1\WTRUST~1\APPLIC~1\Macromedia
   [27/03/2009|23:29] C:\DOCUME~1\WTRUST~1\APPLIC~1\Microsoft
   [23/06/2008|22:37] C:\DOCUME~1\WTRUST~1\APPLIC~1\Mozilla
   [01/05/2008|19:21] C:\DOCUME~1\WTRUST~1\APPLIC~1\Nero
   [06/01/2009|12:45] C:\DOCUME~1\WTRUST~1\APPLIC~1\OpenOffice.org2
   [14/08/2008|19:06] C:\DOCUME~1\WTRUST~1\APPLIC~1\Panasonic
   [09/03/2008|13:09] C:\DOCUME~1\WTRUST~1\APPLIC~1\Real
   [21/12/2007|15:28] C:\DOCUME~1\WTRUST~1\APPLIC~1\SPAMfighter
   [21/12/2007|03:09] C:\DOCUME~1\WTRUST~1\APPLIC~1\Sun
   [29/04/2008|10:09] C:\DOCUME~1\WTRUST~1\APPLIC~1\Thunderbird
   [25/09/2008|10:32] C:\DOCUME~1\WTRUST~1\APPLIC~1\Vso
   [28/12/2007|15:26] C:\DOCUME~1\WTRUST~1\APPLIC~1\WinRAR
   [15/01/2008|23:11] C:\DOCUME~1\WTRUST~1\APPLIC~1\XnView

   [17/07/2009|12:16] C:\DOCUME~1\__SBS_~1\APPLIC~1\Identities
   [17/07/2009|12:15] C:\DOCUME~1\__SBS_~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [02/08/2009 21:39][--a------] C:\WINDOWS	asks\GoogleUpdateTaskMachineCore.job
   [19/12/2007 20:56][--ah-c---] C:\WINDOWS	asks\SA.DAT
   [30/08/2002 14:00][-r-h-c---] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [07/11/2008|10:10] C:\Program Files\Adobe
   [19/09/2009|17:59] C:\Program Files\Ahead
   [11/09/2009|16:19] C:\Program Files\AlerteGPS
   [05/10/2009|02:40] C:\Program Files\Alex Feinman
   [20/12/2007|16:05] C:\Program Files\Alwil Software
   [11/04/2009|10:46] C:\Program Files\ArcSoft
   [17/07/2009|10:24] C:\Program Files\a-squared Free
   [15/09/2008|23:54] C:\Program Files\Bonjour
   [18/01/2009|19:44] C:\Program Files\CCleaner
   [19/12/2007|20:45] C:\Program Files\ComPlus Applications
   [15/09/2009|21:15] C:\Program Files\DAEMON Tools Lite
   [15/09/2009|18:02] C:\Program Files\DAEMON Tools Toolbar
   [22/12/2008|11:45] C:\Program Files\Dynacom Technologies, Inc
   [04/10/2009|19:31] C:\Program Files\Enigma Software Group
   [05/10/2009|00:51] C:\Program Files\Fichiers communs
   [19/09/2009|19:44] C:\Program Files\Foxit Software
   [02/08/2009|21:42] C:\Program Files\Google
   [05/10/2009|02:59] C:\Program Files\Hewlett-Packard
   [27/04/2008|23:44] C:\Program Files\HiJackThis
   [05/10/2009|02:55] C:\Program Files\HP
   [17/07/2009|10:30] C:\Program Files\IMAPSize
   [11/09/2009|16:20] C:\Program Files\InstallShield Installation Information
   [07/04/2008|18:38] C:\Program Files\Internet Explorer
   [04/11/2008|21:16] C:\Program Files\Investintech.com Inc
   [26/08/2009|09:02] C:\Program Files\Java
   [05/10/2009|02:02] C:\Program Files\JkDefrag
   [05/10/2009|01:31] C:\Program Files\Malwarebytes' Anti-Malware
   [19/09/2009|18:29] C:\Program Files\Microsoft Office
   [20/12/2007|15:18] C:\Program Files\Microsoft Visual Studio
   [19/09/2009|18:24] C:\Program Files\Microsoft Visual Studio 8
   [17/07/2009|12:13] C:\Program Files\Microsoft Windows Small Business Server
   [19/09/2009|19:00] C:\Program Files\Microsoft Works
   [19/09/2009|18:27] C:\Program Files\Microsoft.NET
   [05/10/2009|16:17] C:\Program Files\Mozilla Firefox
   [19/09/2009|17:50] C:\Program Files\Mozilla Thunderbird
   [19/09/2009|18:30] C:\Program Files\MSBuild
   [22/01/2008|20:51] C:\Program Files\MSECache
   [01/05/2008|20:29] C:\Program Files\Nero
   [01/05/2008|19:22] C:\Program Files\NeroInstall.bak
   [21/07/2008|16:35] C:\Program Files\NOS
   [20/12/2007|15:22] C:\Program Files\Notepad++
   [20/12/2007|14:51] C:\Program Files\NVIDIA Corporation
   [19/09/2009|17:58] C:\Program Files\OpenOffice.org 2.3
   [19/12/2007|20:45] C:\Program Files\Outlook Express
   [19/12/2007|20:45] C:\Program Files\Paint.NET
   [14/08/2008|19:00] C:\Program Files\Panasonic
   [18/09/2009|12:27] C:\Program Files\PDFCreator
   [21/12/2007|03:50] C:\Program Files\PowerQuest
   [22/12/2008|11:29] C:\Program Files\Progitek
   [15/09/2008|23:54] C:\Program Files\QuickTime
   [01/03/2008|17:59] C:\Program Files\Real
   [17/07/2009|16:33] C:\Program Files\RealVNC
   [17/07/2009|10:22] C:\Program Files\Spybot - Search & Destroy
   [20/12/2007|13:51] C:\Program Files\SystemRequirementsLab
   [19/12/2007|20:55] C:\Program Files\Taskix
   [05/10/2009|01:31] C:\Program Files\TeamViewer
   [04/10/2009|23:40] C:\Program Files\Trend Micro
   [19/09/2009|17:55] C:\Program Files\TUGZip
   [19/12/2007|20:55] C:\Program Files\Uninstall Information
   [20/08/2009|15:41] C:\Program Files\Universal
   [20/08/2009|15:41] C:\Program Files\VersalSoft
   [19/09/2009|19:44] C:\Program Files\Virtual Earth 3D
   [19/09/2009|19:44] C:\Program Files\VSO
   [19/09/2009|19:05] C:\Program Files\Windows Desktop Search
   [19/12/2007|20:46] C:\Program Files\Windows Media Player
   [19/12/2007|20:45] C:\Program Files\Windows Trust
   [21/12/2007|03:05] C:\Program Files\WinRAR
   [04/10/2009|23:33] C:\Program Files\xerox
   [05/10/2009|02:59] C:\Program Files\Zero G Registry

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [07/11/2008|10:10] C:\Program Files\Fichiers communs\Adobe
   [19/09/2009|17:59] C:\Program Files\Fichiers communs\Ahead
   [10/09/2009|16:27] C:\Program Files\Fichiers communs\Apple
   [11/04/2009|10:46] C:\Program Files\Fichiers communs\ArcSoft
   [19/09/2009|18:29] C:\Program Files\Fichiers communs\DESIGNER
   [21/12/2007|11:54] C:\Program Files\Fichiers communs\Hewlett-Packard
   [05/10/2009|02:55] C:\Program Files\Fichiers communs\HP
   [20/12/2007|14:51] C:\Program Files\Fichiers communs\InstallShield
   [21/12/2007|03:09] C:\Program Files\Fichiers communs\Java
   [19/09/2009|19:00] C:\Program Files\Fichiers communs\Microsoft Shared
   [19/12/2007|20:45] C:\Program Files\Fichiers communs\MSSoap
   [01/05/2008|20:29] C:\Program Files\Fichiers communs\Nero
   [20/12/2007|14:51] C:\Program Files\Fichiers communs\NVIDIA Shared
   [19/12/2007|21:43] C:\Program Files\Fichiers communs\ODBC
   [12/04/2009|22:15] C:\Program Files\Fichiers communs\Real
   [19/12/2007|20:46] C:\Program Files\Fichiers communs\Services
   [21/12/2007|11:48] C:\Program Files\Fichiers communs\SWF Studio
   [08/03/2009|11:57] C:\Program Files\Fichiers communs\Symantec Shared
   [19/09/2009|18:23] C:\Program Files\Fichiers communs\System
   [12/04/2009|22:15] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 15 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-10-05 18:38:24
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:190][D:5]-> C:\DOCUME~1\cdc\LOCALS~1\Temp
   [F:5][D:0]-> C:\DOCUME~1\cdc\Cookies
   [F:32][D:4]-> C:\DOCUME~1\cdc\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 05/10/2009|18:38 - Option : [1]

   --------------------\  Fin du rapport a 18:38:45

Xplode · Answer

Ok parfait,

-+-+-+-+-> ComboFix <-+-+-+-


[x] Télécharge ComboFIX ( de sUBs ) à cette adresse : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[x] /!\ Fermez toutes les fenêtres de programme ouvertes /!\

[x] /!\ Désactivez toutes les protections résidentes ( Antivirus, Pare-Feu, AntiSpyware ) /!\

[x] Double clique sur " Combofix.exe "

[x] Suis les indications qui sont données à l'écran, à un moment tu auras un message te demandant d'installer la console de récupération, fais le 

[x] Combofix va maintenant déconnecter ton PC d'internet

[x] Pendant le scan, ne touche à rien ( souris, clavier )

[x] A la fin du scan, le rapport s'ouvrira automatiquement, copie/colle le dans ton prochain message.

[o] Nb : Si jamais il ne s'ouvrait pas, il se trouve sous C:\Combofix.txt

Stong · Answer

Dis moi, ça pose un problème si je le fais en mode sans échec ?

Xplode · Answer

Non, pas de soucis.

Stong · Answer

Voici le rapport combofix. J'ai eu deux messages d'erreur pendant la manip, mais ca n'a pas stoppé le programme.


ComboFix 09-10-04.01 - cdc 05/10/2009 18:59.2.1 - NTFSx86 NETWORK
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.1023.803 [GMT 2:00]
Lancé depuis: \server2003\commun\Vir\ComboFix.exe
.

(((((((((((((((((((((((((((((   Fichiers créés du 2009-09-05 au 2009-10-05  ))))))))))))))))))))))))))))))))))))
.

2009-10-05 16:37 . 2009-10-05 16:38	--------	d-----w-	C:\Lop SD
2009-10-05 00:59 . 2005-02-03 17:31	32768	----a-w-	c:\windows\system32\compJNI.dll
2009-10-05 00:59 . 2003-06-20 17:21	36864	----a-w-	c:\windows\system32\hpbmmjno.dll
2009-10-05 00:59 . 2004-08-20 13:02	102400	----a-w-	c:\windows\system32\PMLJNI.dll
2009-10-05 00:59 . 2004-05-10 20:11	40960	----a-w-	c:\windows\system32\d4channel.dll
2009-10-05 00:59 . 2003-06-16 21:52	74752	----a-w-	c:\windows\system32\jst.dll
2009-10-05 00:54 . 2009-10-05 00:55	--------	d-----w-	c:\program files\Fichiers communs\HP
2009-10-05 00:49 . 2009-10-05 01:48	54452	----a-w-	c:\windows\hppins01.dat
2009-10-05 00:49 . 2005-04-08 16:52	2392	------w-	c:\windows\hppmdl01.dat
2009-10-05 00:40 . 2009-10-05 00:40	--------	d-----w-	c:\program files\Alex Feinman
2009-10-05 00:38 . 2008-05-02 09:05	62592	------w-	c:\windows\system32\dllcache\cdrom.sys
2009-10-05 00:38 . 2008-05-02 13:31	466432	------w-	c:\windows\system32\imapi2fs.dll
2009-10-05 00:38 . 2008-05-02 13:31	466432	------w-	c:\windows\system32\dllcache\imapi2fs.dll
2009-10-05 00:38 . 2008-05-02 13:31	320000	------w-	c:\windows\system32\imapi2.dll
2009-10-05 00:38 . 2008-05-02 13:31	320000	------w-	c:\windows\system32\dllcache\imapi2.dll
2009-10-05 00:37 . 2009-09-28 06:49	781864	----a-w-	C:\WindowsXP-KB932716-v2-x86-FRA.exe
2009-10-05 00:02 . 2008-09-02 13:49	253952	----a-w-	c:\windows\system32\JkDefragScreenSaver.exe
2009-10-05 00:02 . 2008-09-02 13:49	106496	----a-w-	c:\windows\system32\JkDefragScreenSaver.scr
2009-10-05 00:01 . 2009-10-05 00:02	--------	d-----w-	c:\program files\JkDefrag
2009-10-04 23:31 . 2009-10-04 23:31	--------	d-----w-	c:\documents and settings\cdc\Application Data\Malwarebytes
2009-10-04 23:31 . 2009-09-10 12:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-04 23:31 . 2009-10-04 23:31	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-10-04 23:31 . 2009-10-04 23:31	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-04 23:31 . 2009-09-10 12:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-10-04 23:00 . 2009-10-04 23:00	--------	d-----w-	c:\windows\system32\NtmsData
2009-10-04 21:40 . 2009-10-04 21:40	--------	d-----w-	C:sit
2009-10-04 21:33 . 2009-10-04 21:33	--------	d-----w-	c:\windows\system32\wbem\snmp
2009-10-04 10:26 . 2009-10-04 10:26	19254	----a-w-	c:\documents and settings\cdc\Local Settings\Application Data\jebomo.dat
2009-09-21 09:01 . 2009-10-05 00:55	--------	d-----w-	c:\program files\HP
2009-09-19 17:06 . 2009-09-19 17:06	--------	d-----w-	c:\documents and settings\cdc\Application Data\Windows Desktop Search
2009-09-19 17:05 . 2009-09-28 13:47	--------	d-----w-	c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2009-09-19 17:05 . 2009-09-19 17:05	--------	d-----w-	c:\program files\Windows Desktop Search
2009-09-19 17:04 . 2009-10-05 00:51	--------	d-----w-	c:\windows\system32\DllCache
2009-09-19 17:04 . 2008-03-07 16:56	98304	------w-	c:\windows\system32\dllcache
lhtml.dll
2009-09-19 17:04 . 2008-03-07 16:56	29696	------w-	c:\windows\system32\dllcache\mimefilt.dll
2009-09-19 17:04 . 2008-03-07 16:56	192000	------w-	c:\windows\system32\dllcache\offfilt.dll
2009-09-19 17:04 . 2009-10-05 00:38	--------	d--h--w-	c:\windows\$hf_mig$
2009-09-19 16:30 . 2009-09-19 17:00	--------	d-----w-	c:\program files\Microsoft Works
2009-09-19 16:30 . 2009-09-19 16:30	--------	d-----w-	c:\program files\MSBuild
2009-09-19 16:27 . 2009-09-19 16:27	--------	d-----w-	c:\program files\Microsoft.NET
2009-09-19 16:24 . 2009-09-19 16:24	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2009-09-19 16:23 . 2009-09-19 16:24	--------	d-----w-	c:\windows\SHELLNEW
2009-09-19 16:23 . 2009-09-19 16:23	--------	d-----w-	c:\documents and settings\cdc\Local Settings\Application Data\Microsoft Help
2009-09-19 16:23 . 2009-09-30 19:34	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-19 16:22 . 2009-09-19 16:22	--------	d-----r-	C:\MSOCache
2009-09-19 16:09 . 2009-09-19 17:44	--------	d-----w-	c:\documents and settings\cdc\Application Data\Vso
2009-09-19 15:48 . 2009-09-19 15:48	--------	d-----w-	c:\documents and settings\cdc\Application Data\Apple Computer
2009-09-18 12:49 . 2009-09-18 12:49	--------	d-----w-	c:\documents and settings\cdc\Application Data\TeamViewer
2009-09-18 12:49 . 2009-10-04 23:31	--------	d-----w-	c:\program files\TeamViewer
2009-09-18 12:49 . 2009-09-18 12:49	--------	d-----w-	c:\documents and settings\cdc	emp
2009-09-18 10:26 . 2001-10-28 15:42	116224	----a-w-	c:\windows\system32\pdfcmnnt.dll
2009-09-18 10:26 . 2009-09-18 10:27	--------	d-----w-	c:\program files\PDFCreator
2009-09-18 10:26 . 1998-07-05 23:00	23552	----a-w-	c:\windows\system32\MSMPIDE.DLL
2009-09-15 16:02 . 2009-09-15 16:02	--------	d-----w-	c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-09-15 16:02 . 2009-09-15 16:02	--------	d-----w-	c:\program files\DAEMON Tools Toolbar
2009-09-15 16:02 . 2009-09-15 19:15	--------	d-----w-	c:\program files\DAEMON Tools Lite
2009-09-15 16:00 . 2009-09-15 16:00	721904	----a-w-	c:\windows\system32\drivers\sptd.sys
2009-09-15 16:00 . 2009-09-15 16:04	--------	d-----w-	c:\documents and settings\cdc\Application Data\DAEMON Tools Lite
2009-09-15 15:52 . 2009-09-15 15:52	--------	d-----w-	c:\documents and settings\cdc\Application Data\Download Manager
2009-09-15 15:43 . 2009-09-15 15:43	--------	d-----w-	c:\documents and settings\cdc\Local Settings\Application Data\Ahead
2009-09-15 14:50 . 2009-09-19 15:59	--------	d-----w-	c:\program files\Ahead
2009-09-11 14:20 . 2003-07-16 12:27	43264	------w-	c:\windows\system32\drivers\ser2pl.sys
2009-09-11 14:19 . 2009-09-11 14:19	--------	d-----w-	c:\program files\AlerteGPS
2009-09-10 14:27 . 2009-09-10 14:27	--------	d-----w-	c:\documents and settings\cdc\Local Settings\Application Data\Apple

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-05 14:40 . 2009-07-17 10:23	451546	----a-w-	c:\windows\system32\perfh040.dat
2009-10-05 14:40 . 2009-07-17 10:23	69480	----a-w-	c:\windows\system32\perfc040.dat
2009-10-05 00:59 . 2007-12-21 09:54	--------	d-----w-	c:\program files\Hewlett-Packard
2009-10-05 00:59 . 2007-12-21 09:57	--------	d--h--w-	c:\program files\Zero G Registry
2009-10-04 21:40 . 2009-07-17 10:22	--------	d-----w-	c:\program files\Trend Micro
2009-10-04 17:42 . 2007-12-21 01:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-04 17:31 . 2009-03-08 09:36	--------	d-----w-	c:\program files\Enigma Software Group
2009-10-02 06:52 . 2002-08-30 12:00	85326	----a-w-	c:\windows\system32\perfc00C.dat
2009-10-02 06:52 . 2002-08-30 12:00	496038	----a-w-	c:\windows\system32\perfh00C.dat
2009-09-20 07:46 . 2009-07-18 07:53	83296	----a-w-	c:\documents and settings\cdc\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-19 19:05 . 2009-07-22 10:15	--------	d-----w-	c:\documents and settings\All Users\Application Data\Mozilla Firefox
2009-09-19 17:46 . 2008-11-09 16:56	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skyline
2009-09-19 17:46 . 2008-01-26 10:41	--------	d-----w-	c:\documents and settings\All Users\Application Data\WinZip
2009-09-19 17:44 . 2008-05-01 18:36	--------	d-----w-	c:\program files\VSO
2009-09-19 17:44 . 2009-09-19 17:44	47360	----a-w-	c:\documents and settings\cdc\Application Data\pcouffin.sys
2009-09-19 17:44 . 2008-07-28 19:40	--------	d-----w-	c:\program files\Foxit Software
2009-09-19 17:44 . 2009-03-27 21:29	--------	d-----w-	c:\program files\Virtual Earth 3D
2009-09-19 15:59 . 2007-12-20 13:57	--------	d-----w-	c:\program files\Fichiers communs\Ahead
2009-09-19 15:58 . 2007-12-26 20:18	--------	d-----w-	c:\program files\OpenOffice.org 2.3
2009-09-19 15:55 . 2007-12-19 18:55	--------	d-----w-	c:\program files\TUGZip
2009-09-19 15:50 . 2008-04-29 08:09	--------	d-----w-	c:\program files\Mozilla Thunderbird
2009-09-11 14:20 . 2007-12-20 11:57	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-09-10 14:27 . 2008-09-15 21:53	--------	d-----w-	c:\program files\Fichiers communs\Apple
2009-08-26 07:02 . 2007-12-21 01:09	--------	d-----w-	c:\program files\Java
2009-08-20 13:41 . 2009-08-20 13:41	--------	d-----w-	c:\program files\VersalSoft
2009-08-20 13:41 . 2009-08-20 13:41	--------	d-----w-	c:\program files\Universal
2009-07-25 03:23 . 2008-12-16 21:22	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-07-20 19:28 . 2009-07-20 19:28	126	----a-w-	c:\documents and settings\cdc\Local Settings\Application Data\fusioncache.dat
2009-07-17 14:05 . 2009-07-17 13:50	77	----a-w-	C:\sauvegarde.cmd
.

(((((((((((((((((((((((((((((   SnapShot@2009-10-04_20.36.06   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-12-16 21:39 . 2007-11-30 11:19	18296              c:\windows\system32\spmsg.dll
+ 2002-08-30 12:00 . 2009-10-05 14:40	57262              c:\windows\system32\perfc009.dat
+ 2004-08-03 20:59 . 2008-05-02 09:05	62592              c:\windows\system32\drivers\cdrom.sys
+ 2009-10-05 00:59 . 2009-10-05 00:59	84992              c:\windows\Installer\c20d7.msi
+ 2009-10-05 00:55 . 2009-10-05 00:55	45056              c:\windows\Installer\{64FC0C98-B035-4530-B15D-3D30610B6DF1}\HPSUShortcut2_936C42D08CEE4BDFB8CEC4BDC93C6CF8_1.exe
- 2009-09-21 09:06 . 2009-09-21 09:06	45056              c:\windows\Installer\{64FC0C98-B035-4530-B15D-3D30610B6DF1}\HPSUShortcut2_936C42D08CEE4BDFB8CEC4BDC93C6CF8_1.exe
+ 2009-10-05 00:57 . 2009-10-05 00:57	40960              c:\windows\Installer\{20FBC0A0-3160-4F14-83ED-3A74BB6B8C31}\NewShortcut1.A6CC6977_F7B4_4C0B_9510_BCD847D4BDB2.exe
- 2009-09-21 09:08 . 2009-09-21 09:08	40960              c:\windows\Installer\{20FBC0A0-3160-4F14-83ED-3A74BB6B8C31}\NewShortcut1.A6CC6977_F7B4_4C0B_9510_BCD847D4BDB2.exe
+ 2009-10-05 00:38 . 2008-05-02 09:05	62592              c:\windows\Driver Cache\i386\cdrom.sys
+ 2009-10-05 00:54 . 2009-10-05 00:54	90112              c:\windows\assembly\GAC\LTRASTERVIEWLib\1.0.0.0__a53cf5803f4c3827\LTRASTERVIEWLib.dll
- 2009-09-21 09:06 . 2009-09-21 09:06	90112              c:\windows\assembly\GAC\LTRASTERVIEWLib\1.0.0.0__a53cf5803f4c3827\LTRASTERVIEWLib.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	40960              c:\windows\assembly\GAC\LTRASTERLib\1.0.0.0__a53cf5803f4c3827\LTRASTERLib.dll
- 2009-09-21 09:06 . 2009-09-21 09:06	40960              c:\windows\assembly\GAC\LTRASTERLib\1.0.0.0__a53cf5803f4c3827\LTRASTERLib.dll
- 2009-09-21 09:06 . 2009-09-21 09:06	73728              c:\windows\assembly\GAC\LTRASTERIOLib\1.0.0.0__a53cf5803f4c3827\LTRASTERIOLib.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	73728              c:\windows\assembly\GAC\LTRASTERIOLib\1.0.0.0__a53cf5803f4c3827\LTRASTERIOLib.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	77824              c:\windows\assembly\GAC\LEAD\13.0.0.89__9cf889f53ea9b907\LEAD.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	77824              c:\windows\assembly\GAC\LEAD\13.0.0.89__9cf889f53ea9b907\LEAD.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	40960              c:\windows\assembly\GAC\LEAD.Windows.Forms\13.0.0.89__9cf889f53ea9b907\LEAD.Windows.Forms.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	40960              c:\windows\assembly\GAC\LEAD.Windows.Forms\13.0.0.89__9cf889f53ea9b907\LEAD.Windows.Forms.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	69632              c:\windows\assembly\GAC\LEAD.Windows.Forms.DrawingContainer\13.0.0.89__9cf889f53ea9b907\LEAD.Windows.Forms.DrawingContainer.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	69632              c:\windows\assembly\GAC\LEAD.Windows.Forms.DrawingContainer\13.0.0.89__9cf889f53ea9b907\LEAD.Windows.Forms.DrawingContainer.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	86016              c:\windows\assembly\GAC\LEAD.Drawing\13.0.0.89__9cf889f53ea9b907\LEAD.Drawing.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	86016              c:\windows\assembly\GAC\LEAD.Drawing\13.0.0.89__9cf889f53ea9b907\LEAD.Drawing.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	90112              c:\windows\assembly\GAC\LEAD.Drawing.Imaging.ImageProcessing\13.0.0.89__9cf889f53ea9b907\LEAD.Drawing.Imaging.ImageProcessing.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	90112              c:\windows\assembly\GAC\LEAD.Drawing.Imaging.ImageProcessing\13.0.0.89__9cf889f53ea9b907\LEAD.Drawing.Imaging.ImageProcessing.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	81920              c:\windows\assembly\GAC\LEAD.Drawing.Imaging.Codecs\13.0.0.89__9cf889f53ea9b907\LEAD.Drawing.Imaging.Codecs.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	81920              c:\windows\assembly\GAC\LEAD.Drawing.Imaging.Codecs\13.0.0.89__9cf889f53ea9b907\LEAD.Drawing.Imaging.Codecs.dll
- 2009-09-21 09:07 . 2009-09-21 09:07	18944              c:\windows\assembly\GAC\Interop.MsHtmHst\0.0.0.0__a53cf5803f4c3827\Interop.MsHtmHst.dll
+ 2009-10-05 00:55 . 2009-10-05 00:55	18944              c:\windows\assembly\GAC\Interop.MsHtmHst\0.0.0.0__a53cf5803f4c3827\Interop.MsHtmHst.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	90112              c:\windows\assembly\GAC\Interop.LTANNLib\1.0.0.0__a53cf5803f4c3827\Interop.LTANNLib.dll
- 2009-09-21 09:06 . 2009-09-21 09:06	90112              c:\windows\assembly\GAC\Interop.LTANNLib\1.0.0.0__a53cf5803f4c3827\Interop.LTANNLib.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	10240              c:\windows\assembly\GAC\interop.hpqimgr\1.0.0.0__a53cf5803f4c3827\interop.hpqimgr.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	10240              c:\windows\assembly\GAC\interop.hpqimgr\1.0.0.0__a53cf5803f4c3827\interop.hpqimgr.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	28672              c:\windows\assembly\GAC\Interop.hpqdstcp\3.0.0.0__a53cf5803f4c3827\Interop.hpqdstcp.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	28672              c:\windows\assembly\GAC\Interop.hpqdstcp\3.0.0.0__a53cf5803f4c3827\Interop.hpqdstcp.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	36864              c:\windows\assembly\GAC\Interop.hpqcxm08\3.0.0.0__a53cf5803f4c3827\Interop.hpqcxm08.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	36864              c:\windows\assembly\GAC\Interop.hpqcxm08\3.0.0.0__a53cf5803f4c3827\Interop.hpqcxm08.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	15872              c:\windows\assembly\GAC\interop.hpodxmlutil\2.0.588.1728__a53cf5803f4c3827\interop.hpodxmlutil.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	15872              c:\windows\assembly\GAC\interop.hpodxmlutil\2.0.588.1728__a53cf5803f4c3827\interop.hpodxmlutil.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	13312              c:\windows\assembly\GAC\interop.hpodvid\2.0.588.1728__a53cf5803f4c3827\interop.hpodvid.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	13312              c:\windows\assembly\GAC\interop.hpodvid\2.0.588.1728__a53cf5803f4c3827\interop.hpodvid.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	13312              c:\windows\assembly\GAC\interop.hpodtrk\2.0.588.1728__a53cf5803f4c3827\interop.hpodtrk.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	13312              c:\windows\assembly\GAC\interop.hpodtrk\2.0.588.1728__a53cf5803f4c3827\interop.hpodtrk.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	12800              c:\windows\assembly\GAC\interop.hpodmpv_md\2.0.588.1728__a53cf5803f4c3827\interop.hpodmpv_md.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	12800              c:\windows\assembly\GAC\interop.hpodmpv_md\2.0.588.1728__a53cf5803f4c3827\interop.hpodmpv_md.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	15360              c:\windows\assembly\GAC\interop.hpodmmc\1.0.0.0__a53cf5803f4c3827\interop.hpodmmc.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	15360              c:\windows\assembly\GAC\interop.hpodmmc\1.0.0.0__a53cf5803f4c3827\interop.hpodmmc.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	10240              c:\windows\assembly\GAC\Interop.hpodev08\3.0.0.0__a53cf5803f4c3827\Interop.hpodev08.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	10240              c:\windows\assembly\GAC\Interop.hpodev08\3.0.0.0__a53cf5803f4c3827\Interop.hpodev08.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	94208              c:\windows\assembly\GAC\Interop.hpodeb08\3.0.0.0__a53cf5803f4c3827\Interop.hpodeb08.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	94208              c:\windows\assembly\GAC\Interop.hpodeb08\3.0.0.0__a53cf5803f4c3827\Interop.hpodeb08.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	12800              c:\windows\assembly\GAC\interop.hpodaud\2.0.588.1728__a53cf5803f4c3827\interop.hpodaud.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	12800              c:\windows\assembly\GAC\interop.hpodaud\2.0.588.1728__a53cf5803f4c3827\interop.hpodaud.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	53248              c:\windows\assembly\GAC\interop.hpodai\2.0.588.1728__a53cf5803f4c3827\interop.hpodai.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	53248              c:\windows\assembly\GAC\interop.hpodai\2.0.588.1728__a53cf5803f4c3827\interop.hpodai.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	24576              c:\windows\assembly\GAC\interop.hpodae\2.0.588.1728__a53cf5803f4c3827\interop.hpodae.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	24576              c:\windows\assembly\GAC\interop.hpodae\2.0.588.1728__a53cf5803f4c3827\interop.hpodae.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	98304              c:\windows\assembly\GAC\Interop.hpocxi08\1.0.0.0__3b766a3b3d2dc385\Interop.hpocxi08.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	98304              c:\windows\assembly\GAC\Interop.hpocxi08\1.0.0.0__3b766a3b3d2dc385\Interop.hpocxi08.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	36864              c:\windows\assembly\GAC\Interop.HPDarc\1.0.0.0__19565c63d39c2842\Interop.hpdarc.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	36864              c:\windows\assembly\GAC\Interop.HPDarc\1.0.0.0__19565c63d39c2842\Interop.hpdarc.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	73728              c:\windows\assembly\GAC\hpqvideo\3.0.0.0__a53cf5803f4c3827\hpqvideo.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	73728              c:\windows\assembly\GAC\hpqvideo\3.0.0.0__a53cf5803f4c3827\hpqvideo.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	81920              c:\windows\assembly\GAC\hpqtray.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqtray.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	81920              c:\windows\assembly\GAC\hpqtray.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqtray.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	45056              c:\windows\assembly\GAC\hpqthumb\3.0.0.0__a53cf5803f4c3827\hpqthumb.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	45056              c:\windows\assembly\GAC\hpqthumb\3.0.0.0__a53cf5803f4c3827\hpqthumb.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	28672              c:\windows\assembly\GAC\hpqthrsc\3.0.0.0__a53cf5803f4c3827\hpqthrsc.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	28672              c:\windows\assembly\GAC\hpqthrsc\3.0.0.0__a53cf5803f4c3827\hpqthrsc.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	77824              c:\windows\assembly\GAC\hpqshfop\3.0.0.0__a53cf5803f4c3827\hpqshfop.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	77824              c:\windows\assembly\GAC\hpqshfop\3.0.0.0__a53cf5803f4c3827\hpqshfop.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	45056              c:\windows\assembly\GAC\hpqshfop.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqshfop.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	45056              c:\windows\assembly\GAC\hpqshfop.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqshfop.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	61440              c:\windows\assembly\GAC\hpqptint\3.0.0.0__a53cf5803f4c3827\hpqptint.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	61440              c:\windows\assembly\GAC\hpqptint\3.0.0.0__a53cf5803f4c3827\hpqptint.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	16384              c:\windows\assembly\GAC\hpqptfnd\3.0.0.0__a53cf5803f4c3827\hpqptfnd.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	16384              c:\windows\assembly\GAC\hpqptfnd\3.0.0.0__a53cf5803f4c3827\hpqptfnd.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	81920              c:\windows\assembly\GAC\hpqprutl.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqprutl.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	81920              c:\windows\assembly\GAC\hpqprutl.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqprutl.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	53248              c:\windows\assembly\GAC\hpqprrsc\3.0.0.0__a53cf5803f4c3827\hpqprrsc.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	53248              c:\windows\assembly\GAC\hpqprrsc\3.0.0.0__a53cf5803f4c3827\hpqprrsc.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	12800              c:\windows\assembly\GAC\hpqprrsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqprrsc.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	12800              c:\windows\assembly\GAC\hpqprrsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqprrsc.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	94208              c:\windows\assembly\GAC\hpqprjfx.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqprjfx.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	94208              c:\windows\assembly\GAC\hpqprjfx.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqprjfx.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	20480              c:\windows\assembly\GAC\hpqprif\3.0.0.0__a53cf5803f4c3827\hpqprif.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	20480              c:\windows\assembly\GAC\hpqprif\3.0.0.0__a53cf5803f4c3827\hpqprif.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	12288              c:\windows\assembly\GAC\hpqpel10.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqpel10.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	12288              c:\windows\assembly\GAC\hpqpel10.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqpel10.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	73728              c:\windows\assembly\GAC\hpqpanop.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqpanop.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	73728              c:\windows\assembly\GAC\hpqpanop.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqpanop.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	57344              c:\windows\assembly\GAC\hpqntrop\3.0.0.0__a53cf5803f4c3827\hpqntrop.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	57344              c:\windows\assembly\GAC\hpqntrop\3.0.0.0__a53cf5803f4c3827\hpqntrop.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	16384              c:\windows\assembly\GAC\hpqmyint\3.0.0.0__a53cf5803f4c3827\hpqmyint.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	16384              c:\windows\assembly\GAC\hpqmyint\3.0.0.0__a53cf5803f4c3827\hpqmyint.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	36864              c:\windows\assembly\GAC\hpqmpvad\3.0.0.0__a53cf5803f4c3827\hpqmpvad.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	36864              c:\windows\assembly\GAC\hpqmpvad\3.0.0.0__a53cf5803f4c3827\hpqmpvad.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	65536              c:\windows\assembly\GAC\hpqmdmr\3.0.0.0__a53cf5803f4c3827\hpqmdmr.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	65536              c:\windows\assembly\GAC\hpqmdmr\3.0.0.0__a53cf5803f4c3827\hpqmdmr.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	20480              c:\windows\assembly\GAC\hpqltutl\3.0.0.0__a53cf5803f4c3827\hpqltutl.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	20480              c:\windows\assembly\GAC\hpqltutl\3.0.0.0__a53cf5803f4c3827\hpqltutl.dll
+ 2009-10-05 00:55 . 2009-10-05 00:55	32768              c:\windows\assembly\GAC\hpqisrtb\4.0.0.0__a53cf5803f4c3827\hpqisrtb.dll
- 2009-09-21 09:07 . 2009-09-21 09:07	32768              c:\windows\assembly\GAC\hpqisrtb\4.0.0.0__a53cf5803f4c3827\hpqisrtb.dll
+ 2009-10-05 00:55 . 2009-10-05 00:55	28672              c:\windows\assembly\GAC\hpqisrtb.resources\4.0.0.0_fr_a53cf5803f4c3827\hpqisrtb.resources.dll
- 2009-09-21 09:07 . 2009-09-21 09:07	28672              c:\windows\assembly\GAC\hpqisrtb.resources\4.0.0.0_fr_a53cf5803f4c3827\hpqisrtb.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	49152              c:\windows\assembly\GAC\hpqimlib\3.0.0.0__a53cf5803f4c3827\hpqimlib.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	49152              c:\windows\assembly\GAC\hpqimlib\3.0.0.0__a53cf5803f4c3827\hpqimlib.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	12800              c:\windows\assembly\GAC\hpqimgrc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqimgrc.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	12800              c:\windows\assembly\GAC\hpqimgrc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqimgrc.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	16384              c:\windows\assembly\GAC\hpqiface\3.0.0.0__a53cf5803f4c3827\hpqiface.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	16384              c:\windows\assembly\GAC\hpqiface\3.0.0.0__a53cf5803f4c3827\hpqiface.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	40960              c:\windows\assembly\GAC\hpqgtpin.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqgtpin.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	40960              c:\windows\assembly\GAC\hpqgtpin.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqgtpin.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	73728              c:\windows\assembly\GAC\hpqgskin\3.0.0.0__a53cf5803f4c3827\hpqgskin.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	73728              c:\windows\assembly\GAC\hpqgskin\3.0.0.0__a53cf5803f4c3827\hpqgskin.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	11264              c:\windows\assembly\GAC\hpqgprsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqgprsc.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	11264              c:\windows\assembly\GAC\hpqgprsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqgprsc.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	65536              c:\windows\assembly\GAC\hpqglutl\3.0.0.0__a53cf5803f4c3827\hpqglutl.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	65536              c:\windows\assembly\GAC\hpqglutl\3.0.0.0__a53cf5803f4c3827\hpqglutl.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	32768              c:\windows\assembly\GAC\hpqglutl.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqglutl.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	32768              c:\windows\assembly\GAC\hpqglutl.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqglutl.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	57344              c:\windows\assembly\GAC\hpqgldlg.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqgldlg.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	57344              c:\windows\assembly\GAC\hpqgldlg.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqgldlg.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	28672              c:\windows\assembly\GAC\hpqfmrsc\3.0.0.0__a53cf5803f4c3827\hpqfmrsc.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	28672              c:\windows\assembly\GAC\hpqfmrsc\3.0.0.0__a53cf5803f4c3827\hpqfmrsc.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	24576              c:\windows\assembly\GAC\hpqedppi\3.0.0.0__a53cf5803f4c3827\hpqedppi.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	24576              c:\windows\assembly\GAC\hpqedppi\3.0.0.0__a53cf5803f4c3827\hpqedppi.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	24576              c:\windows\assembly\GAC\hpqeal\3.0.0.0__a53cf5803f4c3827\hpqeal.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	24576              c:\windows\assembly\GAC\hpqeal\3.0.0.0__a53cf5803f4c3827\hpqeal.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	98304              c:\windows\assembly\GAC\hpqdocpt\3.0.0.0__a53cf5803f4c3827\hpqdocpt.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	98304              c:\windows\assembly\GAC\hpqdocpt\3.0.0.0__a53cf5803f4c3827\hpqdocpt.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	15360              c:\windows\assembly\GAC\hpqdocpt.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqdocpt.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	15360              c:\windows\assembly\GAC\hpqdocpt.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqdocpt.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	36864              c:\windows\assembly\GAC\hpqdcrsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqdcrsc.resources.dll
- 2009-09-21 09:06 . 2009-09-21 09:06	36864              c:\windows\assembly\GAC\hpqdcrsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqdcrsc.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	94208              c:\windows\assembly\GAC\hpqdcprf\3.0.0.0__a53cf5803f4c3827\hpqdcprf.dll
- 2009-09-21 09:06 . 2009-09-21 09:06	94208              c:\windows\assembly\GAC\hpqdcprf\3.0.0.0__a53cf5803f4c3827\hpqdcprf.dll
- 2009-09-21 09:06 . 2009-09-21 09:06	49152              c:\windows\assembly\GAC\hpqdcprf.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqdcprf.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	49152              c:\windows\assembly\GAC\hpqdcprf.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqdcprf.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	32768              c:\windows\assembly\GAC\hpqcprsc\3.0.0.0__a53cf5803f4c3827\hpqcprsc.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	32768              c:\windows\assembly\GAC\hpqcprsc\3.0.0.0__a53cf5803f4c3827\hpqcprsc.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	32768              c:\windows\assembly\GAC\hpqcpint\3.0.0.0__a53cf5803f4c3827\hpqcpint.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	32768              c:\windows\assembly\GAC\hpqcpint\3.0.0.0__a53cf5803f4c3827\hpqcpint.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	94208              c:\windows\assembly\GAC\hpqcmctl.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqcmctl.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	94208              c:\windows\assembly\GAC\hpqcmctl.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqcmctl.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	24576              c:\windows\assembly\GAC\hpqcalrsc\3.0.0.0__a53cf5803f4c3827\hpqcalrsc.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	24576              c:\windows\assembly\GAC\hpqcalrsc\3.0.0.0__a53cf5803f4c3827\hpqcalrsc.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	81920              c:\windows\assembly\GAC\hpqcalp.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqcalp.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	81920              c:\windows\assembly\GAC\hpqcalp.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqcalp.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	24576              c:\windows\assembly\GAC\hpqasset\3.0.0.0__a53cf5803f4c3827\hpqasset.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	24576              c:\windows\assembly\GAC\hpqasset\3.0.0.0__a53cf5803f4c3827\hpqasset.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	28672              c:\windows\assembly\GAC\hpqalb\3.0.0.0__a53cf5803f4c3827\hpqalb.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	28672              c:\windows\assembly\GAC\hpqalb\3.0.0.0__a53cf5803f4c3827\hpqalb.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	28672              c:\windows\assembly\GAC\HPODMmcLib\1.0.0.0__a53cf5803f4c3827\HPODMmcLib.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	28672              c:\windows\assembly\GAC\HPODMmcLib\1.0.0.0__a53cf5803f4c3827\HPODMmcLib.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	31744              c:\windows\assembly\GAC\hplMosaicNet\1.3.1.0__0d5444959b41355f\hplMosaicNet.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	31744              c:\windows\assembly\GAC\hplMosaicNet\1.3.1.0__0d5444959b41355f\hplMosaicNet.dll
+ 2009-10-05 00:55 . 2009-10-05 00:55	45056              c:\windows\assembly\GAC\AxInterop.SHDocVw\1.1.0.0__a53cf5803f4c3827\AxInterop.SHDocVw.dll
- 2009-09-21 09:07 . 2009-09-21 09:07	45056              c:\windows\assembly\GAC\AxInterop.SHDocVw\1.1.0.0__a53cf5803f4c3827\AxInterop.SHDocVw.dll
- 2009-09-21 09:06 . 2009-09-21 09:06	77824              c:\windows\assembly\GAC\AxInterop.LTRASTERVIEWLib\1.0.0.0__a53cf5803f4c3827\AxInterop.LTRASTERVIEWLib.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	77824              c:\windows\assembly\GAC\AxInterop.LTRASTERVIEWLib\1.0.0.0__a53cf5803f4c3827\AxInterop.LTRASTERVIEWLib.dll
+ 2007-12-21 09:53 . 2001-08-23 15:20	6912              c:\windows\system32\DllCache\serscan.sys
- 2009-09-21 09:05 . 2009-09-21 09:05	3072              c:\windows\assembly\GAC\policy.13.0.LEAD\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	3072              c:\windows\assembly\GAC\policy.13.0.LEAD\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	3072              c:\windows\assembly\GAC\policy.13.0.LEAD.Wrapper\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Wrapper.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	3072              c:\windows\assembly\GAC\policy.13.0.LEAD.Wrapper\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Wrapper.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	3072              c:\windows\assembly\GAC\policy.13.0.LEAD.Windows.Forms\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Windows.Forms.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	3072              c:\windows\assembly\GAC\policy.13.0.LEAD.Windows.Forms\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Windows.Forms.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	3584              c:\windows\assembly\GAC\policy.13.0.LEAD.Windows.Forms.DrawingContainer\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Windows.Forms.DrawingContainer.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	3584              c:\windows\assembly\GAC\policy.13.0.LEAD.Windows.Forms.DrawingContainer\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Windows.Forms.DrawingContainer.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	3584              c:\windows\assembly\GAC\policy.13.0.LEAD.Windows.Forms.CommonDialogs\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Windows.Forms.CommonDialogs.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	3584              c:\windows\assembly\GAC\policy.13.0.LEAD.Windows.Forms.CommonDialogs\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Windows.Forms.CommonDialogs.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	3072              c:\windows\assembly\GAC\policy.13.0.LEAD.Drawing\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Drawing.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	3072              c:\windows\assembly\GAC\policy.13.0.LEAD.Drawing\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Drawing.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	3584              c:\windows\assembly\GAC\policy.13.0.LEAD.Drawing.Imaging.ImageProcessing\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Drawing.Imaging.ImageProcessing.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	3584              c:\windows\assembly\GAC\policy.13.0.LEAD.Drawing.Imaging.ImageProcessing\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Drawing.Imaging.ImageProcessing.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	3584              c:\windows\assembly\GAC\policy.13.0.LEAD.Drawing.Imaging.Codecs\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Drawing.Imaging.Codecs.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	3584              c:\windows\assembly\GAC\policy.13.0.LEAD.Drawing.Imaging.Codecs\13.0.0.89__9cf889f53ea9b907\policy.13.0.LEAD.Drawing.Imaging.Codecs.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	4096              c:\windows\assembly\GAC\Interop.hprblog\3.0.0.0__a53cf5803f4c3827\Interop.hprblog.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	4096              c:\windows\assembly\GAC\Interop.hprblog\3.0.0.0__a53cf5803f4c3827\Interop.hprblog.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	7680              c:\windows\assembly\GAC\Interop.hpqvideo\3.0.0.0__a53cf5803f4c3827\Interop.hpqvideo.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	7680              c:\windows\assembly\GAC\Interop.hpqvideo\3.0.0.0__a53cf5803f4c3827\Interop.hpqvideo.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	5632              c:\windows\assembly\GAC\interop.hpqcldat\1.0.0.0__a53cf5803f4c3827\interop.hpqcldat.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	5632              c:\windows\assembly\GAC\interop.hpqcldat\1.0.0.0__a53cf5803f4c3827\interop.hpqcldat.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	4608              c:\windows\assembly\GAC\interop.hpodprint2\4.0.0.0__a53cf5803f4c3827\interop.hpodprint2.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	4608              c:\windows\assembly\GAC\interop.hpodprint2\4.0.0.0__a53cf5803f4c3827\interop.hpodprint2.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	7680              c:\windows\assembly\GAC\interop.hpodmpv\2.0.588.1728__a53cf5803f4c3827\interop.hpodmpv.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	7680              c:\windows\assembly\GAC\interop.hpodmpv\2.0.588.1728__a53cf5803f4c3827\interop.hpodmpv.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	6656              c:\windows\assembly\GAC\interop.hpodmp\2.0.588.1728__a53cf5803f4c3827\interop.hpodmp.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	6656              c:\windows\assembly\GAC\interop.hpodmp\2.0.588.1728__a53cf5803f4c3827\interop.hpodmp.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	3584              c:\windows\assembly\GAC\hpqthrsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqthrsc.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	3584              c:\windows\assembly\GAC\hpqthrsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqthrsc.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	7168              c:\windows\assembly\GAC\hpqptint.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqptint.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	7168              c:\windows\assembly\GAC\hpqptint.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqptint.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	9728              c:\windows\assembly\GAC\hpqmdmr.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqmdmr.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	9728              c:\windows\assembly\GAC\hpqmdmr.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqmdmr.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	7168              c:\windows\assembly\GAC\hpqfmrsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqfmrsc.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	7168              c:\windows\assembly\GAC\hpqfmrsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqfmrsc.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	7680              c:\windows\assembly\GAC\hpqcprsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqcprsc.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	7680              c:\windows\assembly\GAC\hpqcprsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqcprsc.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	4096              c:\windows\assembly\GAC\hpqcalrsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqcalrsc.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	4096              c:\windows\assembly\GAC\hpqcalrsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqcalrsc.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	8704              c:\windows\assembly\GAC\hpqactiv.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqactiv.resources.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	8704              c:\windows\assembly\GAC\hpqactiv.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqactiv.resources.dll
+ 2002-08-30 12:00 . 2009-10-05 14:40	385468              c:\windows\system32\perfh009.dat
+ 2009-10-05 00:57 . 2009-10-05 00:57	123904              c:\windows\Installer\c20d1.msi
+ 2009-10-05 00:57 . 2009-10-05 00:57	255488              c:\windows\Installer\c20ca.msi
+ 2009-10-05 00:57 . 2009-10-05 00:57	149504              c:\windows\Installer\c20c4.msi
+ 2009-10-05 00:56 . 2009-10-05 00:56	323072              c:\windows\Installer\c206d.msi
+ 2009-10-05 00:55 . 2009-10-05 00:55	514048              c:\windows\Installer\c2067.msi
+ 2009-10-05 00:55 . 2009-10-05 00:55	197120              c:\windows\Installer\c1fac.msi
+ 2009-10-05 00:55 . 2009-10-05 00:55	204288              c:\windows\Installer\c1fa5.msi
+ 2009-10-05 00:55 . 2009-10-05 00:55	568832              c:\windows\Installer\c1f9f.msi
+ 2009-10-05 00:55 . 2009-10-05 00:55	363008              c:\windows\Installer\c1f98.msi
+ 2009-10-05 00:55 . 2009-10-05 00:55	390656              c:\windows\Installer\c1f92.msi
+ 2009-10-05 00:54 . 2009-10-05 00:54	970240              c:\windows\Installer\c1f64.msi
+ 2009-10-05 00:53 . 2009-10-05 00:53	268800              c:\windows\Installer\c1e9e.msi
+ 2009-10-05 00:53 . 2009-10-05 00:53	269824              c:\windows\Installer\c1e88.msi
+ 2009-10-05 00:53 . 2009-10-05 00:53	188928              c:\windows\Installer\c1e82.msi
+ 2009-10-05 00:53 . 2009-10-05 00:53	289792              c:\windows\Installer\c1e7c.msi
+ 2009-10-05 00:53 . 2009-10-05 00:53	349184              c:\windows\Installer\c1e75.msi
+ 2009-10-05 00:53 . 2009-10-05 00:53	476672              c:\windows\Installer\c1e6f.msi
+ 2009-10-05 00:52 . 2009-10-05 00:52	337920              c:\windows\Installer\c1e69.msi
+ 2009-10-05 00:52 . 2009-10-05 00:52	364032              c:\windows\Installer\c1e63.msi
+ 2009-10-05 00:52 . 2009-10-05 00:52	293376              c:\windows\Installer\c1e5d.msi
+ 2009-10-05 00:52 . 2009-10-05 00:52	284672              c:\windows\Installer\c1e56.msi
+ 2009-10-05 00:52 . 2009-10-05 00:52	185856              c:\windows\Installer\c1e50.msi
+ 2009-10-05 00:40 . 2009-10-05 00:40	318464              c:\windows\Installer\1c236.msi
+ 2009-10-05 00:54 . 2009-10-05 00:54	430080              c:\windows\assembly\GAC\LEAD.Wrapper\13.0.0.89__9cf889f53ea9b907\LEAD.Wrapper.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	430080              c:\windows\assembly\GAC\LEAD.Wrapper\13.0.0.89__9cf889f53ea9b907\LEAD.Wrapper.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	106496              c:\windows\assembly\GAC\LEAD.Windows.Forms.CommonDialogs\13.0.0.89__9cf889f53ea9b907\LEAD.Windows.Forms.CommonDialogs.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	106496              c:\windows\assembly\GAC\LEAD.Windows.Forms.CommonDialogs\13.0.0.89__9cf889f53ea9b907\LEAD.Windows.Forms.CommonDialogs.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	102400              c:\windows\assembly\GAC\LEAD.Drawing.Imaging.Twain\13.0.0.89__9cf889f53ea9b907\LEAD.Drawing.Imaging.Twain.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	102400              c:\windows\assembly\GAC\LEAD.Drawing.Imaging.Twain\13.0.0.89__9cf889f53ea9b907\LEAD.Drawing.Imaging.Twain.dll
+ 2009-10-05 00:55 . 2009-10-05 00:55	126976              c:\windows\assembly\GAC\Interop.SHDocVw\1.1.0.0__a53cf5803f4c3827\Interop.SHDocVw.dll
- 2009-09-21 09:07 . 2009-09-21 09:07	126976              c:\windows\assembly\GAC\Interop.SHDocVw\1.1.0.0__a53cf5803f4c3827\Interop.SHDocVw.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	172032              c:\windows\assembly\GAC\Interop.hpodio08\3.0.0.0__a53cf5803f4c3827\Interop.hpodio08.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	172032              c:\windows\assembly\GAC\Interop.hpodio08\3.0.0.0__a53cf5803f4c3827\Interop.hpodio08.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	163840              c:\windows\assembly\GAC\hpqutils\3.0.0.0__a53cf5803f4c3827\hpqutils.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	163840              c:\windows\assembly\GAC\hpqutils\3.0.0.0__a53cf5803f4c3827\hpqutils.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	229376              c:\windows\assembly\GAC\hpqtray\3.0.0.0__a53cf5803f4c3827\hpqtray.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	229376              c:\windows\assembly\GAC\hpqtray\3.0.0.0__a53cf5803f4c3827\hpqtray.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	286720              c:\windows\assembly\GAC\hpqptfx.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqptfx.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	286720              c:\windows\assembly\GAC\hpqptfx.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqptfx.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	294912              c:\windows\assembly\GAC\hpqprutl\3.0.0.0__a53cf5803f4c3827\hpqprutl.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	294912              c:\windows\assembly\GAC\hpqprutl\3.0.0.0__a53cf5803f4c3827\hpqprutl.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	307200              c:\windows\assembly\GAC\hpqprjfx\3.0.0.0__a53cf5803f4c3827\hpqprjfx.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	307200              c:\windows\assembly\GAC\hpqprjfx\3.0.0.0__a53cf5803f4c3827\hpqprjfx.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	131072              c:\windows\assembly\GAC\hpqpel10\3.0.0.0__a53cf5803f4c3827\hpqpel10.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	131072              c:\windows\assembly\GAC\hpqpel10\3.0.0.0__a53cf5803f4c3827\hpqpel10.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	172032              c:\windows\assembly\GAC\hpqpdmdl\3.0.0.0__a53cf5803f4c3827\hpqpdmdl.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	172032              c:\windows\assembly\GAC\hpqpdmdl\3.0.0.0__a53cf5803f4c3827\hpqpdmdl.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	364544              c:\windows\assembly\GAC\hpqpanop\3.0.0.0__a53cf5803f4c3827\hpqpanop.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	364544              c:\windows\assembly\GAC\hpqpanop\3.0.0.0__a53cf5803f4c3827\hpqpanop.dll
- 2009-09-21 09:06 . 2009-09-21 09:06	651264              c:\windows\assembly\GAC\hpqmydoc\3.0.0.0__a53cf5803f4c3827\hpqmydoc.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	651264              c:\windows\assembly\GAC\hpqmydoc\3.0.0.0__a53cf5803f4c3827\hpqmydoc.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	258048              c:\windows\assembly\GAC\hpqmydoc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqmydoc.resources.dll
- 2009-09-21 09:06 . 2009-09-21 09:06	258048              c:\windows\assembly\GAC\hpqmydoc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqmydoc.resources.dll
- 2009-09-21 09:07 . 2009-09-21 09:07	229376              c:\windows\assembly\GAC\hpqistab\4.0.0.0__a53cf5803f4c3827\hpqistab.dll
+ 2009-10-05 00:55 . 2009-10-05 00:55	229376              c:\windows\assembly\GAC\hpqistab\4.0.0.0__a53cf5803f4c3827\hpqistab.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	167936              c:\windows\assembly\GAC\hpqimgrc\3.0.0.0__a53cf5803f4c3827\hpqimgrc.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	167936              c:\windows\assembly\GAC\hpqimgrc\3.0.0.0__a53cf5803f4c3827\hpqimgrc.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	798720              c:\windows\assembly\GAC\hpqietpz\3.0.0.0__a53cf5803f4c3827\hpqietpz.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	798720              c:\windows\assembly\GAC\hpqietpz\3.0.0.0__a53cf5803f4c3827\hpqietpz.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	225280              c:\windows\assembly\GAC\hpqietpz.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqietpz.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	225280              c:\windows\assembly\GAC\hpqietpz.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqietpz.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	151552              c:\windows\assembly\GAC\hpqgtpin\3.0.0.0__a53cf5803f4c3827\hpqgtpin.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	151552              c:\windows\assembly\GAC\hpqgtpin\3.0.0.0__a53cf5803f4c3827\hpqgtpin.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	110592              c:\windows\assembly\GAC\hpqgprsc\3.0.0.0__a53cf5803f4c3827\hpqgprsc.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	110592              c:\windows\assembly\GAC\hpqgprsc\3.0.0.0__a53cf5803f4c3827\hpqgprsc.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	126976              c:\windows\assembly\GAC\hpqgldlg\3.0.0.0__a53cf5803f4c3827\hpqgldlg.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	126976              c:\windows\assembly\GAC\hpqgldlg\3.0.0.0__a53cf5803f4c3827\hpqgldlg.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	278528              c:\windows\assembly\GAC\hpqdocvw\3.0.0.0__a53cf5803f4c3827\hpqdocvw.dll
- 2009-09-21 09:06 . 2009-09-21 09:06	278528              c:\windows\assembly\GAC\hpqdocvw\3.0.0.0__a53cf5803f4c3827\hpqdocvw.dll
- 2009-09-21 09:06 . 2009-09-21 09:06	106496              c:\windows\assembly\GAC\hpqdocvw.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqdocvw.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	106496              c:\windows\assembly\GAC\hpqdocvw.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqdocvw.resources.dll
- 2009-09-21 09:06 . 2009-09-21 09:06	147456              c:\windows\assembly\GAC\hpqdcrsc\3.0.0.0__a53cf5803f4c3827\hpqdcrsc.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	147456              c:\windows\assembly\GAC\hpqdcrsc\3.0.0.0__a53cf5803f4c3827\hpqdcrsc.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	475136              c:\windows\assembly\GAC\hpqcmctl\3.0.0.0__a53cf5803f4c3827\hpqcmctl.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	475136              c:\windows\assembly\GAC\hpqcmctl\3.0.0.0__a53cf5803f4c3827\hpqcmctl.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	196608              c:\windows\assembly\GAC\hpqccrsc\3.0.0.0__a53cf5803f4c3827\hpqccrsc.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	196608              c:\windows\assembly\GAC\hpqccrsc\3.0.0.0__a53cf5803f4c3827\hpqccrsc.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	184320              c:\windows\assembly\GAC\hpqccrsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqccrsc.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	184320              c:\windows\assembly\GAC\hpqccrsc.resources\3.0.0.0_fr_a53cf5803f4c3827\hpqccrsc.resources.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	237568              c:\windows\assembly\GAC\hpqcalp\3.0.0.0__a53cf5803f4c3827\hpqcalp.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	237568              c:\windows\assembly\GAC\hpqcalp\3.0.0.0__a53cf5803f4c3827\hpqcalp.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	131072              c:\windows\assembly\GAC\hpqactiv\3.0.0.0__a53cf5803f4c3827\hpqactiv.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	131072              c:\windows\assembly\GAC\hpqactiv\3.0.0.0__a53cf5803f4c3827\hpqactiv.dll
- 2009-09-21 09:05 . 2009-09-21 09:05	1230336              c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.1.0.0_x-ww_b319d8da\msxml4.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	1230336              c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.1.0.0_x-ww_b319d8da\msxml4.dll
+ 2009-10-05 00:55 . 2009-10-05 00:55	1067520              c:\windows\Installer\c2048.msi
+ 2009-10-05 00:54 . 2009-10-05 00:54	1166848              c:\windows\Installer\c1eb2.msi
- 2009-09-21 09:05 . 2009-09-21 09:05	1044480              c:\windows\assembly\GAC\hpqptfx\3.0.0.0__a53cf5803f4c3827\hpqptfx.dll
+ 2009-10-05 00:54 . 2009-10-05 00:54	1044480              c:\windows\assembly\GAC\hpqptfx\3.0.0.0__a53cf5803f4c3827\hpqptfx.dll
.
-- Instantané actualisé --
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeScanNT Monitor"="c:\program files\Trend Micro\Client Server Security Agent\pccntmon.exe" [2009-06-03 935208]
"OE"="c:\program files\Trend Micro\Client Server Security Agent\TMAS_OE\TMAS_OEMon.exe" [2009-05-20 492808]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-11-12 245760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="c:\windows\system32\sti_ci.dll" [2004-08-19 138240]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"HideRunAsVerb"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoStrCmpLogical"= 0 (0x0)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoStrCmpLogical"= 0 (0x0)
"NoWelcomeScreen"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage rapide du logiciel HP Image Zone.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Démarrage rapide du logiciel HP Image Zone.lnk
backup=c:\windows\pss\Démarrage rapide du logiciel HP Image Zone.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^LUMIX Simple Viewer.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\LUMIX Simple Viewer.lnk
backup=c:\windows\pss\LUMIX Simple Viewer.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe"=
"c:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\Real\RealPlayer\realplay.exe"=
"c:\Program Files\AlerteGPS\G200NEO\G200_V1_2.exe"=
"\\server2003\commun\Logiciels, abonnements\Imprimante HP 2840 - Driver, software (plus rapide que par le CD)\setup\HPZnet01.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12345:TCP"= 12345:TCP:Trend Micro Client/Server Security Agent Listener

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers
vcchflt.sys [19/12/2007 21:42 16640]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [10/03/2009 23:05 335376]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers	mevtmgr.sys [17/07/2009 12:24 50192]
S2 TmFilter;Trend Micro Filter;c:\program files\Trend Micro\Client Server Security Agent	mxpflt.sys [22/05/2009 03:02 225296]
S2 TmPreFilter;Trend Micro PreFilter;c:\program files\Trend Micro\Client Server Security Agent	mpreflt.sys [22/05/2009 03:00 36368]
S3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [25/01/2008 15:40 85520]
S3 TmPfw;Pare-feu personnel Trend Micro Client/Server Security Agent;c:\program files\Trend Micro\Client Server Security Agent\TmPfw.exe [16/07/2009 13:12 497008]
S3 TmProxy;Service proxy Trend Micro Client/Server Security Agent;c:\program files\Trend Micro\Client Server Security Agent\TmProxy.exe [16/07/2009 13:12 685320]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [02/08/2009 21:39 133104]

[COLOR=RED]NETSVCS DOIT ÊTRE RÉPARÉ - liste des éléments présents/COLOR
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
BITS
ShellHWDetection
WmdmPmSN
wuauserv

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

.
Contenu du dossier 'Tâches planifiées'

2009-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-02 19:39]
.
.
------- Examen supplémentaire -------
.
uStart Page = fr.yahoo.com/
uInternet Settings,ProxyOverride = <local>
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
LSP: %SYSTEMROOT%\system32
vappfilter.dll
FF - ProfilePath - c:\documents and settings\cdc\Application Data\Mozilla\Firefox\Profiles\mq0uw7cq.default\
FF - prefs.js: browser.search.selectedEngine - WikipÃ©dia (fr)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - component: c:\program files\Real\RealPlayer\browserrecord\components
prpbrowserrecordplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7
pGoogleOneClick8.dll

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-05 19:02
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(708)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32
vappfilter.dll
c:\windows\system32\COMRes.dll

- - - - - - - > 'lsass.exe'(868)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32
vappfilter.dll
c:\program files\Bonjour\mdnsNSP.dll

- - - - - - - > 'explorer.exe'(1484)
c:\windows\system32\COMRes.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\fr-fr\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\fr-fr\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\SETUPAPI.dll
.
Heure de fin: 2009-10-05 19:04
ComboFix-quarantined-files.txt  2009-10-05 17:04
ComboFix2.txt  2009-10-04 20:37

Avant-CF: 72 610 103 296 octets libres
Après-CF: 72 612 126 720 octets libres

570

Stong · Answer

Voici le rapport COmboFix d'hier soir :


ComboFix 09-10-04.01 - cdc 04/10/2009 22:30.1.1 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.1023.576 [GMT 2:00]
Lancé depuis: \server2003\commun\désinstaller antivirus pro 2010r\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\obol.exe
c:\documents and settings\All Users\Documents\irytyzypas._dl
c:\documents and settings\All Users\Documents\oveme.exe
c:\documents and settings\All Users\Documents	ynum.scr
c:\documents and settings\cdc\Application Data\akug.dll
c:\documents and settings\cdc\Application Data\frame8K11.cab
c:\documents and settings\cdc\Application Data\inst.exe
c:\documents and settings\cdc\Application Data\isujijaho.inf
c:\documents and settings\cdc\Application Data\lizkavd.exe
c:\documents and settings\cdc\Application Data
etusej22.cab
c:\documents and settings\cdc\Application Data\seres.exe
c:\documents and settings\cdc\Application Data\svcst.exe
c:\documents and settings\cdc\Cookies\azimufukuv._dl
c:\documents and settings\cdc\Cookies\hile.dl
c:\documents and settings\cdc\Cookies\qezowimaby.dl
c:\documents and settings\cdc\Cookiesiseweco.bin
c:\documents and settings\cdc\Cookies\uvohyjogel.exe
c:\windows\Installer\4878d.msi
c:\windows\lagylowe.dl
c:\windows\system32\frjacnwrm.dll
c:\windows\system32\sys.dat
c:\windows\system32\vuzifelu.scr
c:\windows\yhiwibyg._dl

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-09-04 au 2009-10-04  ))))))))))))))))))))))))))))))))))))
.

2009-10-04 10:26 . 2009-10-04 10:26	19254	----a-w-	c:\documents and settings\cdc\Local Settings\Application Data\jebomo.dat
2009-09-21 09:10 . 2005-02-03 17:31	32768	----a-w-	c:\windows\system32\compJNI.dll
2009-09-21 09:10 . 2004-08-20 13:02	102400	----a-w-	c:\windows\system32\PMLJNI.dll
2009-09-21 09:10 . 2004-05-10 20:11	40960	----a-w-	c:\windows\system32\d4channel.dll
2009-09-21 09:10 . 2003-06-20 17:21	36864	----a-w-	c:\windows\system32\hpbmmjno.dll
2009-09-21 09:10 . 2003-06-16 21:52	74752	----a-w-	c:\windows\system32\jst.dll
2009-09-21 09:05 . 2009-09-21 09:07	--------	d-----w-	c:\program files\Fichiers communs\HP
2009-09-21 09:01 . 2009-09-21 09:06	--------	d-----w-	c:\program files\HP
2009-09-21 09:00 . 2009-09-21 09:13	54452	----a-w-	c:\windows\hppins01.dat
2009-09-21 09:00 . 2005-04-08 16:52	2392	------w-	c:\windows\hppmdl01.dat
2009-09-19 17:06 . 2009-09-19 17:06	--------	d-----w-	c:\documents and settings\cdc\Application Data\Windows Desktop Search
2009-09-19 17:05 . 2009-09-28 13:47	--------	d-----w-	c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2009-09-19 17:05 . 2009-09-19 17:05	--------	d-----w-	c:\program files\Windows Desktop Search
2009-09-19 17:04 . 2009-09-19 17:04	--------	d-----w-	c:\windows\system32\DllCache
2009-09-19 17:04 . 2008-03-07 16:56	98304	------w-	c:\windows\system32\dllcache
lhtml.dll
2009-09-19 17:04 . 2008-03-07 16:56	29696	------w-	c:\windows\system32\dllcache\mimefilt.dll
2009-09-19 17:04 . 2008-03-07 16:56	192000	------w-	c:\windows\system32\dllcache\offfilt.dll
2009-09-19 17:04 . 2009-09-19 17:04	--------	d--h--w-	c:\windows\$hf_mig$
2009-09-19 16:30 . 2009-09-19 17:00	--------	d-----w-	c:\program files\Microsoft Works
2009-09-19 16:30 . 2009-09-19 16:30	--------	d-----w-	c:\program files\MSBuild
2009-09-19 16:27 . 2009-09-19 16:27	--------	d-----w-	c:\program files\Microsoft.NET
2009-09-19 16:24 . 2009-09-19 16:24	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2009-09-19 16:23 . 2009-09-19 16:24	--------	d-----w-	c:\windows\SHELLNEW
2009-09-19 16:23 . 2009-09-19 16:23	--------	d-----w-	c:\documents and settings\cdc\Local Settings\Application Data\Microsoft Help
2009-09-19 16:23 . 2009-09-30 19:34	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-19 16:22 . 2009-09-19 16:22	--------	d-----r-	C:\MSOCache
2009-09-19 16:09 . 2009-09-19 17:44	--------	d-----w-	c:\documents and settings\cdc\Application Data\Vso
2009-09-19 15:48 . 2009-09-19 15:48	--------	d-----w-	c:\documents and settings\cdc\Application Data\Apple Computer
2009-09-18 12:49 . 2009-09-18 12:49	--------	d-----w-	c:\documents and settings\cdc\Application Data\TeamViewer
2009-09-18 12:49 . 2009-09-18 12:49	--------	d-----w-	c:\program files\TeamViewer
2009-09-18 12:49 . 2009-09-18 12:49	--------	d-----w-	c:\documents and settings\cdc	emp
2009-09-18 10:26 . 2001-10-28 15:42	116224	----a-w-	c:\windows\system32\pdfcmnnt.dll
2009-09-18 10:26 . 2009-09-18 10:27	--------	d-----w-	c:\program files\PDFCreator
2009-09-18 10:26 . 1998-07-05 23:00	23552	----a-w-	c:\windows\system32\MSMPIDE.DLL
2009-09-15 16:02 . 2009-09-15 16:02	--------	d-----w-	c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-09-15 16:02 . 2009-09-15 16:02	--------	d-----w-	c:\program files\DAEMON Tools Toolbar
2009-09-15 16:02 . 2009-09-15 19:15	--------	d-----w-	c:\program files\DAEMON Tools Lite
2009-09-15 16:00 . 2009-09-15 16:00	721904	----a-w-	c:\windows\system32\drivers\sptd.sys
2009-09-15 16:00 . 2009-09-15 16:04	--------	d-----w-	c:\documents and settings\cdc\Application Data\DAEMON Tools Lite
2009-09-15 15:52 . 2009-09-15 15:52	--------	d-----w-	c:\documents and settings\cdc\Application Data\Download Manager
2009-09-15 15:43 . 2009-09-15 15:43	--------	d-----w-	c:\documents and settings\cdc\Local Settings\Application Data\Ahead
2009-09-15 14:50 . 2009-09-19 15:59	--------	d-----w-	c:\program files\Ahead
2009-09-11 14:20 . 2003-07-16 12:27	43264	------w-	c:\windows\system32\drivers\ser2pl.sys
2009-09-11 14:19 . 2009-09-11 14:19	--------	d-----w-	c:\program files\AlerteGPS
2009-09-10 14:27 . 2009-09-10 14:27	--------	d-----w-	c:\documents and settings\cdc\Local Settings\Application Data\Apple

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-04 17:42 . 2007-12-21 01:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-04 17:31 . 2009-03-08 09:36	--------	d-----w-	c:\program files\Enigma Software Group
2009-10-02 06:52 . 2002-08-30 12:00	85326	----a-w-	c:\windows\system32\perfc00C.dat
2009-10-02 06:52 . 2002-08-30 12:00	496038	----a-w-	c:\windows\system32\perfh00C.dat
2009-10-02 06:52 . 2009-07-17 10:23	69480	----a-w-	c:\windows\system32\perfc040.dat
2009-10-02 06:52 . 2009-07-17 10:23	451546	----a-w-	c:\windows\system32\perfh040.dat
2009-09-21 09:10 . 2007-12-21 09:54	--------	d-----w-	c:\program files\Hewlett-Packard
2009-09-21 09:10 . 2007-12-21 09:57	--------	d--h--w-	c:\program files\Zero G Registry
2009-09-20 07:46 . 2009-07-18 07:53	83296	----a-w-	c:\documents and settings\cdc\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-19 19:05 . 2009-07-22 10:15	--------	d-----w-	c:\documents and settings\All Users\Application Data\Mozilla Firefox
2009-09-19 17:46 . 2008-11-09 16:56	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skyline
2009-09-19 17:46 . 2008-01-26 10:41	--------	d-----w-	c:\documents and settings\All Users\Application Data\WinZip
2009-09-19 17:44 . 2008-05-01 18:36	--------	d-----w-	c:\program files\VSO
2009-09-19 17:44 . 2009-09-19 17:44	47360	----a-w-	c:\documents and settings\cdc\Application Data\pcouffin.sys
2009-09-19 17:44 . 2008-07-28 19:40	--------	d-----w-	c:\program files\Foxit Software
2009-09-19 17:44 . 2009-03-27 21:29	--------	d-----w-	c:\program files\Virtual Earth 3D
2009-09-19 15:59 . 2007-12-20 13:57	--------	d-----w-	c:\program files\Fichiers communs\Ahead
2009-09-19 15:58 . 2007-12-26 20:18	--------	d-----w-	c:\program files\OpenOffice.org 2.3
2009-09-19 15:55 . 2007-12-19 18:55	--------	d-----w-	c:\program files\TUGZip
2009-09-19 15:50 . 2008-04-29 08:09	--------	d-----w-	c:\program files\Mozilla Thunderbird
2009-09-11 14:20 . 2007-12-20 11:57	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-09-10 14:27 . 2008-09-15 21:53	--------	d-----w-	c:\program files\Fichiers communs\Apple
2009-08-26 07:02 . 2007-12-21 01:09	--------	d-----w-	c:\program files\Java
2009-08-20 13:41 . 2009-08-20 13:41	--------	d-----w-	c:\program files\VersalSoft
2009-08-20 13:41 . 2009-08-20 13:41	--------	d-----w-	c:\program files\Universal
2009-07-25 03:23 . 2008-12-16 21:22	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-07-20 19:28 . 2009-07-20 19:28	126	----a-w-	c:\documents and settings\cdc\Local Settings\Application Data\fusioncache.dat
2009-07-17 14:05 . 2009-07-17 13:50	77	----a-w-	C:\sauvegarde.cmd
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2A4E1E2-9183-4F26-8D6E-43FC5424E6B2}]
2007-08-15 20:42	283648	----a-w-	c:\windows\system32\gqcsbmzej.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeScanNT Monitor"="c:\program files\Trend Micro\Client Server Security Agent\pccntmon.exe" [2009-06-03 935208]
"OE"="c:\program files\Trend Micro\Client Server Security Agent\TMAS_OE\TMAS_OEMon.exe" [2009-05-20 492808]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-11-12 245760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="c:\windows\system32\sti_ci.dll" [2004-08-19 138240]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"HideRunAsVerb"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoStrCmpLogical"= 0 (0x0)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoStrCmpLogical"= 0 (0x0)
"NoWelcomeScreen"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage rapide du logiciel HP Image Zone.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Démarrage rapide du logiciel HP Image Zone.lnk
backup=c:\windows\pss\Démarrage rapide du logiciel HP Image Zone.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^LUMIX Simple Viewer.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\LUMIX Simple Viewer.lnk
backup=c:\windows\pss\LUMIX Simple Viewer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe"=
"c:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\Real\RealPlayer\realplay.exe"=
"c:\Program Files\AlerteGPS\G200NEO\G200_V1_2.exe"=
"\\server2003\commun\Logiciels, abonnements\Imprimante HP 2840 - Driver, software (plus rapide que par le CD)\setup\HPZnet01.exe"=
"c:\Program Files\TeamViewer\Version4\TeamViewer.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12345:TCP"= 12345:TCP:Trend Micro Client/Server Security Agent Listener

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers
vcchflt.sys [19/12/2007 21:42 16640]
R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers	mevtmgr.sys [17/07/2009 12:24 50192]
R2 TmFilter;Trend Micro Filter;c:\program files\Trend Micro\Client Server Security Agent	mxpflt.sys [22/05/2009 03:02 225296]
R2 TmPreFilter;Trend Micro PreFilter;c:\program files\Trend Micro\Client Server Security Agent	mpreflt.sys [22/05/2009 03:00 36368]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [10/03/2009 23:05 335376]
R3 TmPfw;Pare-feu personnel Trend Micro Client/Server Security Agent;c:\program files\Trend Micro\Client Server Security Agent\TmPfw.exe [16/07/2009 13:12 497008]
R3 TmProxy;Service proxy Trend Micro Client/Server Security Agent;c:\program files\Trend Micro\Client Server Security Agent\TmProxy.exe [16/07/2009 13:12 685320]
S3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [25/01/2008 15:40 85520]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [02/08/2009 21:39 133104]

[COLOR=RED]NETSVCS DOIT ÊTRE RÉPARÉ - liste des éléments présents/COLOR
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
BITS
ShellHWDetection
WmdmPmSN
wuauserv

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

.
Contenu du dossier 'Tâches planifiées'

2009-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-02 19:39]
.
.
------- Examen supplémentaire -------
.
uStart Page = fr.yahoo.com/
uInternet Settings,ProxyOverride = <local>
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
LSP: %SYSTEMROOT%\system32
vappfilter.dll
FF - ProfilePath - c:\documents and settings\cdc\Application Data\Mozilla\Firefox\Profiles\mq0uw7cq.default\
FF - prefs.js: browser.search.selectedEngine - WikipÃ©dia (fr)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - component: c:\program files\Real\RealPlayer\browserrecord\components
prpbrowserrecordplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7
pGoogleOneClick8.dll

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-mserv - c:\documents and settings\cdc\Application Data\svcst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-04 22:36
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(928)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32
vappfilter.dll
c:\windows\system32\COMRes.dll

- - - - - - - > 'lsass.exe'(1016)
c:\windows\system32\setupapi.dll
c:\windows\system32
vappfilter.dll
c:\program files\Bonjour\mdnsNSP.dll
c:\windows\system32\COMRes.dll
.
Heure de fin: 2009-10-04 22:37
ComboFix-quarantined-files.txt  2009-10-04 20:37

Avant-CF: 72 934 318 080 octets libres
Après-CF: 72 957 177 856 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /fastdetect /noexecute=optin

283

Xplode · Answer

Ok, relance un scan malwarebyte's en mode rapide  puis poste le rapport.

---------------

-+-+-+-> List & Kill'em <-+-+-+-


[x] Désactive ton antivirus le temps de la manip ainsi que ton parefeu si présent

[x] Télécharge List&Kill'em à cette adresse : http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem.exe

[x] Enregistre le sur ton bureau

[x] Double clique dessus (clique droit "executer en tant qu'administrateur" pour Vista) pour lancer le scan.

[x] Choisis la langue puis choisis l'option 1 = Mode Recherche

[x] Laisse l'outil scanner.

[x] Le rapport s'affichera une fois le scan fini.

[x] Copie/Colle son contenu puis poste le dans ton prochain message.

Stong · Answer

Re,
Voici le rapport malwarebytes en mode rapide :

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2907
Windows 5.1.2600 Service Pack 2 (Safe Mode)

05/10/2009 20:56:20
mbam-log-2009-10-05 (20-56-20).txt

Type de recherche: Examen rapide
Eléments examinés: 116299
Temps écoulé: 2 minute(s), 33 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Stong · Answer

Et voici le rapport List'em :

List'em by g3n-h@ckm@n 1.0.3.5 

updated on 01.10.2009 ::::: 11.30 

Windows_NT 

Microsoft Windows XP [version 5.1.2600]
 

05/10/2009    20:57:02,10 
 

Nom de l'image              PIDÿ Nom de la sessio Num‚ro d Utilisation 
========================= ====== ================ ======== ============
System Idle Process            0 Console                 0        16 Ko
System                         4 Console                 0       212 Ko
smss.exe                     524 Console                 0       392 Ko
csrss.exe                    668 Console                 0     3ÿ404 Ko
winlogon.exe                 708 Console                 0     2ÿ292 Ko
services.exe                 840 Console                 0     3ÿ244 Ko
lsass.exe                    852 Console                 0     2ÿ112 Ko
svchost.exe                 1056 Console                 0     5ÿ760 Ko
svchost.exe                 1144 Console                 0     3ÿ480 Ko
svchost.exe                 1200 Console                 0    13ÿ956 Ko
svchost.exe                 1300 Console                 0     3ÿ852 Ko
explorer.exe                1780 Console                 0    20ÿ312 Ko
List_Killem.exe             1936 Console                 0     4ÿ640 Ko
cmd.exe                     1828 Console                 0     1ÿ800 Ko
tasklist.exe                 460 Console                 0     4ÿ140 Ko
wmiprvse.exe                 560 Console                 0     5ÿ556 Ko
 
Path : C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\QuickTime\QTSystem 

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

"C:\Program Files\DAEMON Tools Toolbar"  
C:\Documents and Settings\cdc\LOCAL Settings\Temp\applnch.exe  
 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}"  
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}"  
 
¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch : 

BATCHRUNNER.EXE-01635E31.pf
BATCHRUNNER.EXE-05203FBF.pf
BATCHRUNNER.EXE-05889CFA.pf
CMD.EXE-087B4001.pf
DEVCON.EXE-3189D4D7.pf
IE4UINIT.EXE-169A5A39.pf
IEUDINIT.EXE-054FE003.pf
LCLOCK.EXE-01097107.pf
LOGAGENT.EXE-027AF92B.pf
MSCORSVW.EXE-1BF30400.pf
MSHTA.EXE-331DF029.pf
NTOSBOOT-B00DFAAD.pf
REG.EXE-0D2A95F7.pf
REGEDIT.EXE-1B606482.pf
REGSVR32.EXE-25EEFE2F.pf
RESCHANGE.EXE-0D0B0E88.pf
RUNDLL32.EXE-163D5AA8.pf
RUNDLL32.EXE-19573350.pf
RUNDLL32.EXE-1A32BF91.pf
RUNDLL32.EXE-286A7F8C.pf
RUNDLL32.EXE-2AF77CC9.pf
RUNDLL32.EXE-49F747DB.pf
RUNDLL32.EXE-4A9161EE.pf
SETUP50.EXE-362FF7C9.pf
SHMGRATE.EXE-1BA69E68.pf
SHUTDOWN.EXE-12DAD820.pf
SLEEP.EXE-2C1008B8.pf
SVCHOST.EXE-3530F672.pf
TASKIX32.EXE-07C982B1.pf
TASKKILL.EXE-0A8306E3.pf
TRANSBAR.EXE-1D7E823D.pf
UNREGMP2.EXE-07CACB61.pf
VERCLSID.EXE-3667BD89.pf
VISUALTASKTIPS.EXE-1785BFC8.pf
VSDRV.EXE-0103E326.pf
WGACRACK.EXE-312375C5.pf
WLCLOCK.EXE-00E1B431.pf
WMIADAP.EXE-2DF425B2.pf
WMIPRVSE.EXE-28F301A9.pf
WPIUNSPYRO.EXE-04E913E4.pf
WPIUNTXT.EXE-0A2B8373.pf
WTLCLOCKPLUGIN.EXE-11E76CFB.pf
WTRANSBAR.EXE-029A26F4.pf
WTTASKIX.EXE-020CEAD1.pf
WTTASKIXPLUGIN.EXE-3058D906.pf
WTTRANSBARPLUGIN.EXE-1A148C33.pf
WTTUGPLUGIN.EXE-3803BBB5.pf
WTUG.EXE-26E437F1.pf
WTVISTADRIVESTATUSPLUGIN.EXE-3A3926C6.pf
WTVISUALTASKTIPSPLUGIN.EXE-04E69296.pf
WVISTADRIVE.EXE-29AF76C6.pf
WVISUALTASKTIPS.EXE-373AAAF8.pf
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Xplode · Answer

-+-+-+-> List & Kill'em ( Suppression ) <-+-+-+- [x] Redémarre en Mode Sans Echec [x] Relance List&Kill'em mais cette fois-ci choisis l'option 2 = Mode Destruction. [x] Laisse l'outil travailler. [x] Après les verifications , un rapport va s'ouvrir. [x] ferme-le. [x] Un deuxieme rapport va s'ouvrir, copie/colle son contenu et poste le dans ton prochain message. --------------------- -+-+-+-> RSIT <-+-+-+- [x] Télécharge Random's System Information Tool à cette adresse : http://images.malwareremoval.com/random/RSIT.exe [x] Double clique sur " RSIT.exe ". [x] Clique sur " Continue ". [x] Si hijackthis n'est pas présent il sera automatiquement téléchargé et tu devras accepter la license. [x] Une fois l'analyse finie, deux fichiers ( info.txt & log.txt ) s'ouvriront. [x] Copie colle le contenu des deux rapports dans ton prochain message [o] Si jamais tu as fermé les rapports sans faire attention, ils sont sous C:\rsit

Stong · Answer

Re,
Voici le rapport Kill'em :

Kill'em by g3n-h@ckm@n 1.0.3.5 

updated on 01.10.2009 ::::: 11.30 

Windows_NT 

Microsoft Windows XP [version 5.1.2600]
 

05/10/2009    21:40:40,07 

Fichiers analysés : 
================= 
 

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

"C:\Program Files\DAEMON Tools Toolbar"  
C:\Documents and Settings\cdc\LOCAL Settings\Temp\applnch.exe  
 
 
¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers : 
  
Quarantaine : 

applnch.exe.Kill'em
DAEMON Tools Toolbar.Kill'em

¤¤¤¤¤¤¤¤¤¤ Verification : 
 

 
Path : C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\QuickTime\QTSystem 

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}"  
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}"  
 
¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch : 

NTOSBOOT-B00DFAAD.pf
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Stong · Answer

Lorsque je lance RSIT.exe, je n'obtiens qu'un seul fichier (log). Je ne sais pas pourquoi je n'ai pas l'autre.
Voici le log.txt :

Logfile of random's system information tool 1.06 (written by random/random)
Run by cdc at 2009-10-05 21:49:17
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 69 GB (69%) free of 100 GB
Total RAM: 1023 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:49:19, on 05/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20627)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
C:\Program Files\Trend Micro\Client Server Security Agent
trtscan.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\Trend Micro\Client Server Security Agent	mlisten.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Client Server Security Agent\TmPfw.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\PROGRA~1\HEWLET~1\Toolbox\STATUS~1\STATUS~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\Client Server Security Agent\CNTAoSMgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\Program Files\Trend Micro\Client Server Security Agent\TmProxy.exe
\server2003\commun\Vir\RSIT.exe
C:\Program Files	rend micro\cdc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - (no file)
O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O3 - Toolbar: (no name) - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - (no file)
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [OE] C:\Program Files\Trend Micro\Client Server Security Agent\TMAS_OE\TMAS_OEMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O16 - DPF: {485D813E-EE26-4DF8-9FAF-DEDF2885306E} (NSHelp Class) - http://server2003/connectcomputer/nshelp.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cavesduchateau.local
O17 - HKLM\Software\..\Telephony: DomainName = cavesduchateau.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cavesduchateau.local
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: ClipSrv - Unknown owner - C:\WINDOWS\system32\clipsrv.exe (file missing)
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
O23 - Service: Scan en temps réel Trend Micro Client/Server Security Agent (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent
trtscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Unknown owner - C:\WINDOWS\system32\IoctlSvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent	mlisten.exe
O23 - Service: Pare-feu personnel Trend Micro Client/Server Security Agent (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\TmPfw.exe
O23 - Service: Service proxy Trend Micro Client/Server Security Agent (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\TmProxy.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

Stong · Answer

Je précise aussi que sous C:\RSIt, il y a bien les deux fichiers log et info.
Le log.txt correspond à celui que je viens de faire mais l'info.txt est celui d'hier soir.

Xplode · Answer

-+-+-+->  AD-Remover <-+-+-+-


[x] Si tu es sous vista : Désactive l'UAC (Menu Démarrer \ Panneau de Configuration \ Comptes d'utilisateurs et protection des utilisateurs \ Comptes d'utilisateurs \ Activer ou désactiver le contrôle des comptes d'utilisateurs \ décoche la case Utiliser le contrôle ... et valide par OK , il te sera demandé de redémarrer, fais le)

[x] Télécharge Ad-remover (de C_XX) sur ton bureau : http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

[x] Lance l'installation avec les paramètres par défaut..

 ! Déconnecte toi et ferme toutes applications en cours ! 

[x] Double-clique sur le raccourci Ad-Remover sur ton Bureau. (Clic droit -> "Exécuter en tant qu'administrateur". ( Pour Vista))

[x] Séléctionne l'option F pour français

[x] A la fenêtre qui s'affiche clique sur " oui "

[x] Séléctionne l'option S

[x] Laisse l'outil travailler.

[x] Une fois le scan fini, appuie sur une touche, le rapport s'ouvre

[x] Copie/colle le dans ton prochain post

Stong · Answer

Et voilà :


.
======= RAPPORT D'AD-REMOVER 1.1.4.5_X | UNIQUEMENT XP/VISTA/7 =======
.
Mit à jour par C_XX le 05.10.2009 à 17:48
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 21:59:03, 05/10/2009 | Mode sans echec | Option: SCAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™  Service Pack 2 v5.1.2600
Nom du PC: PC-SECRETARIAT1 | Utilisateur actuel: cdc
.
============== ÉLÉMENT(S) TROUVÉ(S) ==============
.

HKLM\Software\Microsoft\Internet Explorer\Toolbar\{FE063DB9-4EC0-403e-8DD8-394C54984B2C} 
.
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.0.14 *
.
 Nom du profil: mq0uw7cq.default (cdc)
.
(Prefs.js) user_pref("browser.search.selectedEngine", "WikipÃ©dia (fr)"); 
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://www.google.fr"); 
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.14"); 
.
.
* Internet Explorer Version 7.0.5730.11 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: fr.yahoo.com/
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start Page: hxxp://go.microsoft.com/fwlink/?LinkId=69157
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials ... ) ==============
.
C:\Documents and Settings\cdc\Bureau\TIS1610_1063\Setup\Function\Share\160\Patch.exe
C:\Documents and Settings\WTrust-Enigma\Bureau\TIS1610_1063\Setup\Function\Share\160\Patch.exe
.
===================================
.
1886 Octet(s) - C:\Ad-Report-SCAN[1].log 
.
10 Fichier(s) - C:\DOCUME~1\cdc\LOCALS~1\Temp 
1 Fichier(s) - C:\WINDOWS\Temp 
.
0 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
0 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE 
.
Fin à: 22:05:06 | 05/10/2009 - SCAN[1]
.
============== E.O.F ==============
.

Stong · Answer

Y a-t-il un souci ?

Xplode · Answer

Lancel l'option " L " d'ad-remover puis fais ceci :

CFScript ----->

[x] Crée un nouveau fichier *.txt

[x] Copie/Colle ceci dedans :


KillAll::

drivers::
a1ffezxw
neokdss



[x] Enregistre ensuite le fichier que tu appelleras " CFScript.txt "

[x] Fais glisser le fichier CFScript.txt sur l'icone de combofix.

[x] Combofix se lancera, puis scannera le PC, copie/colle le rapport qui s'ouvrira

Stong · Answer

Salut Xplode,

Voici le rapport combofix :

 ComboFix 09-10-05.01 - cdc 06/10/2009 17:01.3.1 - NTFSx86 NETWORK
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.1023.806 [GMT 2:00]
Lancé depuis: \server2003\commun\Vir\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\cdc\Bureau\CFScript.txt
.

(((((((((((((((((((((((((((((   Fichiers créés du 2009-09-06 au 2009-10-06  ))))))))))))))))))))))))))))))))))))
.

2009-10-06 07:10 . 2009-10-06 07:10	--------	d-----w-	c:\documents and settings\cdc\Application Data\HpUpdate
2009-10-06 07:10 . 2009-10-06 07:10	--------	d-----w-	c:\windows\Hewlett-Packard
2009-10-05 19:59 . 2009-10-06 14:51	--------	d-----w-	c:\program files\Ad-Remover
2009-10-05 19:40 . 2009-10-05 19:41	--------	d-----w-	C:\Kill'em
2009-10-05 16:37 . 2009-10-05 16:38	--------	d-----w-	C:\Lop SD
2009-10-05 00:59 . 2005-02-03 17:31	32768	----a-w-	c:\windows\system32\compJNI.dll
2009-10-05 00:59 . 2003-06-20 17:21	36864	----a-w-	c:\windows\system32\hpbmmjno.dll
2009-10-05 00:59 . 2004-08-20 13:02	102400	----a-w-	c:\windows\system32\PMLJNI.dll
2009-10-05 00:59 . 2004-05-10 20:11	40960	----a-w-	c:\windows\system32\d4channel.dll
2009-10-05 00:59 . 2003-06-16 21:52	74752	----a-w-	c:\windows\system32\jst.dll
2009-10-05 00:54 . 2009-10-05 00:55	--------	d-----w-	c:\program files\Fichiers communs\HP
2009-10-05 00:49 . 2009-10-05 01:48	54452	----a-w-	c:\windows\hppins01.dat
2009-10-05 00:49 . 2005-04-08 16:52	2392	------w-	c:\windows\hppmdl01.dat
2009-10-05 00:40 . 2009-10-05 00:40	--------	d-----w-	c:\program files\Alex Feinman
2009-10-05 00:38 . 2008-05-02 09:05	62592	------w-	c:\windows\system32\dllcache\cdrom.sys
2009-10-05 00:38 . 2008-05-02 13:31	466432	------w-	c:\windows\system32\imapi2fs.dll
2009-10-05 00:38 . 2008-05-02 13:31	466432	------w-	c:\windows\system32\dllcache\imapi2fs.dll
2009-10-05 00:38 . 2008-05-02 13:31	320000	------w-	c:\windows\system32\imapi2.dll
2009-10-05 00:38 . 2008-05-02 13:31	320000	------w-	c:\windows\system32\dllcache\imapi2.dll
2009-10-05 00:37 . 2009-09-28 06:49	781864	----a-w-	C:\WindowsXP-KB932716-v2-x86-FRA.exe
2009-10-05 00:02 . 2008-09-02 13:49	253952	----a-w-	c:\windows\system32\JkDefragScreenSaver.exe
2009-10-05 00:02 . 2008-09-02 13:49	106496	----a-w-	c:\windows\system32\JkDefragScreenSaver.scr
2009-10-05 00:01 . 2009-10-05 00:02	--------	d-----w-	c:\program files\JkDefrag
2009-10-04 23:31 . 2009-10-04 23:31	--------	d-----w-	c:\documents and settings\cdc\Application Data\Malwarebytes
2009-10-04 23:31 . 2009-09-10 12:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-04 23:31 . 2009-10-04 23:31	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-10-04 23:31 . 2009-10-04 23:31	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-04 23:31 . 2009-09-10 12:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-10-04 23:00 . 2009-10-04 23:00	--------	d-----w-	c:\windows\system32\NtmsData
2009-10-04 21:40 . 2009-10-04 21:40	--------	d-----w-	C:sit
2009-10-04 21:33 . 2009-10-04 21:33	--------	d-----w-	c:\windows\system32\wbem\snmp
2009-10-04 10:26 . 2009-10-04 10:26	19254	----a-w-	c:\documents and settings\cdc\Local Settings\Application Data\jebomo.dat
2009-09-21 09:01 . 2009-10-06 07:10	--------	d-----w-	c:\program files\HP
2009-09-19 17:06 . 2009-09-19 17:06	--------	d-----w-	c:\documents and settings\cdc\Application Data\Windows Desktop Search
2009-09-19 17:05 . 2009-09-28 13:47	--------	d-----w-	c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2009-09-19 17:05 . 2009-09-19 17:05	--------	d-----w-	c:\program files\Windows Desktop Search
2009-09-19 17:04 . 2009-10-05 00:51	--------	d-----w-	c:\windows\system32\DllCache
2009-09-19 17:04 . 2008-03-07 16:56	98304	------w-	c:\windows\system32\dllcache
lhtml.dll
2009-09-19 17:04 . 2008-03-07 16:56	29696	------w-	c:\windows\system32\dllcache\mimefilt.dll
2009-09-19 17:04 . 2008-03-07 16:56	192000	------w-	c:\windows\system32\dllcache\offfilt.dll
2009-09-19 17:04 . 2009-10-05 00:38	--------	d--h--w-	c:\windows\$hf_mig$
2009-09-19 16:30 . 2009-09-19 17:00	--------	d-----w-	c:\program files\Microsoft Works
2009-09-19 16:30 . 2009-09-19 16:30	--------	d-----w-	c:\program files\MSBuild
2009-09-19 16:27 . 2009-09-19 16:27	--------	d-----w-	c:\program files\Microsoft.NET
2009-09-19 16:24 . 2009-09-19 16:24	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2009-09-19 16:23 . 2009-09-19 16:24	--------	d-----w-	c:\windows\SHELLNEW
2009-09-19 16:23 . 2009-09-19 16:23	--------	d-----w-	c:\documents and settings\cdc\Local Settings\Application Data\Microsoft Help
2009-09-19 16:23 . 2009-09-30 19:34	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-19 16:22 . 2009-09-19 16:22	--------	d-----r-	C:\MSOCache
2009-09-19 16:09 . 2009-09-19 17:44	--------	d-----w-	c:\documents and settings\cdc\Application Data\Vso
2009-09-19 15:48 . 2009-09-19 15:48	--------	d-----w-	c:\documents and settings\cdc\Application Data\Apple Computer
2009-09-18 12:49 . 2009-09-18 12:49	--------	d-----w-	c:\documents and settings\cdc\Application Data\TeamViewer
2009-09-18 12:49 . 2009-10-04 23:31	--------	d-----w-	c:\program files\TeamViewer
2009-09-18 12:49 . 2009-09-18 12:49	--------	d-----w-	c:\documents and settings\cdc	emp
2009-09-18 10:26 . 2001-10-28 15:42	116224	----a-w-	c:\windows\system32\pdfcmnnt.dll
2009-09-18 10:26 . 2009-09-18 10:27	--------	d-----w-	c:\program files\PDFCreator
2009-09-18 10:26 . 1998-07-05 23:00	23552	----a-w-	c:\windows\system32\MSMPIDE.DLL
2009-09-15 16:02 . 2009-09-15 16:02	--------	d-----w-	c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-09-15 16:02 . 2009-09-15 19:15	--------	d-----w-	c:\program files\DAEMON Tools Lite
2009-09-15 16:00 . 2009-09-15 16:00	721904	----a-w-	c:\windows\system32\drivers\sptd.sys
2009-09-15 16:00 . 2009-09-15 16:04	--------	d-----w-	c:\documents and settings\cdc\Application Data\DAEMON Tools Lite
2009-09-15 15:52 . 2009-09-15 15:52	--------	d-----w-	c:\documents and settings\cdc\Application Data\Download Manager
2009-09-15 15:43 . 2009-09-15 15:43	--------	d-----w-	c:\documents and settings\cdc\Local Settings\Application Data\Ahead
2009-09-15 14:50 . 2009-09-19 15:59	--------	d-----w-	c:\program files\Ahead
2009-09-11 14:20 . 2003-07-16 12:27	43264	------w-	c:\windows\system32\drivers\ser2pl.sys
2009-09-11 14:19 . 2009-09-11 14:19	--------	d-----w-	c:\program files\AlerteGPS
2009-09-10 14:27 . 2009-09-10 14:27	--------	d-----w-	c:\documents and settings\cdc\Local Settings\Application Data\Apple

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-06 14:56 . 2007-12-19 19:36	98304	----a-w-	c:\windows\DUMP3c4d.tmp
2009-10-06 07:10 . 2007-12-21 09:54	--------	d-----w-	c:\program files\Hewlett-Packard
2009-10-05 19:49 . 2009-07-17 10:22	--------	d-----w-	c:\program files\Trend Micro
2009-10-05 17:59 . 2002-08-30 12:00	85326	----a-w-	c:\windows\system32\perfc00C.dat
2009-10-05 17:59 . 2002-08-30 12:00	496038	----a-w-	c:\windows\system32\perfh00C.dat
2009-10-05 17:59 . 2009-07-17 10:23	69480	----a-w-	c:\windows\system32\perfc040.dat
2009-10-05 17:59 . 2009-07-17 10:23	451546	----a-w-	c:\windows\system32\perfh040.dat
2009-10-05 00:59 . 2007-12-21 09:57	--------	d--h--w-	c:\program files\Zero G Registry
2009-10-04 17:42 . 2007-12-21 01:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-04 17:31 . 2009-03-08 09:36	--------	d-----w-	c:\program files\Enigma Software Group
2009-09-20 07:46 . 2009-07-18 07:53	83296	----a-w-	c:\documents and settings\cdc\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-19 19:05 . 2009-07-22 10:15	--------	d-----w-	c:\documents and settings\All Users\Application Data\Mozilla Firefox
2009-09-19 17:46 . 2008-11-09 16:56	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skyline
2009-09-19 17:46 . 2008-01-26 10:41	--------	d-----w-	c:\documents and settings\All Users\Application Data\WinZip
2009-09-19 17:44 . 2008-05-01 18:36	--------	d-----w-	c:\program files\VSO
2009-09-19 17:44 . 2009-09-19 17:44	47360	----a-w-	c:\documents and settings\cdc\Application Data\pcouffin.sys
2009-09-19 17:44 . 2008-07-28 19:40	--------	d-----w-	c:\program files\Foxit Software
2009-09-19 17:44 . 2009-03-27 21:29	--------	d-----w-	c:\program files\Virtual Earth 3D
2009-09-19 15:59 . 2007-12-20 13:57	--------	d-----w-	c:\program files\Fichiers communs\Ahead
2009-09-19 15:58 . 2007-12-26 20:18	--------	d-----w-	c:\program files\OpenOffice.org 2.3
2009-09-19 15:55 . 2007-12-19 18:55	--------	d-----w-	c:\program files\TUGZip
2009-09-19 15:50 . 2008-04-29 08:09	--------	d-----w-	c:\program files\Mozilla Thunderbird
2009-09-11 14:20 . 2007-12-20 11:57	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-09-10 14:27 . 2008-09-15 21:53	--------	d-----w-	c:\program files\Fichiers communs\Apple
2009-08-26 07:02 . 2007-12-21 01:09	--------	d-----w-	c:\program files\Java
2009-08-20 13:41 . 2009-08-20 13:41	--------	d-----w-	c:\program files\VersalSoft
2009-08-20 13:41 . 2009-08-20 13:41	--------	d-----w-	c:\program files\Universal
2009-07-25 03:23 . 2008-12-16 21:22	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-07-20 19:28 . 2009-07-20 19:28	126	----a-w-	c:\documents and settings\cdc\Local Settings\Application Data\fusioncache.dat
2009-07-17 14:05 . 2009-07-17 13:50	77	----a-w-	C:\sauvegarde.cmd
.

(((((((((((((((((((((((((((((   SnapShot_2009-10-05_17.02.58   )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-08-30 12:00 . 2009-10-05 17:59	60744              c:\windows\system32\perfc009.dat
+ 2002-08-30 12:00 . 2009-10-05 17:59	396462              c:\windows\system32\perfh009.dat
+ 2009-10-06 07:10 . 2009-10-06 07:10	816640              c:\windows\Installer\15e013.msi
+ 2009-10-06 07:10 . 2009-10-06 07:10	102400              c:\windows\Installer\{818ABC3C-635C-4651-8183-D0E9640B7DD1}\NewShortcut1_47F36D92E58E456DB73C3382737E4C42.exe
+ 2009-10-06 07:10 . 2009-10-06 07:10	1728512              c:\windows\Hewlett-Packard\Setup Files\HP Software Update\{EC391058-A292-41C5-92C7-95C5A09793B8}\HP Update.msi
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeScanNT Monitor"="c:\program files\Trend Micro\Client Server Security Agent\pccntmon.exe" [2009-06-03 935208]
"OE"="c:\program files\Trend Micro\Client Server Security Agent\TMAS_OE\TMAS_OEMon.exe" [2009-05-20 492808]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-11-12 245760]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="c:\windows\system32\sti_ci.dll" [2004-08-19 138240]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"HideRunAsVerb"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoStrCmpLogical"= 0 (0x0)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoStrCmpLogical"= 0 (0x0)
"NoWelcomeScreen"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage rapide du logiciel HP Image Zone.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Démarrage rapide du logiciel HP Image Zone.lnk
backup=c:\windows\pss\Démarrage rapide du logiciel HP Image Zone.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^LUMIX Simple Viewer.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\LUMIX Simple Viewer.lnk
backup=c:\windows\pss\LUMIX Simple Viewer.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe"=
"c:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\Real\RealPlayer\realplay.exe"=
"c:\Program Files\AlerteGPS\G200NEO\G200_V1_2.exe"=
"\\server2003\commun\Logiciels, abonnements\Imprimante HP 2840 - Driver, software (plus rapide que par le CD)\setup\HPZnet01.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12345:TCP"= 12345:TCP:Trend Micro Client/Server Security Agent Listener

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers
vcchflt.sys [19/12/2007 21:42 16640]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [10/03/2009 23:05 335376]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers	mevtmgr.sys [17/07/2009 12:24 50192]
S2 TmFilter;Trend Micro Filter;c:\program files\Trend Micro\Client Server Security Agent	mxpflt.sys [22/05/2009 03:02 225296]
S2 TmPreFilter;Trend Micro PreFilter;c:\program files\Trend Micro\Client Server Security Agent	mpreflt.sys [22/05/2009 03:00 36368]
S3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [25/01/2008 15:40 85520]
S3 TmPfw;Pare-feu personnel Trend Micro Client/Server Security Agent;c:\program files\Trend Micro\Client Server Security Agent\TmPfw.exe [16/07/2009 13:12 497008]
S3 TmProxy;Service proxy Trend Micro Client/Server Security Agent;c:\program files\Trend Micro\Client Server Security Agent\TmProxy.exe [16/07/2009 13:12 685320]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [02/08/2009 21:39 133104]

[COLOR=RED]NETSVCS DOIT ÊTRE RÉPARÉ - liste des éléments présents/COLOR
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
BITS
ShellHWDetection
WmdmPmSN
wuauserv

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

.
Contenu du dossier 'Tâches planifiées'

2009-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-02 19:39]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = <local>
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
LSP: %SYSTEMROOT%\system32
vappfilter.dll
FF - ProfilePath - c:\documents and settings\cdc\Application Data\Mozilla\Firefox\Profiles\mq0uw7cq.default\
FF - prefs.js: browser.search.selectedEngine - WikipÃ©dia (fr)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - component: c:\program files\Real\RealPlayer\browserrecord\components
prpbrowserrecordplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7
pGoogleOneClick8.dll

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-06 17:06
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(712)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32
vappfilter.dll
c:\windows\system32\COMRes.dll

- - - - - - - > 'lsass.exe'(872)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32
vappfilter.dll
c:\program files\Bonjour\mdnsNSP.dll

- - - - - - - > 'explorer.exe'(1372)
c:\windows\system32\COMRes.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\fr-fr\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\fr-fr\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\browselc.dll
c:\windows\system32\shdoclc.dll
c:\windows\system32\portabledeviceapi.dll
.
Heure de fin: 2009-10-06 17:08 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-10-06 15:08
ComboFix2.txt  2009-10-05 17:04
ComboFix3.txt  2009-10-04 20:37

Avant-CF: 72 456 769 536 octets libres
Après-CF: 72 470 069 248 octets libres

287

Xplode · Answer

Comment se porte le PC ?

Stong · Answer

Hé bien, premièrement il n'y a plus le virus Antivirus pro 2010, l'impression a été rétabli (j'ai quand même réinstallé les pilotes et softwares). Ca change déjà beaucoup de chose !
Ensuite, il me semble être un peu plus rapide une fois le démarrage terminé. Bon, c'est sur, ca reste une bouse (il est vieux le pauvre), mais c'est quand même mieux :)
La désinfection est terminée ?

Stong · Answer

Egalement, il me semble plus rapide lorsqu'on navigue dans des dossiers sur le disque dur, ainsi que lorsque je navigue dans les dossiers du serveur.

Merci Xplode pour ton aide. Est ce que ça te dérangerait de m'expliquer rapidement qu'est ce qui t'a fait utilisé tel logiciel à tel moment etc ... ?

Suppression Antivir Pro 2010

29 réponses

Newsletters