pb de virus

Question

bonjour jai ete contaminé par un virus et je narrive pa a lenleverg norton antivirus mais il a ete desactiver et je narrive pas a le reinstallervoici le log de hijackthisLogfile of HijackThis v1.99.1Scan saved at 17:19:25, on 10/12/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Documents and Settings\magali\Mes documents\Ma musique\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exeO4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1
avapw32.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exeO4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\system32\yaemu.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXEO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dllO9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dllO9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exeO9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exeO17 - HKLM\System\CCS\Services\Tcpip\..\{18779D05-C696-4CDA-9A81-999933615D91}: NameServer = 85.255.114.93,85.255.112.61O17 - HKLM\System\CS1\Services\Tcpip\..\{18779D05-C696-4CDA-9A81-999933615D91}: NameServer = 85.255.114.93,85.255.112.61O17 - HKLM\System\CS2\Services\Tcpip\..\{18779D05-C696-4CDA-9A81-999933615D91}: NameServer = 85.255.114.93,85.255.112.61O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXEO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exejespere ke vous pourrez maider

Utilisateur anonyme · Answer

salutTelecharge cecihttp://www.silentrunners.org/Silent%20Runners.vbs Execute le,atends quelques minutes, il va creer ensuite un dossier juste a coté de silent runner sous format texte, copie/colle ce qu il te donneraA+

fleudelys · Answer

merci de maider voila"Silent Runners.vbs", revision 41, http://www.silentrunners.org/Operating System: Windows XP SP2Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]"desktop" = "C:\WINDOWS\system32\idemlog.exe" [empty string]"UnSpyPC" = ""C:\Program Files\UnSpyPC\UnSpyPC.exe"" [file not found]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++}"wininet.dll" = "mscornet.exe" [null data]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"Smapp" = "C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" ["Analog Devices, Inc."]"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]"WooCnxMon" = "C:\PROGRA~1\Wanadoo\CnxMon.exe" [empty string]"WOOWATCH" = "C:\PROGRA~1\Wanadoo\Watch.exe" ["France Télécom R&D"]"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]"Omnipage" = "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" ["ScanSoft, Inc"]"TkBellExe" = ""C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot" ["RealNetworks, Inc."]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"WOOTASKBARICON" = "C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" [null data]"NAV Agent" = "C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe" ["Symantec Corporation"]"WFXSwtch" = "C:\PROGRA~1\NORTON~1\DelFax\WFXSWTCH.exe" [null data]"WinFaxAppPortStarter" = "wfxsnt40.exe" [MS]"yaemu.exe" = "C:\WINDOWS\system32\yaemu.exe" [null data]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]"{57C51AF9-DEF7-11D3-A801-00C04F163490}" = "Ghost Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Ghost\GhoShExt.dll" ["Symantec Corporation"]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\INFECTION WARNING! "AppInit_DLLs" = "MsgPlusLoader.dll" ["Patchou"]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\INFECTION WARNING! "System" = "cszhz.exe" [null data]HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]HKLM\Software\Classes\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]Active Desktop and Wallpaper:-----------------------------Active Desktop is disabled at this entry:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellStateHKCU\Control Panel\Desktop\"Wallpaper" = "C:\Documents and Settings\Lobel\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"Startup items in "Lobel" & "All Users" startup folders:-------------------------------------------------------C:\Documents and Settings\Lobel\Menu Démarrer\Programmes\Démarrage"Démarrage d'Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA.EXE -b" [MS]C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string]Enabled Scheduled Tasks:------------------------"Norton AntiVirus - Analyser mon ordinateur" -> launches: "C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.exe /task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca" ["Symantec Corporation"]"Norton SystemWorks One Button Checkup" -> launches: "C:\Program Files\Fichiers communs\Symantec Shared\NMain.exe  /dat:C:\Program Files\Norton SystemWorks\swplugin.nsi /NSWCMD:OBCSchedule" ["Symantec Corporation"]"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------ToolbarsHKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Internet Explorer\Toolbar\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]Extensions (Tools menu items, main toolbar menu buttons)HKCU\Software\Microsoft\Internet Explorer\Extensions\{1462651F-F4BA-4C76-A001-C4284D0FE16E}\"ButtonText" = "Wanadoo""Exec" = "http://www.wanadoo.fr" [file not found]HKLM\Software\Microsoft\Internet Explorer\Extensions\{36ECAF82-3300-8F84-092E-AFF36D6C7040}\"ButtonText" = "Run WinHTTrack""MenuText" = "Launch WinHTTrack""CLSIDExtension" = "{86529161-034E-4F8A-88D2-3C625E612E04}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll" [null data]{FB5F1910-F110-11D2-BB9E-00C04F795683}\"ButtonText" = "Messager Wanadoo""MenuText" = "Messager Wanadoo""Exec" = "C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe" ["France Telecom"]Miscellaneous IE Hijack Points------------------------------C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")Added lines (compared with English-language version):[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"Missing lines (compared with English-language version):[Strings]: 1 lineHKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\"{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = "Search Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Wanadoo\SEARCH~1.DLL" [empty string]Running Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]Norton Unerase Protection, NProtectService, "C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE" ["Symantec Corporation"]Service Norton AntiVirus Auto-Protect, navapsvc, "C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe" ["Symantec Corporation"]SoundMAX Agent Service, SoundMAX Agent Service (default), "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe" ["Analog Devices, Inc."]Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]Print Monitors:---------------HKLM\System\CurrentControlSet\Control\Print\Monitors\DelFax Ports\Driver = "WFXMNT40.DLL" [MS]hpzlnt05\Driver = "hpzlnt05.dll" ["HP"]Ports DelrinaFax (qualité photo)\Driver = "WFXMNTHQ.DLL" [MS]----------+ This report excludes default entries except where indicated.+ To see *everywhere* the script checks and *everything* it finds,  launch it from a command prompt or a shortcut with the -all parameter.+ To search all directories of local fixed drives for DESKTOP.INI  DLL launch points and all Registry CLSIDs for dormant Explorer Bars,  use the -supp parameter or answer "No" at the first message box.---------- (total run time: 17 seconds, including 4 seconds for message boxes)

Utilisateur anonyme · Answer

Re moi,Ton antivirus te detecte un certain hclean?*Telecharge cecihttp://cjoint.com/?mksAlUS0sYLance Hcsrch.batIl va generer un rapportcopie/colle le sur le foruma+

fleurdelys · Answer

jarrive pas a faire aller mon antivirus, j'ai essaye de le reinstaller ms il se desactive automatiquement.voila le rapportRapport fait à 18:30:22,39 le 10/12/2005Executé à partir de C:\Documents and Settings\mag\BureauOS: Microsoft Windows XP [version 5.1.2600]*********************************************Vérification HKLM\...\...\...\...\ruins*********************************************Fichiers détectés :*********************************************Recherche des processus aleatoiresd'après les modèles : cs***.exe, dm***.exe, ya***.exeC:\WINDOWS\System32*********************************************Recherche presence  hclean32.exe... non trouvé...encor merci...

Utilisateur anonyme · Answer

re,Télécharge: Pocket Killbox ici http://www.downloads.subratam.org/KillBox.exe :: Démo d utilisation (merci a Balltrap34 pour cette réalisation) ::http://pageperso.aol.fr/balltrap34/killbox.htm - - -----------------------------------------------------------------¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked : O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\system32\yaemu.exeO17 - HKLM\System\CCS\Services\Tcpip\..\{18779D05-C696-4CDA-9A81-999933615D91}: NameServer = 85.255.114.93,85.255.112.61 O17 - HKLM\System\CS1\Services\Tcpip\..\{18779D05-C696-4CDA-9A81-999933615D91}: NameServer = 85.255.114.93,85.255.112.61 O17 - HKLM\System\CS2\Services\Tcpip\..\{18779D05-C696-4CDA-9A81-999933615D91}: NameServer = 85.255.114.93,85.255.112.61 -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ Déconnecte toi d'internet c'est important puis vérifie ceci: demarrer > connection > clic droit sur ta connection > propriétés gestion de reseau assure toi que protocole internet tcp/ip est en surbrillance (attention, ne décoche pas la case)> clic sur propriétés > selectionne "obtenir les adresses des serveurs automatiquement" valide avec ok -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_1- Double-clic sur KillBox.exe (Pocket Killbox) - coche: delete on reboot - Dans "Full Path of File to Delete" copie et colle: C:\WINDOWS\system32\yaemu.exe- clique sur la croix rouge - une fenêtre va apparaître pour confirmation clique sur YES - une seconde fenêtre te demande si tu veux redémarrer clique sur YES -Si le pc ne redemarre pas tout seul, redemarre le par toi memeReposte un hijack this + silent runnera+

fleurdelys · Answer

re g executer ad-aware et spybot en mode sans echecensuite g executer hijack et la la ligne "04-HKLM....yaemu.exe" avai disparug fixer les autres comme tu ma disapres g chercher le fichier "yaemu.exe" ms il a ete effacer de pc.g quand mm executer killbox et o redemarrage g encor eu l'apparition d une pub (due o virus)g executer msconfig et dans demarrage g decocher le lancement de "yaemu.exe" et un autre truc "UNSpyPC" g encor redemarrer et g tjrs le pbjespere ke c un peu pres clair lolvoila le log Logfile of HijackThis v1.99.1Scan saved at 20:42:21, on 10/12/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exeC:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXEC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\wdfmgr.exeC:\WINDOWS\System32\alg.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\wbem\wmiprvse.exeC:\Program Files\Analog Devices\SoundMAX\SMTray.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\PROGRA~1\Wanadoo\CnxMon.exeC:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exeC:\Program Files\ScanSoft\OmniPageSE\opware32.exeC:\Program Files\Fichiers communs\Real\Update_OB\realsched.exeC:\Program Files\QuickTime\qttask.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exeC:\PROGRA~1\NORTON~1\DelFax\WFXSWTCH.exeC:\WINDOWS\system32\wfxsnt40.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeC:\Program Files\Microsoft Office\Office\OSA.EXEC:\WINDOWS\system32\wuauclt.exeC:\Documents and Settings\magali\Mes documents\Ma musique\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exeO4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exeO4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osbootO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exeO4 - HKLM\..\Run: [WFXSwtch] C:\PROGRA~1\NORTON~1\DelFax\WFXSWTCH.exeO4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exeO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXEO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exeO9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exeO9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXEO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"Silent Runners.vbs", revision 41, http://www.silentrunners.org/Operating System: Windows XP SP2Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]"desktop" = "C:\WINDOWS\system32\idemlog.exe" [empty string]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++}"wininet.dll" = "mscornet.exe" [null data]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"Smapp" = "C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" ["Analog Devices, Inc."]"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]"WooCnxMon" = "C:\PROGRA~1\Wanadoo\CnxMon.exe" [empty string]"WOOWATCH" = "C:\PROGRA~1\Wanadoo\Watch.exe" ["France Télécom R&D"]"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]"Omnipage" = "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" ["ScanSoft, Inc"]"TkBellExe" = ""C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot" ["RealNetworks, Inc."]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"WOOTASKBARICON" = "C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" [null data]"NAV Agent" = "C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe" ["Symantec Corporation"]"WFXSwtch" = "C:\PROGRA~1\NORTON~1\DelFax\WFXSWTCH.exe" [null data]"WinFaxAppPortStarter" = "wfxsnt40.exe" [MS]"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]"{57C51AF9-DEF7-11D3-A801-00C04F163490}" = "Ghost Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Ghost\GhoShExt.dll" ["Symantec Corporation"]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\INFECTION WARNING! "AppInit_DLLs" = "MsgPlusLoader.dll" ["Patchou"]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\INFECTION WARNING! "System" = "cszgb.exe" [null data]HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]HKLM\Software\Classes\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]Active Desktop and Wallpaper:-----------------------------Active Desktop is disabled at this entry:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellStateHKCU\Control Panel\Desktop\"Wallpaper" = "C:\Documents and Settings\Lobel\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"Startup items in "Lobel" & "All Users" startup folders:-------------------------------------------------------C:\Documents and Settings\Lobel\Menu Démarrer\Programmes\Démarrage"Démarrage d'Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA.EXE -b" [MS]C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string]Enabled Scheduled Tasks:------------------------"Norton AntiVirus - Analyser mon ordinateur" -> launches: "C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.exe /task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca" ["Symantec Corporation"]"Norton SystemWorks One Button Checkup" -> launches: "C:\Program Files\Fichiers communs\Symantec Shared\NMain.exe  /dat:C:\Program Files\Norton SystemWorks\swplugin.nsi /NSWCMD:OBCSchedule" ["Symantec Corporation"]"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------ToolbarsHKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Internet Explorer\Toolbar\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]Extensions (Tools menu items, main toolbar menu buttons)HKCU\Software\Microsoft\Internet Explorer\Extensions\{1462651F-F4BA-4C76-A001-C4284D0FE16E}\"ButtonText" = "Wanadoo""Exec" = "http://www.wanadoo.fr" [file not found]HKLM\Software\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11D2-BB9E-00C04F795683}\"ButtonText" = "Messager Wanadoo""MenuText" = "Messager Wanadoo""Exec" = "C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe" ["France Telecom"]Miscellaneous IE Hijack Points------------------------------C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")Added lines (compared with English-language version):[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"Missing lines (compared with English-language version):[Strings]: 1 lineHKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\"{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = "Search Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Wanadoo\SEARCH~1.DLL" [empty string]Running Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]Norton Unerase Protection, NProtectService, "C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE" ["Symantec Corporation"]Service Norton AntiVirus Auto-Protect, navapsvc, "C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe" ["Symantec Corporation"]SoundMAX Agent Service, SoundMAX Agent Service (default), "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe" ["Analog Devices, Inc."]Speed Disk service, Speed Disk service, "C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe" ["Symantec Corporation"]Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]Print Monitors:---------------HKLM\System\CurrentControlSet\Control\Print\Monitors\DelFax Ports\Driver = "WFXMNT40.DLL" [MS]hpzlnt05\Driver = "hpzlnt05.dll" ["HP"]Ports DelrinaFax (qualité photo)\Driver = "WFXMNTHQ.DLL" [MS]

incognito02 · Answer

Bonsoir Fleurdelys, Bonsoir Msiter Régis59 ;-))Pour avancer le travail de Mister Régis59, que je salue au passage !,Affiche tous les fichiers et dossiers :Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichageCoche « afficher les fichiers et dossiers cachés »Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"Décoche « masquer les extensions dont le type est connu »Puis fais «Ok» pour valider les changements.Et appliquer !----------------------------------------------------------------------------Rend toi sur ce site :http://www.virustotal.com/xhtml/virustotal_en.htmlClik sur parcourirRecherche ceci :C:\WINDOWS\system32\wdfmgr.exeClik send et colle le rapport stpBon courage.A+

fleurdelys · Answer

bonsoir merci de maiderAntivirus Version Update Result AntiVir 6.33.0.61 12.09.2005 no virus found Avast 4.6.695.0 12.10.2005 no virus found AVG 718 12.08.2005 no virus found Avira 6.33.0.61 12.09.2005 no virus found BitDefender 7.2 12.10.2005 no virus found CAT-QuickHeal 8.00 12.09.2005 no virus found ClamAV devel-20051108 12.09.2005 no virus found DrWeb 4.33 12.10.2005 no virus found eTrust-Iris 7.1.194.0 12.09.2005 no virus found eTrust-Vet 11.9.1.0 12.09.2005 no virus found Fortinet 2.54.0.0 12.10.2005 no virus found F-Prot 3.16c 12.09.2005 no virus found Ikarus 0.2.59.0 12.10.2005 no virus found Kaspersky 4.0.2.24 12.10.2005 no virus found McAfee 4647 12.09.2005 no virus found NOD32v2 1.1317 12.09.2005 no virus found Norman 5.70.10 12.09.2005 no virus found Panda 8.02.00 12.10.2005 no virus found Sophos 4.00.0 12.10.2005 no virus found Symantec 8.0 12.10.2005 no virus found TheHacker 5.9.1.052 12.09.2005 no virus found VBA32 3.10.5 12.10.2005 no virus found voila apparemment c pas un virus

incognito02 · Answer

On continu ! ;-)idem avec ce fichier :C:\WINDOWS\system32\wbem\wmiprvse.exeNorton ne fonctionne toujours pas ?A+

fleurdelys · Answer

tjrs rien :-(Antivirus Version Update Result AntiVir 6.33.0.61 12.09.2005 no virus found Avast 4.6.695.0 12.10.2005 no virus found AVG 718 12.08.2005 no virus found Avira 6.33.0.61 12.09.2005 no virus found BitDefender 7.2 12.10.2005 no virus found CAT-QuickHeal 8.00 12.09.2005 no virus found ClamAV devel-20051108 12.09.2005 no virus found DrWeb 4.33 12.10.2005 no virus found eTrust-Iris 7.1.194.0 12.09.2005 no virus found eTrust-Vet 11.9.1.0 12.09.2005 no virus found Fortinet 2.54.0.0 12.10.2005 no virus found F-Prot 3.16c 12.09.2005 no virus found Ikarus 0.2.59.0 12.10.2005 no virus found Kaspersky 4.0.2.24 12.10.2005 no virus found McAfee 4647 12.09.2005 no virus found NOD32v2 1.1317 12.09.2005 no virus found Norman 5.70.10 12.09.2005 no virus found Panda 8.02.00 12.10.2005 no virus found Sophos 4.00.0 12.10.2005 no virus found Symantec 8.0 12.10.2005 no virus found TheHacker 5.9.1.052 12.09.2005 no virus found VBA32 3.10.5 12.10.2005 no virus found non norton ne marche pas j'ai fini par le desinstaler

incognito02 · Answer

Bien,Scanne en ligne avec bitdefender http://www.bitdefender.fr/bd/site/page.phpmerci de poster le rapport ici.A+

Utilisateur anonyme · Answer

salutmerci d avoir pris le relaiun fichier me semble suspect:Télécharge ceci: (merci a S!RI pour ce petit programme).http://siri.urz.free.fr/Fix/SmitfraudFix.zipExécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapportCopie/colle le sur le poste stp.a+

fleurdelys · Answer

voila le rapport de bitdefenderC:\RECYCLER\NPROTECT\00090619.exe Infecté par: Trojan.DNSChanger.R C:\RECYCLER\NPROTECT\00090619.exe Echec de la désinfection C:\RECYCLER\NPROTECT\00090619.exe Supprimé C:\RECYCLER\NPROTECT\00090644.exe Infecté par: Trojan.DNSChanger.R C:\RECYCLER\NPROTECT\00090644.exe Echec de la désinfection C:\RECYCLER\NPROTECT\00090644.exe Supprimé C:\RECYCLER\NPROTECT\00090645.exe Infecté par: Trojan.DNSChanger.R C:\RECYCLER\NPROTECT\00090645.exe Echec de la désinfection C:\RECYCLER\NPROTECT\00090645.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP33\A0011413.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP33\A0011413.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP33\A0011413.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP33\A0011423.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP33\A0011423.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP33\A0011423.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP33\A0011428.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP33\A0011428.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP33\A0011428.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP33\A0011442.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP33\A0011442.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP33\A0011442.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP35\A0011630.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP35\A0011630.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP35\A0011630.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP35\A0011636.exe Infecté par: Trojan.DNSChanger.R C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP35\A0011636.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP35\A0011636.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011731.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011731.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011731.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011750.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011750.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011750.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011758.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011758.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011758.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011767.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011767.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011767.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011799.exe Infecté par: Trojan.DNSChanger.R C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011799.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011799.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011801.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011801.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011801.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011809.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011809.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011809.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011823.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011823.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP38\A0011823.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP40\A0011982.exe Infecté par: Trojan.DNSChanger.R C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP40\A0011982.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP40\A0011982.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP40\A0011983.sys Suspecté de: Trojan.Downloader.Msys.A C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP40\A0011983.sys Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP40\A0011983.sys Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP40\A0011984.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP40\A0011984.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP40\A0011984.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012009.exe Infecté par: Trojan.DNSChanger.R C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012009.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012009.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012011.exe Infecté par: Trojan.DNSChanger.R C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012011.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012011.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012012.exe Infecté par: Trojan.DNSChanger.R C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012012.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012012.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012525.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012525.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012525.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012533.exe Infecté par: Trojan.DNSChanger.R C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012533.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012533.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012534.exe Infecté par: Trojan.DNSChanger.R C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012534.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012534.exe Supprimé C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012535.exe Infecté par: Trojan.DNSChanger.R C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012535.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0012535.exe Supprimé C:\WINDOWS\system32\mscornet.exe Infecté par: BehavesLike:Win32.ExplorerHijack C:\WINDOWS\system32\mscornet.exe Echec de la désinfection C:\WINDOWS\system32\mscornet.exe Supprimé ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~et celui de SmitfraudfixRapport fait à 23:12:10,56 le 10/12/2005Executé à partir de C:\Documents and Settings\magali\Bureau\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600]»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32C:\WINDOWS\system32
compat.tlb PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\magali\Application Data»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]"Source"="About:Home""SubscribedURL"="About:Home""FriendlyName"="Ma page d'accueil" »»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pr‚-chargeur Browseui""{8C7461EF-2B13-11d2-BE35-3078302C2030}"="D‚mon de cache des cat‚gories de composant"»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dllgrd merci a vs deuxbiz

incognito02 · Answer

On s'accroche !Démarre en mode sans échec (tapoter sur F8 dés le demarrage de windowsRelance le programme Smitfraud,Cette fois choisir l’option 2, répondre oui a tous ;Sauvegarder le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum ---Nobody is perfect, mais j'essaye .....

fleurdelys · Answer

voilaRapport fait à 23:23:46,57 le 10/12/2005Executé à partir de C:\Documents and Settings\magali\Bureau\virus\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600]»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectésC:\WINDOWS\system32
compat.tlb supprimé »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre Nettoyage terminé. »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

incognito02 · Answer

Ouf !Où en sont tes soucis ?A+

fleurdelys · Answer

rien de nouveau qd j'ai redemarrer en mode normal ya encor une pub qui c'est afficher dans le bureau :-(g rechercher ds mon registre pour voir si il y avait ancor des traces de "yaemu" ou de "unspypc", ki je pence st les responsable, ms rien g tout suppr.en attendant 1 repmerci

Utilisateur anonyme · Answer

Tu peux remettre un silent runner?a+

fleurdelys · Answer

voila .Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]"desktop" = "C:\WINDOWS\system32\idemlog.exe" [empty string]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"Smapp" = "C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" ["Analog Devices, Inc."]"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]"WooCnxMon" = "C:\PROGRA~1\Wanadoo\CnxMon.exe" [empty string]"WOOWATCH" = "C:\PROGRA~1\Wanadoo\Watch.exe" ["France Télécom R&D"]"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]"Omnipage" = "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" ["ScanSoft, Inc"]"TkBellExe" = ""C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot" ["RealNetworks, Inc."]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"WOOTASKBARICON" = "C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" [null data]"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]

Utilisateur anonyme · Answer

Tu peux analyser cela?C:\WINDOWS\system32\idemlog.exea+

fleurdelys · Answer

ya kelke choseAntivirus Version Update Result AntiVir 6.33.0.61 12.09.2005 no virus found Avast 4.6.695.0 12.10.2005 no virus found AVG 718 12.08.2005 no virus found Avira 6.33.0.61 12.09.2005 no virus found BitDefender 7.2 12.10.2005 no virus found CAT-QuickHeal 8.00 12.09.2005 no virus found ClamAV devel-20051108 12.09.2005 no virus found DrWeb 4.33 12.10.2005 no virus found eTrust-Iris 7.1.194.0 12.09.2005 no virus found eTrust-Vet 11.9.1.0 12.09.2005 no virus found Fortinet 2.54.0.0 12.10.2005 suspicious F-Prot 3.16c 12.09.2005 no virus found Ikarus 0.2.59.0 12.10.2005 no virus found Kaspersky 4.0.2.24 12.10.2005 no virus found McAfee 4647 12.09.2005 no virus found NOD32v2 1.1317 12.09.2005 no virus found Norman 5.70.10 12.09.2005 no virus found Panda 8.02.00 12.10.2005 Adware/IdeskBar Sophos 4.00.0 12.10.2005 no virus found Symantec 8.0 12.10.2005 no virus found TheHacker 5.9.1.052 12.09.2005 no virus found VBA32 3.10.5 12.10.2005 Adware.Idesk

Utilisateur anonyme · Answer

reDouble clic sur killbox.exe (Pocket Killbox) - coche: delete on reboot - Dans "Full Path of File to Delete" copie et colle: C:\WINDOWS\system32\idemlog.exe - clique sur la croix rouge - une fenêtre va apparaître pour confirmation clique sur YES - une seconde fenêtre te demande si tu veux redémarrer clique sur YES Laisse le pc redémarrer.Et après reposte un log HijackThis + silent runner + smitfraud fix option 1A+

fleurdelys · Answer

killbox na pas marcher j'ai chercher pk et apparemment j'ai pas de fichier "idemlog.exe" ds le dossier system32.c bizarre non ?  parce j'ai refait une analyse avc le site virustotal et il me redonne le mm rapport

Utilisateur anonyme · Answer

redemarre ton pc et remet un silent runner stp

fleurdelys · Answer

j'ai redemarrerkillbox de marche tjrs pasvoila les rapportsRapport fait à  0:42:53,42 le 11/12/2005Executé à partir de C:\Documents and Settings\magali\Bureau\virus\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600]»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Lobel\Application Data»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]"Source"="About:Home""SubscribedURL"="About:Home""FriendlyName"="Ma page d'accueil" »»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pr‚-chargeur Browseui""{8C7461EF-2B13-11d2-BE35-3078302C2030}"="D‚mon de cache des cat‚gories de composant"»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"Silent Runners.vbs", revision 41, http://www.silentrunners.org/Operating System: Windows XP SP2Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]"desktop" = "C:\WINDOWS\system32\idemlog.exe" [empty string]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"Smapp" = "C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" ["Analog Devices, Inc."]"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]"WooCnxMon" = "C:\PROGRA~1\Wanadoo\CnxMon.exe" [empty string]"WOOWATCH" = "C:\PROGRA~1\Wanadoo\Watch.exe" ["France Télécom R&D"]"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]"Omnipage" = "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" ["ScanSoft, Inc"]"TkBellExe" = ""C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot" ["RealNetworks, Inc."]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"WOOTASKBARICON" = "C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" [null data]"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Logfile of HijackThis v1.99.1Scan saved at 00:45:16, on 11/12/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\wdfmgr.exeC:\WINDOWS\System32\alg.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Analog Devices\SoundMAX\SMTray.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\WINDOWS\system32\wbem\wmiprvse.exeC:\PROGRA~1\Wanadoo\CnxMon.exeC:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exeC:\Program Files\ScanSoft\OmniPageSE\opware32.exeC:\Program Files\Fichiers communs\Real\Update_OB\realsched.exeC:\Program Files\QuickTime\qttask.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeC:\Program Files\Microsoft Office\Office\OSA.EXEC:\Program Files\Wanadoo\EspaceWanadoo.exeC:\Program Files\Wanadoo\ComComp.exeC:\Program Files\Wanadoo\Watch.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\wbem\wmiprvse.exeC:\Documents and Settings\magali\Mes documents\Ma musique\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exeO4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exeO4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osbootO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXEO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exeO9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exeO9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{9BAF614D-7EA9-4421-A30F-266504D9EC43}: NameServer = 80.10.246.130 80.10.246.3O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeau faite g vu ds ton profil ke t du nord, t de kel coin ?

Utilisateur anonyme · Answer

salutbien dormi pour attaquer ce beau dimanche?je suis sur Cambrai; prkoi?---------------------------------------------------------------------------- ¤Affiche tous les fichiers et dossiers : Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage Coche « afficher les fichiers et dossiers cachés » Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" Décoche « masquer les extensions dont le type est connu » Puis fais «Ok» pour valider les changements. Et appliquer !---------------------------------------------------------------------------- Recherche ceci en suivant ce chemin:C:\WINDOWS\system32\idemlog.exeet celui ci cszgb.exetu trouves?a+

fleurdelys · Answer

salut regis59jte demandé ca parce que je ss aussi du coin (a wambrechies) dc voilaj'ai fai la recherche et j'ai trouvé aucun des 2 fichiersmerci de pa mavoir oublier a+

Utilisateur anonyme · Answer

re,J essaie d oublier personne lol.Enchantée Nordiste !!**telecharge ceci http://pageperso.aol.fr/Balltrap34/recherchealea.exe double clik sur le fichier et copie colle ceci idemlog.exe copie/colle le rapportde meme avec  celui ci cszgb.exe a+

fleurdelys · Answer

la recherche est infructueuse, ils ne sont present nulle parta+

Utilisateur anonyme · Answer

Tu peux remettre un silent runner en entier?

fleurdelys · Answer

j'ss ss repasser par bitdefender et voila le rapport Infectés Fichiers 5 Virus Détectés  Trojan.Downloader.FFZ 4 BehavesLike:Win32.ExplorerHijack 1

fleurdelys · Answer

voila le silent runners"Silent Runners.vbs", revision 41, http://www.silentrunners.org/Operating System: Windows XP SP2Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]"desktop" = "C:\WINDOWS\system32\idemlog.exe" [empty string]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"Smapp" = "C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" ["Analog Devices, Inc."]"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]"WooCnxMon" = "C:\PROGRA~1\Wanadoo\CnxMon.exe" [empty string]"WOOWATCH" = "C:\PROGRA~1\Wanadoo\Watch.exe" ["France Télécom R&D"]"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]"Omnipage" = "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" ["ScanSoft, Inc"]"TkBellExe" = ""C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot" ["RealNetworks, Inc."]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"WOOTASKBARICON" = "C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" [null data]"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\INFECTION WARNING! "AppInit_DLLs" = "MsgPlusLoader.dll" ["Patchou"]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\INFECTION WARNING! "System" = "csfrw.exe" [null data]HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]HKLM\Software\Classes\*\shellex\ContextMenuHandlers\WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]Active Desktop and Wallpaper:-----------------------------Active Desktop is disabled at this entry:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellStateHKCU\Control Panel\Desktop\"Wallpaper" = "C:\Documents and Settings\Lobel\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"Startup items in "Lobel" & "All Users" startup folders:-------------------------------------------------------C:\Documents and Settings\Lobel\Menu Démarrer\Programmes\Démarrage"Démarrage d'Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA.EXE -b" [MS]C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------Extensions (Tools menu items, main toolbar menu buttons)HKCU\Software\Microsoft\Internet Explorer\Extensions\{1462651F-F4BA-4C76-A001-C4284D0FE16E}\"ButtonText" = "Wanadoo""Exec" = "http://www.wanadoo.fr" [file not found]HKLM\Software\Microsoft\Internet Explorer\Extensions\{85D1F590-48F4-11D9-9669-0800200C9A66}\"MenuText" = "Uninstall BitDefender Online Scanner v8""Exec" = "%windir%\bdoscandel.exe" [null data]{FB5F1910-F110-11D2-BB9E-00C04F795683}\"ButtonText" = "Messager Wanadoo""MenuText" = "Messager Wanadoo""Exec" = "C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe" ["France Telecom"]Miscellaneous IE Hijack Points------------------------------C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")Added lines (compared with English-language version):[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"Missing lines (compared with English-language version):[Strings]: 1 lineHKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\"{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = "Search Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Wanadoo\SEARCH~1.DLL" [empty string]Running Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]SoundMAX Agent Service, SoundMAX Agent Service (default), "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe" ["Analog Devices, Inc."]Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]Print Monitors:---------------HKLM\System\CurrentControlSet\Control\Print\Monitors\hpzlnt05\Driver = "hpzlnt05.dll" ["HP"]

Utilisateur anonyme · Answer

re,Lance ce scan en ligne: http://www.bitdefender.fr/scan8/ie.html  Copie/colle le rapporta+

fleurdelys · Answer

voilaC:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0013407.exe Infecté par: Trojan.Downloader.FFZ C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0013407.exe Echec de la désinfection C:\System Volume Information\_restore{BBDAE3C7-4B30-4FC8-8810-A27D4D96DB19}\RP41\A0013407.exe Supprimé a+

fleurdelys · Answer

j'ai essayer de repasser ad-aware et spybot en mode sans echec et j'ai desactiver la restauration du systeme et j'ai tjrs le pb :-(

Utilisateur anonyme · Answer

re,ad aware et spybot sont cleans, ils ne detectent rien? si ils sont pas cleans, copie/colle les rapportsA+

fleurdelys · Answer

contente de te revoirnon ils st clean ts les 2a+

Utilisateur anonyme · Answer

re,tu peux me dire ou en sont tes soucis?a+

fleurdelys · Answer

qd je demarre mon pc ya une pub ki apparait sur mon bureau (ya la possibilite de l'enlever en clikan sur une croix)et dc voila

Utilisateur anonyme · Answer

re,1/a quoi ressemble t elle stp?grrr a tout les coups c est celle qui resiste lol2/Télécharge aussi DLLcompare ici: http://www.downloads.subratam.org/DllCompare.exe lance le et clique sur "Run locate.com" Quand "completed the scan, click compare to continue" apparaît en bleu, clique sur le bouton COMPARE en bas à droite Une fois le scan terminé clique sur "make a log of what was found" Fait un copier coller du log sur le foruma+

fleurdelys · Answer

c une grosse bande horizontale composeé de plusieur gros carres qui correspondent a des rubriques (du genre spyware, xxl, game ...) avant kan je metté ma souris sur un des carre yavai un nouveau menu ki se derouler ms maintenant ca me marqur (page non trouvée)dc voila jespere ke c clair :-S*    DLLCompare Log version(1.0.0.127)Files Found that Windows does not See or cannot Access*Not everything listed here means you are infected!________________________________________________O^E says: "There were no files found :)"________________________________________________1 237 items found:  1 237 files, 0 directories.Total of file sizes:  263 387 752 bytes    251,18 MAdministrator Account =  VraiAppInit_DLLs value = MsgPlusLoader.dll (not hidden)--------------------End log---------------------A+

Utilisateur anonyme · Answer

re,dis moi si c est cahttp://img213.imageshack.us/my.php?image=prsentation15bb.jpg

fleurdelys · Answer

oui !!!

Utilisateur anonyme · Answer

re,je penses avoir trouvé (j espere !!)je recherche un programme...j arrive

fleurdelys · Answer

ok merci

Utilisateur anonyme · Answer

re,telecharge cecihttp://cjoint.com/?mlsdUY4sVZDouble clik sur le programmepuis lance leune fois finit, il genere un rapportcopie/colle lea+

fleurdelys · Answer

voila jespere ke c ce ke tu attendaisVérification HKLM\...\...\...\...\ruins*********************************************Fichiers détectés :C:\WINDOWS\Help\SPAlert.chm Présent !*********************************************Recherche des processus aleatoiresd'après les modèles : cs***.exe, dm***.exe, ya***.exeC:\WINDOWS\System32*********************************************Recherche presence  hclean32.exe... non trouvé...

Utilisateur anonyme · Answer

re,Vérifie ceci: Démarrer > panneau de configuration > affichage clique sur l'onglet bureau clique sur personnalisation du bureau clique sur l'onglet Web supprime tout ce qui se trouve ici, sauf "Ma page d'accueil" qui doit rester DECOCHE  ***Télécharge: Pocket Killbox ici http://www.downloads.subratam.org/KillBox.exe :: Démo d utilisation (merci a Balltrap34 pour cette réalisation) ::http://pageperso.aol.fr/balltrap34/killbox.htmAvec la methode du bloc note (cf video), voici la liste:C:\WINDOWS\Help\SPAlert.chmC:\WINDOWS\system32\idemlog.exeC:\WINDOWS\system32\csfrw.exeLaisse le pc redemarrer et remet un silent runnera+

fleurdelys · Answer

voila j'ai tjrs le pbStartup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]"desktop" = "C:\WINDOWS\system32\idemlog.exe" [empty string]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"Smapp" = "C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" ["Analog Devices, Inc."]"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]"WooCnxMon" = "C:\PROGRA~1\Wanadoo\CnxMon.exe" [empty string]"WOOWATCH" = "C:\PROGRA~1\Wanadoo\Watch.exe" ["France Télécom R&D"]"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]"Omnipage" = "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" ["ScanSoft, Inc"]"TkBellExe" = ""C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot" ["RealNetworks, Inc."]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"WOOTASKBARICON" = "C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" [null data]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\INFECTION WARNING! "AppInit_DLLs" = "MsgPlusLoader.dll" ["Patchou"]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\INFECTION WARNING! "System" = "csbsz.exe" [null data]HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]HKLM\Software\Classes\*\shellex\ContextMenuHandlers\WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]Active Desktop and Wallpaper:-----------------------------Active Desktop is disabled at this entry:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellStateHKCU\Control Panel\Desktop\"Wallpaper" = "C:\Documents and Settings\Lobel\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"Startup items in "Lobel" & "All Users" startup folders:-------------------------------------------------------C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------Extensions (Tools menu items, main toolbar menu buttons)HKCU\Software\Microsoft\Internet Explorer\Extensions\{1462651F-F4BA-4C76-A001-C4284D0FE16E}\"ButtonText" = "Wanadoo""Exec" = "http://www.wanadoo.fr" [file not found]HKLM\Software\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11D2-BB9E-00C04F795683}\"ButtonText" = "Messager Wanadoo""MenuText" = "Messager Wanadoo""Exec" = "C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe" ["France Telecom"]Miscellaneous IE Hijack Points------------------------------C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")Added lines (compared with English-language version):[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"Missing lines (compared with English-language version):[Strings]: 1 lineHKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\"{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = "Search Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Wanadoo\SEARCH~1.DLL" [empty string]Running Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]SoundMAX Agent Service, SoundMAX Agent Service (default), "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe" ["Analog Devices, Inc."]Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]Print Monitors:---------------HKLM\System\CurrentControlSet\Control\Print\Monitors\hpzlnt05\Driver = "hpzlnt05.dll" ["HP"]a+

Utilisateur anonyme · Answer

re,Utilise identiquement avec cette liste:Nouvelle liste:C:\WINDOWS\Help\SPAlert.chm C:\WINDOWS\system32\idemlog.exe C:\WINDOWS\system32\csfrw.exe C:\WINDOWS\balloon.wav C:\WINDOWS\ACD Wallpaper.bmp C:\WINDOWS\system32\insurance.bmp C:\WINDOWS\system32\close.bmp C:\WINDOWS\system32\spyware.bmp C:\WINDOWS\system32\xxx.bmp C:\WINDOWS\system32\pharmacy.bmp C:\WINDOWS\system32\gambling.bmp C:\WINDOWS\system32\dating.bmp C:\WINDOWS\system32\idesk.conf C:\WINDOWS\system32\Help.ico C:\WINDOWS\system32\AddQuit.ico C:\WINDOWS\system32\Desktop.ico C:\WINDOWS\system32\Uninstall.ico C:\WINDOWS\system32\IE.ico C:\WINDOWS\system32\Open.ico C:\WINDOWS\system32\Quick.ico C:\WINDOWS\system32\dgprpsetup.exe C:\WINDOWS\system32\dmhwj.exe C:\WINDOWS\system32\filesafer23.exe C:\WINDOWS\system32\idemlog.exe C:\WINDOWS\system32\favset.exe  C:\WINDOWS\system32\howiper.exe  C:\WINDOWS\system32\csqrv.exeRedemarre et dis moi ou ca en est (avec un silent runner)a+

fluerdelys · Answer

killbox a pas voulu me prd ts les fichiers il ma selectionne ke ceux laC:\WINDOWS\ACD Wallpaper.bmp C:\WINDOWS\system32\insurance.bmp C:\WINDOWS\system32\close.bmp C:\WINDOWS\system32\spyware.bmp C:\WINDOWS\system32\xxx.bmp C:\WINDOWS\system32\pharmacy.bmp C:\WINDOWS\system32\gambling.bmp C:\WINDOWS\system32\dating.bmp C:\WINDOWS\system32\idesk.conf Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]"desktop" = "C:\WINDOWS\system32\idemlog.exe" [empty string]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"Smapp" = "C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" ["Analog Devices, Inc."]"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]"WooCnxMon" = "C:\PROGRA~1\Wanadoo\CnxMon.exe" [empty string]"WOOWATCH" = "C:\PROGRA~1\Wanadoo\Watch.exe" ["France Télécom R&D"]"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]"Omnipage" = "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" ["ScanSoft, Inc"]"TkBellExe" = ""C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot" ["RealNetworks, Inc."]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"WOOTASKBARICON" = "C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" [null data]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\INFECTION WARNING! "AppInit_DLLs" = "MsgPlusLoader.dll" ["Patchou"]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\INFECTION WARNING! "System" = "csocj.exe" [null data]HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]HKLM\Software\Classes\*\shellex\ContextMenuHandlers\WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]Active Desktop and Wallpaper:-----------------------------Active Desktop is disabled at this entry:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellStateHKCU\Control Panel\Desktop\"Wallpaper" = "C:\Documents and Settings\Lobel\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"Startup items in "Lobel" & "All Users" startup folders:-------------------------------------------------------C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------Extensions (Tools menu items, main toolbar menu buttons)HKCU\Software\Microsoft\Internet Explorer\Extensions\{1462651F-F4BA-4C76-A001-C4284D0FE16E}\"ButtonText" = "Wanadoo""Exec" = "http://www.wanadoo.fr" [file not found]HKLM\Software\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11D2-BB9E-00C04F795683}\"ButtonText" = "Messager Wanadoo""MenuText" = "Messager Wanadoo""Exec" = "C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe" ["France Telecom"]Miscellaneous IE Hijack Points------------------------------C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")Added lines (compared with English-language version):[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"Missing lines (compared with English-language version):[Strings]: 1 lineHKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\"{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = "Search Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Wanadoo\SEARCH~1.DLL" [empty string]Running Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]SoundMAX Agent Service, SoundMAX Agent Service (default), "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe" ["Analog Devices, Inc."]Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]a+

Utilisateur anonyme · Answer

okon y presque.....il manque pas grand choseTelecharge cecihttp://virus-protect.net/bat/datFind.batExecute leIl va te dire d appuyer sur une touche, puis il te donne un rapportcopie/colle en entierpuis une 2nd fois, un deuxieme rapport/copie/colle leet idem une 3emeUne fois qu il aura finit le programme se fermera tout seula+

Utilisateur anonyme · Answer

re,excuse moi si cela tarde a resoudre ton soucis, c est un cas vraiment tres special, tres peu d infos donc nous cherchons par nous meme, pas toujours evident ....mais tiens bon stp c est qqchose de tres interressant pour moi en tout cas lol**peux tu faire ceci egalement?Télécharge l2mfix ici: http://www.downloads.subratam.org/l2mfix.exe Double clic sur l2mfix.exe pour lancer l'extraction Dans le dossier l2mfix, double clic sur l2mfix.bat, appuie sur n'importe quelle touche puis choisis l'option #1 (et pas autre chose) et valide avec la touche entrée. Le bloc note va s'ouvrir avec le résultat du scan. Fais un copier coller du résultat ici.

balltrap34 · Answer

salut regisen foction des fichiers a suppr fait le avec un bfu

fleurdelys · Answer

re dsl j'ai pa ete chez moi de la semaineje ss prete a continuer la "chasse" lolvoila les rapports de datfind : Le volume dans le lecteur C n'a pas de nom. Le num‚ro de s‚rie du volume est C82D-BE27 R‚pertoire de C:\WINDOWS\system3217/12/2005  17:48             2ÿ422 wpa.dbl10/12/2005  16:09             4ÿ984 close.bmp10/12/2005  16:08            11ÿ772 spyware.bmp10/12/2005  16:08            21ÿ224 xxx.bmp10/12/2005  16:08            21ÿ872 pharmacy.bmp10/12/2005  16:08            21ÿ872 dating.bmp10/12/2005  16:08            23ÿ480 gambling.bmp10/12/2005  16:08               387 idesk.conf09/12/2005  01:21         2ÿ721ÿ632 MRT.exe01/12/2005  05:01         1ÿ492ÿ992 shdocvw.dll27/11/2005  16:10                92 Loadwer.bwz27/11/2005  10:35           120ÿ872 MSForms.TWD27/11/2005  10:35           152ÿ384 FNTCACHE.DAT26/11/2005  11:57            69ÿ632 system.mdw24/11/2005  01:08         3ÿ013ÿ632 mshtml.dll24/11/2005  01:08         1ÿ022ÿ976 browseui.dll05/11/2005  04:17           606ÿ208 urlmon.dll05/11/2005  04:17         1ÿ056ÿ768 danim.dll30/10/2005  19:15           176ÿ167 rmoc3260.dll30/10/2005  19:15             5ÿ632 pndx5032.dll30/10/2005  19:15             6ÿ656 pndx5016.dll30/10/2005  19:15           278ÿ528 pncrt.dll30/10/2005  11:39            48ÿ616 perfc00C.dat30/10/2005  11:39           367ÿ658 perfh00C.dat30/10/2005  11:39           311ÿ604 perfh009.dat30/10/2005  11:39            39ÿ992 perfc009.dat30/10/2005  11:39           775ÿ210 PerfStringBackup.INI27/10/2005  19:32            45ÿ640 MsgPlusLoader.dll27/10/2005  14:04           151ÿ566 UninstIPP.isu27/10/2005  13:30            16ÿ832 amcompat.tlb27/10/2005  13:30            23ÿ392 nscompat.tlb26/10/2005  08:28             2ÿ422 wpa.bak25/10/2005  16:55                 0 h323log.txt25/10/2005  15:27                44 msssc.dll25/10/2005  15:00               386 $winnt$.inf25/10/2005  14:58             3ÿ072 CONFIG.NT25/10/2005  14:58               488 logonui.exe.manifest25/10/2005  14:58               488 WindowsLogon.manifest25/10/2005  14:58               749 cdplayer.exe.manifest25/10/2005  14:58               749 sapi.cpl.manifest25/10/2005  14:58               749 wuaucpl.cpl.manifest25/10/2005  14:58               749 ncpa.cpl.manifest25/10/2005  14:58               749 nwc.cpl.manifest25/10/2005  14:56            21ÿ892 emptyregdb.dat21/10/2005  04:41           662ÿ528 wininet.dll21/10/2005  04:41           474ÿ112 shlwapi.dll21/10/2005  04:41            39ÿ424 pngfilt.dll21/10/2005  04:41           448ÿ512 mshtmled.dll21/10/2005  04:41           530ÿ944 mstime.dll21/10/2005  04:41           146ÿ432 msrating.dll21/10/2005  04:41            55ÿ808 extmgr.dll21/10/2005  04:41           205ÿ312 dxtrans.dll21/10/2005  04:41            96ÿ768 inseng.dll21/10/2005  04:41           251ÿ392 iepeers.dll21/10/2005  04:41           152ÿ064 cdfview.dll20/10/2005  23:25         1ÿ097ÿ728 esent.dll13/10/2005  00:15            15ÿ072 spmsg.dll12/10/2005  23:11           118ÿ784 sirenacm.dll11/10/2005  20:03            65ÿ536 QuickTimeVR.qtx11/10/2005  20:03            49ÿ152 QuickTime.qts06/10/2005  04:18           280ÿ064 gdi32.dll06/10/2005  04:08         1ÿ839ÿ616 win32k.sys23/09/2005  04:06         8ÿ506ÿ880 shell32.dll15/09/2005  06:32           307ÿ200 atiiiexx.dll15/09/2005  05:55           253ÿ952 ATIDEMGR.dll15/09/2005  05:14         6ÿ680ÿ576 atioglx1.dll15/09/2005  04:13         4ÿ837ÿ376 atioglxx.dll15/09/2005  03:58           241ÿ664 ati2dvag.dll15/09/2005  03:53           106ÿ496 atipdlxx.dll15/09/2005  03:53            73ÿ728 Oemdspif.dll15/09/2005  03:53            25ÿ088 Ati2mdxx.exe15/09/2005  03:53            39ÿ936 ati2edxx.dll15/09/2005  03:53            46ÿ080 ati2evxx.dll15/09/2005  03:52           376ÿ832 ati2evxx.exe15/09/2005  03:51            53ÿ248 ATIDDC.DLL15/09/2005  03:44         2ÿ429ÿ952 ati3duag.dll15/09/2005  03:39           602ÿ016 ativvaxx.dll15/09/2005  03:27           147ÿ456 atikvmag.dll15/09/2005  03:04            17ÿ408 atitvo32.dll15/09/2005  02:59           233ÿ472 ati2cqag.dll14/09/2005  20:05           516ÿ096 ati2sgag.exe10/09/2005  02:55         2ÿ067ÿ968 cdosys.dll06/09/2005  21:04           104ÿ373 atiicdxx.dat01/09/2005  02:43           292ÿ352 winsrv.dll01/09/2005  02:43            19ÿ968 linkinfo.dll30/08/2005  04:55         1ÿ293ÿ312 quartz.dll29/08/2005  12:27           520ÿ968 LegitCheckControl.DLL23/08/2005  04:39           124ÿ928 umpnpmgr.dll22/08/2005  19:35           197ÿ632 netman.dll16/08/2005  21:57             5ÿ607 atifglpf.xml26/07/2005  05:40            37ÿ888 olecnv32.dll26/07/2005  05:40            75ÿ264 olecli32.dll26/07/2005  05:40         1ÿ284ÿ608 ole32.dll26/07/2005  05:40           397ÿ824 rpcss.dll26/07/2005  05:40            11ÿ776 xolehlp.dll26/07/2005  05:40           101ÿ376 txflog.dll26/07/2005  05:39            66ÿ560 mtxclu.dll26/07/2005  05:39           161ÿ280 msdtcuiu.dll26/07/2005  05:39            91ÿ136 mtxoci.dll26/07/2005  05:39           945ÿ152 msdtctm.dll26/07/2005  05:39           425ÿ472 msdtcprx.dll26/07/2005  05:39           540ÿ160 comuid.dll26/07/2005  05:39         1ÿ267ÿ200 comsvcs.dll26/07/2005  05:39           243ÿ200 es.dll26/07/2005  05:39            97ÿ792 comrepl.dll26/07/2005  05:39            60ÿ416 colbact.dll26/07/2005  05:39           110ÿ080 clbcatex.dll26/07/2005  05:39           498ÿ688 clbcatq.dll26/07/2005  05:39           625ÿ152 catsrvut.dll26/07/2005  05:39           225ÿ792 catsrv.dll12/07/2005  17:04            23ÿ304 GWFSPidGen.dll08/07/2005  17:28           249ÿ344 tapisrv.dll08/07/2005  17:28            76ÿ800 remotesp.tsp29/06/2005  02:49            74ÿ240 mscms.dll29/06/2005  02:49           254ÿ976 icm32.dll15/06/2005  18:50           295ÿ936 kerberos.dll11/06/2005  00:53            57ÿ856 spoolsv.exe27/05/2005  03:08           137ÿ216 itss.dll27/05/2005  03:08           546ÿ304 hhctrl.ocx27/05/2005  03:08            41ÿ472 hhsetup.dll27/05/2005  03:08           155ÿ136 itircl.dll26/05/2005  03:19           173ÿ536 wuweb.dll26/05/2005  03:16           128ÿ792 wucltui.dll26/05/2005  03:16           175ÿ896 wuaucpl.cpl26/05/2005  03:16           195ÿ352 wuaueng1.dll26/05/2005  03:16           175ÿ896 wuauclt1.exe26/05/2005  03:16           125ÿ720 wuauclt.exe26/05/2005  03:16           467ÿ224 wuapi.dll26/05/2005  03:16         1ÿ343ÿ768 wuaueng.dll26/05/2005  03:16            41ÿ240 wups.dll26/05/2005  03:16            18ÿ200 wups2.dll26/05/2005  03:16            75ÿ544 cdm.dll26/05/2005  03:16           198ÿ424 iuengine.dll17/05/2005  01:42            16ÿ896 xpsp3res.dll11/05/2005  03:30            78ÿ336 telnet.exe04/05/2005  13:45            78ÿ848 msiexec.exe04/05/2005  13:45           884ÿ736 msimsg.dll04/05/2005  13:45           271ÿ360 msihnd.dll04/05/2005  13:45            15ÿ360 msisip.dll04/05/2005  13:45         2ÿ890ÿ240 msi.dll02/03/2005  19:10           578ÿ048 user32.dll02/03/2005  19:10            56ÿ832 authz.dll02/03/2005  19:08         2ÿ181ÿ376 ntoskrnl.exe02/03/2005  19:07         2ÿ058ÿ880 ntkrnlpa.exe25/02/2005  04:35            22ÿ752 spupdsvc.exe07/12/2004  20:34            96ÿ768 srvsvc.dll17/11/2004  18:42           354ÿ304 hypertrm.dll16/11/2004  22:17            68ÿ608 hlink.dll28/10/2004  02:23           728ÿ576 lsasrv.dll13/10/2004  15:12            32ÿ768 WooDial2000.dll11/08/2004  19:49             8ÿ704 asferror.dll11/08/2004  19:49           226ÿ304 wmerror.dll11/08/2004  19:49            86ÿ016 wmpshell.dll11/08/2004  19:49         3ÿ424ÿ256 wmploc.dll11/08/2004  19:49           311ÿ808 MSWMDM.dll11/08/2004  19:49           483ÿ328 Audiodev.dll11/08/2004  00:39         2ÿ362ÿ104 wmvcore.dll11/08/2004  00:39           773ÿ368 wmsdmod.dll11/08/2004  00:38           871ÿ160 wmvdmod.dll11/08/2004  00:38           531ÿ192 wmspdmod.dll11/08/2004  00:38         1ÿ181ÿ944 wmvadvd.dll11/08/2004  00:38           380ÿ144 wmadmod.dll11/08/2004  00:38           253ÿ688 drmclien.dll11/08/2004  00:38           360ÿ176 MSSCP.dll11/08/2004  00:37           290ÿ816 WMDRMNet.dll11/08/2004  00:37           344ÿ064 WMDRMdev.dll11/08/2004  00:36           527ÿ360 drmv2clt.dll11/08/2004  00:36           233ÿ472 blackbox.dll11/08/2004  00:36            95ÿ232 drmstor.dll11/08/2004  00:36           141ÿ312 msnetobj.dll10/08/2004  23:45         1ÿ509ÿ376 WMVADVE.DLL10/08/2004  23:45           221ÿ184 qasf.dll10/08/2004  23:45           712ÿ704 wmadmoe.dll10/08/2004  23:45           161ÿ792 cewmdm.dll10/08/2004  23:45           135ÿ168 wmpasf.dll10/08/2004  23:45           169ÿ472 MsPMSP.dll10/08/2004  23:45            34ÿ304 WMDMPS.dll10/08/2004  23:45           282ÿ624 wmpdxm.dll10/08/2004  23:45            25ÿ088 MsPMSNSv.dll10/08/2004  23:45            30ÿ208 WMDMLOG.dll10/08/2004  23:45         1ÿ589ÿ760 wmpencen.dll10/08/2004  23:45           936ÿ960 wmspdmoe.dll10/08/2004  23:45           999ÿ424 wmvdmoe2.dll10/08/2004  23:45           175ÿ104 wmpsrcwp.dll10/08/2004  23:45         1ÿ116ÿ160 wmsdmoe2.dll10/08/2004  23:41         5ÿ550ÿ080 setb9.tmp10/08/2004  23:41         5ÿ550ÿ080 wmp.dll10/08/2004  23:41         1ÿ027ÿ072 wmnetmgr.dll10/08/2004  23:41           229ÿ376 wmasf.dll10/08/2004  21:07           150ÿ016 wmidx.dll10/08/2004  21:07             6ÿ656 laprxy.dll10/08/2004  21:05            38ÿ912 wpd_ci.dll10/08/2004  21:05           327ÿ680 wpdsp.dll10/08/2004  21:05           331ÿ776 wpdmtpdr.dll10/08/2004  21:05           114ÿ176 wpdmtp.dll10/08/2004  21:05            66ÿ560 wpdmtpus.dll10/08/2004  21:05            61ÿ952 wpdconns.dll10/08/2004  21:05            10ÿ752 wpdtrace.dll10/08/2004  21:05            47ÿ104 uwdf.exe10/08/2004  21:05            38ÿ912 wdfmgr.exe10/08/2004  21:05            15ÿ872 wdfapi.dll10/08/2004  20:52           360ÿ448 l3codecp.acm10/08/2004  20:52            20ÿ480 wmpui.dll10/08/2004  20:52            20ÿ480 wmpcore.dll10/08/2004  20:52            20ÿ480 wmpcd.dll10/08/2004  20:52            20ÿ480 wmp.ocx10/08/2004  20:46            96ÿ768 logagent.exe05/08/2004  13:00             8ÿ192 control.exe05/08/2004  13:00            13ÿ824 convert.exe05/08/2004  13:00            35ÿ328 corpol.dll05/08/2004  13:00            27ÿ097 country.sys05/08/2004  13:00           165ÿ888 credui.dll05/08/2004  13:00           149ÿ019 crtdll.dll05/08/2004  13:00           604ÿ672 crypt32.dll05/08/2004  13:00            75ÿ776 cryptdlg.dll05/08/2004  13:00            33ÿ280 cryptdll.dll05/08/2004  13:00            54ÿ784 cryptext.dll05/08/2004  13:00            63ÿ488 cryptnet.dll05/08/2004  13:00            60ÿ416 cryptsvc.dll05/08/2004  13:00           530ÿ432 cryptui.dll05/08/2004  13:00           102ÿ912 cscdll.dll05/08/2004  13:00            98ÿ304 cscript.exe05/08/2004  13:00           337ÿ920 cscui.dll05/08/2004  13:00            32ÿ768 csrsrv.dll05/08/2004  13:00             6ÿ144 csrss.exe05/08/2004  13:00            73ÿ728 csseqchk.dll05/08/2004  13:00            15ÿ360 ctfmon.exe05/08/2004  13:00            27ÿ136 ctl3d32.dll05/08/2004  13:00            27ÿ200 ctl3dv2.dll05/08/2004  13:00             8ÿ386 ctype.nls05/08/2004  13:00            66ÿ082 c_037.nls05/08/2004  13:00            66ÿ082 c_10000.nls05/08/2004  13:00            66ÿ082 c_10006.nls05/08/2004  13:00            66ÿ082 c_10007.nls05/08/2004  13:00            66ÿ082 c_10010.nls05/08/2004  13:00            66ÿ082 c_10017.nls05/08/2004  13:00            66ÿ082 c_10029.nls05/08/2004  13:00            66ÿ082 c_10079.nls05/08/2004  13:00            66ÿ082 c_10081.nls05/08/2004  13:00            66ÿ082 c_10082.nls05/08/2004  13:00            66ÿ082 c_1026.nls05/08/2004  13:00            66ÿ082 c_1250.nls05/08/2004  13:00            66ÿ082 c_1251.nls05/08/2004  13:00            66ÿ082 c_1252.nls05/08/2004  13:00            66ÿ082 c_1253.nls05/08/2004  13:00            66ÿ082 c_1254.nls05/08/2004  13:00            66ÿ082 c_1255.nls05/08/2004  13:00            66ÿ082 c_1256.nls05/08/2004  13:00            66ÿ082 c_1257.nls05/08/2004  13:00            66ÿ082 c_1258.nls05/08/2004  13:00            66ÿ082 c_20127.nls05/08/2004  13:00           139ÿ810 c_20261.nls05/08/2004  13:00            66ÿ082 c_20866.nls05/08/2004  13:00            66ÿ082 c_20905.nls05/08/2004  13:00            66ÿ082 c_21866.nls05/08/2004  13:00            66ÿ082 c_28591.nls05/08/2004  13:00            66ÿ082 c_28592.nls05/08/2004  13:00            66ÿ082 c_28593.nls05/08/2004  13:00            66ÿ082 C_28594.NLS05/08/2004  13:00            66ÿ082 C_28595.NLS05/08/2004  13:00            66ÿ082 C_28597.NLS05/08/2004  13:00            66ÿ082 c_28598.nls05/08/2004  13:00            66ÿ082 c_28599.nls05/08/2004  13:00            66ÿ082 c_28603.nls05/08/2004  13:00            66ÿ082 c_28605.nls05/08/2004  13:00            66ÿ594 c_437.nls05/08/2004  13:00            66ÿ082 c_500.nls05/08/2004  13:00            66ÿ594 c_737.nls05/08/2004  13:00            66ÿ594 c_775.nls05/08/2004  13:00            66ÿ594 c_850.nls05/08/2004  13:00            66ÿ594 c_852.nls05/08/2004  13:00            66ÿ594 c_855.nls05/08/2004  13:00            66ÿ594 c_857.nls05/08/2004  13:00            66ÿ594 c_860.nls05/08/2004  13:00            66ÿ594 c_861.nls05/08/2004  13:00            66ÿ594 c_863.nls05/08/2004  13:00            66ÿ594 c_865.nls05/08/2004  13:00            66ÿ594 c_866.nls05/08/2004  13:00            66ÿ594 c_869.nls05/08/2004  13:00            66ÿ594 c_874.nls05/08/2004  13:00            66ÿ082 c_875.nls05/08/2004  13:00           162ÿ850 c_932.nls05/08/2004  13:00           196ÿ642 c_936.nls05/08/2004  13:00           196ÿ642 c_949.nls05/08/2004  13:00           196ÿ642 c_950.nls05/08/2004  13:00         1ÿ179ÿ648 d3d8.dll05/08/2004  13:00             8ÿ192 d3d8thk.dll05/08/2004  13:00         1ÿ689ÿ088 d3d9.dll05/08/2004  13:00           436ÿ224 d3dim.dll05/08/2004  13:00           825ÿ344 d3dim700.dll05/08/2004  13:00            34ÿ816 d3dpmesh.dll05/08/2004  13:00           590ÿ336 d3dramp.dll05/08/2004  13:00           350ÿ208 d3drm.dll05/08/2004  13:00            47ÿ616 d3dxof.dll05/08/2004  13:00            70ÿ656 amstream.dll05/08/2004  13:00            55ÿ296 dataclen.dll05/08/2004  13:00           152ÿ064 datime.dll05/08/2004  13:00            17ÿ408 alrsvc.dll05/08/2004  13:00            25ÿ088 davclnt.dll05/08/2004  13:00           153ÿ088 daxctle.ocx05/08/2004  13:00           847ÿ872 dbgeng.dll05/08/2004  13:00           640ÿ000 dbghelp.dll05/08/2004  13:00            24ÿ576 dbmsrpcn.dll05/08/2004  13:00           110ÿ592 dbnetlib.dll05/08/2004  13:00            28ÿ672 dbnmpntw.dll05/08/2004  13:00             1ÿ788 Dcache.bin05/08/2004  13:00             8ÿ704 dciman32.dll05/08/2004  13:00             5ÿ120 dcomcnfg.exe05/08/2004  13:00            39ÿ424 ddeml.dll05/08/2004  13:00            31ÿ744 ddeshare.exe05/08/2004  13:00           266ÿ240 ddraw.dll05/08/2004  13:00            27ÿ136 ddrawex.dll05/08/2004  13:00            21ÿ162 debug.exe05/08/2004  13:00            25ÿ088 defrag.exe05/08/2004  13:00           138ÿ240 desk.cpl05/08/2004  13:00            16ÿ896 deskadp.dll05/08/2004  13:00            16ÿ896 deskmon.dll05/08/2004  13:00            18ÿ944 deskperf.dll05/08/2004  13:00                 2 desktop.ini05/08/2004  13:00            59ÿ904 devenum.dll05/08/2004  13:00            32ÿ738 devmgmt.msc05/08/2004  13:00           290ÿ816 devmgr.dll05/08/2004  13:00            41ÿ131 dfrg.msc05/08/2004  13:00            82ÿ432 dfrgfat.exe05/08/2004  13:00           104ÿ960 dfrgntfs.exe05/08/2004  13:00            55ÿ808 dfrgres.dll05/08/2004  13:00            39ÿ424 dfrgsnap.dll05/08/2004  13:00           123ÿ904 dfrgui.dll05/08/2004  13:00            28ÿ672 dfsshlex.dll05/08/2004  13:00           115ÿ200 dgnet.dll05/08/2004  13:00           176ÿ157 dgrpsetu.dll05/08/2004  13:00            86ÿ044 dgsetup.dll05/08/2004  13:00           111ÿ616 dhcpcsvc.dll05/08/2004  13:00           401ÿ408 dhcpmon.dll05/08/2004  13:00            78ÿ848 dhcpsapi.dll05/08/2004  13:00           395ÿ264 diactfrm.dll05/08/2004  13:00            85ÿ504 diantz.exe05/08/2004  13:00            68ÿ608 digest.dll05/08/2004  13:00            44ÿ032 dimap.dll05/08/2004  13:00           165ÿ376 dinput.dll05/08/2004  13:00           187ÿ904 dinput8.dll05/08/2004  13:00             9ÿ216 diskcomp.com05/08/2004  13:00             7ÿ168 diskcopy.com05/08/2004  13:00         1ÿ502ÿ208 diskcopy.dll05/08/2004  13:00            33ÿ311 diskmgmt.msc05/08/2004  13:00           167ÿ936 diskpart.exe05/08/2004  13:00            19ÿ456 diskperf.exe05/08/2004  13:00            45ÿ083 dispex.dll05/08/2004  13:00            32ÿ256 wupdmgr.exe05/08/2004  13:00           230ÿ912 compstui.dll05/08/2004  13:00             5ÿ120 dllhost.exe05/08/2004  13:00             4ÿ608 dllhst3g.exe05/08/2004  13:00           225ÿ280 dmadmin.exe05/08/2004  13:00            28ÿ672 dmband.dll05/08/2004  13:00            61ÿ440 dmcompos.dll05/08/2004  13:00           330ÿ752 dmconfig.dll05/08/2004  13:00           273ÿ920 dmdlgs.dll05/08/2004  13:00           200ÿ704 dmdskmgr.dll05/08/2004  13:00           134ÿ656 dmdskres.dll05/08/2004  13:00           181ÿ248 dmime.dll05/08/2004  13:00            18ÿ432 dmintf.dll05/08/2004  13:00            35ÿ840 dmloader.dll05/08/2004  13:00            19ÿ456 dmocx.dll05/08/2004  13:00            15ÿ872 dmremote.exe05/08/2004  13:00            82ÿ432 dmscript.dll05/08/2004  13:00            24ÿ576 dmserver.dll05/08/2004  13:00           105ÿ984 dmstyle.dll05/08/2004  13:00           103ÿ424 dmsynth.dll05/08/2004  13:00           104ÿ448 dmusic.dll05/08/2004  13:00            58ÿ880 dmutil.dll05/08/2004  13:00            61ÿ440 dmview.ocx05/08/2004  13:00           148ÿ480 dnsapi.dll05/08/2004  13:00            45ÿ568 dnsrslvr.dll05/08/2004  13:00             6ÿ656 wuauserv.dll05/08/2004  13:00            47ÿ616 docprop.dll05/08/2004  13:00            48ÿ640 docprop2.dll05/08/2004  13:00            10ÿ752 doskey.exe05/08/2004  13:00            54ÿ080 dosx.exe05/08/2004  13:00            97ÿ792 dpcdll.dll05/08/2004  13:00            33ÿ040 dplay.dll05/08/2004  13:00            30ÿ208 dplaysvr.exe05/08/2004  13:00           229ÿ888 dplayx.dll05/08/2004  13:00            24ÿ064 dpmodemx.dll05/08/2004  13:00             3ÿ584 dpnaddr.dll05/08/2004  13:00           375ÿ296 dpnet.dll05/08/2004  13:00            35ÿ328 dpnhpast.dll05/08/2004  13:00            60ÿ928 dpnhupnp.dll05/08/2004  13:00             3ÿ584 dpnlobby.dll05/08/2004  13:00            62ÿ464 dpnmodem.dll05/08/2004  13:00            18ÿ432 dpnsvr.exe05/08/2004  13:00            61ÿ952 dpnwsock.dll05/08/2004  13:00            54ÿ032 dpserial.dll05/08/2004  13:00            21ÿ504 dpvacm.dll05/08/2004  13:00           213ÿ504 dpvoice.dll05/08/2004  13:00            83ÿ456 dpvsetup.exe05/08/2004  13:00           116ÿ736 dpvvox.dll05/08/2004  13:00            42ÿ768 dpwsock.dll05/08/2004  13:00            57ÿ856 dpwsockx.dll05/08/2004  13:00            30ÿ160 compobj.dll05/08/2004  13:00            37ÿ357 compmgmt.msc05/08/2004  13:00           253ÿ440 compatUI.dll05/08/2004  13:00            14ÿ336 drprov.dll05/08/2004  13:00            28ÿ400 drwatson.exe05/08/2004  13:00            47ÿ104 drwtsn32.exe05/08/2004  13:00             4ÿ656 ds16gt.dLL05/08/2004  13:00            16ÿ384 ds32gt.dll05/08/2004  13:00            62ÿ976 dsauth.dll05/08/2004  13:00           181ÿ760 dsdmo.dll05/08/2004  13:00            72ÿ192 dsdmoprp.dll05/08/2004  13:00            93ÿ696 dskquota.dll05/08/2004  13:00           150ÿ016 dskquoui.dll05/08/2004  13:00            18ÿ432 compact.exe05/08/2004  13:00           367ÿ616 dsound.dll05/08/2004  13:00                81 dsound.vxd05/08/2004  13:00         1ÿ294ÿ336 dsound3d.dll05/08/2004  13:00           145ÿ408 dsprop.dll05/08/2004  13:00             4ÿ096 dsprpres.dll05/08/2004  13:00           240ÿ640 dsquery.dll05/08/2004  13:00           218ÿ003 dssec.dat05/08/2004  13:00            52ÿ736 dssec.dll05/08/2004  13:00           137ÿ216 dssenh.dll05/08/2004  13:00           113ÿ664 dsuiext.dll05/08/2004  13:00            19ÿ456 dswave.dll05/08/2004  13:00            10ÿ752 dumprep.exe05/08/2004  13:00           304ÿ128 duser.dll05/08/2004  13:00            59ÿ392 dvdplay.exe05/08/2004  13:00            17ÿ920 dvdupgrd.exe05/08/2004  13:00            15ÿ872 comp.exe05/08/2004  13:00           180ÿ224 dwwin.exe05/08/2004  13:00           619ÿ008 dx7vb.dll05/08/2004  13:00         1ÿ227ÿ264 dx8vb.dll05/08/2004  13:00         1ÿ298ÿ432 dxdiag.exe05/08/2004  13:00         2ÿ113ÿ536 dxdiagn.dll05/08/2004  13:00           499ÿ741 dxmasf.dll05/08/2004  13:00           357ÿ888 dxtmsft.dll05/08/2004  13:00            33ÿ904 commdlg.dll05/08/2004  13:00            71ÿ102 edit.com05/08/2004  13:00            13ÿ781 edit.hlp05/08/2004  13:00            13ÿ010 edlin.exe05/08/2004  13:00           127ÿ213 ega.cpi05/08/2004  13:00           187ÿ392 els.dll05/08/2004  13:00            52ÿ103 command.com05/08/2004  13:00            20ÿ480 encapi.dll05/08/2004  13:00           186ÿ368 encdec.dll05/08/2004  13:00           103ÿ424 EqnClass.Dll05/08/2004  13:00            23ÿ040 ersvc.dll05/08/2004  13:00            10ÿ544 comm.drv05/08/2004  13:00           281ÿ088 comdlg32.dll05/08/2004  13:00         1ÿ114ÿ896 esent97.dll05/08/2004  13:00            17ÿ408 esentprf.dll05/08/2004  13:00             6ÿ708 esentprf.hxx05/08/2004  13:00         1ÿ015ÿ477 esentprf.ini05/08/2004  13:00            39ÿ424 esentutl.exe05/08/2004  13:00           195ÿ072 eudcedit.exe05/08/2004  13:00            42ÿ303 eula.txt05/08/2004  13:00            33ÿ280 eventcls.dll05/08/2004  13:00            55ÿ808 eventlog.dll05/08/2004  13:00             9ÿ216 eventvwr.exe05/08/2004  13:00            56ÿ286 eventvwr.msc05/08/2004  13:00             8ÿ424 exe2bin.exe05/08/2004  13:00            16ÿ896 expand.exe05/08/2004  13:00           380ÿ957 expsrv.dll05/08/2004  13:00           611ÿ328 COMCTL32.NU605/08/2004  13:00            45ÿ568 extrac32.exe05/08/2004  13:00           121ÿ856 exts.dll05/08/2004  13:00               882 fastopen.exe05/08/2004  13:00            80ÿ896 faultrep.dll05/08/2004  13:00            14ÿ848 fc.exe05/08/2004  13:00            21ÿ504 feclient.dll05/08/2004  13:00           611ÿ328 comctl32.dll05/08/2004  13:00           348ÿ160 filemgmt.dll05/08/2004  13:00             9ÿ216 find.exe05/08/2004  13:00            29ÿ184 findstr.exe05/08/2004  13:00            10ÿ240 finger.exe05/08/2004  13:00            80ÿ384 firewall.cpl05/08/2004  13:00             3ÿ072 fixmapi.exe05/08/2004  13:00            88ÿ064 fldrclnr.dll05/08/2004  13:00            16ÿ896 fltlib.dll05/08/2004  13:00            22ÿ528 fltMc.exe05/08/2004  13:00             3ÿ584 comcat.dll05/08/2004  13:00            25ÿ600 comaddin.dll05/08/2004  13:00            16ÿ384 fmifs.dll05/08/2004  13:00            44ÿ544 alg.exe05/08/2004  13:00           386ÿ560 fontext.dll05/08/2004  13:00            79ÿ360 fontsub.dll05/08/2004  13:00            21ÿ504 fontview.exe05/08/2004  13:00             7ÿ168 forcedos.exe05/08/2004  13:00            25ÿ600 format.com05/08/2004  13:00             9ÿ344 framebuf.dll05/08/2004  13:00            55ÿ808 freecell.exe05/08/2004  13:00            32ÿ409 fsmgmt.msc05/08/2004  13:00           193ÿ024 fsquirt.exe05/08/2004  13:00            81ÿ920 fsusd.dll05/08/2004  13:00            61ÿ952 fsutil.exe05/08/2004  13:00            46ÿ080 ftp.exe05/08/2004  13:00           177ÿ152 ftsrch.dll05/08/2004  13:00            60ÿ416 fwcfg.dll05/08/2004  13:00            41ÿ472 g711codc.ax05/08/2004  13:00            98ÿ304 ahui.exe05/08/2004  13:00            24ÿ006 gb2312.uce05/08/2004  13:00            77ÿ824 gcdef.dll05/08/2004  13:00            24ÿ576 gdi.exe05/08/2004  13:00           378ÿ880 wzcdlg.dll05/08/2004  13:00            24ÿ772 geo.nls05/08/2004  13:00           634ÿ880 getuname.dll05/08/2004  13:00           285ÿ184 glmf32.dll05/08/2004  13:00           123ÿ904 glu32.dll05/08/2004  13:00           101ÿ888 gpkcsp.dll05/08/2004  13:00            10ÿ240 gpkrsrc.dll05/08/2004  13:00            26ÿ112 graftabl.com05/08/2004  13:00            19ÿ902 graphics.com05/08/2004  13:00            21ÿ232 graphics.pro05/08/2004  13:00            39ÿ424 grpconv.exe05/08/2004  13:00            26ÿ624 cnvfat.dll05/08/2004  13:00           266ÿ752 h323.tsp05/08/2004  13:00           101ÿ888 advpack.dll05/08/2004  13:00           614ÿ912 h323msp.dll05/08/2004  13:00           131ÿ968 hal.dll05/08/2004  13:00             7ÿ168 hccoin.dll05/08/2004  13:00           157ÿ184 hdwwiz.cpl05/08/2004  13:00            16ÿ384 help.exe05/08/2004  13:00            51ÿ712 wzcsapi.dll05/08/2004  13:00           359ÿ936 wzcsvc.dll05/08/2004  13:00            20ÿ992 hid.dll05/08/2004  13:00            30ÿ208 hidphone.tsp05/08/2004  13:00             4ÿ912 himem.sys05/08/2004  13:00            91ÿ648 xactsrv.dll05/08/2004  13:00            32ÿ768 cnetcfg.dll05/08/2004  13:00            50ÿ688 cnbjmon.dll05/08/2004  13:00           347ÿ648 hnetcfg.dll05/08/2004  13:00            15ÿ360 hnetmon.dll05/08/2004  13:00           336ÿ384 hnetwiz.dll05/08/2004  13:00               929 homepage.inf05/08/2004  13:00             8ÿ704 hostname.exe05/08/2004  13:00           146ÿ944 hotplug.dll05/08/2004  13:00            18ÿ432 wtsapi32.dll05/08/2004  13:00            51ÿ200 wstdecod.dll05/08/2004  13:00            25ÿ088 wsock32.dll05/08/2004  13:00            44ÿ544 hticons.dll05/08/2004  13:00           425ÿ472 html.iec05/08/2004  13:00            24ÿ576 httpapi.dll05/08/2004  13:00            43ÿ008 htui.dll05/08/2004  13:00            40ÿ960 cmutil.dll05/08/2004  13:00           199ÿ680 iac25_32.ax05/08/2004  13:00            23ÿ552 iasacct.dll05/08/2004  13:00            41ÿ472 iasads.dll05/08/2004  13:00            32ÿ256 iashlpr.dll05/08/2004  13:00            62ÿ464 iasnap.dll05/08/2004  13:00            17ÿ920 iaspolcy.dll05/08/2004  13:00           119ÿ808 iasrad.dll05/08/2004  13:00           141ÿ312 iasrecst.dll05/08/2004  13:00            86ÿ528 iassam.dll05/08/2004  13:00           253ÿ440 iassdo.dll05/08/2004  13:00            62ÿ976 iassvcs.dll05/08/2004  13:00            11ÿ264 icaapi.dll05/08/2004  13:00            80ÿ384 iccvid.dll05/08/2004  13:00            16ÿ384 icfgnt5.dll05/08/2004  13:00            65ÿ536 cmstp.exe05/08/2004  13:00             3ÿ584 icmp.dll05/08/2004  13:00            56ÿ320 icmui.dll05/08/2004  13:00            73ÿ728 icwdial.dll05/08/2004  13:00            65ÿ536 icwphbk.dll05/08/2004  13:00            60ÿ458 ideograf.uce05/08/2004  13:00           685ÿ056 advapi32.dll05/08/2004  13:00           121ÿ856 idq.dll05/08/2004  13:00            34ÿ304 ie4uinit.exe05/08/2004  13:00           139ÿ264 ieakeng.dll05/08/2004  13:00           221ÿ696 ieaksie.dll05/08/2004  13:00           245ÿ760 ieakui.dll05/08/2004  13:00           323ÿ584 iedkcs32.dll05/08/2004  13:00            81ÿ920 ieencode.dll05/08/2004  13:00            13ÿ824 cmsetACL.dll05/08/2004  13:00            49ÿ152 iernonce.dll05/08/2004  13:00            63ÿ488 iesetup.dll05/08/2004  13:00            46ÿ298 ieuinit.inf05/08/2004  13:00           114ÿ688 iexpress.exe05/08/2004  13:00           142ÿ848 ifmon.dll05/08/2004  13:00            70ÿ656 ifsutil.dll05/08/2004  13:00             8ÿ192 igmpagnt.dll05/08/2004  13:00            81ÿ920 ils.dll05/08/2004  13:00            16ÿ384 imaadp32.acm05/08/2004  13:00           144ÿ384 imagehlp.dll05/08/2004  13:00            42ÿ496 wsnmp32.dll05/08/2004  13:00            19ÿ968 wshtcpip.dll05/08/2004  13:00            11ÿ776 WshRm.dll05/08/2004  13:00            98ÿ304 wshom.ocx05/08/2004  13:00           150ÿ016 imapi.exe05/08/2004  13:00            36ÿ921 imeshare.dll05/08/2004  13:00            35ÿ840 imgutil.dll05/08/2004  13:00           110ÿ080 imm32.dll05/08/2004  13:00           282ÿ624 inetcfg.dll05/08/2004  13:00           678ÿ400 inetcomm.dll05/08/2004  13:00           359ÿ936 inetcpl.cpl05/08/2004  13:00           121ÿ856 inetcplc.dll05/08/2004  13:00            33ÿ280 inetmib1.dll05/08/2004  13:00            75ÿ264 inetpp.dll05/08/2004  13:00            16ÿ384 inetppui.dll05/08/2004  13:00            50ÿ688 inetres.dll05/08/2004  13:00           450ÿ560 infosoft.dll05/08/2004  13:00           147ÿ456 initpki.dll05/08/2004  13:00             7ÿ168 wshnetbs.dll05/08/2004  13:00           126ÿ464 input.dll05/08/2004  13:00           191ÿ488 cmprops.dll05/08/2004  13:00           956ÿ990 instcat.sql05/08/2004  13:00           134ÿ144 intl.cpl05/08/2004  13:00            39ÿ936 iologmsg.dll05/08/2004  13:00            17ÿ408 ipconf.tsp05/08/2004  13:00            58ÿ368 ipconfig.exe05/08/2004  13:00            11ÿ776 wshisn.dll05/08/2004  13:00            95ÿ744 iphlpapi.dll05/08/2004  13:00           167ÿ424 ipmontr.dll05/08/2004  13:00           332ÿ800 ipnathlp.dll05/08/2004  13:00            14ÿ336 wship6.dll05/08/2004  13:00            57ÿ392 wshfr.dll05/08/2004  13:00            65ÿ536 wshext.dll05/08/2004  13:00            28ÿ672 wshcon.dll05/08/2004  13:00           108ÿ032 wshbth.dll05/08/2004  13:00             9ÿ216 wshatm.dll05/08/2004  13:00           148ÿ480 wscui.cpl05/08/2004  13:00           355ÿ840 ippromon.dll05/08/2004  13:00            81ÿ408 wscsvc.dll05/08/2004  13:00           114ÿ688 wscript.exe05/08/2004  13:00            13ÿ824 wscntfy.exe05/08/2004  13:00            82ÿ944 ws2_32.dll05/08/2004  13:00             3ÿ584 iprop.dll05/08/2004  13:00             4ÿ096 iprtprio.dll05/08/2004  13:00           169ÿ984 iprtrmgr.dll05/08/2004  13:00            27ÿ648 conime.exe05/08/2004  13:00           361ÿ472 ipsecsnp.dll05/08/2004  13:00           184ÿ320 ipsecsvc.dll05/08/2004  13:00           388ÿ096 ipsmsnap.dll05/08/2004  13:00            53ÿ760 ipv6.exe05/08/2004  13:00            59ÿ904 ipv6mon.dll05/08/2004  13:00            91ÿ648 ipxmontr.dll05/08/2004  13:00            74ÿ240 ipxpromn.dll05/08/2004  13:00            21ÿ504 ipxrip.dll05/08/2004  13:00            24ÿ576 ipxroute.exe05/08/2004  13:00            39ÿ936 ipxrtmgr.dll05/08/2004  13:00            66ÿ560 ipxsap.dll05/08/2004  13:00            20ÿ992 ipxwan.dll05/08/2004  13:00           199ÿ168 ir32_32.dll05/08/2004  13:00           848ÿ384 ir41_32.ax05/08/2004  13:00           120ÿ320 ir41_qc.dll05/08/2004  13:00           338ÿ432 ir41_qcx.dll05/08/2004  13:00           755ÿ200 ir50_32.dll05/08/2004  13:00           200ÿ192 ir50_qc.dll05/08/2004  13:00           183ÿ808 ir50_qcx.dll05/08/2004  13:00            13ÿ312 irclass.dll05/08/2004  13:00           380ÿ928 irprops.cpl05/08/2004  13:00            86ÿ016 isign32.dll05/08/2004  13:00            32ÿ768 isrdbg32.dll05/08/2004  13:00            14ÿ336 cmpbk32.dll05/08/2004  13:00                64 cmos.ram05/08/2004  13:00            40ÿ448 cmmon32.exe05/08/2004  13:00           154ÿ624 ivfsrc.ax05/08/2004  13:00            54ÿ784 ixsso.dll05/08/2004  13:00            47ÿ616 iyuv_32.dll05/08/2004  13:00           362ÿ496 jet500.dll05/08/2004  13:00            19ÿ968 ws2help.dll05/08/2004  13:00             5ÿ632 write.exe05/08/2004  13:00            32ÿ768 wpnpinst.exe05/08/2004  13:00            44ÿ544 jgaw400.dll05/08/2004  13:00           144ÿ896 jgdw400.dll05/08/2004  13:00            35ÿ840 jgmd400.dll05/08/2004  13:00            42ÿ496 jgpl400.dll05/08/2004  13:00            45ÿ568 jgsd400.dll05/08/2004  13:00            65ÿ536 jgsh400.dll05/08/2004  13:00            49ÿ488 jobexec.dll05/08/2004  13:00            70ÿ144 joy.cpl05/08/2004  13:00           450ÿ560 jscript.dll05/08/2004  13:00            28ÿ719 jsfr.dll05/08/2004  13:00            15ÿ872 jsproxy.dll05/08/2004  13:00             6ÿ948 kanji_1.uce05/08/2004  13:00             8ÿ484 kanji_2.uce05/08/2004  13:00            14ÿ841 kb16.com05/08/2004  13:00             6ÿ656 KBDAL.DLL05/08/2004  13:00             5ÿ632 kbdaze.dll05/08/2004  13:00             5ÿ632 kbdazel.dll05/08/2004  13:00             6ÿ144 kbdbe.dll05/08/2004  13:00             6ÿ144 kbdbene.dll05/08/2004  13:00             5ÿ632 kbdblr.dll05/08/2004  13:00             6ÿ144 kbdbr.dll05/08/2004  13:00             5ÿ632 kbdbu.dll05/08/2004  13:00             6ÿ144 kbdca.dll05/08/2004  13:00             7ÿ680 kbdcan.dll05/08/2004  13:00             6ÿ656 kbdcr.dll05/08/2004  13:00             7ÿ168 kbdcz.dll05/08/2004  13:00             6ÿ656 kbdcz1.dll05/08/2004  13:00             6ÿ656 kbdcz2.dll05/08/2004  13:00             6ÿ144 kbdda.dll05/08/2004  13:00             5ÿ120 kbddv.dll05/08/2004  13:00             6ÿ144 kbdes.dll05/08/2004  13:00             6ÿ144 kbdest.dll05/08/2004  13:00             6ÿ144 kbdfc.dll05/08/2004  13:00             6ÿ144 kbdfi.dll05/08/2004  13:00             7ÿ168 kbdfi1.dll05/08/2004  13:00             6ÿ144 kbdfo.dll05/08/2004  13:00             6ÿ144 kbdfr.dll05/08/2004  13:00             5ÿ632 kbdgae.dll05/08/2004  13:00             6ÿ144 kbdgkl.dll05/08/2004  13:00             6ÿ144 kbdgr.dll05/08/2004  13:00             6ÿ144 kbdgr1.dll05/08/2004  13:00             5ÿ632 kbdhe.dll05/08/2004  13:00             5ÿ632 kbdhe220.dll05/08/2004  13:00             5ÿ632 kbdhe319.dll05/08/2004  13:00             6ÿ144 kbdhela2.dll05/08/2004  13:00             6ÿ656 kbdhela3.dll05/08/2004  13:00             8ÿ192 kbdhept.dll05/08/2004  13:00             6ÿ656 kbdhu.dll05/08/2004  13:00             5ÿ632 kbdhu1.dll05/08/2004  13:00             6ÿ144 kbdic.dll05/08/2004  13:00             6ÿ144 kbdinbe1.dll05/08/2004  13:00             6ÿ656 kbdinben.dll05/08/2004  13:00             6ÿ656 kbdinmal.dll05/08/2004  13:00             5ÿ632 kbdir.dll05/08/2004  13:00             5ÿ632 kbdit.dll05/08/2004  13:00             5ÿ632 kbdit142.dll05/08/2004  13:00             5ÿ632 kbdkaz.dll05/08/2004  13:00             5ÿ632 kbdkyr.dll05/08/2004  13:00             6ÿ656 kbdla.dll05/08/2004  13:00             5ÿ632 kbdlt.dll05/08/2004  13:00             5ÿ632 kbdlt1.dll05/08/2004  13:00             6ÿ144 kbdlv.dll05/08/2004  13:00             6ÿ144 kbdlv1.dll05/08/2004  13:00             6ÿ144 kbdmac.dll05/08/2004  13:00             5ÿ632 kbdmaori.dll05/08/2004  13:00             6ÿ144 kbdmlt47.dll05/08/2004  13:00             6ÿ144 kbdmlt48.dll05/08/2004  13:00             5ÿ632 kbdmon.dll05/08/2004  13:00             6ÿ144 kbdne.dll05/08/2004  13:00             7ÿ168 kbdnec.dll05/08/2004  13:00             6ÿ144 kbdno.dll05/08/2004  13:00             7ÿ168 kbdno1.dll05/08/2004  13:00             6ÿ656 kbdpl.dll05/08/2004  13:00             5ÿ632 kbdpl1.dll05/08/2004  13:00             6ÿ144 kbdpo.dll05/08/2004  13:00             5ÿ632 kbdro.dll05/08/2004  13:00             5ÿ632 kbdru.dll05/08/2004  13:00             5ÿ632 kbdru1.dll05/08/2004  13:00             6ÿ144 kbdsf.dll05/08/2004  13:00             6ÿ656 kbdsg.dll05/08/2004  13:00             6ÿ656 kbdsl.dll05/08/2004  13:00             6ÿ656 kbdsl1.dll05/08/2004  13:00             7ÿ680 kbdsmsfi.dll05/08/2004  13:00             7ÿ680 kbdsmsno.dll05/08/2004  13:00             6ÿ144 kbdsp.dll05/08/2004  13:00             6ÿ144 kbdsw.dll05/08/2004  13:00             5ÿ632 kbdtat.dll05/08/2004  13:00             6ÿ144 kbdtuf.dll05/08/2004  13:00             6ÿ144 kbdtuq.dll05/08/2004  13:00             5ÿ632 kbduk.dll05/08/2004  13:00             7ÿ168 kbdukx.dll05/08/2004  13:00             5ÿ632 kbdur.dll05/08/2004  13:00             5ÿ632 kbdus.dll05/08/2004  13:00             6ÿ144 kbdusl.dll05/08/2004  13:00             6ÿ144 kbdusr.dll05/08/2004  13:00             6ÿ144 kbdusx.dll05/08/2004  13:00             5ÿ632 kbduzb.dll05/08/2004  13:00             5ÿ632 kbdycc.dll05/08/2004  13:00             6ÿ656 kbdycl.dll05/08/2004  13:00             7ÿ424 kd1394.dll05/08/2004  13:00             7ÿ040 kdcom.dll05/08/2004  13:00            72ÿ365 cmmgr32.hlp05/08/2004  13:00         1ÿ048ÿ576 kernel32.dll05/08/2004  13:00            42ÿ809 key01.sys05/08/2004  13:00             2ÿ000 keyboard.drv05/08/2004  13:00            42ÿ537 keyboard.sys05/08/2004  13:00           157ÿ184 keymgr.dll05/08/2004  13:00            33ÿ280 kmddsp.tsp05/08/2004  13:00            12ÿ876 korean.uce05/08/2004  13:00            92ÿ608 krnl386.exe05/08/2004  13:00            47ÿ104 cmdl32.exe05/08/2004  13:00           352ÿ256 cmdial32.dll05/08/2004  13:00           290ÿ816 l3codeca.acm05/08/2004  13:00           346ÿ112 confmsp.dll05/08/2004  13:00            83ÿ456 l3codecx.ax05/08/2004  13:00             9ÿ728 label.exe05/08/2004  13:00            89ÿ600 langwrbk.dll05/08/2004  13:00           224ÿ448 lanman.drv05/08/2004  13:00           400ÿ896 cmd.exe05/08/2004  13:00            15ÿ872 cmcfg32.dll05/08/2004  13:00            57ÿ856 clusapi.dll05/08/2004  13:00           102ÿ912 apcups.dll05/08/2004  13:00            33ÿ280 clipsrv.exe05/08/2004  13:00           104ÿ448 clipbrd.exe05/08/2004  13:00            28ÿ672 cliconfg.rll05/08/2004  13:00            32ÿ256 wpabaln.exe05/08/2004  13:00           263ÿ680 adsnt.dll05/08/2004  13:00            68ÿ096 adsmsext.dll05/08/2004  13:00            14ÿ336 wowfaxui.dll05/08/2004  13:00             3ÿ200 wowfax.dll05/08/2004  13:00            10ÿ608 wowexec.exe05/08/2004  13:00             2ÿ736 wowdeb.exe05/08/2004  13:00           424ÿ960 licdll.dll05/08/2004  13:00            22ÿ528 licmgr10.dll05/08/2004  13:00            58ÿ880 licwmi.dll05/08/2004  13:00            30ÿ208 lights.exe05/08/2004  13:00            20ÿ480 cliconfg.exe05/08/2004  13:00            13ÿ824 lmhsvc.dll05/08/2004  13:00           399ÿ872 lmrt.dll05/08/2004  13:00            26ÿ624 lnkstub.exe05/08/2004  13:00             1ÿ187 loadfix.com05/08/2004  13:00           100ÿ352 loadperf.dll05/08/2004  13:00           143ÿ360 adsldpc.dll05/08/2004  13:00           249ÿ270 locale.nls05/08/2004  13:00           228ÿ352 localsec.dll05/08/2004  13:00           344ÿ576 localspl.dll05/08/2004  13:00            11ÿ776 localui.dll05/08/2004  13:00            75ÿ264 locator.exe05/08/2004  13:00             5ÿ120 lodctr.exe05/08/2004  13:00            67ÿ072 console.dll05/08/2004  13:00            50ÿ688 loghours.dll05/08/2004  13:00            61ÿ952 logman.exe05/08/2004  13:00            15ÿ872 logoff.exe05/08/2004  13:00           221ÿ696 logon.scr05/08/2004  13:00           515ÿ584 logonui.exe05/08/2004  13:00           175ÿ616 adsldp.dll05/08/2004  13:00            22ÿ016 lpk.dll05/08/2004  13:00             6ÿ144 lpq.exe05/08/2004  13:00             9ÿ216 lpr.exe05/08/2004  13:00            10ÿ240 lprhelp.dll05/08/2004  13:00             9ÿ216 lprmonui.dll05/08/2004  13:00            77ÿ824 cliconfg.dll05/08/2004  13:00            13ÿ312 lsass.exe05/08/2004  13:00           265ÿ216 wow32.dll05/08/2004  13:00            61ÿ126 cliconf.chm05/08/2004  13:00           258ÿ048 wmvds32.ax05/08/2004  13:00            30ÿ720 xcopy.exe05/08/2004  13:00            65ÿ536 cleanmgr.exe05/08/2004  13:00            41ÿ847 lusrmgr.msc05/08/2004  13:00             2ÿ560 lz32.dll05/08/2004  13:00             9ÿ936 lzexpand.dll05/08/2004  13:00               168 l_except.nls05/08/2004  13:00             7ÿ046 l_intl.nls05/08/2004  13:00            73ÿ216 magnify.exe05/08/2004  13:00             8ÿ192 mag_hook.dll05/08/2004  13:00           189ÿ952 main.cpl05/08/2004  13:00            85ÿ504 makecab.exe05/08/2004  13:00           112ÿ128 mapi32.dll05/08/2004  13:00           112ÿ128 mapistub.dll05/08/2004  13:00            14ÿ848 mcastmib.dll05/08/2004  13:00            10ÿ240 mcd32.dll05/08/2004  13:00            10ÿ496 mcdsrv32.dll05/08/2004  13:00             4ÿ608 mchgrcoi.dll05/08/2004  13:00            73ÿ680 mciavi.drv05/08/2004  13:00            85ÿ504 mciavi32.dll05/08/2004  13:00            17ÿ408 mcicda.dll05/08/2004  13:00             8ÿ192 mciole16.dll05/08/2004  13:00             7ÿ680 mciole32.dll05/08/2004  13:00            35ÿ328 mciqtz32.dll05/08/2004  13:00            23ÿ040 mciseq.dll05/08/2004  13:00            25ÿ280 mciseq.drv05/08/2004  13:00            23ÿ552 mciwave.dll05/08/2004  13:00            28ÿ160 mciwave.drv05/08/2004  13:00            50ÿ176 mdhcp.dll05/08/2004  13:00           120ÿ320 mdminst.dll05/08/2004  13:00           147ÿ968 mdwmdmsp.dll05/08/2004  13:00            39ÿ434 mem.exe05/08/2004  13:00            39ÿ936 mf3216.dll05/08/2004  13:00           924ÿ432 mfc40.dll05/08/2004  13:00            45ÿ568 mfc40loc.dll05/08/2004  13:00           924ÿ432 mfc40u.dll05/08/2004  13:00         1ÿ028ÿ096 mfc42.dll05/08/2004  13:00            57ÿ344 mfc42loc.dll05/08/2004  13:00         1ÿ024ÿ000 mfc42u.dll05/08/2004  13:00            11ÿ264 clb.dll05/08/2004  13:00            22ÿ528 mfcsubs.dll05/08/2004  13:00             7ÿ680 ckcnv.exe05/08/2004  13:00            14ÿ848 mgmtapi.dll05/08/2004  13:00            46ÿ258 mib.bin05/08/2004  13:00            18ÿ944 midimap.dll05/08/2004  13:00            60ÿ928 miglibnt.dll05/08/2004  13:00            52ÿ736 migpwd.exe05/08/2004  13:00            18ÿ944 mimefilt.dll05/08/2004  13:00             5ÿ632 cisvc.exe05/08/2004  13:00           673ÿ088 mlang.dat05/08/2004  13:00           586ÿ240 mlang.dll05/08/2004  13:00             3ÿ584 mll_hp.dll05/08/2004  13:00             7ÿ680 mll_mtf.dll05/08/2004  13:00             5ÿ632 mll_qic.dll05/08/2004  13:00           816ÿ128 mmc.exe05/08/2004  13:00            79ÿ872 mmcbase.dll05/08/2004  13:00         1ÿ198ÿ080 mmcndmgr.dll05/08/2004  13:00            26ÿ112 adptif.dll05/08/2004  13:00             1ÿ490 mmdriver.inf05/08/2004  13:00            12ÿ288 mmdrv.dll05/08/2004  13:00            17ÿ920 mmfutil.dll05/08/2004  13:00           278ÿ559 wmv8ds32.ax05/08/2004  13:00           626ÿ176 mmsys.cpl05/08/2004  13:00            70ÿ688 mmsystem.dll05/08/2004  13:00            69ÿ120 ciodm.dll05/08/2004  13:00           119ÿ808 mmutilse.dll05/08/2004  13:00            34ÿ560 mnmdd.dll05/08/2004  13:00            32ÿ768 mnmsrvc.exe05/08/2004  13:00           210ÿ432 mobsync.dll05/08/2004  13:00           144ÿ384 mobsync.exe05/08/2004  13:00            19ÿ456 mode.com05/08/2004  13:00           156ÿ160 modemui.dll05/08/2004  13:00            10ÿ112 modex.dll05/08/2004  13:00            15ÿ872 more.com05/08/2004  13:00             8ÿ192 cidaemon.exe05/08/2004  13:00             8ÿ192 mountvol.exe05/08/2004  13:00             2ÿ032 mouse.drv05/08/2004  13:00           310ÿ272 mp43dmod.dll05/08/2004  13:00           384ÿ512 mp4sdmod.dll05/08/2004  13:00           118ÿ272 mpeg2data.ax05/08/2004  13:00           148ÿ992 mpg2splt.ax05/08/2004  13:00           240ÿ640 mpg4dmod.dll05/08/2004  13:00           262ÿ144 mpg4ds32.ax05/08/2004  13:00           124ÿ928 mplay32.exe05/08/2004  13:00            22ÿ016 mpnotify.exe05/08/2004  13:00            59ÿ904 mpr.dll05/08/2004  13:00            87ÿ040 mprapi.dll05/08/2004  13:00            69ÿ120 mprddm.dll05/08/2004  13:00            49ÿ152 mprdim.dll05/08/2004  13:00           114ÿ688 mprmsg.dll05/08/2004  13:00            47ÿ616 mprui.dll05/08/2004  13:00            14ÿ336 mrinfo.exe05/08/2004  13:00            61ÿ440 admparse.dll05/08/2004  13:00           102ÿ912 msaatext.dll05/08/2004  13:00            61ÿ312 msacm.dll05/08/2004  13:00            72ÿ192 msacm32.dll05/08/2004  13:00            20ÿ992 msacm32.drv05/08/2004  13:00           221ÿ184 msadds32.ax05/08/2004  13:00            14ÿ848 msadp32.acm05/08/2004  13:00             3ÿ584 msafd.dll05/08/2004  13:00            86ÿ016 msapsspc.dll05/08/2004  13:00            57ÿ344 msasn1.dll05/08/2004  13:00           294ÿ912 msaud32.acm05/08/2004  13:00            77ÿ312 msaudite.dll05/08/2004  13:00           303ÿ616 wmstream.dll05/08/2004  13:00             7ÿ168 mscat32.dll05/08/2004  13:00               817 mscdexnt.exe05/08/2004  13:00           109ÿ568 cic.dll05/08/2004  13:00            69ÿ632 msconf.dll05/08/2004  13:00            12ÿ288 mscpx32r.dLL05/08/2004  13:00            36ÿ864 mscpxl32.dLL05/08/2004  13:00           294ÿ400 MSCTF.dll05/08/2004  13:00           177ÿ152 MSCTFIME.IME05/08/2004  13:00            69ÿ120 MSCTFP.dll05/08/2004  13:00           118ÿ784 msdadiag.dll05/08/2004  13:00           151ÿ552 msdart.dll05/08/2004  13:00            12ÿ288 msdatsrc.tlb05/08/2004  13:00            14ÿ336 msdmo.dll05/08/2004  13:00             6ÿ144 msdtc.exe05/08/2004  13:00            58ÿ880 msdtclog.dll05/08/2004  13:00               768 msdtcprf.h05/08/2004  13:00             3ÿ914 msdtcprf.ini05/08/2004  13:00            41ÿ461 ciadv.msc05/08/2004  13:00           166ÿ400 ciadmin.dll05/08/2004  13:00            11ÿ264 chkntfs.exe05/08/2004  13:00           848ÿ922 msdxm.ocx05/08/2004  13:00             4ÿ126 msdxmlc.dll05/08/2004  13:00            94ÿ282 msencode.dll05/08/2004  13:00           512ÿ029 msexch40.dll05/08/2004  13:00           319ÿ517 msexcl40.dll05/08/2004  13:00            50ÿ176 xmlprovi.dll05/08/2004  13:00           537ÿ088 msftedit.dll05/08/2004  13:00            22ÿ528 msg.exe05/08/2004  13:00             9ÿ216 msg711.acm05/08/2004  13:00           118ÿ784 msg723.acm05/08/2004  13:00         1ÿ004ÿ032 msgina.dll05/08/2004  13:00            11ÿ776 chkdsk.exe05/08/2004  13:00            19ÿ968 msgsm32.acm05/08/2004  13:00            33ÿ792 msgsvc.dll05/08/2004  13:00           188ÿ416 msh261.drv05/08/2004  13:00           294ÿ912 msh263.drv05/08/2004  13:00           128ÿ000 mshearts.exe05/08/2004  13:00            29ÿ184 mshta.exe05/08/2004  13:00           445ÿ440 xpob2res.dll05/08/2004  13:00         1ÿ351ÿ168 mshtml.tlb05/08/2004  13:00             7ÿ680 chcp.com05/08/2004  13:00            57ÿ344 mshtmler.dll05/08/2004  13:00                75 ChaŒnes.scf05/08/2004  13:00            51ÿ712 msident.dll05/08/2004  13:00             6ÿ656 msidle.dll05/08/2004  13:00            16ÿ896 msidntld.dll05/08/2004  13:00           252ÿ416 msieftp.dll05/08/2004  13:00            80ÿ896 charmap.exe05/08/2004  13:00            16ÿ896 cfgmgr32.dll05/08/2004  13:00             4ÿ608 msimg32.dll05/08/2004  13:00            39ÿ424 cfgbkend.dll05/08/2004  13:00            41ÿ990 certmgr.msc05/08/2004  13:00           159ÿ232 MSIMTF.dll05/08/2004  13:00           467ÿ968 certmgr.dll05/08/2004  13:00           200ÿ192 certcli.dll05/08/2004  13:00            15ÿ872 cdmodem.dll05/08/2004  13:00         1ÿ507ÿ356 msjet40.dll05/08/2004  13:00           358ÿ976 msjetoledb40.dll05/08/2004  13:00           115ÿ200 wmsdmoe.dll05/08/2004  13:00           184ÿ351 msjint40.dll05/08/2004  13:00            27ÿ648 ccfgnt.dll05/08/2004  13:00            53ÿ279 msjter40.dll05/08/2004  13:00           241ÿ693 msjtes40.dll05/08/2004  13:00            25ÿ600 mslbui.dll05/08/2004  13:00             3ÿ072 CONFIG.TMP05/08/2004  13:00           146ÿ432 msls31.dll05/08/2004  13:00           213ÿ023 msltus40.dll05/08/2004  13:00            85ÿ504 catsrvps.dll05/08/2004  13:00           290ÿ816 msnsspc.dll05/08/2004  13:00            37ÿ376 msobjs.dll05/08/2004  13:00           252ÿ928 msoeacct.dll05/08/2004  13:00           105ÿ984 msoert2.dll05/08/2004  13:00            24ÿ576 msorc32r.dll05/08/2004  13:00           143ÿ360 msorcl32.dll05/08/2004  13:00           359ÿ936 cards.dll05/08/2004  13:00           347ÿ648 mspaint.exe05/08/2004  13:00            30ÿ208 mspatcha.dll05/08/2004  13:00           348ÿ189 mspbde40.dll05/08/2004  13:00           146ÿ432 capesnpn.dll05/08/2004  13:00            50ÿ688 camocx.dll05/08/2004  13:00            43ÿ008 msports.dll05/08/2004  13:00            48ÿ128 msprivs.dll05/08/2004  13:00            69ÿ632 msr2c.dll05/08/2004  13:00             7ÿ168 msr2cenu.dll05/08/2004  13:00            65ÿ536 msratelc.dll05/08/2004  13:00           115ÿ200 calc.exe05/08/2004  13:00            73ÿ802 msrclr40.dll05/08/2004  13:00            19ÿ456 cacls.exe05/08/2004  13:00           421ÿ919 msrd2x40.dll05/08/2004  13:00           315ÿ423 msrd3x40.dll05/08/2004  13:00            85ÿ504 cabview.dll05/08/2004  13:00            28ÿ746 msrecr40.dll05/08/2004  13:00            59ÿ904 cabinet.dll05/08/2004  13:00           552ÿ989 msrepl40.dll05/08/2004  13:00            11ÿ264 msrle32.dll05/08/2004  13:00           134ÿ656 mssap.dll05/08/2004  13:00            69ÿ632 msscds32.ax05/08/2004  13:00            50ÿ688 btpanui.dll05/08/2004  13:00           102ÿ400 msscript.ocx05/08/2004  13:00            36ÿ352 mssign32.dll05/08/2004  13:00             4ÿ608 mssip32.dll05/08/2004  13:00           101ÿ888 actxprxy.dll05/08/2004  13:00            30ÿ208 bthserv.dll05/08/2004  13:00             9ÿ037 ansi.sys05/08/2004  13:00            13ÿ312 msswch.dll05/08/2004  13:00             6ÿ656 msswchx.exe05/08/2004  13:00           281ÿ600 mstask.dll05/08/2004  13:00           258ÿ077 mstext40.dll05/08/2004  13:00           110ÿ592 bthprops.cpl05/08/2004  13:00            12ÿ288 mstinit.exe05/08/2004  13:00           115ÿ712 mstlsapi.dll05/08/2004  13:00           411ÿ648 mstsc.exe05/08/2004  13:00           655ÿ360 mstscax.dll05/08/2004  13:00           195ÿ584 msutb.dll05/08/2004  13:00           129ÿ536 msv1_0.dll05/08/2004  13:00         1ÿ355ÿ776 msvbvm50.dll05/08/2004  13:00         1ÿ392ÿ671 msvbvm60.dll05/08/2004  13:00           851ÿ968 comres.dll05/08/2004  13:00            54ÿ784 msvcirt.dll05/08/2004  13:00           565ÿ760 msvcp50.dll05/08/2004  13:00           413ÿ696 msvcp60.dll05/08/2004  13:00            20ÿ992 bthci.dll05/08/2004  13:00            46ÿ080 ipsec6.exe05/08/2004  13:00           343ÿ040 msvcrt.dll05/08/2004  13:00           253ÿ952 msvcrt20.dll05/08/2004  13:00            61ÿ440 msvcrt40.dll05/08/2004  13:00           121ÿ856 msvfw32.dll05/08/2004  13:00            25ÿ600 msvidc32.dll05/08/2004  13:00         1ÿ433ÿ600 msvidctl.dll05/08/2004  13:00           127ÿ168 msvideo.dll05/08/2004  13:00            72ÿ704 msw3prt.dll05/08/2004  13:00           831ÿ519 mswdat10.dll05/08/2004  13:00           204ÿ800 mswebdvd.dll05/08/2004  13:00            78ÿ336 browsewm.dll05/08/2004  13:00           247ÿ808 mswsock.dll05/08/2004  13:00           614ÿ429 mswstr10.dll05/08/2004  13:00           348ÿ189 msxbde40.dll05/08/2004  13:00           506ÿ368 msxml.dll05/08/2004  13:00           701ÿ440 msxml2.dll05/08/2004  13:00            43ÿ792 msxml2r.dll05/08/2004  13:00         1ÿ236ÿ480 msxml3.dll05/08/2004  13:00            51ÿ200 msxml3r.dll05/08/2004  13:00            12ÿ642 append.exe05/08/2004  13:00            77ÿ312 browser.dll05/08/2004  13:00            30ÿ720 msxmlr.dll05/08/2004  13:00            17ÿ408 msyuv.dll05/08/2004  13:00            70ÿ144 browselc.dll05/08/2004  13:00            20ÿ480 mtxdm.dll05/08/2004  13:00             4ÿ096 mtxex.dll05/08/2004  13:00            25ÿ088 mtxlegih.dll05/08/2004  13:00            22ÿ984 bopomofo.uce05/08/2004  13:00            90ÿ624 mycomput.dll05/08/2004  13:00            91ÿ648 mydocs.dll05/08/2004  13:00            55ÿ296 narrator.exe05/08/2004  13:00            36ÿ352 narrhook.dll05/08/2004  13:00            21ÿ504 nbtstat.exe05/08/2004  13:00            36ÿ352 ncobjapi.dll05/08/2004  13:00            35ÿ840 ncpa.cpl05/08/2004  13:00             5ÿ120 bootvrfy.exe05/08/2004  13:00             7ÿ680 ncxpnt.dll05/08/2004  13:00            18ÿ432 nddeapi.dll05/08/2004  13:00             4ÿ096 nddeapir.exe05/08/2004  13:00            19ÿ456 nddenb32.dll05/08/2004  13:00            57ÿ344 ndptsp.tsp05/08/2004  13:00            19ÿ456 wmiprop.dll05/08/2004  13:00            42ÿ496 net.exe05/08/2004  13:00           121ÿ876 net.hlp05/08/2004  13:00           124ÿ928 net1.exe05/08/2004  13:00           108ÿ512 netapi.dll05/08/2004  13:00           332ÿ288 netapi32.dll05/08/2004  13:00           633ÿ856 netcfgx.dll05/08/2004  13:00           114ÿ176 netdde.exe05/08/2004  13:00           251ÿ392 netevent.dll05/08/2004  13:00           291ÿ328 neth.dll05/08/2004  13:00           144ÿ896 netid.dll05/08/2004  13:00           407ÿ040 netlogon.dll05/08/2004  13:00            12ÿ288 bootvid.dll05/08/2004  13:00           200ÿ192 netmsg.dll05/08/2004  13:00           885ÿ248 netplwiz.dll05/08/2004  13:00            12ÿ288 netrap.dll05/08/2004  13:00            25ÿ600 netsetup.cpl05/08/2004  13:00           332ÿ800 netsetup.exe05/08/2004  13:00            88ÿ576 netsh.exe05/08/2004  13:00         1ÿ723ÿ904 netshell.dll05/08/2004  13:00            37ÿ888 netstat.exe05/08/2004  13:00            83ÿ456 netui0.dll05/08/2004  13:00           245ÿ760 netui1.dll05/08/2004  13:00           312ÿ832 netui2.dll05/08/2004  13:00           251ÿ392 newdev.dll05/08/2004  13:00           103ÿ936 nlhtml.dll05/08/2004  13:00             7ÿ116 nlsfunc.exe05/08/2004  13:00            12ÿ288 nmevtmsg.dll05/08/2004  13:00            28ÿ672 nmmkcert.dll05/08/2004  13:00             1ÿ696 noise.chs05/08/2004  13:00             1ÿ696 noise.cht05/08/2004  13:00               741 noise.dat05/08/2004  13:00           149ÿ848 noise.deu05/08/2004  13:00               751 noise.eng05/08/2004  13:00               751 noise.enu05/08/2004  13:00            19ÿ684 noise.esn05/08/2004  13:00            49ÿ196 noise.fra05/08/2004  13:00            19ÿ618 noise.ita05/08/2004  13:00            13ÿ256 noise.nld05/08/2004  13:00            13ÿ730 noise.sve05/08/2004  13:00               697 noise.tha05/08/2004  13:00            70ÿ656 notepad.exe05/08/2004  13:00            55ÿ296 npptools.dll05/08/2004  13:00             4ÿ096 actmovie.exe05/08/2004  13:00            79ÿ360 nslookup.exe05/08/2004  13:00           733ÿ184 ntdll.dll05/08/2004  13:00            27ÿ916 ntdos.sys05/08/2004  13:00            29ÿ146 ntdos404.sys05/08/2004  13:00            29ÿ370 ntdos411.sys05/08/2004  13:00            29ÿ274 ntdos412.sys05/08/2004  13:00            29ÿ146 ntdos804.sys05/08/2004  13:00            67ÿ072 ntdsapi.dll05/08/2004  13:00            48ÿ794 ntimage.gif05/08/2004  13:00            34ÿ000 ntio.sys05/08/2004  13:00            34ÿ560 ntio404.sys05/08/2004  13:00            35ÿ648 ntio411.sys05/08/2004  13:00            35ÿ424 ntio412.sys05/08/2004  13:00            34ÿ560 ntio804.sys05/08/2004  13:00             4ÿ608 bootok.exe05/08/2004  13:00            43ÿ520 ntlanman.dll05/08/2004  13:00            59ÿ392 ntlanui.dll05/08/2004  13:00            14ÿ848 ntlanui2.dll05/08/2004  13:00             8ÿ192 ntlsapi.dll05/08/2004  13:00           119ÿ808 ntmarta.dll05/08/2004  13:00            40ÿ960 ntmsapi.dll05/08/2004  13:00           181ÿ248 ntmsdba.dll05/08/2004  13:00            45ÿ056 ntmsevt.dll05/08/2004  13:00           496ÿ640 ntmsmgr.dll05/08/2004  13:00            25ÿ901 ntmsmgr.msc05/08/2004  13:00            32ÿ590 ntmsoprq.msc05/08/2004  13:00           438ÿ272 ntmssvc.dll05/08/2004  13:00            71ÿ680 blastcln.exe05/08/2004  13:00            91ÿ648 ntprint.dll05/08/2004  13:00            31ÿ744 ntsd.exe05/08/2004  13:00            36ÿ864 ntsdexts.dll05/08/2004  13:00           145ÿ920 ntshrui.dll05/08/2004  13:00           420ÿ864 ntvdm.exe05/08/2004  13:00            13ÿ312 ntvdmd.dll05/08/2004  13:00           261ÿ120 nusrmgr.cpl05/08/2004  13:00             7ÿ168 bitsprx3.dll05/08/2004  13:00           147ÿ968 nwprovau.dll05/08/2004  13:00           267ÿ776 oakley.dll05/08/2004  13:00           288ÿ768 objsel.dll05/08/2004  13:00            97ÿ280 occache.dll05/08/2004  13:00            63ÿ488 wmimgmt.msc05/08/2004  13:00            62ÿ976 ocmanage.dll05/08/2004  13:00            26ÿ224 odbc16gt.dll05/08/2004  13:00           249ÿ856 odbc32.dll05/08/2004  13:00            16ÿ384 odbc32gt.dll05/08/2004  13:00            32ÿ768 odbcad32.exe05/08/2004  13:00            24ÿ576 odbcbcp.dll05/08/2004  13:00           135ÿ168 odbcconf.dll05/08/2004  13:00            69ÿ632 odbcconf.exe05/08/2004  13:00             4ÿ310 odbcconf.rsp05/08/2004  13:00            32ÿ768 odbccp32.cpl05/08/2004  13:00           106ÿ496 odbccp32.dll05/08/2004  13:00            65ÿ536 odbccr32.dll05/08/2004  13:00            65ÿ536 odbccu32.dll05/08/2004  13:00             8ÿ192 bitsprx2.dll05/08/2004  13:00             5ÿ632 wmi.dll05/08/2004  13:00            98ÿ304 odbcint.dll05/08/2004  13:00            61ÿ712 odbcji32.dll05/08/2004  13:00           278ÿ559 odbcjt32.dll05/08/2004  13:00             8ÿ191 bios4.rom05/08/2004  13:00            12ÿ288 odbcp32r.dll05/08/2004  13:00            60ÿ928 wmerrFRA.dll05/08/2004  13:00            28ÿ420 bios1.rom05/08/2004  13:00           147ÿ456 odbctrac.dll05/08/2004  13:00            20ÿ511 oddbse32.dll05/08/2004  13:00            20ÿ510 odexl32.dll05/08/2004  13:00            20ÿ510 odfox32.dll05/08/2004  13:00            20ÿ510 odpdx32.dll05/08/2004  13:00            20ÿ511 odtext32.dll05/08/2004  13:00        13ÿ107ÿ200 oembios.bin05/08/2004  13:00             4ÿ461 oembios.dat05/08/2004  13:00             6ÿ761 oembios.sig05/08/2004  13:00            17ÿ408 bidispl.dll05/08/2004  13:00           120ÿ832 offfilt.dll05/08/2004  13:00            39ÿ744 ole2.dll05/08/2004  13:00           169ÿ520 ole2disp.dll05/08/2004  13:00           153ÿ008 ole2nls.dll05/08/2004  13:00             8ÿ704 batt.dll05/08/2004  13:00           163ÿ328 oleacc.dll05/08/2004  13:00            18ÿ944 oleaccrc.dll05/08/2004  13:00           553ÿ472 oleaut32.dll05/08/2004  13:00            83ÿ456 olecli.dll05/08/2004  13:00            28ÿ672 batmeter.dll05/08/2004  13:00            52ÿ736 basesrv.dll05/08/2004  13:00           119ÿ808 oledlg.dll05/08/2004  13:00           110ÿ592 oleprn.dll05/08/2004  13:00            83ÿ456 olepro32.dll05/08/2004  13:00            24ÿ064 olesvr.dll05/08/2004  13:00            22ÿ016 olesvr32.dll05/08/2004  13:00            69ÿ120 olethk32.dll05/08/2004  13:00           713ÿ728 opengl32.dll05/08/2004  13:00           216ÿ576 osk.exe05/08/2004  13:00            68ÿ096 osuninst.dll05/08/2004  13:00            41ÿ984 osuninst.exe05/08/2004  13:00           116ÿ224 p2p.dll05/08/2004  13:00            86ÿ016 p2pgasvc.dll05/08/2004  13:00           312ÿ320 p2pgraph.dll05/08/2004  13:00            88ÿ064 p2pnetsh.dll05/08/2004  13:00           526ÿ848 p2psvc.dll05/08/2004  13:00            59ÿ904 packager.exe05/08/2004  13:00            10ÿ240 panmap.dll05/08/2004  13:00           157ÿ696 paqsp.dll05/08/2004  13:00            22ÿ528 pathping.exe05/08/2004  13:00            65ÿ024 pautoenr.dll05/08/2004  13:00            73ÿ216 avwav.dll05/08/2004  13:00               114 pcl.sep05/08/2004  13:00           286ÿ208 pdh.dll05/08/2004  13:00            15ÿ360 pentnt.exe05/08/2004  13:00           111ÿ104 activeds.tlb05/08/2004  13:00           194ÿ048 activeds.dll05/08/2004  13:00               427 perfci.h05/08/2004  13:00             3ÿ030 perfci.ini05/08/2004  13:00            42ÿ496 perfctrs.dll05/08/2004  13:00            28ÿ626 perfd009.dat05/08/2004  13:00            34ÿ108 perfd00C.dat05/08/2004  13:00            27ÿ136 perfdisk.dll05/08/2004  13:00               140 perffilt.h05/08/2004  13:00             1ÿ293 perffilt.ini05/08/2004  13:00           119ÿ296 aclui.dll05/08/2004  13:00           135ÿ680 acledit.dll05/08/2004  13:00           272ÿ128 perfi009.dat05/08/2004  13:00           322ÿ810 perfi00C.dat05/08/2004  13:00            15ÿ872 perfmon.exe05/08/2004  13:00

fleurdelys · Answer

ca t'en fait des lignes a controler !! lol  merciLe volume dans le lecteur C n'a pas de nom. Le num‚ro de s‚rie du volume est C82D-BE27 R‚pertoire de C:\DOCUME~1\Mag\LOCALS~1\Temp14/12/2005  15:27         2ÿ048ÿ000 Acr13.tmp11/12/2005  19:12            16ÿ384 ~DFE39B.tmp11/12/2005  18:48            16ÿ384 ~DFA0F5.tmp11/12/2005  16:19             4ÿ764 bt7825.bat11/12/2005  14:25               717 control.xml11/12/2005  12:44         1ÿ584ÿ415 TFRA.tmp11/12/2005  11:55               932 spng_redir.html               7 fichier(s)        3ÿ671ÿ596 octets               0 R‚p(s)  121ÿ229ÿ254ÿ656 octets libres Le volume dans le lecteur C n'a pas de nom. Le num‚ro de s‚rie du volume est C82D-BE27 R‚pertoire de C:\WINDOWS18/12/2005  16:04                 0 0.log18/12/2005  16:04           898ÿ185 WindowsUpdate.log18/12/2005  16:04               159 wiadebug.log18/12/2005  16:04                50 wiaservc.log18/12/2005  16:04             2ÿ048 bootstat.dat17/12/2005  19:23            32ÿ612 SchedLgU.Txt15/12/2005  19:40            12ÿ513 ocmsn.log15/12/2005  19:40             9ÿ393 KB910437.log15/12/2005  19:40            50ÿ031 ntdtcsetup.log15/12/2005  19:40             1ÿ393 imsins.log15/12/2005  19:40            85ÿ566 comsetup.log15/12/2005  19:40            88ÿ532 tsoc.log15/12/2005  19:40            34ÿ687 iis6.log15/12/2005  19:40            11ÿ377 msgsocm.log15/12/2005  19:40           221ÿ750 FaxSetup.log15/12/2005  19:40           113ÿ829 ocgen.log15/12/2005  19:40           482ÿ030 setupapi.log15/12/2005  19:40            19ÿ520 updspapi.log15/12/2005  19:40             1ÿ393 imsins.BAK15/12/2005  19:40            16ÿ379 KB905915.log11/12/2005  17:00                69 NeroDigital.ini11/12/2005  16:41           570ÿ480 ntbtlog.txt11/12/2005  15:59           176ÿ518 setupact.log11/12/2005  15:25               259 SYSTEM.INI11/12/2005  15:25               739 win.ini11/12/2005  14:25            12ÿ159 wmsetup.log11/12/2005  13:43             8ÿ192 Lobel.pcb11/12/2005  12:52            54ÿ156 QTFont.qfn10/12/2005  17:52                58 WFXDEL.BAT10/12/2005  14:39           638ÿ428 Bobsaver.exe10/12/2005  14:39           362ÿ880 Bobsaver.scr10/12/2005  14:39            29ÿ696 mickey32.dll03/12/2005  17:36             1ÿ409 QTFont.for19/11/2005  14:08                28 Lobel.acl19/11/2005  14:06                50 cdplayer.ini10/11/2005  19:32            11ÿ862 KB896424.log27/10/2005  14:35               237 wmsetup10.log27/10/2005  14:04               105 UMXADDIN.INI27/10/2005  14:03               525 MAXLINK.INI27/10/2005  13:29           316ÿ640 WMSysPr9.prx27/10/2005  13:14               154 adidsl.ini27/10/2005  13:09                21 Fast800.ini26/10/2005  08:43            32ÿ704 KB900725.log26/10/2005  08:42            30ÿ137 KB905749.log26/10/2005  08:42            25ÿ589 KB896688.log26/10/2005  08:42            24ÿ634 KB904706.log26/10/2005  08:42            24ÿ929 KB905414.log26/10/2005  08:42            24ÿ115 KB901017.log26/10/2005  08:42            29ÿ469 KB902400.log26/10/2005  08:42            20ÿ654 KB894391.log26/10/2005  08:42            18ÿ779 KB896423.log26/10/2005  08:42            18ÿ272 KB899587.log26/10/2005  08:42            17ÿ767 KB899591.log26/10/2005  08:42            17ÿ949 KB893756.log26/10/2005  08:42            17ÿ316 KB896358.log26/10/2005  08:42            18ÿ898 KB890859.log26/10/2005  08:42            14ÿ847 KB901214.log26/10/2005  08:42            14ÿ994 KB893066.log26/10/2005  08:41            14ÿ654 KB896428.log26/10/2005  08:41            14ÿ983 KB896422.log26/10/2005  08:41            15ÿ360 KB890046.log26/10/2005  08:41            13ÿ792 KB885250.log26/10/2005  08:41            14ÿ244 KB885835.log26/10/2005  08:41            13ÿ219 KB887742.log26/10/2005  08:41            12ÿ664 KB888113.log26/10/2005  08:41            12ÿ708 KB891781.log26/10/2005  08:41            12ÿ619 KB887472.log26/10/2005  08:41            12ÿ641 KB888302.log26/10/2005  08:41            12ÿ103 KB885836.log26/10/2005  08:41             8ÿ435 KB886185.log26/10/2005  08:41            12ÿ094 KB873339.log26/10/2005  08:28           793ÿ192 setuplog.txt25/10/2005  16:54                 0 Sti_Trace.log25/10/2005  16:52             1ÿ470 regopt.log25/10/2005  16:51                 0 setuperr.log25/10/2005  16:02             7ÿ712 KB898461.log25/10/2005  16:02             6ÿ420 KB893803v2.log25/10/2005  15:40            20ÿ998 ydi.log25/10/2005  15:38             3ÿ994 Ascd_tmp.ini25/10/2005  15:04               833 OEWABLog.txt25/10/2005  15:01             8ÿ192 REGLOCS.OLD25/10/2005  14:58                 0 control.ini25/10/2005  14:58             4ÿ205 ODBCINST.INI25/10/2005  14:58               749 WindowsShell.Manifest25/10/2005  14:56                37 vbaddin.ini25/10/2005  14:56                36 vb.ini25/10/2005  14:56               133 DtcInstall.log25/10/2005  14:56             1ÿ022 sessmgr.setup.log25/10/2005  14:55               200 cmsetacl.log27/05/2005  00:22            10ÿ752 hh.exe14/03/2005  13:38               469 bdoscandellang.ini04/03/2005  14:10           106ÿ496 bdoscandel.exe05/08/2004  13:00         1ÿ086ÿ058 SET4.tmp05/08/2004  13:00            14ÿ043 SET8.tmp05/08/2004  13:00                 2 desktop.ini05/08/2004  13:00            16ÿ730 Plume.bmp05/08/2004  13:00            26ÿ582 Granit vert.bmp05/08/2004  13:00         1ÿ014ÿ836 SET3.tmp05/08/2004  13:00            70ÿ656 NOTEPAD.EXE05/08/2004  13:00            65ÿ832 Mur de Santa Fe.bmp05/08/2004  13:00            39ÿ340 wmprfFRA.prx05/08/2004  13:00             1ÿ272 Rosace bleue 16.bmp05/08/2004  13:00            15ÿ872 TASKMAN.EXE05/08/2004  13:00            17ÿ062 Tasse … caf‚.bmp05/08/2004  13:00            82ÿ944 clock.avi05/08/2004  13:00            94ÿ864 twain.dll05/08/2004  13:00            50ÿ688 twain_32.dll05/08/2004  13:00            49ÿ680 twunk_16.exe05/08/2004  13:00            25ÿ600 twunk_32.exe05/08/2004  13:00             9ÿ522 Zapotec.bmp05/08/2004  13:00            49ÿ102 winnt256.bmp05/08/2004  13:00             1ÿ405 msdfmap.ini05/08/2004  13:00            26ÿ680 RiviŠre Sumida.bmp05/08/2004  13:00            17ÿ362 Rhododendron.bmp05/08/2004  13:00            65ÿ954 Vent de prairie.bmp05/08/2004  13:00            18ÿ944 vmmreg32.dll05/08/2004  13:00            65ÿ978 Bulles de savon.bmp05/08/2004  13:00         1ÿ036ÿ288 explorer.exe05/08/2004  13:00           153ÿ088 regedit.exe05/08/2004  13:00            17ÿ336 Jour de pˆche.bmp05/08/2004  13:00                80 explorer.scf05/08/2004  13:00            49ÿ102 winnt.bmp05/08/2004  13:00           256ÿ768 winhelp.exe05/08/2004  13:00           288ÿ256 winhlp32.exe05/08/2004  13:00               707 _default.pif12/05/2003  15:55           978ÿ944 SynthCoreA.Dll17/02/2003  08:36               342 adiras.ini03/01/2003  16:28                74 PMINI.ini30/08/2002  12:59           380ÿ928 SynCor.exe14/08/2001  16:38           308ÿ736 IsUn040c.exe17/12/1999  11:13            86ÿ016 unvise32.exe29/10/1998  16:45           306ÿ688 IsUninst.exe17/12/1996  00:00            38ÿ468 MSO97.ACL             133 fichier(s)       12ÿ582ÿ420 octets               0 R‚p(s)  121ÿ229ÿ246ÿ464 octets libres Le volume dans le lecteur C n'a pas de nom. Le num‚ro de s‚rie du volume est C82D-BE27 R‚pertoire de C:\18/12/2005  16:10                 0 sys.txt18/12/2005  16:10             6ÿ857 system.txt18/12/2005  16:10               593 systemtemp.txt18/12/2005  16:09            92ÿ978 system32.txt18/12/2005  16:04       805ÿ306ÿ368 pagefile.sys11/12/2005  19:38                 8 rech.txt)11/12/2005  15:25               216 boot.ini04/12/2005  17:47             9ÿ836 hpfr5550.log25/10/2005  14:58                 0 AUTOEXEC.BAT25/10/2005  14:58                 0 IO.SYS25/10/2005  14:58                 0 CONFIG.SYS25/10/2005  14:58                 0 MSDOS.SYS05/08/2004  13:00             4ÿ952 Bootfont.bin05/08/2004  13:00            47ÿ564 NTDETECT.COM05/08/2004  13:00           251ÿ712 ntldr              15 fichier(s)      805ÿ721ÿ084 octets               0 R‚p(s)  121ÿ229ÿ242ÿ368 octets libres

fleurdelys · Answer

voila L2MFIX find log 121605 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] "DLLName"="Ati2evxx.dll" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000001 "Lock"="AtiLockEvent" "Logoff"="AtiLogoffEvent" "Logon"="AtiLogonEvent" "Disconnect"="AtiDisConnectEvent" "Reconnect"="AtiReConnectEvent" "Safe"=dword:00000000 "Shutdown"="AtiShutdownEvent" "StartScreenSaver"="AtiStartScreenSaverEvent" "StartShell"="AtiStartShellEvent" "Startup"="AtiStartupEvent" "StopScreenSaver"="AtiStopScreenSaverEvent" "Unlock"="AtiUnLockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ermsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "SV1"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia" "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo" "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..." "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Page de propri‚t‚s des versions pr‚c‚dentes" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Versions pr‚c‚dentes" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..." "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices" "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu" "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{BB7DF450-F119-11CD-8465-00AA00425D90}"="Microsoft Access Custom Icon Handler" "{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band" ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ browseui.dll Thu 24 Nov 2005 1:08:34 A.... 1 022 976 999,00 K cdfview.dll Fri 21 Oct 2005 4:41:00 A.... 152 064 148,50 K danim.dll Sat 5 Nov 2005 4:17:22 A.... 1 056 768 1,01 M dxtrans.dll Fri 21 Oct 2005 4:41:00 A.... 205 312 200,50 K esent.dll Thu 20 Oct 2005 23:25:54 A.... 1 097 728 1,05 M extmgr.dll Fri 21 Oct 2005 4:41:00 A.... 55 808 54,50 K gdi32.dll Thu 6 Oct 2005 4:18:12 A.... 280 064 273,50 K iepeers.dll Fri 21 Oct 2005 4:41:00 A.... 251 392 245,50 K inseng.dll Fri 21 Oct 2005 4:41:00 A.... 96 768 94,50 K msgplu~1.dll Thu 27 Oct 2005 19:32:48 A.... 45 640 44,57 K mshtml.dll Thu 24 Nov 2005 1:08:36 A.... 3 013 632 2,87 M mshtmled.dll Fri 21 Oct 2005 4:41:04 A.... 448 512 438,00 K msrating.dll Fri 21 Oct 2005 4:41:04 A.... 146 432 143,00 K msssc.dll Tue 25 Oct 2005 15:27:18 A.... 44 0,04 K mstime.dll Fri 21 Oct 2005 4:41:04 A.... 530 944 518,50 K pncrt.dll Sun 30 Oct 2005 19:15:36 A.... 278 528 272,00 K pndx5016.dll Sun 30 Oct 2005 19:15:38 A.... 6 656 6,50 K pndx5032.dll Sun 30 Oct 2005 19:15:38 A.... 5 632 5,50 K pngfilt.dll Fri 21 Oct 2005 4:41:04 A.... 39 424 38,50 K rmoc3260.dll Sun 30 Oct 2005 19:15:44 A.... 176 167 172,04 K shdocvw.dll Thu 1 Dec 2005 5:01:16 A.... 1 492 992 1,42 M shell32.dll Fri 23 Sep 2005 4:07:00 A.... 8 506 880 8,11 M shlwapi.dll Fri 21 Oct 2005 4:41:04 A.... 474 112 463,00 K sirenacm.dll Wed 12 Oct 2005 23:11:06 A.... 118 784 116,00 K spmsg.dll Thu 13 Oct 2005 0:15:24 ..... 15 072 14,72 K urlmon.dll Sat 5 Nov 2005 4:17:26 A.... 606 208 592,00 K wininet.dll Fri 21 Oct 2005 4:41:06 A.... 662 528 647,00 K 27 items found: 27 files, 0 directories. Total of file sizes: 20 787 067 bytes 19,82 M Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Le volume dans le lecteur C n'a pas de nom. Le num‚ro de s‚rie du volume est C82D-BE27 R‚pertoire de C:\WINDOWS\System32 15/12/2005 19:40 dllcache 25/10/2005 15:02 Microsoft 0 fichier(s) 0 octets 2 R‚p(s) 121ÿ227ÿ517ÿ952 octets libres

Utilisateur anonyme · Answer

salutdepuis j ai eu le temps de confectionner un petit programme avec Moe31Telecharge cecihttp://cjoint.com/?mrlUOG2MIa Execute le, ouvre HcsrchPuis le bloc note s ouvre, copie/colle le rapporta+

fleurdelys · Answer

sltle lien est mort je crois, j'arrive pas a le telecharger

Utilisateur anonyme · Answer

re,chez moi il marche pourtant...Essai celui la, je viens de le creerhttp://cjoint.com/?msr2FKfjVpa+

fleurdelys · Answer

voila

Rapport fait à 18:02:06,71 le 18/12/2005
Executé à partir de C:\Documents and Settings\mag
OS: Microsoft Windows XP [version 5.1.2600]

*********************************************

Vérification HKLM\...\...\...\...\ruins

*********************************************

Fichiers détectés :

C:\WINDOWS\System32\close.bmp Présent !
C:\WINDOWS\System32\dating.bmp Présent !
C:\WINDOWS\System32\gambling.bmp Présent !
C:\WINDOWS\System32\idesk.conf Présent !
C:\WINDOWS\System32\pharmacy.bmp Présent !
C:\WINDOWS\System32\spyware.bmp Présent !
C:\WINDOWS\System32\xxx.bmp Présent !

*********************************************

Recherche des processus aleatoires
d'après les modèles : cs***.exe, dm***.exe, ya***.exe

C:\WINDOWS\System32

*********************************************

Recherche presence C:\WINDOWS\System32\idemlog.exe...

non trouvé...

Utilisateur anonyme · Answer

saluttu peux remettre un hijack this et jte donne la manipa+

fleurdelys · Answer

voila

Logfile of HijackThis v1.99.1
Scan saved at 18:18:13, on 18/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Wanadoo\CnxMon.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Wanadoo\EspaceWanadoo.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\mag\Mes documents\Ma musique\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9BAF614D-7EA9-4421-A30F-266504D9EC43}: NameServer = 80.10.246.130 80.10.246.3
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Utilisateur anonyme · Answer

Merci,

Télécharge: Pocket Killbox ici
http://www.downloads.subratam.org/KillBox.exe

:: Démo d utilisation (merci a Balltrap34 pour cette réalisation) ::
http://pageperso.aol.fr/balltrap34/killbox.htm

**
Avec la methode du bloc note(cf video), voici la liste:

C:\WINDOWS\System32\close.bmp
C:\WINDOWS\System32\dating.bmp
C:\WINDOWS\System32\gambling.bmp
C:\WINDOWS\System32\idesk.conf
C:\WINDOWS\System32\pharmacy.bmp
C:\WINDOWS\System32\spyware.bmp
C:\WINDOWS\System32\xxx.bmp

Laisse le pc redemarrer ou redemarre le toi meme s il ne le fait pas

Puis remet le rapport du prog stp

A+

fleurdelys · Answer

ca yé j'ai plus rien ki apparait !! ya encor des truc a suppr ?
merci

Logfile of HijackThis v1.99.1
Scan saved at 18:58:02, on 18/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Wanadoo\CnxMon.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Wanadoo\EspaceWanadoo.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Documents and Settings\mag\Mes documents\Ma musique\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9BAF614D-7EA9-4421-A30F-266504D9EC43}: NameServer = 80.10.246.130 80.10.246.3
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

"Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"desktop" = "C:\WINDOWS\system32\idemlog.exe" [empty string]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Smapp" = "C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" ["Analog Devices, Inc."]
"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]
"WooCnxMon" = "C:\PROGRA~1\Wanadoo\CnxMon.exe" [empty string]
"WOOWATCH" = "C:\PROGRA~1\Wanadoo\Watch.exe" ["France Télécom R&D"]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]
"Omnipage" = "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" ["ScanSoft, Inc"]
"TkBellExe" = ""C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"WOOTASKBARICON" = "C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
INFECTION WARNING! "AppInit_DLLs" = "MsgPlusLoader.dll" ["Patchou"]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
INFECTION WARNING! "System" = "cszdh.exe" [null data]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\mag\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

Startup items in "mag" & "All Users" startup folders:
-------------------------------------------------------

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
"DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Extensions (Tools menu items, main toolbar menu buttons)

HKCU\Software\Microsoft\Internet Explorer\Extensions\
{1462651F-F4BA-4C76-A001-C4284D0FE16E}\
"ButtonText" = "Wanadoo"
"Exec" = "http://www.wanadoo.fr" [file not found]

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messager Wanadoo"
"MenuText" = "Messager Wanadoo"
"Exec" = "C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe" ["France Telecom"]

Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"

Missing lines (compared with English-language version):
[Strings]: 1 line

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
"{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = "Search Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Wanadoo\SEARCH~1.DLL" [empty string]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
SoundMAX Agent Service, SoundMAX Agent Service (default), "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe" ["Analog Devices, Inc."]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzlnt05\Driver = "hpzlnt05.dll" ["HP"]

Utilisateur anonyme · Answer

reet l autre programme stp?a+

fleurdelys · Answer

Rapport fait à 19:33:47,95 le 18/12/2005
Executé à partir de C:\Documents and Settings\mag
OS: Microsoft Windows XP [version 5.1.2600]

*********************************************

Vérification HKLM\...\...\...\...\ruins

*********************************************

Fichiers détectés :

*********************************************

Recherche des processus aleatoires
d'après les modèles : cs***.exe, dm***.exe, ya***.exe

C:\WINDOWS\System32

*********************************************

Recherche presence C:\WINDOWS\System32\idemlog.exe...

non trouvé...

Utilisateur anonyme · Answer

ok ou en sont t es soucisa+

fleurdelys · Answer

apparemment c nikel la pub ne s'affiche plusj'v essayer de reinstaller mon antivirus jte tien au courantya plus de risques ?a+

Utilisateur anonyme · Answer

non pas de risque qu il reviennea+

fleurdelys · Answer

rej'ai reinstaller norton ms il ne vt pa se lancer et j'ai toujours une alerte XP m'informant que norton est installer mais que son statut est inconnu !

Utilisateur anonyme · Answer

salutdesinstalle norton et installe avasthttp://www.avast.com/eng/download-avast-home.htmla+

fleurdelys · Answer

tu c pa d'ou ca pt venir ?Quand j'ai ete contaminer par le spyware ya un antivirus qui s'est installer (unspypc) ca pt pas venir de la ? le pc ma mis le spyware par default ?a+

Utilisateur anonyme · Answer

Installe avast, norton est une usine a gaza+

Pb de virus - Page 4

Discussions similaires

Newsletters