Security Tool a encore frappé

Justlikeme84 -  
Bonjour,

Hier, en rentrant de vacance, j'allume mon ordinateurs, et surprise, un "pseudo" antivirus s'affiche à l'ecran, une certain "Security Tool" et me dit que j'ai 40 virus sur mon PC, j'ai trouvé cela bizarre puisque que je n'ai jamais téléchargé cet antivirus, mon fond d'écran est devenu rouge, et tous mes raccourci ne sont plus là. La barre des tâche est affiché mais reste bloqué, je peut cliquer dessus combien de fois que je veut, rien ne s'affiche tel une simple photo.
Je fait alors quelque recherche sur Google, et je tombe sur cette page : http://www.commentcamarche.net/faq/24055-security-tool

Ce serait apparemment un Rogue, qui ce fait passé pour un antivirus alors que c'est encore une saleté de virus.

J'ai donc suivi à la lettre les indication pour supprimé ce programme. Après 4h, j'arrive enfin à la dernière étape, croyant que c'était fini.

Mais mauvaise surprise, en redémarrant l'ordinateur, le fond d'écran rouge, et la barre des tâche bloqué sont toujours là. Cet fois je revoit mes raccourci, et Security Tool ne s'affiche plus mais à part bougé la souris, je ne peut rien faire, ni cliquer sur l'un des raccourci ni même éteindre l'ordinateur. Là je réussi à vous demandé de l'aide car je suis en mode sans échec avec prise de réseau

Alors voilà mon problème, comment refaire marchai mon PC comme avant.

Je vous en supplies, aidé moi, je suis complètement désespère :(

28 réponses

Résumé de la discussion

Une infection par un rogue antivirus nommé Security Tool provoque l'affichage d'alertes et un bureau rouge sur Windows XP, avec une barre des tâches bloquée et des raccourcis inaccessibles. Des solutions proposées incluent l'utilisation d'un outil de nettoyage hors ligne (OTL) et l'analyse de rapports pour identifier les éléments malveillants, avec des instructions pour partager les fichiers rapportés. Les échanges mentionnent aussi qu'après remise en état, le système peut nécessiter une réinstallation et entraîner la perte de données, tandis que des listes de fichiers et de composants compromis sont partagées. En parallèle, les discussions évoquent comment le malware peut avoir été introduit et soulignent l'intérêt d'analyser les journaux système et les caches pour estimer l'étendue d'infection.

Bobot (l’IA à votre service)
  1. Justlikeme84
    Désolé de réécrire un message, mais j'ai un rapport Maladroites' Anti-Malware et un rapport Combofix à vous montré :

    Maladroites' Anti-Malware :
    Malwarebytes' Anti-Malware 1.44
    Version de la base de données: 3809
    Windows 5.1.2600 Service Pack 3 (Safe Mode)
    Internet Explorer 8.0.6001.18702

    01/03/2010 18:07:22
    mbam-log-2010-03-01 (18-07-22).txt

    Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
    Eléments examinés: 184218
    Temps écoulé: 16 minute(s), 14 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 0
    Valeur(s) du Registre infectée(s): 0
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 1
    Fichier(s) infecté(s): 5

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Valeur(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    C:\Documents and Settings\All Users\Application Data\66191225 (Rogue.Multiple) -> Quarantined and deleted successfully.

    Fichier(s) infecté(s):
    C:\Documents and Settings\All Users\Application Data\66191225\66191225.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Compaq_Propriétaire\Menu Démarrer\Programmes\Démarrage\winesm32.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Compaq_Propriétaire\Bureau\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Compaq_Propriétaire\Menu Démarrer\Programmes\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Compaq_Propriétaire\Application Data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
    1. Justlikeme84
      Combofix :

      ComboFix 10-03-01.01 - Compaq_Propriétaire 01/03/2010 19:02:33.2.1 - x86 NETWORK
      Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.446.292 [GMT 1:00]
      Lancé depuis: c:\documents and settings\Compaq_Propriétaire\Bureau\CCM.exe
      .

      ((((((((((((((((((((((((((((( Fichiers créés du 2010-02-01 au 2010-03-01 ))))))))))))))))))))))))))))))))))))
      .

      2010-03-01 17:41 . 2010-03-01 17:42 -------- d-----w- C:\649471cf68250fbff62a08b1d2
      2010-03-01 17:40 . 2010-03-01 17:40 -------- d-----w- c:\windows\LastGood
      2010-03-01 16:35 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
      2010-03-01 16:35 . 2010-03-01 16:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
      2010-03-01 16:35 . 2010-03-01 16:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
      2010-03-01 16:35 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
      2010-02-28 18:47 . 2010-02-28 18:47 -------- d-sh--w- c:\documents and settings\Administrateur\IETldCache
      2010-02-28 17:33 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
      2010-02-28 17:33 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys
      2010-02-28 17:33 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
      2010-02-28 17:33 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\dllcache\i2omgmt.sys
      2010-02-28 17:33 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys
      2010-02-28 17:33 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\dllcache\changer.sys
      2010-02-28 17:32 . 2010-02-28 17:32 116 ----a-w- c:\windows\system32\fjhdyfhsn.bat
      2010-02-28 14:13 . 2010-02-28 14:13 -------- d-----w- C:\feab351d1b38e822eb1b0e55b77af0
      2010-02-27 09:54 . 2010-02-27 09:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
      2010-02-27 09:28 . 2010-02-27 09:30 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
      2010-02-05 16:03 . 2010-02-05 16:03 -------- d-----w- c:\program files\pspvideo9
      2010-02-05 15:43 . 2010-02-05 15:44 -------- d-----w- c:\program files\AviSynth 2.5
      2010-02-05 15:20 . 2010-02-05 15:20 -------- d-----w- c:\program files\Fichiers communs\DVDVideoSoft
      2010-02-05 15:20 . 2010-02-05 15:20 -------- d-----w- c:\program files\DVDVideoSoft
      2010-02-04 18:47 . 2010-02-04 18:47 -------- d-----w- c:\program files\Audacity
      2010-02-01 17:39 . 2010-03-01 16:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
      2010-02-01 17:39 . 2010-02-01 17:48 -------- d-----w- c:\program files\Spybot - Search & Destroy
      2010-01-31 11:58 . 2010-01-31 11:58 -------- d-----w- c:\program files\CCleaner
      2010-01-31 11:12 . 2010-01-31 11:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
      2010-01-31 11:11 . 2010-01-31 11:11 -------- d-----w- c:\program files\Messenger Plus! Live

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2010-02-27 17:58 . 2004-11-23 21:26 85636 ----a-w- c:\windows\system32\perfc00C.dat
      2010-02-27 17:58 . 2004-11-23 21:26 512292 ----a-w- c:\windows\system32\perfh00C.dat
      2010-02-27 17:54 . 2010-02-27 17:54 -------- d-----w- c:\program files\MSBuild
      2010-02-27 17:54 . 2010-02-27 17:54 -------- d-----w- c:\program files\Reference Assemblies
      2010-02-27 15:57 . 2010-01-11 09:34 -------- d-----w- c:\program files\Alwil Software
      2010-02-27 09:37 . 2005-01-02 21:08 -------- d-----w- c:\program files\Easy Internet signup
      2010-01-26 17:12 . 2010-01-26 17:12 -------- d-----w- c:\program files\ViiKiiDesktopPlugin
      2010-01-26 17:12 . 2010-01-26 17:12 -------- d-----w- c:\program files\Fichiers communs\Adobe AIR
      2010-01-26 17:11 . 2010-02-28 18:46 38784 ----a-w- c:\documents and settings\Administrateur\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
      2010-01-24 08:06 . 2010-01-23 18:41 -------- d-----w- c:\program files\uTorrent
      2010-01-23 14:28 . 2004-11-23 21:20 81603 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
      2010-01-13 18:34 . 2010-01-13 18:18 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
      2010-01-12 08:05 . 2010-01-12 08:03 -------- d-----w- c:\program files\DivX
      2010-01-12 08:04 . 2010-01-12 08:03 -------- d-----w- c:\program files\Fichiers communs\DivX Shared
      2010-01-12 07:17 . 2010-01-12 07:17 0 ----a-w- c:\windows\nsreg.dat
      2010-01-11 19:39 . 2010-01-11 19:39 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
      2010-01-11 19:32 . 2010-01-11 19:32 -------- d-----w- c:\program files\MSXML 4.0
      2010-01-11 19:03 . 2010-01-11 19:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
      2010-01-11 19:02 . 2010-01-11 19:02 -------- d-----w- c:\program files\Norton Security Scan
      2010-01-11 19:02 . 2005-01-02 21:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
      2010-01-11 19:02 . 2010-01-11 19:02 -------- d-----w- c:\program files\NortonInstaller
      2010-01-11 19:02 . 2010-01-11 19:02 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
      2010-01-11 18:56 . 2005-01-02 21:12 -------- d-----w- c:\program files\Symantec
      2010-01-11 09:50 . 2010-01-11 09:50 -------- d-----w- c:\program files\VideoLAN
      2010-01-11 09:36 . 2005-01-02 21:10 -------- d-----w- c:\program files\Google
      2010-01-11 07:47 . 2010-01-10 17:22 57 ----a-w- c:\documents and settings\All Users\Application Data\Brother\BrLog\BrCollectDir\BR_cat.bat
      2010-01-10 17:47 . 2010-01-10 17:47 411368 ----a-w- c:\windows\system32\deploytk.dll
      2010-01-10 17:47 . 2005-01-02 20:43 -------- d-----w- c:\program files\Java
      2010-01-10 17:41 . 2005-01-02 20:49 -------- d--h--w- c:\program files\InstallShield Installation Information
      2010-01-10 17:40 . 2010-01-10 17:39 -------- d-----w- c:\program files\SightSpeed
      2010-01-10 17:38 . 2010-01-10 17:37 -------- d-----w- c:\program files\Creative
      2010-01-10 17:33 . 2010-01-10 17:33 -------- d-----w- c:\program files\Microsoft
      2010-01-10 17:33 . 2010-01-10 17:33 -------- d-----w- c:\program files\Windows Live
      2010-01-10 17:33 . 2010-01-10 17:33 -------- d-----w- c:\program files\Windows Live SkyDrive
      2010-01-10 17:30 . 2010-01-10 17:30 -------- d-----w- c:\program files\Fichiers communs\Windows Live
      2010-01-10 17:22 . 2010-01-10 17:22 50 ----a-w- c:\windows\system32\bridf06a.dat
      2010-01-10 17:22 . 2010-01-10 17:22 -------- d-----w- c:\program files\Brother
      2010-01-10 17:22 . 2005-01-02 20:49 -------- d-----w- c:\program files\Fichiers communs\InstallShield
      2010-01-10 17:21 . 2010-01-10 17:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Brother
      2010-01-10 17:05 . 2010-01-10 17:05 1833 --sha-r- c:\windows\system32\drivers\103C_HP_CPC_EJ158AA-ABF SR1606FR FR540_YC_0Pres_QCZB550_E54FRheRED3_48_IAMETHYST-M_SMSI_V1.0_B3.36_T051021_WXH2_L40C_M447_J200_7AMD_8Sempron_91.79_#100110_N10EC8139_Z_G10025954_OTSSTcorp CD DVDW TS-H552D_DHWP2647.MRK
      2009-12-31 16:50 . 2004-08-05 18:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
      2009-12-21 19:07 . 2004-08-05 18:00 916480 ------w- c:\windows\system32\wininet.dll
      2009-12-17 07:41 . 2004-08-05 18:00 347648 ----a-w- c:\windows\system32\mspaint.exe
      2009-12-14 07:09 . 2004-08-05 18:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
      2009-12-04 18:22 . 2004-08-05 18:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
  2. Justlikeme84
    Suite ComboFix :

    ((((((((((((((((((((((((((((( SnapShot@2010-01-31_12.09.21 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-07-11 23:02 . 2009-07-11 23:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
    + 2009-07-11 23:02 . 2009-07-11 23:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
    + 2009-07-11 23:02 . 2009-07-11 23:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
    + 2009-07-11 23:02 . 2009-07-11 23:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
    + 2009-07-11 23:02 . 2009-07-11 23:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
    + 2009-07-11 23:02 . 2009-07-11 23:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
    + 2009-07-11 23:02 . 2009-07-11 23:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
    + 2009-07-11 23:02 . 2009-07-11 23:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
    + 2009-07-11 23:02 . 2009-07-11 23:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
    + 2009-07-11 23:02 . 2009-07-11 23:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
    + 2009-07-11 23:02 . 2009-07-11 23:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
    + 2009-07-11 23:02 . 2009-07-11 23:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
    + 2009-07-11 23:05 . 2009-07-11 23:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
    + 2009-07-11 23:05 . 2009-07-11 23:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
    - 2010-01-11 19:13 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
    + 2010-01-11 19:13 . 2010-01-23 08:11 46080 c:\windows\system32\tzchange.exe
    + 2008-07-29 20:10 . 2008-07-29 20:10 26112 c:\windows\system32\TsWpfWrp.exe
    + 2010-02-27 17:54 . 2008-07-06 12:06 89088 c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
    + 2008-07-29 18:59 . 2008-07-29 18:59 43544 c:\windows\system32\PresentationHostProxy.dll
    + 2004-11-23 21:26 . 2010-02-27 17:58 71868 c:\windows\system32\perfc009.dat
    + 2008-07-25 10:17 . 2008-07-25 10:17 15360 c:\windows\system32\mui\0409\mscorees.dll
    + 2004-08-05 18:00 . 2009-11-27 17:13 17920 c:\windows\system32\msyuv.dll
    + 2010-01-11 00:21 . 2009-11-27 16:08 28672 c:\windows\system32\msvidc32.dll
    - 2004-08-05 18:00 . 2008-04-14 02:33 11264 c:\windows\system32\msrle32.dll
    + 2004-08-05 18:00 . 2009-11-27 16:08 11264 c:\windows\system32\msrle32.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 83968 c:\windows\system32\mscories.dll
    + 2004-08-05 18:00 . 2009-11-27 16:08 48128 c:\windows\system32\iyuv_32.dll
    + 2008-07-29 18:24 . 2008-07-29 18:24 97800 c:\windows\system32\infocardapi.dll
    + 2008-07-29 18:24 . 2008-07-29 18:24 11264 c:\windows\system32\icardres.dll
    + 2008-07-29 20:10 . 2008-07-29 20:10 73720 c:\windows\system32\dxva2.dll
    + 2010-01-10 17:40 . 2008-04-13 18:46 19200 c:\windows\system32\dllcache\wstcodec.sys
    + 2004-08-05 18:00 . 2008-04-13 18:45 20608 c:\windows\system32\dllcache\usbuhci.sys
    + 2010-01-10 17:07 . 2008-04-13 18:47 25856 c:\windows\system32\dllcache\usbprint.sys
    + 2010-01-10 17:07 . 2008-04-13 18:45 32128 c:\windows\system32\dllcache\usbccgp.sys
    + 2004-08-05 18:00 . 2008-04-14 02:34 21896 c:\windows\system32\dllcache\tdtcp.sys
    + 2004-08-05 18:00 . 2008-04-14 02:34 12040 c:\windows\system32\dllcache\tdpipe.sys
    + 2005-01-02 20:50 . 2008-04-13 18:45 56576 c:\windows\system32\dllcache\swmidi.sys
    + 2010-01-10 17:41 . 2008-04-13 18:46 15232 c:\windows\system32\dllcache\streamip.sys
    + 2010-01-10 17:41 . 2008-04-13 18:46 11136 c:\windows\system32\dllcache\slip.sys
    + 2004-08-05 18:00 . 2008-04-13 18:40 11392 c:\windows\system32\dllcache\sfloppy.sys
    + 2004-08-05 18:00 . 2008-04-14 02:00 66048 c:\windows\system32\dllcache\serial.sys
    + 2004-08-04 04:31 . 2004-08-04 04:31 20992 c:\windows\system32\dllcache\rtl8139.sys
    + 2004-08-05 18:00 . 2008-04-14 01:55 40064 c:\windows\system32\dllcache\processr.sys
    + 2004-08-05 18:00 . 2008-04-13 18:51 61824 c:\windows\system32\dllcache\nic1394.sys
    + 2010-01-10 17:41 . 2008-04-13 18:46 10880 c:\windows\system32\dllcache\ndisip.sys
    + 2010-01-10 17:40 . 2008-04-13 18:46 85248 c:\windows\system32\dllcache\nabtsfec.sys
    + 2009-11-27 17:13 . 2009-11-27 17:13 17920 c:\windows\system32\dllcache\msyuv.dll
    + 2010-01-11 00:21 . 2009-11-27 16:08 28672 c:\windows\system32\dllcache\msvidc32.dll
    + 2009-11-27 16:08 . 2009-11-27 16:08 11264 c:\windows\system32\dllcache\msrle32.dll
    + 2004-08-05 18:00 . 2008-04-14 01:53 30336 c:\windows\system32\dllcache\modem.sys
    + 2009-11-27 16:08 . 2009-11-27 16:08 48128 c:\windows\system32\dllcache\iyuv_32.dll
    + 2004-08-05 18:00 . 2008-04-13 18:54 11264 c:\windows\system32\dllcache\irenum.sys
    + 2004-08-05 18:00 . 2008-04-13 18:57 20864 c:\windows\system32\dllcache\ipinip.sys
    + 2004-08-05 18:00 . 2008-04-13 18:53 36608 c:\windows\system32\dllcache\ip6fw.sys
    + 2004-08-05 18:00 . 2008-04-13 18:40 20480 c:\windows\system32\dllcache\flpydisk.sys
    + 2010-02-27 17:54 . 2008-07-06 12:06 89088 c:\windows\system32\dllcache\filterpipelineprintproc.dll
    + 2004-08-05 18:00 . 2008-04-13 18:40 27392 c:\windows\system32\dllcache\fdc.sys
    + 2005-01-02 20:50 . 2008-04-13 18:45 52864 c:\windows\system32\dllcache\dmusic.sys
    + 2009-12-14 07:09 . 2009-12-14 07:09 33280 c:\windows\system32\dllcache\csrsrv.dll
    + 2004-08-05 18:00 . 2004-08-05 18:00 18688 c:\windows\system32\dllcache\cdaudio.sys
    + 2010-01-10 17:40 . 2008-04-13 18:46 17024 c:\windows\system32\dllcache\ccdecode.sys
    + 2009-06-10 14:14 . 2009-11-27 16:08 85504 c:\windows\system32\dllcache\avifil32.dll
    - 2009-06-10 14:14 . 2009-06-10 14:14 85504 c:\windows\system32\dllcache\avifil32.dll
    + 2004-08-05 18:00 . 2008-04-13 18:51 59904 c:\windows\system32\dllcache\atmarpc.sys
    + 2004-08-05 18:00 . 2008-04-13 18:57 14336 c:\windows\system32\dllcache\asyncmac.sys
    + 2004-08-05 18:00 . 2008-04-13 18:51 60800 c:\windows\system32\dllcache\arp1394.sys
    + 2008-07-25 10:16 . 2008-07-25 10:16 96760 c:\windows\system32\dfshim.dll
    - 2004-11-23 21:22 . 2010-01-23 14:41 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2004-11-23 21:22 . 2010-02-28 17:35 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2010-02-28 17:35 . 2010-02-28 17:35 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012010022820100301\index.dat
    + 2004-11-23 22:12 . 2010-02-28 17:35 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
    - 2004-11-23 22:12 . 2010-01-23 14:41 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
    + 2010-02-28 17:32 . 2010-02-28 17:35 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
    - 2004-08-05 18:00 . 2009-06-10 14:14 85504 c:\windows\system32\avifil32.dll
    + 2004-08-05 18:00 . 2009-11-27 16:08 85504 c:\windows\system32\avifil32.dll
    + 2008-07-29 22:40 . 2008-07-29 22:40 70648 c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
    + 2008-07-29 22:40 . 2008-07-29 22:40 91136 c:\windows\Microsoft.NET\Framework\v3.5\MSBuild.exe
    + 2008-07-29 22:40 . 2008-07-29 22:40 41984 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.VisualC.STLCLR.dll
    + 2008-07-29 22:40 . 2008-07-29 22:40 40960 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.Data.Entity.Build.Tasks.dll
    + 2008-07-29 17:47 . 2008-07-29 17:47 89080 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.2052.dll
    + 2008-07-29 17:47 . 2008-07-29 17:47 92664 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1042.dll
    + 2008-07-29 17:47 . 2008-07-29 17:47 95224 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1041.dll
    + 2008-07-29 17:47 . 2008-07-29 17:47 89592 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1028.dll
    + 2008-07-29 17:47 . 2008-07-29 17:47 84480 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.2052.dll
    + 2008-07-29 17:47 . 2008-07-29 17:47 94720 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1042.dll
    + 2008-07-29 17:47 . 2008-07-29 17:47 97792 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1041.dll
    + 2008-07-29 17:47 . 2008-07-29 17:47 84992 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1028.dll
    + 2008-07-29 17:47 . 2008-07-29 17:47 97280 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
    + 2008-07-29 22:40 . 2008-07-29 22:40 95224 c:\windows\Microsoft.NET\Framework\v3.5\EdmGen.exe
    + 2008-07-29 22:40 . 2008-07-29 22:40 78856 c:\windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe
    + 2008-07-29 22:40 . 2008-07-29 22:40 41984 c:\windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe
    + 2008-07-29 22:40 . 2008-07-29 22:40 41992 c:\windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe
    + 2008-07-29 22:40 . 2008-07-29 22:40 41992 c:\windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe
    + 2008-07-29 20:10 . 2008-07-29 20:10 46104 c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
    + 2008-07-29 18:59 . 2008-07-29 18:59 32768 c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationCFFRasterizer.dll
    + 2008-07-29 20:10 . 2008-07-29 20:10 71160 c:\windows\Microsoft.NET\Framework\v3.0\WPF\PenIMC.dll
    + 2008-07-29 18:32 . 2008-07-29 18:32 17448 c:\windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
    + 2008-07-29 18:16 . 2008-07-29 18:16 32768 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.WasHosting.dll
    + 2008-07-29 18:16 . 2008-07-29 18:16 73728 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.Install.dll
    + 2008-07-29 18:16 . 2008-07-29 18:16 20504 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceMonikerSupport.dll
    + 2008-07-29 18:16 . 2008-07-29 18:16 11280 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelEvents.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 37896 c:\windows\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 81400 c:\windows\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
    + 2008-07-25 10:17 . 2008-07-25 10:17 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 57392 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 95232 c:\windows\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 16896 c:\windows\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 61952 c:\windows\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
    + 2008-07-25 10:17 . 2008-07-25 10:17 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    + 2008-07-25 10:17 . 2008-07-25 10:17 53248 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    + 2008-07-25 10:17 . 2008-07-25 10:17 88584 c:\windows\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 24584 c:\windows\Microsoft.NET\Framework\v2.0.50727\normalization.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 31744 c:\windows\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 19456 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 69632 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    + 2008-07-25 10:16 . 2008-07-25 10:16 18944 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 77312 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 94208 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 46592 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 83456 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 69632 c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
    + 2008-07-25 10:16 . 2008-07-25 10:16 97792 c:\windows\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 12800 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 40960 c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe
    + 2008-07-25 10:17 . 2008-07-25 10:17 72192 c:\windows\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 65032 c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
    + 2008-07-25 10:17 . 2008-07-25 10:17 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 18936 c:\windows\Microsoft.NET\Framework\v2.0.50727\fusion.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 62968 c:\windows\Microsoft.NET\Framework\v2.0.50727\dfdll.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 35320 c:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    + 2008-07-25 10:17 . 2008-07-25 10:17 69120 c:\windows\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 27136 c:\windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 13312 c:\windows\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 80376 c:\windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    + 2008-07-25 10:17 . 2008-07-25 10:17 89608 c:\windows\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
    + 2008-11-25 03:59 . 2008-11-25 03:59 31560 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
    + 2008-07-25 10:16 . 2008-07-25 10:16 34312 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
    + 2008-07-25 10:16 . 2008-07-25 10:16 33288 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
    + 2008-07-25 10:16 . 2008-07-25 10:16 24576 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
    + 2008-07-25 10:16 . 2008-07-25 10:16 84480 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 33800 c:\windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 17416 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 22024 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
    + 2008-07-25 10:17 . 2008-07-25 10:17 58880 c:\windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    + 2008-07-25 10:16 . 2008-07-25 10:16 98808 c:\windows\Microsoft.NET\Framework\v2.0.50727\alink.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 10752 c:\windows\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 13824 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 96768 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 16896 c:\windows\Microsoft.NET\Framework\SharedReg12.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 16896 c:\windows\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
    + 2008-07-25 10:17 . 2008-07-25 10:17 16896 c:\windows\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 16896 c:\windows\Microsoft.NET\Framework\sbscmp10.dll
    + 2008-07-25 10:16 . 2008-07-25 10:16 82944 c:\windows\Microsoft.NET\Framework\NETFXSBS10.exe
    + 2008-07-29 20:07 . 2008-07-29 20:07 23040 c:\windows\Installer\6b794e.msp
    + 2010-02-27 17:53 . 2010-02-27 17:53 88576 c:\windows\Installer\67eaa3.msi
    + 2010-02-27 09:31 . 2010-02-27 09:31 22528 c:\windows\Installer\33222.msi
    1. Justlikeme84
      Suite ComboFix :

      + 2009-11-27 17:13 . 2009-11-27 17:13 17920 c:\windows\Driver Cache\i386\msyuv.dll
      + 2009-11-27 16:08 . 2009-11-27 16:08 48128 c:\windows\Driver Cache\i386\iyuv_32.dll
      + 2010-02-27 17:54 . 2008-07-06 12:06 89088 c:\windows\Driver Cache\i386\filterpipelineprintproc.dll
      + 2010-02-28 10:52 . 2010-02-28 10:52 60928 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\a715aa442ef87ae99b3ade185599249d\UIAutomationProvider.ni.dll
      + 2010-02-28 11:48 . 2010-02-28 11:48 37888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\423f794d1f4ed6e120fbb02e436491cb\System.Windows.Presentation.ni.dll
      + 2010-02-28 11:48 . 2010-02-28 11:48 36864 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\19ca1747c1ea18a3b639b302bca8df93\System.Web.DynamicData.Design.ni.dll
      + 2010-02-28 11:46 . 2010-02-28 11:46 94208 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\532438e2acfcadc469a4d468c51f8451\System.ComponentModel.DataAnnotations.ni.dll
      + 2010-02-28 11:46 . 2010-02-28 11:46 82944 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\597b20e1b053d6a510cfe033c07a63e6\System.AddIn.Contract.ni.dll
      + 2010-02-28 10:48 . 2010-02-28 10:48 47104 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\2d7408a0232f2e2efd0d7adf5dfa733a\PresentationFontCache.ni.exe
      + 2010-02-28 10:47 . 2010-02-28 10:47 39424 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\c8fd2d9233f8ea3031fb16f697635231\PresentationCFFRasterizer.ni.dll
      + 2010-02-28 11:47 . 2010-02-28 11:47 55296 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\790cf1edb17ee41b59be62ecbd59613b\Microsoft.Vsa.ni.dll
      + 2010-02-28 11:46 . 2010-02-28 11:46 65024 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\e9aba2eab90d647356f65e66053da02b\Microsoft.Build.Framework.ni.dll
      + 2010-02-28 11:46 . 2010-02-28 11:46 74752 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\28343d470d992f169ca0e7cdb3cc3117\Microsoft.Build.Framework.ni.dll
      + 2010-02-28 11:46 . 2010-02-28 11:46 14336 c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\f4e38208e88cb4cc314a1d6543b9fcc6\dfsvc.ni.exe
      + 2010-02-28 11:46 . 2010-02-28 11:46 25600 c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\11eb4f6606ba01e5128805759121ea6c\Accessibility.ni.dll
      + 2010-02-27 17:54 . 2010-02-27 17:54 94208 c:\windows\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll
      + 2010-02-27 17:54 . 2010-02-27 17:54 98304 c:\windows\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll
      + 2010-02-27 17:54 . 2010-02-27 17:54 40960 c:\windows\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll
      + 2010-02-27 17:55 . 2010-02-27 17:55 12288 c:\windows\assembly\GAC_MSIL\System.Windows.Presentation\3.5.0.0__b77a5c561934e089\System.Windows.Presentation.dll
      + 2010-02-27 17:55 . 2010-02-27 17:55 61440 c:\windows\assembly\GAC_MSIL\System.Web.Routing\3.5.0.0__31bf3856ad364e35\System.Web.Routing.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
      + 2010-02-27 17:55 . 2010-02-27 17:55 32768 c:\windows\assembly\GAC_MSIL\System.Web.DynamicData.Design\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.Design.dll
      + 2010-02-27 17:55 . 2010-02-27 17:55 77824 c:\windows\assembly\GAC_MSIL\System.Web.Abstractions\3.5.0.0__31bf3856ad364e35\System.Web.Abstractions.dll
      + 2010-02-27 17:54 . 2010-02-27 17:54 32768 c:\windows\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
      + 2010-02-27 17:54 . 2010-02-27 17:54 73728 c:\windows\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\System.ServiceModel.Install.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
      + 2010-02-27 17:55 . 2010-02-27 17:55 53248 c:\windows\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
      + 2010-02-27 17:55 . 2010-02-27 17:55 57344 c:\windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll
      + 2010-02-27 17:55 . 2010-02-27 17:55 45056 c:\windows\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll
      + 2010-02-27 17:54 . 2010-02-27 17:54 46104 c:\windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
      + 2010-02-27 17:54 . 2010-02-27 17:54 32768 c:\windows\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\PresentationCFFRasterizer.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
      + 2010-02-27 17:55 . 2010-02-27 17:55 41984 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
      + 2010-02-27 17:55 . 2010-02-27 17:55 94208 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v3.5.dll
      + 2010-02-27 17:55 . 2010-02-27 17:55 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
      + 2004-08-05 18:00 . 2009-11-27 16:08 8704 c:\windows\system32\tsbyuv.dll
      + 2004-08-05 18:00 . 2009-11-27 16:08 8704 c:\windows\system32\dllcache\tsbyuv.dll
      + 2005-01-02 20:50 . 2008-04-13 18:45 6272 c:\windows\system32\dllcache\splitter.sys
      + 2010-01-10 17:41 . 2008-04-13 18:39 5504 c:\windows\system32\dllcache\mstee.sys
      + 2005-01-02 20:50 . 2008-04-13 18:39 4992 c:\windows\system32\dllcache\mspqm.sys
      + 2005-01-02 20:50 . 2008-04-13 18:39 5376 c:\windows\system32\dllcache\mspclock.sys
      + 2005-01-02 20:50 . 2008-04-13 18:39 7552 c:\windows\system32\dllcache\mskssrv.sys
      + 2005-01-02 20:50 . 2008-04-13 18:45 2944 c:\windows\system32\dllcache\drmkaud.sys
      + 2008-07-29 22:40 . 2008-07-29 22:40 5632 c:\windows\Microsoft.NET\Framework\v3.5\Sentinel.v3.5Client.dll
      + 2008-07-25 10:16 . 2008-07-25 10:16 7168 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 5632 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 6656 c:\windows\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 8192 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 9728 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
      + 2008-07-25 10:16 . 2008-07-25 10:16 5120 c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
      + 2009-11-27 16:08 . 2009-11-27 16:08 8704 c:\windows\Driver Cache\i386\tsbyuv.dll
      + 2010-02-27 17:55 . 2010-02-27 17:55 5632 c:\windows\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\Sentinel.v3.5Client.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
      + 2010-02-27 17:58 . 2010-02-27 17:58 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
      + 2009-07-11 23:02 . 2009-07-11 23:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
      + 2009-07-11 23:02 . 2009-07-11 23:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
      + 2009-07-11 23:05 . 2009-07-11 23:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
      + 2009-07-11 23:02 . 2009-07-11 23:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 635904 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 558080 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 479232 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
      + 2008-07-29 20:26 . 2008-07-29 20:26 301568 c:\windows\system32\XPSViewer\XPSViewer.exe
      + 2010-02-27 17:54 . 2008-07-06 12:06 575488 c:\windows\system32\xpsshhdr.dll
      + 2008-07-29 18:59 . 2008-07-29 18:59 161296 c:\windows\system32\UIAutomationCore.dll
      + 2010-02-27 17:54 . 2008-07-06 12:06 765440 c:\windows\system32\spool\XPSEP\i386\mxdwdrv.dll
      + 2010-02-27 17:54 . 2008-07-06 12:06 765440 c:\windows\system32\spool\XPSEP\i386\i386\mxdwdrv.dll
      + 2010-02-27 17:54 . 2008-07-06 12:06 748032 c:\windows\system32\spool\XPSEP\amd64\mxdwdrv.dll
      + 2010-02-27 17:54 . 2008-07-06 12:06 748032 c:\windows\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll
      + 2010-02-27 17:54 . 2008-07-06 12:06 147456 c:\windows\system32\spool\prtprocs\x64\filterpipelineprintproc.dll
      + 2010-02-27 17:54 . 2008-07-06 10:50 597504 c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
      + 2010-02-27 17:54 . 2008-03-13 04:52 761344 c:\windows\system32\spool\drivers\w32x86\3\unires.dll
      + 2010-02-27 17:54 . 2008-07-06 12:06 744960 c:\windows\system32\spool\drivers\w32x86\3\unidrvui.dll
      + 2010-02-27 17:54 . 2008-07-06 12:06 373248 c:\windows\system32\spool\drivers\w32x86\3\unidrv.dll
      + 2010-02-27 17:54 . 2008-07-06 12:06 198656 c:\windows\system32\spool\drivers\w32x86\3\mxdwdui.dll
      + 2010-02-27 17:54 . 2008-07-06 12:06 765440 c:\windows\system32\spool\drivers\w32x86\3\mxdwdrv.dll
      + 2004-08-05 18:00 . 2009-12-08 09:24 474624 c:\windows\system32\shlwapi.dll
      - 2004-08-05 18:00 . 2008-04-14 02:33 474624 c:\windows\system32\shlwapi.dll
      + 2006-08-24 15:15 . 2006-08-24 15:15 150808 c:\windows\system32\rgb9rast_2.dll
      + 2010-02-27 17:54 . 2008-07-06 12:06 117760 c:\windows\system32\prntvpt.dll
      + 2008-07-29 18:59 . 2008-07-29 18:59 781344 c:\windows\system32\PresentationNative_v0300.dll
      + 2008-07-29 19:35 . 2008-07-29 19:35 326160 c:\windows\system32\PresentationHost.exe
      + 2008-07-29 18:59 . 2008-07-29 18:59 105016 c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
      + 2004-11-23 21:26 . 2010-02-27 17:58 442602 c:\windows\system32\perfh009.dat
      + 2008-07-25 10:16 . 2008-07-25 10:16 158720 c:\windows\system32\mscorier.dll
      + 2008-07-25 10:16 . 2008-07-25 10:16 282112 c:\windows\system32\mscoree.dll
      + 2004-08-05 18:00 . 2009-12-09 05:54 726528 c:\windows\system32\jscript.dll
      - 2004-08-05 18:00 . 2009-06-22 06:47 726528 c:\windows\system32\jscript.dll
      + 2008-07-29 18:24 . 2008-07-29 18:24 622080 c:\windows\system32\icardagt.exe
      + 2004-11-23 21:25 . 2010-02-28 10:45 168304 c:\windows\system32\FNTCACHE.DAT
      + 2008-07-29 20:10 . 2008-07-29 20:10 493048 c:\windows\system32\evr.dll
      + 2005-01-02 20:50 . 2008-04-13 16:39 142592 c:\windows\system32\drivers\aec.sys
      - 2005-01-02 20:50 . 2008-04-13 16:39 142592 c:\windows\system32\drivers\aec.sys
      + 2010-02-27 17:54 . 2008-07-06 12:06 575488 c:\windows\system32\dllcache\xpsshhdr.dll
      + 2010-01-11 19:11 . 2009-12-31 16:50 353792 c:\windows\system32\dllcache\srv.sys
      + 2009-12-08 09:24 . 2009-12-08 09:24 474624 c:\windows\system32\dllcache\shlwapi.dll
      + 2004-08-05 18:00 . 2008-04-14 02:34 139656 c:\windows\system32\dllcache\rdpwd.sys
      + 2010-02-27 17:54 . 2008-07-06 10:50 597504 c:\windows\system32\dllcache\printfilterpipelinesvc.exe
      + 2009-12-17 07:41 . 2009-12-17 07:41 347648 c:\windows\system32\dllcache\mspaint.exe
      + 2010-01-11 19:10 . 2009-12-04 18:22 455424 c:\windows\system32\dllcache\mrxsmb.sys
      + 2004-08-04 06:46 . 2004-08-04 06:46 607452 c:\windows\system32\dllcache\ltmdmnt.sys
      + 2005-01-02 20:50 . 2008-04-13 18:45 172416 c:\windows\system32\dllcache\kmixer.sys
      - 2004-08-05 18:00 . 2009-06-22 06:47 726528 c:\windows\system32\dllcache\jscript.dll
      + 2004-08-05 18:00 . 2009-12-09 05:54 726528 c:\windows\system32\dllcache\jscript.dll
      + 2005-01-02 20:50 . 2008-04-13 16:39 142592 c:\windows\system32\dllcache\aec.sys
      + 2004-05-26 12:37 . 2004-05-26 12:37 719872 c:\windows\system32\devil.dll
      + 2008-12-21 21:46 . 2008-12-21 21:46 351744 c:\windows\system32\avisynth.dll
      + 2008-07-29 22:40 . 2008-07-29 22:40 196104 c:\windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
      + 2008-07-29 22:40 . 2008-07-29 22:40 802816 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.Build.Tasks.v3.5.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 984056 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapUI.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 107512 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 111096 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.3082.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 110072 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.2070.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 106488 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1055.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 105976 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1053.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 107000 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1049.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 107512 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1046.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 109048 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1045.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 106488 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1044.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 108536 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1043.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 110072 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1040.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 111096 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1038.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 101368 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1037.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 112120 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1036.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 106488 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1035.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 113656 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1032.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 111608 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1031.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 108536 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1030.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 108536 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1029.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 102904 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1025.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 689152 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vsscenario.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 413184 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vsbasereqs.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 632320 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs70uimgr.dll
      + 2010-02-27 17:55 . 2010-02-27 17:55 652800 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs_setup.msi
      + 2008-07-29 17:47 . 2008-07-29 17:47 110080 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 131584 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.3082.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 131072 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.2070.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 121344 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1055.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 121344 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1053.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 123904 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1049.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 122880 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1046.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 128512 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1045.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 121856 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1044.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 129024 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1043.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 128512 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1040.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 132096 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1038.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 111104 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1037.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 133120 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1036.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 122368 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1035.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 137728 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1032.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 130048 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1031.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 126464 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1030.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 125440 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1029.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 113152 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1025.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 269304 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
      + 2008-07-29 17:47 . 2008-07-29 17:47 177152 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\HtmlLite.dll
      + 2008-07-29 17:47 . 2008-07-29 17:47 276984 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\dlmgr.dll
      + 2008-07-29 22:15 . 2008-07-29 22:15 225490 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\baseline.dat
      + 2008-07-29 22:40 . 2008-07-29 22:40 233976 c:\windows\Microsoft.NET\Framework\v3.5\1033\vbc7ui.dll
      + 2008-07-29 22:40 . 2008-07-29 22:40 168448 c:\windows\Microsoft.NET\Framework\v3.5\1033\cscompui.dll
      + 2008-07-29 19:35 . 2008-07-29 19:35 864256 c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationUI.dll
      + 2008-07-29 18:59 . 2008-07-29 18:59 132120 c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationHostDLL.dll
      + 2008-07-29 20:10 . 2008-07-29 20:10 806928 c:\windows\Microsoft.NET\Framework\v3.0\WPF\NaturalLanguage6.dll
      + 2008-07-29 18:16 . 2008-07-29 18:16 152576 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
      + 2008-07-29 18:16 . 2008-07-29 18:16 966656 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.Runtime.Serialization.dll
      + 2008-07-29 18:16 . 2008-07-29 18:16 132096 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
      + 2008-07-29 18:16 . 2008-07-29 18:16 110592 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMdiagnostics.dll
      + 2008-07-29 18:16 . 2008-07-29 18:16 156688 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
      + 2008-07-29 18:16 . 2008-07-29 18:16 163840 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.Dtc.dll
      + 2008-07-29 18:16 . 2008-07-29 18:16 397312 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.dll
      + 2008-07-29 18:24 . 2008-07-29 18:24 881664 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
      + 2008-07-29 18:16 . 2008-07-29 18:16 168968 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
      + 2008-11-25 03:59 . 2008-11-25 03:59 436040 c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 839680 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 835584 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 261632 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 114688 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 131072 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 303104 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 372736 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 113664 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 626688 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 188416 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 401408 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll
      + 2008-07-25 10:16 . 2008-07-25 10:16 970752 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 745472 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
      + 2008-11-25 03:59 . 2008-11-25 03:59 486400 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 425984 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 392184 c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 118784 c:\windows\Microsoft.NET\Framework\v2.0.50727\shfusion.dll
      + 2008-07-25 10:16 . 2008-07-25 10:16 143360 c:\windows\Microsoft.NET\Framework\v2.0.50727\peverify.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 100856 c:\windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
      + 2008-07-25 10:17 . 2008-07-25 10:17 230912 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 345600 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 114176 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
      + 2008-11-25 03:59 . 2008-11-25 03:59 364872 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 308224 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll
      + 2008-11-25 03:59 . 2008-11-25 03:59 990032 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 659456 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 372736 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll
      + 2008-07-25 10:16 . 2008-07-25 10:16 749568 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
      + 2008-07-25 10:16 . 2008-07-25 10:16 655360 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
      + 2008-07-25 10:16 . 2008-07-25 10:16 348160 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 230904 c:\windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
      + 2008-07-25 10:17 . 2008-07-25 10:17 798224 c:\windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 575496 c:\windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 106496 c:\windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
      + 2008-07-25 10:16 . 2008-07-25 10:16 507904 c:\windows\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
      + 2008-07-25 10:16 . 2008-07-25 10:16 106496 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
      + 2008-07-25 10:17 . 2008-07-25 10:17 147968 c:\windows\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll
      + 2008-07-25 10:16 . 2008-07-25 10:16 218112 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll
      + 2008-07-25 10:17 . 2008-07-25 10:17 193016 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll
      + 2008-07-25 10:16 . 2008-07-25 10:16 145408 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll
      + 2008-12-13 08:58 . 2008-12-13 08:58 754688 c:\windows\Installer\6c89f1.msp
      + 2010-02-27 17:55 . 2010-02-27 17:55 648192 c:\windows\Installer\6c89cb.msi
      + 2008-07-29 20:23 . 2008-07-29 20:23 250880 c:\windows\Installer\6b7957.msp
      + 2008-07-29 20:28 . 2008-07-29 20:28 278016 c:\windows\Installer\6b7955.msp
      + 2008-07-29 18:40 . 2008-07-29 18:40 291840 c:\windows\Installer\6b7953.msp
      + 2010-02-27 17:55 . 2010-02-27 17:55 137728 c:\windows\Installer\6b794d.msi
      + 2008-07-29 16:35 . 2008-07-29 16:35 553472 c:\windows\Installer\67eaa8.msp
      + 2008-07-29 16:33 . 2008-07-29 16:33 506368 c:\windows\Installer\67eaa6.msp
      + 2008-07-29 16:37 . 2008-07-29 16:37 911360 c:\windows\Installer\67eaa5.msp
      + 2009-03-20 10:48 . 2009-03-20 10:48 183808 c:\windows\Installer\1f36c.msp
      + 2010-02-27 09:55 . 2010-02-27 09:55 219648 c:\windows\Installer\18ebd7.msi
      1. Justlikeme84
        + 2010-02-27 12:41 . 2008-07-08 13:04 406392 c:\windows\ie8updates\KB976662-IE8\spuninst\updspapi.dll
        + 2010-02-27 12:41 . 2008-07-08 13:03 234872 c:\windows\ie8updates\KB976662-IE8\spuninst\spuninst.exe
        + 2010-02-27 12:41 . 2009-06-22 06:47 726528 c:\windows\ie8updates\KB976662-IE8\jscript.dll
        + 2010-02-27 17:54 . 2008-03-13 04:52 761344 c:\windows\Driver Cache\i386\unires.dll
        + 2010-02-27 17:54 . 2008-07-06 12:06 744960 c:\windows\Driver Cache\i386\unidrvui.dll
        + 2010-02-27 17:54 . 2008-07-06 12:06 373248 c:\windows\Driver Cache\i386\unidrv.dll
        + 2010-02-27 17:54 . 2008-07-06 12:06 198656 c:\windows\Driver Cache\i386\mxdwdui.dll
        + 2010-02-27 17:54 . 2008-07-06 12:06 765440 c:\windows\Driver Cache\i386\mxdwdrv.dll
        + 2010-01-11 19:10 . 2009-12-04 18:22 455424 c:\windows\Driver Cache\i386\mrxsmb.sys
        + 2010-02-28 11:46 . 2010-02-28 11:46 321536 c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\2ef5bc3a2edd7570bb23886a4f32294a\WsatConfig.ni.exe
        + 2010-02-28 10:53 . 2010-02-28 10:53 240128 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\6a818099f0386e2356ae94f886a2196f\WindowsFormsIntegration.ni.dll
        + 2010-02-28 10:52 . 2010-02-28 10:52 187904 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\a6d9503962d47c722231c1478f180695\UIAutomationTypes.ni.dll
        + 2010-02-28 10:52 . 2010-02-28 10:52 447488 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\5c028c3d8db6c0f0277673ea4a2d89fb\UIAutomationClient.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 400896 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\c338a470b14851ce5987bb0f0869c310\System.Xml.Linq.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 129536 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\bb77ea11f46ab438b2b7ed7c180011a1\System.Web.Routing.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 202240 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\6ee255220d90dcbe80c990e443051cc5\System.Web.RegularExpressions.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 859648 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\58f62044fa702ea6f936071aa5520baa\System.Web.Extensions.Design.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 328704 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\79c29ac85dd57dd485ab60118ac292ff\System.Web.Entity.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 301056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\d3d65e34fa60f0b6c72ca0d12ec89933\System.Web.Entity.Design.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 547328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\b7891f5659db299dbd1b3c72db7edb9f\System.Web.DynamicData.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\00ec08741a765c707bd9169346064a81\System.Web.Abstractions.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 627200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\5a555c9ae6984c40157cf940bb519f7c\System.Transactions.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\ea3366939280c1715f1c620e33ee3c8a\System.ServiceProcess.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 676352 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\1c8df2da33222c048d683017f2095f04\System.Security.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 311296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\bfd6e16d8c3589cd2bd3f8d46f0a5402\System.Runtime.Serialization.Formatters.Soap.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 621056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Net\519d9c618341b136f9b963ffb7495308\System.Net.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 998400 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\8642fdfbf02a6cb6f01169fe6fdb5d11\System.Management.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 330752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\1d3fbbd23ce1e8637ef4f40a8d23cd32\System.Management.Instrumentation.ni.dll
        + 2010-02-28 11:45 . 2010-02-28 11:45 381440 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\7c367a96b10d626ec8cbf8149272d845\System.IO.Log.ni.dll
        + 2010-02-28 11:45 . 2010-02-28 11:45 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\68e71147704ef0d34d9a4bece7767fc5\System.IdentityModel.Selectors.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 280064 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\4267bd908175603006c6c90bb5d900c7\System.EnterpriseServices.Wrapper.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 627712 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\4267bd908175603006c6c90bb5d900c7\System.EnterpriseServices.ni.dll
        + 2010-02-28 10:51 . 2010-02-28 10:51 208384 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\18bbe2b6717e7f1d1dd672526e9889ee\System.Drawing.Design.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 455680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c434a07332ce490711c27fd0edb7562f\System.DirectoryServices.Protocols.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 881152 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\8b3bb7a2c2f3ffe94c866283f1cd5957\System.DirectoryServices.AccountManagement.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 939008 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\a4b887f476fa4b8746a93a9fc2208560\System.Data.Services.Client.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 354816 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\1cf3acad6553d6c59df576794f4e8bd6\System.Data.Services.Design.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 756736 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\392de34573f9f8ec885714f2f3e7f07f\System.Data.Entity.Design.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 135680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\1db495ff00bbd14df4af6680c4de0653\System.Data.DataSetExtensions.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 971264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\b82c00e2d24305ad6cb08556e3779b75\System.Configuration.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\de514e484e49b04b016949d57ffac03e\System.Configuration.Install.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 633856 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\ce984d754e3c0b6be4504b785cc43574\System.AddIn.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 366080 c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\045dd501b7257b1cc26083538ae69045\SMSvcHost.ni.exe
        + 2010-02-28 11:46 . 2010-02-28 11:46 256000 c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\9790551187e294b4ed3aaa1c221891c7\SMDiagnostics.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 320512 c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\10a0c9707876fc1f65e64b811a28b020\ServiceModelReg.ni.exe
        + 2010-02-28 10:50 . 2010-02-28 10:50 224768 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\f475294d8c7dc2dd4febeef27bc0417e\PresentationFramework.Classic.ni.dll
        + 2010-02-28 10:50 . 2010-02-28 10:50 539648 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8003abaf6bcf70f7eb620d06837e897b\PresentationFramework.Luna.ni.dll
        + 2010-02-28 10:50 . 2010-02-28 10:50 368128 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\59a67874d8d8475faa5be1d993083d12\PresentationFramework.Aero.ni.dll
        + 2010-02-28 10:50 . 2010-02-28 10:50 258048 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\2c980c9a5051d723c6ec2a78a3d0e2b3\PresentationFramework.Royale.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 133632 c:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\6d38e317128608bc4516ea46ab94590e\MSBuild.ni.exe
        + 2010-02-28 11:46 . 2010-02-28 11:46 386560 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\1820d6a012fc0e16c3e1d29d973cd2d0\Microsoft.Transactions.Bridge.Dtc.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 144384 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\55b9eff9e23359faed4351386c062238\Microsoft.Build.Utilities.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 175104 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\4217124db1ea5de5f1a1f3eea75e8d32\Microsoft.Build.Utilities.v3.5.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 839680 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\96825c34d7e1f7df1923ff2123bed8da\Microsoft.Build.Engine.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 222720 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\9b321ebf67587237f576df6104a32588\Microsoft.Build.Conversion.v3.5.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 220672 c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\9bea05938bee3555c5aa8763d89a68f9\CustomMarshalers.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 410112 c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\12629e2f3e315459bee67cbbaac85cb2\ComSvcConfig.ni.exe
        + 2010-02-28 11:46 . 2010-02-28 11:46 842240 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\b5b2feadc3943e3976daebc0bcd2b5e2\AspNetMMCExt.ni.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 385024 c:\windows\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 167936 c:\windows\assembly\GAC_MSIL\UIAutomationClient\3.0.0.0__31bf3856ad364e35\UIAutomationClient.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 139264 c:\windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 507904 c:\windows\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\System.WorkflowServices.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 540672 c:\windows\assembly\GAC_MSIL\System.Workflow.Runtime\3.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 335872 c:\windows\assembly\GAC_MSIL\System.Web.Extensions.Design\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.Design.dll
        + 2010-02-27 18:00 . 2010-02-27 18:00 139264 c:\windows\assembly\GAC_MSIL\System.Web.Entity\3.5.0.0__b77a5c561934e089\System.Web.Entity.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 131072 c:\windows\assembly\GAC_MSIL\System.Web.Entity.Design\3.5.0.0__b77a5c561934e089\System.Web.Entity.Design.dll
        + 2010-02-27 18:00 . 2010-02-27 18:00 229376 c:\windows\assembly\GAC_MSIL\System.Web.DynamicData\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 688128 c:\windows\assembly\GAC_MSIL\System.Speech\3.0.0.0__31bf3856ad364e35\System.Speech.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 569344 c:\windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 966656 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 233472 c:\windows\assembly\GAC_MSIL\System.Net\3.5.0.0__b03f5f7f11d50a3a\System.Net.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 143360 c:\windows\assembly\GAC_MSIL\System.Management.Instrumentation\3.5.0.0__b77a5c561934e089\System.Management.Instrumentation.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 131072 c:\windows\assembly\GAC_MSIL\System.IO.Log\3.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 430080 c:\windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 126976 c:\windows\assembly\GAC_MSIL\System.IdentityModel.Selectors\3.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 286720 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
        + 2010-02-27 18:00 . 2010-02-27 18:00 442368 c:\windows\assembly\GAC_MSIL\System.Data.Services\3.5.0.0__b77a5c561934e089\System.Data.Services.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 114688 c:\windows\assembly\GAC_MSIL\System.Data.Services.Design\3.5.0.0__b77a5c561934e089\System.Data.Services.Design.dll
        + 2010-02-27 18:00 . 2010-02-27 18:00 294912 c:\windows\assembly\GAC_MSIL\System.Data.Services.Client\3.5.0.0__b77a5c561934e089\System.Data.Services.Client.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 684032 c:\windows\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089\System.Data.Linq.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 229376 c:\windows\assembly\GAC_MSIL\System.Data.Entity.Design\3.5.0.0__b77a5c561934e089\System.Data.Entity.Design.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 667648 c:\windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 163840 c:\windows\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\System.AddIn.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 110592 c:\windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 528384 c:\windows\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\ReachFramework.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 864256 c:\windows\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\PresentationUI.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 163840 c:\windows\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 397312 c:\windows\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 139264 c:\windows\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 196608 c:\windows\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 598016 c:\windows\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\PresentationBuildTasks.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 397312 c:\windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 802816 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v3.5.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 733184 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 106496 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v3.5.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 368640 c:\windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 163840 c:\windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
        + 2009-07-11 23:02 . 2009-07-11 23:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
        + 2009-07-11 23:02 . 2009-07-11 23:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
        + 2010-02-27 17:54 . 2008-07-06 12:06 1676288 c:\windows\system32\xpssvcs.dll
        + 2010-02-27 17:54 . 2008-07-06 12:06 1676288 c:\windows\system32\spool\XPSEP\i386\xpssvcs.dll
        + 2010-02-27 17:54 . 2008-07-06 12:06 1676288 c:\windows\system32\spool\XPSEP\i386\i386\xpssvcs.dll
        + 2010-02-27 17:54 . 2008-07-06 16:36 2936832 c:\windows\system32\spool\XPSEP\amd64\xpssvcs.dll
        + 2010-02-27 17:54 . 2008-07-06 16:36 2936832 c:\windows\system32\spool\XPSEP\amd64\amd64\xpssvcs.dll
        + 2010-02-27 17:54 . 2008-07-06 12:06 1676288 c:\windows\system32\spool\drivers\w32x86\3\XpsSvcs.dll
        + 2004-08-05 18:00 . 2009-11-27 17:13 1297920 c:\windows\system32\quartz.dll
        + 2010-02-27 17:54 . 2008-07-06 12:06 1676288 c:\windows\system32\dllcache\xpssvcs.dll
        + 2009-06-03 19:10 . 2009-11-27 17:13 1297920 c:\windows\system32\dllcache\quartz.dll
        + 2008-07-29 22:40 . 2008-07-29 22:40 1720824 c:\windows\Microsoft.NET\Framework\v3.5\vbc.exe
        + 2008-07-29 17:47 . 2008-07-29 17:47 1054208 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs_setup.dll
        + 2008-07-29 17:47 . 2008-07-29 17:47 1364992 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\SITSetup.dll
        + 2008-07-29 17:47 . 2008-07-29 17:47 1064448 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\gencomp.dll
        + 2008-07-29 22:40 . 2008-07-29 22:40 1548280 c:\windows\Microsoft.NET\Framework\v3.5\csc.exe
        + 2008-12-05 18:35 . 2008-12-05 18:35 1736528 c:\windows\Microsoft.NET\Framework\v3.0\WPF\wpfgfx_v0300.dll
        + 2008-07-29 20:10 . 2008-07-29 20:10 2637840 c:\windows\Microsoft.NET\Framework\v3.0\WPF\NlsLexicons0009.dll
        + 2008-07-29 20:10 . 2008-07-29 20:10 4883464 c:\windows\Microsoft.NET\Framework\v3.0\WPF\NlsData0009.dll
        + 2008-12-05 19:12 . 2008-12-05 19:12 5931008 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.dll
        + 2008-07-25 10:16 . 2008-07-25 10:16 1344000 c:\windows\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
        + 2008-07-25 10:17 . 2008-07-25 10:17 1172472 c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        + 2008-11-25 03:59 . 2008-11-25 03:59 2048000 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
        + 2008-07-25 10:17 . 2008-07-25 10:17 5025792 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
        + 2008-11-25 03:59 . 2008-11-25 03:59 5242880 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
        + 2008-07-25 10:17 . 2008-07-25 10:17 3149824 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
        + 2008-07-25 10:17 . 2008-07-25 10:17 5062656 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
        + 2008-07-25 10:17 . 2008-07-25 10:17 2933248 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
        + 2008-11-25 03:59 . 2008-11-25 03:59 5813576 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
        + 2008-11-25 03:59 . 2008-11-25 03:59 4546560 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
        + 2008-07-25 10:16 . 2008-07-25 10:16 1163768 c:\windows\Microsoft.NET\Framework\v2.0.50727\cscomp.dll
        + 2008-12-13 08:57 . 2008-12-13 08:57 8397824 c:\windows\Installer\6c89da.msp
        + 2008-07-29 18:26 . 2008-07-29 18:26 1043456 c:\windows\Installer\6b7956.msp
        + 2008-07-29 19:37 . 2008-07-29 19:37 2679808 c:\windows\Installer\6b7954.msp
        + 2008-07-29 20:15 . 2008-07-29 20:15 3697664 c:\windows\Installer\6b7952.msp
        + 2008-07-29 18:34 . 2008-07-29 18:34 1448448 c:\windows\Installer\6b7951.msp
        + 2008-07-29 19:22 . 2008-07-29 19:22 4137984 c:\windows\Installer\6b7950.msp
        + 2008-07-29 18:18 . 2008-07-29 18:18 3376640 c:\windows\Installer\6b794f.msp
        + 2008-07-29 16:45 . 2008-07-29 16:45 2543616 c:\windows\Installer\67eaac.msp
        + 2008-07-29 16:29 . 2008-07-29 16:29 2926080 c:\windows\Installer\67eaab.msp
        + 2008-07-29 16:41 . 2008-07-29 16:41 6487040 c:\windows\Installer\67eaaa.msp
        + 2008-07-29 16:39 . 2008-07-29 16:39 3403264 c:\windows\Installer\67eaa9.msp
        + 2008-07-29 16:43 . 2008-07-29 16:43 1013248 c:\windows\Installer\67eaa7.msp
        + 2008-07-29 16:31 . 2008-07-29 16:31 6083072 c:\windows\Installer\67eaa4.msp
        + 2010-02-28 10:47 . 2010-02-28 10:47 3313664 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\14cd5f4b61d35f9b76327d6be9853755\WindowsBase.ni.dll
        + 2010-02-28 10:52 . 2010-02-28 10:52 1049600 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\f3c7957351aec85f526a3350c9718b1e\UIAutomationClientsideProviders.ni.dll
        + 2010-02-27 18:00 . 2010-02-27 18:00 7599104 c:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP319.tmp\System.dll
        + 2010-02-28 10:46 . 2010-02-28 10:46 7868416 c:\windows\assembly\NativeImages_v2.0.50727_32\System\80978a322d7dd39f0a71be1251ae395a\System.ni.dll
        + 2010-02-28 10:52 . 2010-02-28 10:52 5450752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\773a9786013451d3baaeff003dc4230f\System.Xml.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 1356288 c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\ac1750e78d79520dcf19195772eff1b6\System.WorkflowServices.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 1908224 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\d265da36954fcb4cb7ad5adc693ea0f2\System.Workflow.Runtime.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 4514304 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\693a8fbe6f7ad6e4e429052da4317e59\System.Workflow.ComponentModel.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 2992640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\cc99fbbac0b6e4e9ca62093e49b0c16b\System.Workflow.Activities.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 1840640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\b57bb002a655920cbfa2bee29d1e22b7\System.Web.Services.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 2209280 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\81197e32ec931f439b3114e9031b65d6\System.Web.Mobile.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 2403328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\7f64c9d25471b72e1e957bdfe67947c8\System.Web.Extensions.ni.dll
        + 2010-02-28 10:51 . 2010-02-28 10:51 1917440 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\63cf639b6e0a3c25c1643c85016e7422\System.Speech.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 1706496 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\340cad17fe57947eacbc8fa2cea780da\System.ServiceModel.Web.ni.dll
        + 2010-02-28 11:45 . 2010-02-28 11:45 2338304 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\034c91b133dee73d452652c52767b5ea\System.Runtime.Serialization.ni.dll
        + 2010-02-28 10:51 . 2010-02-28 10:51 1035264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\646ab52eef343380aa002c220dc31e13\System.Printing.ni.dll
        + 2010-02-28 11:45 . 2010-02-28 11:45 1056768 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\c2de8479e54852f56996f79bc93acb13\System.IdentityModel.ni.dll
        + 2010-02-28 10:51 . 2010-02-28 10:51 1587200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3da96ee075bab9202626ae44c18d226c\System.Drawing.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 1116672 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\543aced762f6b0c3f8e037955941afc6\System.DirectoryServices.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 1801216 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\a6b58624486714fa71e5e35186850ff0\System.Deployment.ni.dll
        + 2010-02-28 10:50 . 2010-02-28 10:50 6616576 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\c70731047b0022638b3f9fb158948a03\System.Data.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 2510336 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\826b09ab0d0e36f4d631b4cd335df511\System.Data.SqlXml.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 1328128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\956a513dcbd44d5a6801840ef2b0b47b\System.Data.Services.ni.dll
        + 2010-02-28 10:51 . 2010-02-28 10:51 2516480 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\0bbec79460b1137df5313f9baf7b246f\System.Data.Linq.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 9924096 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\6479f975b105808a8d9e7a7fdc762551\System.Data.Entity.ni.dll
        + 2010-02-28 10:50 . 2010-02-28 10:50 2295296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\47d87251e93256c635eb73403b8db33e\System.Core.ni.dll
        + 2010-02-28 10:50 . 2010-02-28 10:50 2128896 c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\4bfb3048bf200a6a8592d1b4ba861a7f\ReachFramework.ni.dll
        + 2010-02-28 10:50 . 2010-02-28 10:50 1657856 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6bafb1a2a73794ddb9761cb321c9e7e2\PresentationUI.ni.dll
        + 2010-02-28 10:47 . 2010-02-28 10:47 1451008 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\e634bc4c4a00635a0a254febab0e2e2c\PresentationBuildTasks.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\1c86afc399d0fdd8e069266ffbe748d1\Microsoft.VisualBasic.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 1093120 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\6b2f62f5e981913fce1d223f645d9ddf\Microsoft.Transactions.Bridge.ni.dll
        + 2010-02-28 11:47 . 2010-02-28 11:47 2332160 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\b261961046545831aa60963e84905968\Microsoft.JScript.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 1620992 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\bd241492d96db39f20e758c13c845033\Microsoft.Build.Tasks.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 1966080 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\a47100d8f4574bed2d49d83d0ab8964e\Microsoft.Build.Tasks.v3.5.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 1888768 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\6cfe582681724965fb817e8ece5f0909\Microsoft.Build.Engine.ni.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 1245184 c:\windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 3149824 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 1630208 c:\windows\assembly\GAC_MSIL\System.Workflow.ComponentModel\3.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 1138688 c:\windows\assembly\GAC_MSIL\System.Workflow.Activities\3.0.0.0__31bf3856ad364e35\System.Workflow.Activities.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
        + 2010-02-27 18:00 . 2010-02-27 18:00 1277952 c:\windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
        + 2010-02-27 17:59 . 2010-02-27 17:59 5931008 c:\windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
        + 2010-02-27 17:55 . 2010-02-27 17:55 2879488 c:\windows\assembly\GAC_MSIL\System.Data.Entity\3.5.0.0__b77a5c561934e089\System.Data.Entity.dll
        + 2010-02-27 17:59 . 2010-02-27 17:59 5283840 c:\windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
        + 2010-02-27 17:54 . 2010-02-27 17:54 4210688 c:\windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
        + 2010-02-27 17:58 . 2010-02-27 17:58 4546560 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
        + 2010-01-12 07:44 . 2010-02-01 19:26 30364104 c:\windows\system32\MRT.exe
        + 2008-12-13 09:21 . 2008-12-13 09:21 10473472 c:\windows\Installer\6c89e5.msp
        + 2009-08-14 19:32 . 2009-08-14 19:32 11110912 c:\windows\Installer\1f36e.msp
        + 2010-02-28 10:52 . 2010-02-28 10:52 12430848 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\63406259e94d5c0ff5b79401dfe113ce\System.Windows.Forms.ni.dll
        + 2010-02-28 11:48 . 2010-02-28 11:48 11796992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\3963ce03d445a8619abbf388d590134b\System.Web.ni.dll
        + 2010-02-28 11:46 . 2010-02-28 11:46 17317888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\4146033013edebd7e0cb604e504ebfee\System.ServiceModel.ni.dll
        + 2010-02-28 10:51 . 2010-02-28 10:51 10683392 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\8ee220bc3cce4f7bbd7818946519ed7f\System.Design.ni.dll
        + 2010-02-28 10:49 . 2010-02-28 10:49 14327808 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\96e710f47c601cba3f2348a8d11ddede\PresentationFramework.ni.dll
        + 2010-02-28 10:48 . 2010-02-28 10:48 12216320 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\956375d487cbef36165b3250030e3574\PresentationCore.ni.dll
        + 2010-02-27 17:59 . 2010-02-27 17:59 11486720 c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\6d667f19d687361886990f3ca0f49816\mscorlib.ni.dll
        .
        2. Justlikeme84
          Suite Combofix :

          .
          -- Instantané actualisé --
          .
          ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
          REGEDIT4

          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
          "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-10 149280]
          "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
          "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-08 344064]
          "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
          "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
          "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344]
          "PS2"="c:\windows\system32\ps2.exe" [2004-10-25 90112]
          "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2005-05-11 253952]
          "HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-02-17 49152]
          "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 61440]

          [HKLM\~\startupfolder\C:^Documents and Settings^Compaq_Propriétaire^Menu Démarrer^Programmes^Démarrage^ViiKiiDesktopPlugin.lnk]
          path=c:\documents and settings\Compaq_Propriétaire\Menu Démarrer\Programmes\Démarrage\ViiKiiDesktopPlugin.lnk
          backup=c:\windows\pss\ViiKiiDesktopPlugin.lnkStartup

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
          2006-03-28 14:48 622592 ------r- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
          2005-05-04 23:21 278528 ----a-w- c:\program files\iTunes\iTunesHelper.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PD0620 STISvc]
          2005-05-10 17:03 36864 ----a-r- c:\windows\system32\P0620Pin.dll

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt]
          2005-01-26 17:02 49152 ----a-w- c:\program files\Brother\Brmfl06a\BrStDvPt.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
          2009-03-05 15:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
          "%windir%\\system32\\sessmgr.exe"=
          "c:\\Program Files\\iTunes\\iTunes.exe"=
          "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
          "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
          "c:\\Program Files\\SightSpeed\\SightSpeed.exe"=
          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
          "c:\\Program Files\\uTorrent\\uTorrent.exe"=

          S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/01/2010 10:35 133104]
          .
          Contenu du dossier 'Tâches planifiées'

          2010-02-27 c:\windows\Tasks\Connexion facile à Internet.job
          - c:\program files\Easy Internet signup\HPSdpApp.exe [2005-05-24 15:46]

          2010-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
          - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-11 09:34]

          2010-02-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
          - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-11 09:34]
          .
          .
          ------- Examen supplémentaire -------
          .
          uStart Page = hxxp://gllod.com
          IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
          IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
          IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
          IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
          DPF: {50DC58D0-C870-4BE6-BC41-971ED2D5F022} - hxxp://www.super-messenger.fr/tab/HookWlmEx.exe
          FF - ProfilePath - c:\documents and settings\Compaq_Propriétaire\Application Data\Mozilla\Firefox\Profiles\uxcvx8vw.default\
          FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
          FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
          FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
          FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

          ---- PARAMETRES FIREFOX ----
          FF - user.js: yahoo.homepage.dontask - true.
          - - - - ORPHELINS SUPPRIMES - - - -

          MSConfigStartUp-66191225 - c:\docume~1\ALLUSE~1\APPLIC~1\66191225\66191225.exe

          **************************************************************************

          catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2010-03-01 19:05
          Windows 5.1.2600 Service Pack 3 NTFS

          Recherche de processus cachés ...

          Recherche d'éléments en démarrage automatique cachés ...

          Recherche de fichiers cachés ...

          Scan terminé avec succès
          Fichiers cachés: 0

          **************************************************************************
          .
          --------------------- DLLs chargées dans les processus actifs ---------------------

          - - - - - - - > 'winlogon.exe'(428)
          c:\windows\system32\Ati2evxx.dll
          c:\windows\system32\CLBCATQ.DLL
          .
          Heure de fin: 2010-03-01 19:06:45
          ComboFix-quarantined-files.txt 2010-03-01 18:06
          ComboFix2.txt 2010-01-31 12:10

          Avant-CF: 180 149 592 064 octets libres
          Après-CF: 180 202 205 184 octets libres

          - - End Of File - - 6F5D44A4F309589A5FC8839C00CAFF83
          2. lecube
            Salut,

            Telecharge https://www.avira.com sur un autre PC et grave le sur un CD. Tu bootes dessus et security tool prendra une claque ( j'ai nettoye le PC de mon oncle avec ...) Merci Linux et Antivir ;-P
            A+
            1. gen-hackman
              salut :

              Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection)

              ▶ Télécharge List_Kill'em et enregistre le sur ton bureau

              ▶ Branche clés usb , disques durs externes , mp3 , mp4 , etc..

              double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

              coche la case "creer une icone sur le bureau"

              une fois terminée , clic sur "terminer" et le programme se lancera seul

              choisis la langue puis choisis l'option 1 = Mode Recherche

              ▶ laisse travailler l'outil

              à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

              un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

              ▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

              1. Justlikeme84
                Vioilà le rapport List'em

                List'em by g3n-h@ckm@n 1.2.8.2

                User : Compaq_Propriétaire (Administrateurs)
                Update on 01/03/2010 by g3n-h@ckm@n ::::: 11.30
                Start at: 10:16:33 | 02/03/2010
                Contact : https://forums.commentcamarche.net/forum/virus-securite-7

                AMD Sempron(tm) Processor 3200+
                Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
                Internet Explorer 8.0.6001.18702
                Windows Firewall Status : Enabled

                C:\ -> Disque fixe local | 182,71 Go (167,77 Go free) [PRESARIO] | NTFS
                D:\ -> Disque fixe local | 3,58 Go (385,16 Mo free) [PRESARIO_RP] | FAT32
                E:\ -> Disque CD-ROM
                F:\ -> Disque amovible
                G:\ -> Disque amovible
                H:\ -> Disque amovible
                I:\ -> Disque amovible

                Boot: Safeboot

                ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\csrss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\Explorer.EXE
                C:\Program Files\Mozilla Firefox\firefox.exe
                C:\Program Files\List_Kill'em\List_Kill'em.scr
                C:\WINDOWS\system32\cmd.exe
                C:\WINDOWS\system32\wbem\wmiprvse.exe
                C:\Documents and Settings\Compaq_Propriétaire\Local Settings\temp\9.tmp\pv.exe

                ======================
                Keys "Run"
                ======================
                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                MSMSGS REG_SZ "C:\Program Files\Messenger\msmsgs.exe" /background
                ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
                hpsysdrv REG_SZ c:\windows\system\hpsysdrv.exe
                ATIPTA REG_SZ C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                KBD REG_SZ C:\HP\KBD\KBD.EXE
                Recguard REG_SZ C:\WINDOWS\SMINST\RECGUARD.EXE
                AlcxMonitor REG_SZ ALCXMNTR.EXE
                PS2 REG_SZ C:\WINDOWS\system32\ps2.exe
                LSBWatcher REG_SZ c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
                HP Software Update REG_EXPAND_SZ C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                ControlCenter3 REG_SZ C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun

                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

                =====================
                Other Keys
                =====================
                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
                dontdisplaylastusername REG_DWORD 0 (0x0)
                legalnoticecaption REG_SZ
                legalnoticetext REG_SZ
                shutdownwithoutlogon REG_DWORD 1 (0x1)
                undockwithoutlogon REG_DWORD 1 (0x1)
                DisableRegistryTools REG_DWORD 0 (0x0)

                ===============
                [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
                NoDriveTypeAutoRun REG_DWORD 323 (0x143)
                NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
                NoDrives REG_DWORD 0 (0x0)

                ===============
                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
                HonorAutoRunSetting REG_DWORD 1 (0x1)
                NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
                NoDriveTypeAutoRun REG_DWORD 323 (0x143)
                NoDrives REG_DWORD 0 (0x0)

                ===============
                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

                ===============
                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
                AutoRestartShell REG_DWORD 1 (0x1)
                DefaultDomainName REG_SZ HADOUCHI-SALON
                DefaultUserName REG_SZ Compaq_Propriétaire
                LegalNoticeCaption REG_SZ
                LegalNoticeText REG_SZ
                PowerdownAfterShutdown REG_SZ 0
                ReportBootOk REG_SZ 1
                Shell REG_SZ Explorer.exe
                ShutdownWithoutLogon REG_SZ 0
                System REG_SZ
                Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
                VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
                SfcQuota REG_DWORD -1 (0xffffffff)
                allocatecdroms REG_SZ 0
                allocatedasd REG_SZ 0
                allocatefloppies REG_SZ 0
                cachedlogonscount REG_SZ 10
                forceunlocklogon REG_DWORD 0 (0x0)
                passwordexpirywarning REG_DWORD 14 (0xe)
                scremoveoption REG_SZ 0
                AllowMultipleTSSessions REG_DWORD 1 (0x1)
                UIHost REG_EXPAND_SZ logonui.exe
                LogonType REG_DWORD 1 (0x1)
                Background REG_SZ 0 0 0
                DebugServerCommand REG_SZ no
                SFCDisable REG_DWORD 0 (0x0)
                WinStationsDisabled REG_SZ 0
                DefaultPassword REG_SZ
                HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
                ShowLogonOptions REG_DWORD 0 (0x0)
                AltDefaultUserName REG_SZ Compaq_Propriétaire
                AltDefaultDomainName REG_SZ HADOUCHI-SALON
                ChangePasswordUseKerberos REG_DWORD 1 (0x1)

                ===============
                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

                ===============
                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
                {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

                ===============
                [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
                %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
                C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
                C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
                C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
                C:\Program Files\SightSpeed\SightSpeed.exe REG_SZ C:\Program Files\SightSpeed\SightSpeed.exe:*:Enabled:SightSpeed
                %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
                C:\Program Files\uTorrent\uTorrent.exe REG_SZ C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent

                [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
                %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
                %ProgramFiles%\iTunes\iTunes.exe REG_SZ %ProgramFiles%\iTunes\iTunes.exe:*:enabled:iTunes
                C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
                C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
                %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000

                ===============
                ActivX controls
                ===============
                HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{50DC58D0-C870-4BE6-BC41-971ED2D5F022}
                HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D6F45B3-9043-443D-A792-115447494D24}
                HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
                HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
                HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}
                HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}
                HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
                HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
                HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}

                ===============
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8b15971b-5355-4c82-8c07-7e181ea07608}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{94de52c8-2d59-4f1b-883e-79663d2d9a8c}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
                HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}

                ==============
                BHO :
                ======
                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

                ===
                DNS
                ===

                Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Miniport d'ordonnancement de paquets
                DNS Server Search Order: 192.168.1.1
                HKLM\SYSTEM\CCS\Services\Tcpip\..\{493C5252-5061-4D01-99D4-3E25183F954D}: DhcpNameServer=192.168.1.1
                HKLM\SYSTEM\CCS\Services\Tcpip\..\{DE246E2C-8697-44FE-A5BB-FA04D12D4DEC}: DhcpNameServer=15.243.128.51 15.243.160.51
                HKLM\SYSTEM\CS1\Services\Tcpip\..\{493C5252-5061-4D01-99D4-3E25183F954D}: DhcpNameServer=192.168.1.1
                HKLM\SYSTEM\CS1\Services\Tcpip\..\{DE246E2C-8697-44FE-A5BB-FA04D12D4DEC}: DhcpNameServer=15.243.128.51 15.243.160.51
                HKLM\SYSTEM\CS2\Services\Tcpip\..\{493C5252-5061-4D01-99D4-3E25183F954D}: DhcpNameServer=192.168.1.1
                HKLM\SYSTEM\CS2\Services\Tcpip\..\{DE246E2C-8697-44FE-A5BB-FA04D12D4DEC}: DhcpNameServer=15.243.128.51 15.243.160.51
                HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
                HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
                HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

                ================
                Internet Explorer :
                ================
                [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

                [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                Start Page REG_SZ https://www.hugedomains.com/domain_profile.cfm?d=gllod&e=com

                ========
                Services
                ========
                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

                Ndisuio : 0x3 ( OK = 3 )
                EapHost : 0x3 ( OK = 2 )
                SharedAccess : 0x2 ( OK = 2 )
                wuauserv : 0x2 ( OK = 2 )

                =========
                Atapi.sys
                =========

                %%%% HASHDEEP-1.0
                %%%% size,md5,sha256,filename
                ## Invoked from: C:\Documents and Settings\Compaq_Propriétaire\Local Settings\temp\9.tmp
                ## C:\> hashdeep.exe C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
                ##
                95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
                %%%% HASHDEEP-1.0
                %%%% size,md5,sha256,filename
                ## Invoked from: C:\Documents and Settings\Compaq_Propriétaire\Local Settings\temp\9.tmp
                ## C:\> hashdeep.exe C:\WINDOWS\ERDNT\cache\atapi.sys
                ##
                96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ERDNT\cache\atapi.sys
                %%%% HASHDEEP-1.0
                %%%% size,md5,sha256,filename
                ## Invoked from: C:\Documents and Settings\Compaq_Propriétaire\Local Settings\temp\9.tmp
                ## C:\> hashdeep.exe C:\WINDOWS\ServicePackFiles\i386\atapi.sys
                ##
                96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ServicePackFiles\i386\atapi.sys
                %%%% HASHDEEP-1.0
                %%%% size,md5,sha256,filename
                ## Invoked from: C:\Documents and Settings\Compaq_Propriétaire\Local Settings\temp\9.tmp
                ## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
                ##
                96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\drivers\atapi.sys
                %%%% HASHDEEP-1.0
                %%%% size,md5,sha256,filename
                ## Invoked from: C:\Documents and Settings\Compaq_Propriétaire\Local Settings\temp\9.tmp
                ## C:\> hashdeep.exe C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys
                ##
                95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys

                Référence :
                ==========

                Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
                Win XP_32b : a64013e98426e1877cb653685c5c0009
                Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
                Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
                Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
                Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
                Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
                Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
                Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
                Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

                =======
                Drive :
                =======

                D‚fragmenteur de disque Windows
                Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

                Rapport d'analyse
                183 Go total, 168 Go libre (91%), 18% fragment‚ (fragmentation du fichier 37%)

                Vous devriez d‚fragmenter ce volume.

                ¤¤¤¤¤¤¤¤¤¤ Files/folders :

                Present !! : C:\WINDOWS\002617_.tmp
                Present !! : C:\WINDOWS\System32\drivers\Cdaudio.sys
                Present !! : C:\WINDOWS\System32\fjhdyfhsn.bat"
                Present !! : C:\Documents and Settings\Compaq_Propri‚taire\Application Data\wklnhst.dat
                Present !! : C:\Documents and Settings\Compaq_Propri‚taire\Application Data\wklnhst.dat

                ¤¤¤¤¤¤¤¤¤¤ Keys :

                Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
                Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
                Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
                Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
                Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
                Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
                Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"

                ============

                catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                Rootkit scan 2010-03-02 10:22:06
                Windows 5.1.2600 Service Pack 3 NTFS

                scanning hidden processes ...

                scanning hidden services & system hive ...

                scanning hidden registry entries ...

                scanning hidden files ...

                scan completed successfully
                hidden processes: 0
                hidden services: 0
                hidden files: 0

                Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

                device: opened successfully
                user: MBR read successfully
                called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
                kernel: MBR read successfully
                user & kernel MBR OK

                ==========
                Programs
                ==========

                Adobe
                Alwil Software
                ATI Technologies
                Audacity
                AviSynth 2.5
                Brother
                CCleaner
                ComPlus Applications
                Creative
                DivX
                DVDVideoSoft
                Easy Internet signup
                Fichiers communs
                Google
                Hewlett-Packard
                Hp
                InstallShield Installation Information
                Internet Explorer
                InterVideo
                iPod
                iTunes
                Java
                List_Kill'em
                Malwarebytes' Anti-Malware
                Messenger
                Messenger Plus! Live
                Microsoft
                Microsoft CAPICOM 2.1.0.2
                microsoft frontpage
                Microsoft Office
                Microsoft Works
                Movie Maker
                Mozilla Firefox
                MSBuild
                MSN
                MSN Gaming Zone
                MSXML 4.0
                NetMeeting
                Norton Security Scan
                NortonInstaller
                Online Services
                Outlook Express
                PC-Doctor 5 for Windows
                pspvideo9
                QuickTime
                Reference Assemblies
                Services en ligne
                SightSpeed
                Sonic
                Spybot - Search & Destroy
                Symantec
                Uninstall Information
                uTorrent
                VideoLAN
                ViiKiiDesktopPlugin
                Windows Live
                Windows Live SkyDrive
                Windows Media Player
                Windows NT
                WindowsUpdate
                WinRAR
                xerox

                ============
                Drive C:
                ============

                649471cf68250fbff62a08b1d2
                771043b7cfae05aca725bfe5c70c199f
                AUTOEXEC.BAT
                BOOT.BAK
                boot.ini
                Bootfont.bin
                CCM
                cmdcons
                cmldr
                ComboFix.txt
                CONFIG.SYS
                Documents and Settings
                feab351d1b38e822eb1b0e55b77af0
                hp
                IO.SYS
                Kill'em
                List'em.txt
                MSDOS.SYS
                NTDETECT.COM
                ntldr
                pagefile.sys
                Program Files
                Python22
                Qoobox
                rkill.log
                System Volume Information
                system.sav
                WINDOWS

                ¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

                ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

                End of scan : 10:29:19,04
                1. gen-hackman
                  ▶ Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
                  mais cette fois-ci :

                  ▶ choisis l'option 2 = Mode Suppression

                  laisse travailler l'outil.

                  en fin de scan un rapport s'ouvre

                  ▶ colle le contenu dans ta reponse
                  1. Justlikeme84
                    J'ai fait comme tu m'as dit, mais aucun rapport ne s'est ouvert à la fin. Je précise que je suis en mode sans echec avec prise de résau, donc je ne sais pas si cela influence les résultat ....
                    2. Justlikeme84
                      Voilà le 2ème rapport Kill'em :

                      Kill'em by g3n-h@ckm@n 1.2.8.2

                      User : Compaq_Propriétaire (Administrateurs)
                      Update on 01/03/2010 by g3n-h@ckm@n ::::: 11.30
                      Start at: 10:46:49 | 02/03/2010
                      Contact : https://forums.commentcamarche.net/forum/virus-securite-7

                      AMD Sempron(tm) Processor 3200+
                      Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
                      Internet Explorer 8.0.6001.18702
                      Windows Firewall Status : Enabled

                      C:\ -> Disque fixe local | 182,71 Go (167,76 Go free) [PRESARIO] | NTFS
                      D:\ -> Disque fixe local | 3,58 Go (385,16 Mo free) [PRESARIO_RP] | FAT32
                      E:\ -> Disque CD-ROM
                      F:\ -> Disque amovible
                      G:\ -> Disque amovible
                      H:\ -> Disque amovible
                      I:\ -> Disque amovible

                      ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\csrss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\Program Files\List_Kill'em\List_Kill'em.scr
                      C:\WINDOWS\system32\cmd.exe
                      C:\WINDOWS\system32\wbem\wmiprvse.exe
                      C:\Documents and Settings\Compaq_Propriétaire\Local Settings\temp\43.tmp\ERUNT.EXE
                      C:\Documents and Settings\Compaq_Propriétaire\Local Settings\temp\43.tmp\pv.exe

                      Detections :
                      ==========

                      ¤¤¤¤¤¤¤¤¤¤ Files/folders :

                      Quarantined & Deleted !! : C:\WINDOWS\002617_.tmp

                      Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\Cdaudio.sys
                      Quarantined & Deleted !! : C:\WINDOWS\System32\fjhdyfhsn.bat
                      Quarantined & Deleted !! : C:\Documents and Settings\Compaq_Propri‚taire\Application Data\wklnhst.dat

                      ==============
                      host file OK !
                      ==============

                      ========
                      Registry
                      ========

                      Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
                      Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
                      Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
                      Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
                      Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
                      Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
                      Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
                      1. gen-hackman
                        --
                        ♦G3и-н@¢км@и™©®♦Télécharge OTL de OLDTimer

                        ▶ enregistre le sur ton Bureau.

                        ▶ Double clic ( pour vista / 7 => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.

                        ▶ Coche les 2 cases Lop et Purity

                        ▶ Coche la case devant scan all users

                        ▶ règle-le sur "60 Days"

                        ▶ dans la colonne de gauche , mets tout sur "all"

                        ne modifie pas ceci :

                        "files created whithin" et "files modified whithin"

                        ▶Clic sur Run Scan.

                        A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

                        Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

                        ▶▶▶ NE LE POSTE PAS SUR LE FORUM

                        Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

                        ▶ Clique sur Parcourir et cherche le fichier ci-dessus.

                        ▶ Clique sur Ouvrir.

                        ▶ Clique sur "Cliquez ici pour déposer le fichier".

                        Un lien de cette forme :

                        http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

                        est ajouté dans la page.

                        ▶ Copie ce lien dans ta réponse.

                        ▶▶ Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau.
                        1. Justlikeme84
                          Voilà OLT.txt :

                          http://www.cijoint.fr/cjlink.php?file=cj201003/cijOFIjDCd.txt

                          Et Extras.txt :

                          http://www.cijoint.fr/cjlink.php?file=cj201003/cijjKrcWDb.txt
                          1. Justlikeme84
                            Je voudrait aussi précisé que ma page d'accueil sur IE est devenu Gllod.com au lien de Google.
                            1. gen-hackman
                              ▶ Télécharge Ad-remover ( de C_XX ) sur ton bureau :

                              ▶ Déconnecte toi et ferme toutes applications en cours !

                              ▶ Double clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut .

                              ▶ Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .

                              ▶ Au menu principal choisis l'option "L" et tape sur [entrée] .

                              ▶ Laisse travailler l'outil et ne touche à rien ...

                              ▶ Poste le rapport qui apparait à la fin , sur le forum ...

                              ( Le rapport est sauvegardé aussi sous C:\Ad-report.log )
                              ( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

                              ▶ Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
                              Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
                              Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
                              1. Justlikeme84
                                Là je doit aller travailler, je posterai le rapport cette après midi vers 17h30, j'espère que tu sera toujours là pour m'aider.

                                En tout cas merci, en espérant qu'ont ne fait pas tous ça pour rien :)
                                2. Justlikeme84
                                  Rebonjour,

                                  Voilà le repport Ad-Remover :

                                  .
                                  ======= RAPPORT D'AD-REMOVER 1.1.4.6_J | UNIQUEMENT XP/VISTA/7 =======
                                  .
                                  Mis à jour par C_XX le 05.02.2010 à 17:34
                                  Contact: AdRemover.contact@gmail.com
                                  Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
                                  .
                                  Lancé à: 16:47:33, 02/03/2010 | Mode Normal | Option: CLEAN
                                  Exécuté de: C:\Ad-Remover\
                                  Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
                                  Nom du PC: HADOUCHI-SALON | Utilisateur actuel: Compaq_Propri‚taire
                                  .
                                  ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
                                  .

                                  (!) -- Fichiers temporaires supprimés.

                                  .
                                  .
                                  ============== Scan additionnel ==============
                                  .
                                  .
                                  * Mozilla FireFox Version 3.5.8 [fr] *
                                  .
                                  Nom du profil: uxcvx8vw.default (Compaq_Propri‚taire)
                                  .
                                  (COMPAQ~1, prefs.js) Browser.download.lastDir, C:\Documents and Settings\Compaq_Propriétaire\Bureau
                                  (COMPAQ~1, prefs.js) Browser.startup.homepage, hxxp://www.google.fr/
                                  (COMPAQ~1, prefs.js) Extensions.enabledItems, jqs@sun.com:1.0,{20a82645-c095-46ed-80e3-08825760534b}:1.1,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.8
                                  .
                                  .
                                  .
                                  * Internet Explorer Version 8.0.6001.18702 *
                                  .
                                  [HKEY_CURRENT_USER\..\Internet Explorer\Main]
                                  .
                                  Do404Search: 01000000
                                  Local Page: C:\WINDOWS\system32\blank.htm
                                  Show_ToolBar: yes
                                  Start Page: hxxp://fr.msn.com/
                                  Enable Browser Extensions: yes
                                  Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                  Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                  Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                                  .
                                  [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
                                  .
                                  Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                  Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                  Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                  Delete_Temp_Files_On_Exit: yes
                                  Local Page: C:\WINDOWS\system32\blank.htm
                                  Start Page: hxxp://fr.msn.com/
                                  Search bar: hxxp://search.msn.com/spbasic.htm
                                  .
                                  [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
                                  .
                                  Tabs: res://ieframe.dll/tabswelcome.htm
                                  .
                                  ===================================
                                  .
                                  2126 Octet(s) - C:\Ad-Report-CLEAN[1].log
                                  .
                                  30 Fichier(s) - C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
                                  2 Fichier(s) - C:\WINDOWS\Temp
                                  3 Fichier(s) - C:\WINDOWS\Prefetch
                                  .
                                  19 Fichier(s) - C:\Ad-Remover\BACKUP
                                  0 Fichier(s) - C:\Ad-Remover\QUARANTINE
                                  .
                                  Fin à: 16:49:32 | 02/03/2010 - CLEAN[1]
                                  .
                                  ============== E.O.F ==============
                                  .
                                  • 1
                                  • 2

                                  Discussions similaires

                                  Security boot fail lors du démarrage
                                  Steu

                                  5 réponses
                                  SecurityHealth est a désactiver ou pas au démarrage de W10 Pro 64 ?
                                  Walti55

                                  2 réponses
                                  Comment retirer le SECURE BOOT ?
                                  Elparigo60

                                  10 réponses
                                  Security Boot Fail Windows 10 Acer
                                  benjamin5800

                                  22 réponses