Besoin d'une verif =(
Résolu
niniedu05
Messages postés
16
Statut
Membre
-
oliver -
oliver -
Bonjour a tous !!
Voila, depuis une semaine j'me bas avec mon ordi et mes 7000 fichier infecter que j'ai eu.. j'ai analyser j'ai plus rien, mais j'aimerais bien que quelqu'un verifie mon hijack voir si j'ai quelquechose!? Merci pr toute reponse!
Logfile of HijackThis v1.99.1
Scan saved at 08:16:07, on 09/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\winbond\w89c33\wwu.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\MICHEL~1\LOCALS~1\Temp\Rar$EX00.422\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: {b073434d-c7dd-3598-cd54-87de7d3bbe26} - {62ebb3d7-ed78-45dc-8953-dd7cd434370b} - C:\WINDOWS\system32\axkkwaeb.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [oouserv6.exe] C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe
O4 - HKLM\..\Run: [4c05167c] rundll32.exe "C:\WINDOWS\system32\wjisyfat.dll",b
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: IEEE 802.11g Wireless LAN Utility.lnk = ?
O4 - Global Startup: WWU.lnk = C:\Program Files\winbond\w89c33\wwu.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {317153FE-B7FB-419B-AC87-0B2EC97D7A04} (VB2S ActiveX Control) - http://www.subdo.com/activex/vb2s.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://ninie05600.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1074670941046
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {90F7E144-984F-4FA6-83A7-C9C8DCB9974C} (RSActiveXObj Control) - http://www.radarsync.com/RSActiveX.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer = 192.168.0.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c006D652.dat
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: DirectX Service (DirectSejb) - Unknown owner - C:\WINDOWS\system32\directx.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
Voila, depuis une semaine j'me bas avec mon ordi et mes 7000 fichier infecter que j'ai eu.. j'ai analyser j'ai plus rien, mais j'aimerais bien que quelqu'un verifie mon hijack voir si j'ai quelquechose!? Merci pr toute reponse!
Logfile of HijackThis v1.99.1
Scan saved at 08:16:07, on 09/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\winbond\w89c33\wwu.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\MICHEL~1\LOCALS~1\Temp\Rar$EX00.422\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: {b073434d-c7dd-3598-cd54-87de7d3bbe26} - {62ebb3d7-ed78-45dc-8953-dd7cd434370b} - C:\WINDOWS\system32\axkkwaeb.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [oouserv6.exe] C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe
O4 - HKLM\..\Run: [4c05167c] rundll32.exe "C:\WINDOWS\system32\wjisyfat.dll",b
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: IEEE 802.11g Wireless LAN Utility.lnk = ?
O4 - Global Startup: WWU.lnk = C:\Program Files\winbond\w89c33\wwu.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {317153FE-B7FB-419B-AC87-0B2EC97D7A04} (VB2S ActiveX Control) - http://www.subdo.com/activex/vb2s.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://ninie05600.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1074670941046
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {90F7E144-984F-4FA6-83A7-C9C8DCB9974C} (RSActiveXObj Control) - http://www.radarsync.com/RSActiveX.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer = 192.168.0.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c006D652.dat
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: DirectX Service (DirectSejb) - Unknown owner - C:\WINDOWS\system32\directx.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
A voir également:
- Besoin d'une verif =(
- Verif lien - Guide
- Verif site internet - Guide
- Supprimer france verif ✓ - Forum Navigateur
- Comment supp "france vérif" ? ✓ - Forum Réseaux sociaux
- Verif tools permis - Accueil - Services en ligne
29 réponses
j'ai poster le hijack pour voir si y'avai pa sun fichier par hazard pas normal, fait une semaine que je scan 3 fois parce que sa bug mon panda antivirus a detecter 7540 virus 90 logiciel espion..et il me les a tous suprimer cet nuit... c'est pas moi ki l'est inventer Oo lol j'suis pas blonde quand meme ;) j'ai pas garder les poste de scan.
justement il ya des fichiers bizarres...et un rapport de ce que tua s enlevé ainsi que le nom du virus m'aurait bien été, mais on va faire sans...
je voudrais que tu fasses ceci
Télécharge SmitfraudFix de S!Ri, balltrap34 et moe31
http://siri.urz.free.fr/Fix
Installe le à la racine de C\ : double clique sur l'exe pour le décompresser et lancer le fix.
Utilisation ----- option 1 - Recherche :
Double clique sur smitfraudfix.cmd Sélectionne 1 pour créer un rapport des fichiers responsables de l'infection.
Poste le rapport
Attention : process.exe est détecté par certains antivirus comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité.
je voudrais que tu fasses ceci
Télécharge SmitfraudFix de S!Ri, balltrap34 et moe31
http://siri.urz.free.fr/Fix
Installe le à la racine de C\ : double clique sur l'exe pour le décompresser et lancer le fix.
Utilisation ----- option 1 - Recherche :
Double clique sur smitfraudfix.cmd Sélectionne 1 pour créer un rapport des fichiers responsables de l'infection.
Poste le rapport
Attention : process.exe est détecté par certains antivirus comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité.
Ah ok.. beh comme virus me souvien que j'avai genre la security toolbar, psw.x-vir, cyberlog-x, networm-i .. fin apré me souvien plus..
SmitFraudFix v2.250
Rapport fait à 12:35:42,31, 09/11/2007
Executé à partir de C:\Documents and Settings\michel virginie\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\winbond\w89c33\wwu.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\avciman.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\psimreal.exe
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\ virginie
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\virginie\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\MICHEL~1\Favoris
»»»»»»»»»»»»»»»»»»»»»»»» Bureau
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=dword:00000001
"AppInit_DLLs"="C:\\WINDOWS\\system32\\__c006D652.dat"
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Rustock
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Winbond W89C33 mPCI 802.11 Wireless LAN Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer=192.168.0.1
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
SmitFraudFix v2.250
Rapport fait à 12:35:42,31, 09/11/2007
Executé à partir de C:\Documents and Settings\michel virginie\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\winbond\w89c33\wwu.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\avciman.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\psimreal.exe
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\ virginie
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\virginie\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\MICHEL~1\Favoris
»»»»»»»»»»»»»»»»»»»»»»»» Bureau
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=dword:00000001
"AppInit_DLLs"="C:\\WINDOWS\\system32\\__c006D652.dat"
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Rustock
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Winbond W89C33 mPCI 802.11 Wireless LAN Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer=192.168.0.1
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Redémarrer l'ordinateur en mode sans échec
1) Redémarre ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisi la première option : Sans Échec, et valide avec "Entrée"
5) Choisi ton compte habituel, et non Administrateur
· Double cliquer sur Smitfraudfix.exe.
· Sélectionner 2 pour supprimer les fichiers responsables de l'infection.
· A la question Voulez-vous nettoyer le registre ?], répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection. Le fix déterminera si le fichier wininet.dll est infecté.
· A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.
· Quitter le programme en appuyant sur Q.
N.B.: Cette étape élimine les fichiers infectieux détectés à l'étape #1
Attention que l'option 2 de l'outil supprime le fond d'écran !
process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
Redémarrer normalement et coller sur le forum le rapport généré et un rapport hijack this
1) Redémarre ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisi la première option : Sans Échec, et valide avec "Entrée"
5) Choisi ton compte habituel, et non Administrateur
· Double cliquer sur Smitfraudfix.exe.
· Sélectionner 2 pour supprimer les fichiers responsables de l'infection.
· A la question Voulez-vous nettoyer le registre ?], répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection. Le fix déterminera si le fichier wininet.dll est infecté.
· A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.
· Quitter le programme en appuyant sur Q.
N.B.: Cette étape élimine les fichiers infectieux détectés à l'étape #1
Attention que l'option 2 de l'outil supprime le fond d'écran !
process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
Redémarrer normalement et coller sur le forum le rapport généré et un rapport hijack this
re
J'ai fait aussi une analyse avec spybot il m'a suprimer pas mal de truc..
vala le raport hijack:
Logfile of HijackThis v1.99.1
Scan saved at 14:38:04, on 09/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\winbond\w89c33\wwu.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AvltMain.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: {b073434d-c7dd-3598-cd54-87de7d3bbe26} - {62ebb3d7-ed78-45dc-8953-dd7cd434370b} - C:\WINDOWS\system32\axkkwaeb.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [oouserv6.exe] C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe
O4 - HKLM\..\Run: [4c05167c] rundll32.exe "C:\WINDOWS\system32\wjisyfat.dll",b
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: IEEE 802.11g Wireless LAN Utility.lnk = ?
O4 - Global Startup: WWU.lnk = C:\Program Files\winbond\w89c33\wwu.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {317153FE-B7FB-419B-AC87-0B2EC97D7A04} (VB2S ActiveX Control) - http://www.subdo.com/activex/vb2s.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://ninie05600.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1074670941046
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {90F7E144-984F-4FA6-83A7-C9C8DCB9974C} (RSActiveXObj Control) - http://www.radarsync.com/RSActiveX.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer = 192.168.0.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: DirectX Service (DirectSejb) - Unknown owner - C:\WINDOWS\system32\directx.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
J'ai fait aussi une analyse avec spybot il m'a suprimer pas mal de truc..
vala le raport hijack:
Logfile of HijackThis v1.99.1
Scan saved at 14:38:04, on 09/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\winbond\w89c33\wwu.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AvltMain.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: {b073434d-c7dd-3598-cd54-87de7d3bbe26} - {62ebb3d7-ed78-45dc-8953-dd7cd434370b} - C:\WINDOWS\system32\axkkwaeb.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [oouserv6.exe] C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe
O4 - HKLM\..\Run: [4c05167c] rundll32.exe "C:\WINDOWS\system32\wjisyfat.dll",b
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: IEEE 802.11g Wireless LAN Utility.lnk = ?
O4 - Global Startup: WWU.lnk = C:\Program Files\winbond\w89c33\wwu.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {317153FE-B7FB-419B-AC87-0B2EC97D7A04} (VB2S ActiveX Control) - http://www.subdo.com/activex/vb2s.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://ninie05600.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1074670941046
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {90F7E144-984F-4FA6-83A7-C9C8DCB9974C} (RSActiveXObj Control) - http://www.radarsync.com/RSActiveX.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer = 192.168.0.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: DirectX Service (DirectSejb) - Unknown owner - C:\WINDOWS\system32\directx.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
on continue
Ouvrir l'Explorateur Windows: > Démarrer > Programmes > Accessoires > Explorateur Windows ou Démarrer > Programmes > Explorateur Windows.
Cliquer sur Outils > Options des dossiers > Affichage.
Sélectionner :
cocher : Afficher les fichiers et dossiers cachés.
décocher : Masquer les extensions des fichiers dont le type est connu.
décocher : Masquer les fichiers protégés du système d'exploitation (recommandé)
Cliquer sur Appliquer et Ok
Et teste ceci:
C:\WINDOWS\system32\axkkwaeb.dll
Cliquer sur ce lien
https://www.virustotal.com/gui/
Cliquer sur Parcourir et indiquer le chemin du ou des fichier(s) que j’ai désigné(s).
Cliquer sur Send File
Au message Sending File, ne pas fermer cette fenêtre.
Si vous avez un message Current Statue: queued : Patience!
Au bout de quelques minutes, vous aurez dans l'encadré: Current status: finished
Faire un copier/coller du résultat et postez-le dans votre prochain message.
fais la même chose avec ces fichiers
C:\WINDOWS\system32\wjisyfat.dll"
C:\Program Files\winbond\w89c33\wwu.exe
C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe
Tu recaches tes fichiers dossiers
décocher : Afficher les fichiers et dossiers cachés.
recocher : Masquer les extensions des fichiers dont le type est connu.
cocher : Masquer les fichiers protégés du système d'exploitation (recommandé)
Cliquer sur Appliquer et Ok
Ouvrir l'Explorateur Windows: > Démarrer > Programmes > Accessoires > Explorateur Windows ou Démarrer > Programmes > Explorateur Windows.
Cliquer sur Outils > Options des dossiers > Affichage.
Sélectionner :
cocher : Afficher les fichiers et dossiers cachés.
décocher : Masquer les extensions des fichiers dont le type est connu.
décocher : Masquer les fichiers protégés du système d'exploitation (recommandé)
Cliquer sur Appliquer et Ok
Et teste ceci:
C:\WINDOWS\system32\axkkwaeb.dll
Cliquer sur ce lien
https://www.virustotal.com/gui/
Cliquer sur Parcourir et indiquer le chemin du ou des fichier(s) que j’ai désigné(s).
Cliquer sur Send File
Au message Sending File, ne pas fermer cette fenêtre.
Si vous avez un message Current Statue: queued : Patience!
Au bout de quelques minutes, vous aurez dans l'encadré: Current status: finished
Faire un copier/coller du résultat et postez-le dans votre prochain message.
fais la même chose avec ces fichiers
C:\WINDOWS\system32\wjisyfat.dll"
C:\Program Files\winbond\w89c33\wwu.exe
C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe
Tu recaches tes fichiers dossiers
décocher : Afficher les fichiers et dossiers cachés.
recocher : Masquer les extensions des fichiers dont le type est connu.
cocher : Masquer les fichiers protégés du système d'exploitation (recommandé)
Cliquer sur Appliquer et Ok
voila pour le fichier C:\WINDOWS\system32\axkkwaeb.dll :
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.11.9.1 2007.11.09 -
AntiVir 7.6.0.34 2007.11.09 TR/Dldr.ConHook.Gen
Authentium 4.93.8 2007.11.09 -
Avast 4.7.1074.0 2007.11.08 -
AVG 7.5.0.503 2007.11.09 BHO.CNA
BitDefender 7.2 2007.11.09 -
CAT-QuickHeal 9.00 2007.11.09 -
ClamAV 0.91.2 2007.11.09 -
DrWeb 4.44.0.09170 2007.11.09 -
eSafe 7.0.15.0 2007.11.08 -
eTrust-Vet 31.2.5282 2007.11.09 -
Ewido 4.0 2007.11.09 -
FileAdvisor 1 2007.11.09 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.4.2.54 2007.11.09 -
F-Secure 6.70.13030.0 2007.11.09 -
Ikarus T3.1.1.12 2007.11.09 -
Kaspersky 7.0.0.125 2007.11.09 -
McAfee 5159 2007.11.08 -
Microsoft 1.3007 2007.11.09 -
NOD32v2 2649 2007.11.09 -
Norman 5.80.02 2007.11.08 Vundo.gen49
Panda 9.0.0.4 2007.11.09 Suspicious file
Prevx1 V2 2007.11.09 Trojan.Vundo
Rising 20.17.41.00 2007.11.09 -
Sophos 4.23.0 2007.11.09 -
Sunbelt 2.2.907.0 2007.11.09 -
Symantec 10 2007.11.09 -
TheHacker 6.2.9.122 2007.11.09 -
VBA32 3.12.2.4 2007.11.08 -
VirusBuster 4.3.26:9 2007.11.08 -
Webwasher-Gateway 6.0.1 2007.11.09 Trojan.Dldr.ConHook.Gen
Information additionnelle
File size: 80448 bytes
MD5: e0f67125e6c6f2957be23ff48fb0af5c
SHA1: 98d81b8961f2804f70442329f139ae655ef11e20
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5=E73E240D401ACAC93A980168D0081D002A859F1B
pour: C:\WINDOWS\system32\wjisyfat.dll
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.11.9.1 2007.11.09 -
AntiVir 7.6.0.34 2007.11.09 TR/Dldr.ConHook.Gen
Authentium 4.93.8 2007.11.09 -
Avast 4.7.1074.0 2007.11.08 -
AVG 7.5.0.503 2007.11.09 BHO.CNB
BitDefender 7.2 2007.11.09 Trojan.Agent.AFSP
CAT-QuickHeal 9.00 2007.11.09 -
ClamAV 0.91.2 2007.11.09 -
DrWeb 4.44.0.09170 2007.11.09 Trojan.Virtumod.227
eSafe 7.0.15.0 2007.11.08 -
eTrust-Vet 31.2.5282 2007.11.09 -
Ewido 4.0 2007.11.09 -
FileAdvisor 1 2007.11.09 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.4.2.54 2007.11.09 -
F-Secure 6.70.13030.0 2007.11.09 -
Ikarus T3.1.1.12 2007.11.09 -
Kaspersky 7.0.0.125 2007.11.09 -
McAfee 5159 2007.11.08 -
Microsoft 1.3007 2007.11.09 -
NOD32v2 2649 2007.11.09 -
Norman 5.80.02 2007.11.08 Vundo.gen49
Panda 9.0.0.4 2007.11.09 -
Prevx1 V2 2007.11.09 Trojan.Vundo
Rising 20.17.41.00 2007.11.09 -
Sophos 4.23.0 2007.11.09 -
Sunbelt 2.2.907.0 2007.11.09 -
Symantec 10 2007.11.09 -
TheHacker 6.2.9.122 2007.11.09 -
VBA32 3.12.2.4 2007.11.08 -
VirusBuster 4.3.26:9 2007.11.08 -
Webwasher-Gateway 6.0.1 2007.11.09 Trojan.Dldr.ConHook.Gen
Information additionnelle
File size: 86080 bytes
MD5: b2b30b07675fd48435e517945e008921
SHA1: 18e507a5c8e2df86abe2464b5f9646fefa7d0a21
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5=A6441F24406854B050DB01D995CCF100A9200A5A
vla pour C:\Program Files\winbond\w89c33\wwu.exe :
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.11.9.1 2007.11.09 -
AntiVir 7.6.0.34 2007.11.09 -
Authentium 4.93.8 2007.11.09 -
Avast 4.7.1074.0 2007.11.08 -
AVG 7.5.0.503 2007.11.09 -
BitDefender 7.2 2007.11.09 -
CAT-QuickHeal 9.00 2007.11.09 -
ClamAV 0.91.2 2007.11.09 -
DrWeb 4.44.0.09170 2007.11.09 -
eSafe 7.0.15.0 2007.11.08 -
eTrust-Vet 31.2.5282 2007.11.09 -
Ewido 4.0 2007.11.09 -
FileAdvisor 1 2007.11.09 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.4.2.54 2007.11.09 -
F-Secure 6.70.13030.0 2007.11.09 -
Ikarus T3.1.1.12 2007.11.09 -
Kaspersky 7.0.0.125 2007.11.09 -
McAfee 5159 2007.11.08 -
Microsoft 1.3007 2007.11.09 -
NOD32v2 2649 2007.11.09 -
Norman 5.80.02 2007.11.08 -
Panda 9.0.0.4 2007.11.09 -
Rising 20.17.41.00 2007.11.09 -
Sophos 4.23.0 2007.11.09 -
Sunbelt 2.2.907.0 2007.11.09 -
Symantec 10 2007.11.09 -
TheHacker 6.2.9.122 2007.11.09 -
VBA32 3.12.2.4 2007.11.08 -
VirusBuster 4.3.26:9 2007.11.08 -
Webwasher-Gateway 6.0.1 2007.11.09 -
Information additionnelle
File size: 931840 bytes
MD5: 1e78076d05e2b84f52e29618f3b71083
SHA1: dbd482e0ee44ecdee0c05d4fd8c1e4cdd4fc52e4
par contre pour le fichier C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe il existe pas.. jpeu mm taper l'adresse il mdise chemin d'accés introuvable.. blablabla.. lol
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.11.9.1 2007.11.09 -
AntiVir 7.6.0.34 2007.11.09 TR/Dldr.ConHook.Gen
Authentium 4.93.8 2007.11.09 -
Avast 4.7.1074.0 2007.11.08 -
AVG 7.5.0.503 2007.11.09 BHO.CNA
BitDefender 7.2 2007.11.09 -
CAT-QuickHeal 9.00 2007.11.09 -
ClamAV 0.91.2 2007.11.09 -
DrWeb 4.44.0.09170 2007.11.09 -
eSafe 7.0.15.0 2007.11.08 -
eTrust-Vet 31.2.5282 2007.11.09 -
Ewido 4.0 2007.11.09 -
FileAdvisor 1 2007.11.09 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.4.2.54 2007.11.09 -
F-Secure 6.70.13030.0 2007.11.09 -
Ikarus T3.1.1.12 2007.11.09 -
Kaspersky 7.0.0.125 2007.11.09 -
McAfee 5159 2007.11.08 -
Microsoft 1.3007 2007.11.09 -
NOD32v2 2649 2007.11.09 -
Norman 5.80.02 2007.11.08 Vundo.gen49
Panda 9.0.0.4 2007.11.09 Suspicious file
Prevx1 V2 2007.11.09 Trojan.Vundo
Rising 20.17.41.00 2007.11.09 -
Sophos 4.23.0 2007.11.09 -
Sunbelt 2.2.907.0 2007.11.09 -
Symantec 10 2007.11.09 -
TheHacker 6.2.9.122 2007.11.09 -
VBA32 3.12.2.4 2007.11.08 -
VirusBuster 4.3.26:9 2007.11.08 -
Webwasher-Gateway 6.0.1 2007.11.09 Trojan.Dldr.ConHook.Gen
Information additionnelle
File size: 80448 bytes
MD5: e0f67125e6c6f2957be23ff48fb0af5c
SHA1: 98d81b8961f2804f70442329f139ae655ef11e20
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5=E73E240D401ACAC93A980168D0081D002A859F1B
pour: C:\WINDOWS\system32\wjisyfat.dll
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.11.9.1 2007.11.09 -
AntiVir 7.6.0.34 2007.11.09 TR/Dldr.ConHook.Gen
Authentium 4.93.8 2007.11.09 -
Avast 4.7.1074.0 2007.11.08 -
AVG 7.5.0.503 2007.11.09 BHO.CNB
BitDefender 7.2 2007.11.09 Trojan.Agent.AFSP
CAT-QuickHeal 9.00 2007.11.09 -
ClamAV 0.91.2 2007.11.09 -
DrWeb 4.44.0.09170 2007.11.09 Trojan.Virtumod.227
eSafe 7.0.15.0 2007.11.08 -
eTrust-Vet 31.2.5282 2007.11.09 -
Ewido 4.0 2007.11.09 -
FileAdvisor 1 2007.11.09 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.4.2.54 2007.11.09 -
F-Secure 6.70.13030.0 2007.11.09 -
Ikarus T3.1.1.12 2007.11.09 -
Kaspersky 7.0.0.125 2007.11.09 -
McAfee 5159 2007.11.08 -
Microsoft 1.3007 2007.11.09 -
NOD32v2 2649 2007.11.09 -
Norman 5.80.02 2007.11.08 Vundo.gen49
Panda 9.0.0.4 2007.11.09 -
Prevx1 V2 2007.11.09 Trojan.Vundo
Rising 20.17.41.00 2007.11.09 -
Sophos 4.23.0 2007.11.09 -
Sunbelt 2.2.907.0 2007.11.09 -
Symantec 10 2007.11.09 -
TheHacker 6.2.9.122 2007.11.09 -
VBA32 3.12.2.4 2007.11.08 -
VirusBuster 4.3.26:9 2007.11.08 -
Webwasher-Gateway 6.0.1 2007.11.09 Trojan.Dldr.ConHook.Gen
Information additionnelle
File size: 86080 bytes
MD5: b2b30b07675fd48435e517945e008921
SHA1: 18e507a5c8e2df86abe2464b5f9646fefa7d0a21
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5=A6441F24406854B050DB01D995CCF100A9200A5A
vla pour C:\Program Files\winbond\w89c33\wwu.exe :
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.11.9.1 2007.11.09 -
AntiVir 7.6.0.34 2007.11.09 -
Authentium 4.93.8 2007.11.09 -
Avast 4.7.1074.0 2007.11.08 -
AVG 7.5.0.503 2007.11.09 -
BitDefender 7.2 2007.11.09 -
CAT-QuickHeal 9.00 2007.11.09 -
ClamAV 0.91.2 2007.11.09 -
DrWeb 4.44.0.09170 2007.11.09 -
eSafe 7.0.15.0 2007.11.08 -
eTrust-Vet 31.2.5282 2007.11.09 -
Ewido 4.0 2007.11.09 -
FileAdvisor 1 2007.11.09 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.4.2.54 2007.11.09 -
F-Secure 6.70.13030.0 2007.11.09 -
Ikarus T3.1.1.12 2007.11.09 -
Kaspersky 7.0.0.125 2007.11.09 -
McAfee 5159 2007.11.08 -
Microsoft 1.3007 2007.11.09 -
NOD32v2 2649 2007.11.09 -
Norman 5.80.02 2007.11.08 -
Panda 9.0.0.4 2007.11.09 -
Rising 20.17.41.00 2007.11.09 -
Sophos 4.23.0 2007.11.09 -
Sunbelt 2.2.907.0 2007.11.09 -
Symantec 10 2007.11.09 -
TheHacker 6.2.9.122 2007.11.09 -
VBA32 3.12.2.4 2007.11.08 -
VirusBuster 4.3.26:9 2007.11.08 -
Webwasher-Gateway 6.0.1 2007.11.09 -
Information additionnelle
File size: 931840 bytes
MD5: 1e78076d05e2b84f52e29618f3b71083
SHA1: dbd482e0ee44ecdee0c05d4fd8c1e4cdd4fc52e4
par contre pour le fichier C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe il existe pas.. jpeu mm taper l'adresse il mdise chemin d'accés introuvable.. blablabla.. lol
bien cela confirme ce que je pensais, il y a infection vundo...
Télécharge VundoFix.exe (par Atribune) sur ton Bureau
http://www.atribune.org/ccount/click.php?id=4
clic double sur VundoFix.exe afin de le lancer
clic sur le bouton Scan for Vundo
Lorsque le scan est complété, clic sur le bouton Remove Vundo
Une invite te demandera si tu veux supprimer les fichiers, clic YES
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
Tu verras une invite qui t'annonce que ton PC va redémarrer;
clic OK
Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci haut, à partir de "clic sur le bouton Scan for Vundo".
Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis dans ta prochaine réponse
Télécharge VundoFix.exe (par Atribune) sur ton Bureau
http://www.atribune.org/ccount/click.php?id=4
clic double sur VundoFix.exe afin de le lancer
clic sur le bouton Scan for Vundo
Lorsque le scan est complété, clic sur le bouton Remove Vundo
Une invite te demandera si tu veux supprimer les fichiers, clic YES
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
Tu verras une invite qui t'annonce que ton PC va redémarrer;
clic OK
Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci haut, à partir de "clic sur le bouton Scan for Vundo".
Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis dans ta prochaine réponse
VundoFix V6.5.11
Checking Java version...
Scan started at 16:04:41 09/11/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
il mdit sa ds le rapport.
Checking Java version...
Scan started at 16:04:41 09/11/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
il mdit sa ds le rapport.
ok on va faire autrement, attention ce n'est pas la même manip!!
vundo est souvent récalcitrant
il en reste donc tu fais ceci en suivant bien les consignes
Relance Vundofix
http://www.atribune.org/ccount/click.php?id=4
* Ne clique pas sur "Scan for a vundo"
* Clique droit au milieu de la fenêtre
* Clique sur Add more files ?
* Copie/colle les fichiers ci-dessous ( un par case) :
C:\WINDOWS\system32\axkkwaeb.dl
C:\WINDOWS\system32\wjisyfat.dll
* Clique sur Add files
* Ensuite clique sur Close Windows
* Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaître dans la fenêtre principale)
* Si l'outils demande un redémarrage, accepte
· Poste le rapport Vundofix, ainsi qu'un nouveau log hijackthis
vundo est souvent récalcitrant
il en reste donc tu fais ceci en suivant bien les consignes
Relance Vundofix
http://www.atribune.org/ccount/click.php?id=4
* Ne clique pas sur "Scan for a vundo"
* Clique droit au milieu de la fenêtre
* Clique sur Add more files ?
* Copie/colle les fichiers ci-dessous ( un par case) :
C:\WINDOWS\system32\axkkwaeb.dl
C:\WINDOWS\system32\wjisyfat.dll
* Clique sur Add files
* Ensuite clique sur Close Windows
* Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaître dans la fenêtre principale)
* Si l'outils demande un redémarrage, accepte
· Poste le rapport Vundofix, ainsi qu'un nouveau log hijackthis
Voila, dsl pr le retard mon pc beuger ;)
vundofix:
Beginning removal...
Performing Repairs to the registry.
Done!
hijack:
Logfile of HijackThis v1.99.1
Scan saved at 17:06:48, on 09/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\winbond\w89c33\wwu.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\panda software\panda antivirus 2007\WebProxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: {b073434d-c7dd-3598-cd54-87de7d3bbe26} - {62ebb3d7-ed78-45dc-8953-dd7cd434370b} - C:\WINDOWS\system32\axkkwaeb.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [oouserv6.exe] C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe
O4 - HKLM\..\Run: [4c05167c] rundll32.exe "C:\WINDOWS\system32\wjisyfat.dll",b
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: IEEE 802.11g Wireless LAN Utility.lnk = ?
O4 - Global Startup: WWU.lnk = C:\Program Files\winbond\w89c33\wwu.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {317153FE-B7FB-419B-AC87-0B2EC97D7A04} (VB2S ActiveX Control) - http://www.subdo.com/activex/vb2s.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://ninie05600.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1074670941046
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {90F7E144-984F-4FA6-83A7-C9C8DCB9974C} (RSActiveXObj Control) - http://www.radarsync.com/RSActiveX.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer = 192.168.0.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: DirectX Service (DirectSejb) - Unknown owner - C:\WINDOWS\system32\directx.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
vundofix:
Beginning removal...
Performing Repairs to the registry.
Done!
hijack:
Logfile of HijackThis v1.99.1
Scan saved at 17:06:48, on 09/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\winbond\w89c33\wwu.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\panda software\panda antivirus 2007\WebProxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: {b073434d-c7dd-3598-cd54-87de7d3bbe26} - {62ebb3d7-ed78-45dc-8953-dd7cd434370b} - C:\WINDOWS\system32\axkkwaeb.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [oouserv6.exe] C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe
O4 - HKLM\..\Run: [4c05167c] rundll32.exe "C:\WINDOWS\system32\wjisyfat.dll",b
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: IEEE 802.11g Wireless LAN Utility.lnk = ?
O4 - Global Startup: WWU.lnk = C:\Program Files\winbond\w89c33\wwu.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {317153FE-B7FB-419B-AC87-0B2EC97D7A04} (VB2S ActiveX Control) - http://www.subdo.com/activex/vb2s.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://ninie05600.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1074670941046
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {90F7E144-984F-4FA6-83A7-C9C8DCB9974C} (RSActiveXObj Control) - http://www.radarsync.com/RSActiveX.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4CBD64D1-725F-4D1D-A9ED-FC7D68F27533}: NameServer = 192.168.0.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: DirectX Service (DirectSejb) - Unknown owner - C:\WINDOWS\system32\directx.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
Télécharge combofix.exe (par sUBs) sur ton Bureau
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Double clique combofix.exe.
Tape sur la touche Y (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Double clique combofix.exe.
Tape sur la touche Y (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
voila le rapport:
ComboFix 07-11-08.1 - michel virginie 2007-11-09 17:51:12.1 - NTFSx86
Running from: C:\Documents and Settings\michel virginie\Bureau\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk
C:\Documents and Settings\michel virginie\Application Data\inst.exe
C:\Documents and Settings\michel virginie\Favoris\Online Security Guide.lnk
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\dbyjerdp.dllbox
C:\WINDOWS\system32\slqvwhtm.dllbox
C:\WINDOWS\system32\tzmsuned.dllbox
C:\WINDOWS\system32\vdacgcxf.dllbox
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_IPRIP
-------\Iprip
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-09 to 2007-11-09 ))))))))))))))))))))))))))))))))))))
.
2007-11-09 17:48 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-09 16:04 <REP> d-------- C:\VundoFix Backups
2007-11-09 16:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2007-11-09 15:59 <REP> d-------- C:\Temp
2007-11-08 08:25 71,680 --------- C:\WINDOWS\system32\drivers\PAVDRV51.SYS
2007-11-08 08:25 248 --a------ C:\WINDOWS\system32\PavCPL.dat
2007-11-08 08:24 <REP> d-------- C:\WINDOWS\system32\PAV
2007-11-08 08:23 <REP> d-------- C:\Program Files\Panda Software
2007-11-08 08:23 45,056 --a------ C:\WINDOWS\system32\avldr.dll
2007-11-08 08:11 80,448 --a------ C:\WINDOWS\system32\axkkwaeb.dll
2007-11-08 08:08 86,080 --a------ C:\WINDOWS\system32\wjisyfat.dll
2007-11-04 21:05 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\Grisoft
2007-11-04 18:16 <REP> d-------- C:\Program Files\CCleaner
2007-11-04 16:18 35,328 --a------ C:\WINDOWS\system32\xxywxus.dll
2007-11-04 16:17 32,768 --a------ C:\Documents and Settings\michel virginie\pdf.exe
2007-11-04 14:35 1,208 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-04 12:15 <REP> d-------- C:\WINDOWS\AU_Temp
2007-11-04 05:37 78,912 --a------ C:\WINDOWS\system32\wptwkpkc.dll
2007-11-04 05:31 278,601 ---hs---- C:\WINDOWS\system32\npqss.bak2
2007-11-03 17:37 <REP> d-------- C:\Program Files\Incomplete
2007-11-03 17:31 6,465 ---hs---- C:\WINDOWS\system32\npqss.bak1
2007-11-03 17:26 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2007-11-03 17:24 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\BitTorrent
2007-11-03 17:23 35,328 --a------ C:\WINDOWS\system32\ddcbayv.dll
2007-11-03 17:07 <REP> d-------- C:\Documents and Settings\michel virginie\Incomplete
2007-11-03 17:06 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\LimeWire
2007-11-02 17:40 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\Skype
2007-11-02 17:39 <REP> d-------- C:\Program Files\Skype
2007-11-02 17:39 <REP> d-------- C:\Program Files\Fichiers communs\Skype
2007-11-02 17:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2007-11-01 19:07 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\BSplayer Pro
2007-11-01 19:07 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\BSplayer
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-09 12:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-08 20:58 22 ----a-w C:\WINDOWS\Fonts\a.zip
2007-11-08 07:44 --------- d-----w C:\Program Files\eMule
2007-11-08 07:23 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-04 17:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom
2007-11-04 11:15 86,094 ----a-w C:\WINDOWS\BPMNT.dll
2007-11-04 11:15 1,163,344 ----a-w C:\WINDOWS\vsapi32.dll
2007-11-04 10:52 71,749 ----a-w C:\WINDOWS\hcextoutput.dll
2007-11-04 10:52 267,845 ----a-w C:\WINDOWS\tsc.exe
2007-11-02 19:51 --------- d-----w C:\Program Files\Teamspeak2_RC2
2007-10-03 18:40 --------- d-----w C:\Program Files\QuickTime
2007-10-01 16:12 --------- d-----w C:\Documents and Settings\michel virginie\Application Data\OpenOffice.org2
2007-09-27 06:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-09-22 11:15 --------- d-----w C:\Documents and Settings\michel virginie\Application Data\Viewpoint
2007-09-22 11:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-09-20 05:32 --------- d-----w C:\Program Files\Java
2007-09-19 16:32 --------- d-----w C:\Program Files\OpenOffice.org 2.2
2007-09-18 17:42 --------- d-----w C:\Program Files\Trend Micro
2007-09-18 17:09 77,824 ----a-w C:\WINDOWS\uinst001.exe
2007-09-13 09:05 --------- d-----w C:\Program Files\Illustrate
2007-09-13 09:05 --------- d-----w C:\Documents and Settings\michel virginie\Application Data\AccurateRip
2007-09-11 14:44 --------- d-----w C:\Program Files\DivX
2007-07-25 17:16 94,208 ----a-w C:\Documents and Settings\michel virginie\Application Data\ezplay.sys
2007-07-25 17:16 47,360 ----a-w C:\Documents and Settings\michel virginie\Application Data\pcouffin.sys
2004-05-10 15:43 62,865 -c--a-w C:\WINDOWS\inf\IM\odysseyIM3.sys
2004-05-10 15:43 45,056 ----a-w C:\WINDOWS\inf\IM\imdinst.exe
2004-05-10 15:43 12,739 -c--a-w C:\WINDOWS\inf\IM\odNetInstall.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62ebb3d7-ed78-45dc-8953-dd7cd434370b}]
2007-11-08 08:11 80448 --a------ C:\WINDOWS\system32\axkkwaeb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [2005-08-03 14:32 C:\WINDOWS\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [2005-03-08 02:33 C:\WINDOWS\system32\VTTimer.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 14:44]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 14:43]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" []
"oouserv6.exe"="C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe" []
"4c05167c"="C:\WINDOWS\system32\wjisyfat.dll" [2007-11-08 08:08]
"APVXDWIN"="C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.exe" [2007-01-25 18:50]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-09-27 12:28]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
avldr.dll 2006-07-14 13:46 45056 C:\WINDOWS\system32\avldr.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"MessagerStarter Wanadoo"=C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo
"WooCnxMon"=C:\PROGRA~1\Wanadoo\CnxMon.exe
"autoclk"=autoclk.exe
"WOOWATCH"=C:\PROGRA~1\Wanadoo\Watch.exe
"WOOTASKBARICON"=C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
"BDNewsAgent"=C:\Program Files\Softwin\BitDefender Free Edition\\bdnagent.exe
"WinampAgent"=C:\Program Files\Winamp\winampa.exe
"NeroCheck"=C:\WINDOWS\system32\\NeroCheck.exe
"adiras"=adiras.exe
"Prism_Utility"=Prismsta.exe
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
"RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
"eDonkey2000"="C:\Program Files\eDonkey2000\eDonkey2000.exe" -t
"OoPDFSettingsv6.exe"=C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
"oouserv6.exe"=C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe
"SunJavaUpdateSched"=C:\Program Files\Java\j2re1.4.2_10\bin\jusched.exe
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"SoundMan"=SOUNDMAN.EXE
"Openwares LiveUpdate"=C:\Program Files\LiveUpdate\LiveUpdate.exe
"OSD"=C:\Program Files\OSD\OSD.EXE
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
"VirusScan Online"=C:\Program Files\McAfee.com\VSO\mcvsshld.exe
"OASClnt"=C:\Program Files\McAfee.com\VSO\oasclnt.exe
"MCAgentExe"=c:\PROGRA~1\mcafee.com\agent\mcagent.exe
"MCUpdateExe"=C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
"MSKAGENTEXE"=C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
"MSKDetectorExe"=C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
"_AntiSpyware"=c:\progra~1\mcafee\MCAFEE~3\masalert.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-09 18:00:30
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\system32\fc.exe 14848 bytes executable
C:\WINDOWS\system32\mmtask.tsk 1152 bytes
C:\WINDOWS\system32\rsmsink.exe 24576 bytes executable
C:\WINDOWS\system32\iasacct.dll 23552 bytes executable
C:\WINDOWS\system32\iasads.dll 41472 bytes executable
C:\WINDOWS\system32\iashlpr.dll 32256 bytes executable
C:\WINDOWS\system32\iasnap.dll 62464 bytes executable
C:\WINDOWS\system32\iaspolcy.dll 17920 bytes executable
C:\WINDOWS\system32\iasrad.dll 119808 bytes executable
C:\WINDOWS\system32\iasrecst.dll 141312 bytes executable
C:\WINDOWS\system32\iassam.dll 86528 bytes executable
C:\WINDOWS\system32\iassdo.dll 253440 bytes executable
C:\WINDOWS\system32\iassvcs.dll 62976 bytes executable
C:\WINDOWS\system32\icaapi.dll 11264 bytes executable
C:\WINDOWS\system32\iccvid.dll 80384 bytes executable
C:\WINDOWS\system32\icfgnt5.dll 16384 bytes executable
C:\WINDOWS\system32\icm32.dll 254976 bytes executable
C:\WINDOWS\system32\icmp.dll 3584 bytes executable
C:\WINDOWS\system32\icmui.dll 56320 bytes executable
C:\WINDOWS\system32\icrav03.rat 8798 bytes
C:\WINDOWS\system32\icsxml
C:\WINDOWS\system32\icwdial.dll 73728 bytes executable
C:\WINDOWS\system32\icwphbk.dll 65536 bytes executable
C:\WINDOWS\system32\ideograf.uce 60458 bytes
C:\WINDOWS\system32\idndl.dll 26112 bytes executable
C:\WINDOWS\system32\c_10000.nls 66082 bytes
C:\WINDOWS\system32\c_10001.nls 162850 bytes
C:\WINDOWS\system32\c_10002.nls 195618 bytes
C:\WINDOWS\system32\c_10003.nls 177698 bytes
C:\WINDOWS\system32\c_10006.nls 66082 bytes
C:\WINDOWS\system32\c_10007.nls 66082 bytes
C:\WINDOWS\system32\c_10008.nls 173602 bytes
C:\WINDOWS\system32\c_10010.nls 66082 bytes
C:\WINDOWS\system32\c_10017.nls 66082 bytes
C:\WINDOWS\system32\c_10029.nls 66082 bytes
C:\WINDOWS\system32\c_10079.nls 66082 bytes
C:\WINDOWS\system32\c_10081.nls 66082 bytes
C:\WINDOWS\system32\c_10082.nls 66082 bytes
C:\WINDOWS\system32\c_1026.nls 66082 bytes
C:\WINDOWS\system32\c_1250.nls 66082 bytes
C:\WINDOWS\system32\c_1251.nls 66082 bytes
C:\WINDOWS\system32\c_1252.nls 66082 bytes
C:\WINDOWS\system32\c_1253.nls 66082 bytes
C:\WINDOWS\system32\c_1254.nls 66082 bytes
C:\WINDOWS\system32\c_1255.nls 66082 bytes
C:\WINDOWS\system32\c_1256.nls 66082 bytes
C:\WINDOWS\system32\c_1257.nls 66082 bytes
C:\WINDOWS\system32\c_28599.nls 66082 bytes
C:\WINDOWS\system32\c_28603.nls 66082 bytes
C:\WINDOWS\system32\c_28605.nls 66082 bytes
C:\WINDOWS\system32\c_437.nls 66594 bytes
C:\WINDOWS\system32\c_500.nls 66082 bytes
C:\WINDOWS\system32\c_737.nls 66594 bytes
C:\WINDOWS\system32\c_775.nls 66594 bytes
C:\WINDOWS\system32\c_850.nls 66594 bytes
C:\WINDOWS\system32\c_852.nls 66594 bytes
C:\WINDOWS\system32\c_855.nls 66594 bytes
C:\WINDOWS\system32\c_857.nls 66594 bytes
C:\WINDOWS\system32\c_860.nls 66594 bytes
C:\WINDOWS\system32\c_861.nls 66594 bytes
C:\WINDOWS\system32\c_863.nls 66594 bytes
C:\WINDOWS\system32\c_865.nls 66594 bytes
C:\WINDOWS\system32\c_866.nls 66594 bytes
C:\WINDOWS\system32\c_869.nls 66594 bytes
C:\WINDOWS\system32\c_874.nls 66594 bytes
C:\WINDOWS\system32\c_875.nls 66082 bytes
C:\WINDOWS\system32\credui.dll 165888 bytes executable
C:\WINDOWS\system32\c_037.nls 66082 bytes
C:\WINDOWS\system32\c_1258.nls 66082 bytes
C:\WINDOWS\system32\c_28598.nls 66082 bytes
C:\WINDOWS\system32\c_932.nls 162850 bytes
C:\WINDOWS\system32\dbgeng.dll 847872 bytes executable
C:\WINDOWS\system32\devmgr.dll 290816 bytes executable
C:\WINDOWS\system32\dispex.dll 45083 bytes executable
C:\WINDOWS\system32\DKRNL.JAX 24 bytes
C:\WINDOWS\system32\dmsynth.dll 103424 bytes executable
C:\WINDOWS\system32\dpnlobby.dll 3584 bytes executable
C:\WINDOWS\system32\dsauth.dll 62976 bytes executable
C:\WINDOWS\system32\dswave.dll 19456 bytes executable
C:\WINDOWS\system32\edlin.exe 13010 bytes
C:\WINDOWS\system32\eudcedit.exe 195072 bytes executable
C:\WINDOWS\system32\dbghelp.dll 640000 bytes executable
C:\WINDOWS\system32\dbmsrpcn.dll 24576 bytes executable
C:\WINDOWS\system32\dbnetlib.dll 110592 bytes executable
C:\WINDOWS\system32\dbnmpntw.dll 28672 bytes executable
C:\WINDOWS\system32\Dcache.bin 1788 bytes
C:\WINDOWS\system32\dciman32.dll 8704 bytes executable
C:\WINDOWS\system32\dcomcnfg.exe 5120 bytes executable
C:\WINDOWS\system32\ddcbayv.dll 35328 bytes executable
C:\WINDOWS\system32\ddeml.dll 39424 bytes
C:\WINDOWS\system32\ddeshare.exe 31744 bytes executable
C:\WINDOWS\system32\ddraw.dll 266240 bytes executable
C:\WINDOWS\system32\ddrawex.dll 27136 bytes executable
C:\WINDOWS\system32\debug.exe 21162 bytes
C:\WINDOWS\system32\declrds.ax 47104 bytes executable
C:\WINDOWS\system32\defrag.exe 25088 bytes executable
C:\WINDOWS\system32\desk.cpl 138240 bytes executable
C:\WINDOWS\system32\deskadp.dll 16896 bytes executable
C:\WINDOWS\system32\deskmon.dll 16896 bytes executable
C:\WINDOWS\system32\deskperf.dll 18944 bytes executable
C:\WINDOWS\system32\desktop.ini 2 bytes
C:\WINDOWS\system32\devenum.dll 59904 bytes executable
C:\WINDOWS\system32\devmgmt.msc 32738 bytes
C:\WINDOWS\system32\divxdec_0407.dll 89600 bytes executable
C:\WINDOWS\system32\divxdec_040c.dll 90112 bytes executable
C:\WINDOWS\system32\divxdec_0411.dll 89600 bytes executable
C:\WINDOWS\system32\dsdmo.dll 181760 bytes executable
C:\WINDOWS\system32\dsdmoprp.dll 72192 bytes executable
C:\WINDOWS\system32\dskquota.dll 93696 bytes executable
C:\WINDOWS\system32\dskquoui.dll 150016 bytes executable
C:\WINDOWS\system32\dsound.dll 367616 bytes executable
C:\WINDOWS\system32\dsound.vxd 81 bytes
C:\WINDOWS\system32\dsound3d.dll 1294336 bytes executable
C:\WINDOWS\system32\dsprop.dll 145408 bytes executable
C:\WINDOWS\system32\dsprpres.dll 4096 bytes executable
C:\WINDOWS\system32\dsquery.dll 240640 bytes executable
C:\WINDOWS\system32\dssec.dat 218003 bytes
C:\WINDOWS\system32\dssec.dll 52736 bytes executable
C:\WINDOWS\system32\dssenh.dll 137216 bytes executable
C:\WINDOWS\system32\dsuiext.dll 113664 bytes executable
C:\WINDOWS\system32\feclient.dll 21504 bytes executable
C:\WINDOWS\system32\filemgmt.dll 348160 bytes executable
C:\WINDOWS\system32\find.exe 9216 bytes executable
C:\WINDOWS\system32\findstr.exe 29184 bytes executable
C:\WINDOWS\system32\finger.exe 10240 bytes executable
C:\WINDOWS\system32\firewall.cpl 80384 bytes executable
C:\WINDOWS\system32\fixmapi.exe 3072 bytes executable
C:\WINDOWS\system32\fldrclnr.dll 88064 bytes executable
C:\WINDOWS\system32\fltlib.dll 16896 bytes executable
C:\WINDOWS\system32\fltmc.exe 23040 bytes executable
C:\WINDOWS\system32\fmifs.dll 16384 bytes executable
C:\WINDOWS\system32\FNTCACHE.DAT 482720 bytes
C:\WINDOWS\system32\fontext.dll 386560 bytes executable
C:\WINDOWS\system32\fontsub.dll 80896 bytes executable
C:\WINDOWS\system32\fontview.exe 21504 bytes executable
C:\WINDOWS\system32\forcedos.exe 7168 bytes executable
C:\WINDOWS\system32\format.com 25600 bytes executable
C:\WINDOWS\system32\fr-fr
C:\WINDOWS\system32\framebuf.dll 9344 bytes executable
C:\WINDOWS\system32\freecell.exe 55808 bytes executable
C:\WINDOWS\system32\fsmgmt.msc 32409 bytes
C:\WINDOWS\system32\fsquirt.exe 193024 bytes executable
C:\WINDOWS\system32\fsusd.dll 81920 bytes executable
C:\WINDOWS\system32\npptools.dll 55296 bytes executable
C:\WINDOWS\system32\npqss.bak1 6465 bytes
C:\WINDOWS\system32\npqss.bak2 278601 bytes
C:\WINDOWS\system32\npqss.ini 256421 bytes
C:\WINDOWS\system32\nscompat.tlb 23392 bytes
C:\WINDOWS\system32\nslookup.exe 79360 bytes executable
C:\WINDOWS\system32\ntbackup.chm 79238 bytes
C:\WINDOWS\system32\ntbackup.exe 1166336 bytes executable
C:\WINDOWS\system32\ntbackup.hlp 68824 bytes
C:\WINDOWS\system32\ntdll.dll 733184 bytes executable
C:\WINDOWS\system32\ntdos.sys 27916 bytes
C:\WINDOWS\system32\ntdos404.sys 29146 bytes
C:\WINDOWS\system32\ntdos411.sys 29370 bytes
C:\WINDOWS\system32\ntdos412.sys 29274 bytes
C:\WINDOWS\system32\ntdos804.sys 29146 bytes
C:\WINDOWS\system32\ntdsapi.dll 67072 bytes executable
C:\WINDOWS\system32\ntimage.gif 48794 bytes
C:\WINDOWS\system32\ntio.sys 34000 bytes
C:\WINDOWS\system32\ntio404.sys 34560 bytes
C:\WINDOWS\system32\ntio411.sys 35648 bytes
C:\WINDOWS\system32\ntio412.sys 35424 bytes
C:\WINDOWS\system32\ntio804.sys 34560 bytes
C:\WINDOWS\system32\ntkrnlpa.exe 2059648 bytes executable
C:\WINDOWS\system32\ntlanman.dll 43520 bytes executable
C:\WINDOWS\system32\ntlanui.dll 59392 bytes executable
C:\WINDOWS\system32\ntlanui2.dll 14848 bytes executable
C:\WINDOWS\system32\iprtprio.dll 4096 bytes executable
C:\WINDOWS\system32\iprtrmgr.dll 169984 bytes executable
C:\WINDOWS\system32\ipsec6.exe 46080 bytes executable
C:\WINDOWS\system32\ipsecsnp.dll 361472 bytes executable
C:\WINDOWS\system32\ipsecsvc.dll 184320 bytes executable
C:\WINDOWS\system32\ipsink.ax 16384 bytes executable
C:\WINDOWS\system32\ipsmsnap.dll 388096 bytes executable
C:\WINDOWS\system32\ipv6.exe 53760 bytes executable
C:\WINDOWS\system32\ipv6mon.dll 59904 bytes executable
C:\WINDOWS\system32\ipxmontr.dll 91648 bytes executable
C:\WINDOWS\system32\ipxpromn.dll 74240 bytes executable
C:\WINDOWS\system32\ipxrip.dll 21504 bytes executable
C:\WINDOWS\system32\ipxroute.exe 24576 bytes executable
C:\WINDOWS\system32\ipxrtmgr.dll 39936 bytes executable
C:\WINDOWS\system32\ipxsap.dll 66560 bytes executable
C:\WINDOWS\system32\ipxwan.dll 20992 bytes executable
C:\WINDOWS\system32\ir32_32.dll 199168 bytes executable
C:\WINDOWS\system32\ir41_32.ax 848384 bytes executable
C:\WINDOWS\system32\ir41_32.dll 756736 bytes executable
C:\WINDOWS\system32\ir41_qc.dll 120320 bytes executable
C:\WINDOWS\system32\kbd101.dll 6144 bytes executable
C:\WINDOWS\system32\kbd101a.dll 6144 bytes executable
C:\WINDOWS\system32\kbd101b.dll 6144 bytes executable
C:\WINDOWS\system32\kbd101c.dll 6144 bytes executable
C:\WINDOWS\system32\kbd103.dll 5632 bytes executable
C:\WINDOWS\system32\kbd106.dll 6144 bytes executable
C:\WINDOWS\system32\kbd106n.dll 6144 bytes executable
C:\WINDOWS\system32\KBDAL.DLL 6656 bytes executable
C:\WINDOWS\system32\kbdax2.dll 6144 bytes executable
C:\WINDOWS\system32\kbdaze.dll 5632 bytes executable
C:\WINDOWS\system32\kbdazel.dll 5632 bytes executable
C:\WINDOWS\system32\kbdbe.dll 6144 bytes executable
C:\WINDOWS\system32\kbdbene.dll 6144 bytes executable
C:\WINDOWS\system32\kbdblr.dll 5632 bytes executable
C:\WINDOWS\system32\kbdbr.dll 6144 bytes executable
C:\WINDOWS\system32\kbdbu.dll 5632 bytes executable
C:\WINDOWS\system32\kbdca.dll 6144 bytes executable
C:\WINDOWS\system32\kbdcan.dll 7680 bytes executable
C:\WINDOWS\system32\kbdcr.dll 6656 bytes executable
C:\WINDOWS\system32\kbdcz.dll 7168 bytes executable
C:\WINDOWS\system32\kbdcz1.dll 6656 bytes executable
C:\WINDOWS\system32\kbdcz2.dll 6656 bytes executable
C:\WINDOWS\system32\kbdda.dll 6144 bytes executable
C:\WINDOWS\system32\kbddv.dll 5120 bytes executable
C:\WINDOWS\system32\kbdes.dll 6144 bytes executable
C:\WINDOWS\system32\kbdest.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfc.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfi.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfi1.dll 7168 bytes executable
C:\WINDOWS\system32\kbdfo.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfr.dll 6144 bytes executable
C:\WINDOWS\system32\kbdlk41a.dll 6656 bytes executable
C:\WINDOWS\system32\kbdlk41j.dll 6144 bytes executable
C:\WINDOWS\system32\kbdlt.dll 5632 bytes executable
C:\WINDOWS\system32\kbdlt1.dll 5632 bytes executable
C:\WINDOWS\system32\kbdlv.dll 6144 bytes executable
C:\WINDOWS\system32\kbdlv1.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmac.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmaori.dll 5632 bytes executable
C:\WINDOWS\system32\kbdmlt47.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmlt48.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmon.dll 5632 bytes executable
C:\WINDOWS\system32\kbdne.dll 6144 bytes executable
C:\WINDOWS\system32\kbdnec.dll 7168 bytes executable
C:\WINDOWS\system32\kbdnec95.dll 7168 bytes executable
C:\WINDOWS\system32\kbdnecAT.dll 9216 bytes executable
C:\WINDOWS\system32\kbdnecNT.dll 7680 bytes executable
C:\WINDOWS\system32\kbdno.dll 6144 bytes executable
C:\WINDOWS\system32\kbdno1.dll 7168 bytes executable
C:\WINDOWS\system32\kbdpl.dll 6656 bytes executable
C:\WINDOWS\system32\LAPRXY.dll 11264 bytes executable
C:\WINDOWS\system32\lcphrase.tbl 211938 bytes
C:\WINDOWS\system32\lcptr.tbl 24114 bytes
C:\WINDOWS\system32\LegitCheckControl.dll 1476992 bytes executable
C:\WINDOWS\system32\lfbmp10N.dll 34304 bytes executable
C:\WINDOWS\system32\lfbmp13n.dll 57344 bytes executable
C:\WINDOWS\system32\LFBMP62N.DLL 22016 bytes executable
C:\WINDOWS\system32\LFCMP10N.DLL 266752 bytes executable
C:\WINDOWS\system32\lfcmp13n.dll 401408 bytes executable
C:\WINDOWS\system32\LFCMP62N.DLL 158720 bytes executable
C:\WINDOWS\system32\lffax10N.dll 77824 bytes executable
C:\WINDOWS\system32\lffax13n.dll 98304 bytes executable
C:\WINDOWS\system32\lfgif13n.dll 69632 bytes executable
C:\WINDOWS\system32\lfpng13n.dll 159744 bytes executable
C:\WINDOWS\system32\lftif10N.dll 122368 bytes executable
C:\WINDOWS\system32\lftif13n.dll 155648 bytes executable
C:\WINDOWS\system32\lhacm.acm 34064 bytes executable
C:\WINDOWS\system32\libdivx.dll 1044480 bytes executable
C:\WINDOWS\system32\licdll.dll 424960 bytes executable
C:\WINDOWS\system32\licmgr10.dll 22528 bytes executable
C:\WINDOWS\system32\licwmi.dll 58880 bytes executable
C:\WINDOWS\system32\mciavi32.dll 85504 bytes executable
C:\WINDOWS\system32\mcicda.dll 17408 bytes executable
C:\WINDOWS\system32\mciole16.dll 8192 bytes
C:\WINDOWS\system32\mciole32.dll 7680 bytes executable
C:\WINDOWS\system32\mciqtz32.dll 35328 bytes executable
C:\WINDOWS\system32\mciseq.dll 23040 bytes executable
C:\WINDOWS\system32\mciseq.drv 25280 bytes
C:\WINDOWS\system32\mciwave.dll 23552 bytes executable
C:\WINDOWS\system32\mciwave.drv 28160 bytes
C:\WINDOWS\system32\mcoinstall.exe 28672 bytes executable
C:\WINDOWS\system32\mdaccore.rsp 228 bytes
C:\WINDOWS\system32\mdhcp.dll 50176 bytes executable
C:\WINDOWS\system32\mdminst.dll 120320 bytes executable
C:\WINDOWS\system32\mdwmdmsp.dll 147968 bytes executable
C:\WINDOWS\system32\mem.exe 39434 bytes
C:\WINDOWS\system32\mf3216.dll 40960 bytes executable
C:\WINDOWS\system32\mfc40.dll 924432 bytes executable
C:\WINDOWS\system32\mfc40loc.dll 45568 bytes executable
C:\WINDOWS\system32\mfc40u.dll 927504 bytes executable
C:\WINDOWS\system32\mfc42.dll 1028096 bytes executable
C:\WINDOWS\system32\mmutilse.dll 119808 bytes executable
C:\WINDOWS\system32\mnmdd.dll 34560 bytes executable
C:\WINDOWS\system32\mnmsrvc.exe 32768 bytes executable
C:\WINDOWS\system32\mobsync.dll 210432 bytes executable
C:\WINDOWS\system32\mobsync.exe 144384 bytes executable
C:\WINDOWS\system32\mode.com 19456 bytes executable
C:\WINDOWS\system32\modemui.dll 156160 bytes executable
C:\WINDOWS\system32\modex.dll 10112 bytes executable
C:\WINDOWS\system32\more.com 15872 bytes executable
C:\WINDOWS\system32\moricons.dll 216064 bytes executable
C:\WINDOWS\system32\mountvol.exe 8192 bytes executable
C:\WINDOWS\system32\mouse.drv 2032 bytes
C:\WINDOWS\system32\MP43DECD.dll 259072 bytes executable
C:\WINDOWS\system32\MP43DMOD.dll 4096 bytes executable
C:\WINDOWS\system32\MP4SDECD.dll 317440 bytes executable
C:\WINDOWS\system32\MP4SDMOD.dll 4096 bytes executable
C:\WINDOWS\system32\mpeg2data.ax 118272 bytes executable
C:\WINDOWS\system32\mpg2splt.ax 148992 bytes executable
C:\WINDOWS\system32\MPG4DECD.dll 259072 bytes executable
C:\WINDOWS\system32\MPG4DMOD.dll 4096 bytes executable
C:\WINDOWS\system32\mpg4ds32.ax 262144 bytes executable
C:\WINDOWS\system32\mplay32.exe 124928 bytes executable
C:\WINDOWS\system32\mpnotify.exe 22016 bytes executable
C:\WINDOWS\system32\mpr.dll 59904 bytes executable
C:\WINDOWS\system32\mprapi.dll 87040 bytes executable
C:\WINDOWS\system32\mprddm.dll 69120 bytes executable
C:\WINDOWS\system32\mprdim.dll 49152 bytes executable
C:\WINDOWS\system32\msexch35.dll 344064 bytes executable
C:\WINDOWS\system32\msexch40.dll 512029 bytes executable
C:\WINDOWS\system32\msexcl35.dll 252688 bytes executable
C:\WINDOWS\system32\msexcl40.dll 319517 bytes executable
C:\WINDOWS\system32\MSFLXGRD.OCX 200976 bytes executable
C:\WINDOWS\system32\msftedit.dll 539136 bytes executable
C:\WINDOWS\system32\msg.exe 22528 bytes executable
C:\WINDOWS\system32\msg711.acm 9216 bytes executable
C:\WINDOWS\system32\msg723.acm 118784 bytes executable
C:\WINDOWS\system32\msgina.dll 1004032 bytes executable
C:\WINDOWS\system32\msgsm32.acm 19968 bytes executable
C:\WINDOWS\system32\msgsvc.dll 33792 bytes executable
C:\WINDOWS\system32\msh261.drv 188416 bytes executable
C:\WINDOWS\system32\msh263.drv 294912 bytes executable
C:\WINDOWS\system32\msyuv.dll 17408 bytes executable
C:\WINDOWS\system32\mtxclu.dll 66560 bytes executable
C:\WINDOWS\system32\mtxdm.dll 20480 bytes executable
C:\WINDOWS\system32\mtxex.dll 4096 bytes executable
C:\WINDOWS\system32\mtxlegih.dll 25088 bytes executable
C:\WINDOWS\system32\mtxoci.dll 91136 bytes executable
C:\WINDOWS\system32\mucltui.dll 271224 bytes executable
C:\WINDOWS\system32\mucltui.dll.mui 30072 bytes executable
C:\WINDOWS\system32\mui
C:\WINDOWS\system32\muweb.dll 207736 bytes executable
C:\WINDOWS\system32\muzika.xm 50492 bytes
C:\WINDOWS\system32\ole2disp.dll 169520 bytes
C:\WINDOWS\system32\ole2nls.dll 153008 bytes
C:\WINDOWS\system32\ole32.dll 1284608 bytes executable
C:\WINDOWS\system32\oleacc.dll 163328 bytes executable
C:\WINDOWS\system32\oleaccrc.dll 18944 bytes executable
C:\WINDOWS\system32\Oleaut32.1 490256 bytes executable
C:\WINDOWS\system32\oleaut32.dll 549376 bytes executable
C:\WINDOWS\system32\olecli.dll 83456 bytes
C:\WINDOWS\system32\olecli32.dll 75264 bytes executable
C:\WINDOWS\system32\olecnv32.dll 37888 bytes executable
C:\WINDOWS\system32\oledlg.dll 124928 bytes executable
C:\WINDOWS\system32\oleprn.dll 110592 bytes executable
C:\WINDOWS\system32\olepro32.dll 83456 bytes executable
C:\WINDOWS\system32\olesvr.dll 24064 bytes
C:\WINDOWS\system32\olesvr32.dll 22016 bytes executable
C:\WINDOWS\system32\olethk32.dll 69120 bytes executable
C:\WINDOWS\system32\Omcamext.ax 38925 bytes executable
C:\WINDOWS\system32\omcamext.dll 53248 bytes executable
C:\WINDOWS\system32\omcamsti.dll 36864 bytes executable
C:\WINDOWS\system32\OmCamUSD.dll 16452 bytes executable
C:\WINDOWS\system32\oobe
C:\WINDOWS\system32\OoneZipPopup.dll 452608 bytes executable
C:\WINDOWS\system32\OoPdfManagerPopup.dll 587776 bytes executable
C:\WINDOWS\system32\opengl32.dll 713728 bytes executable
C:\WINDOWS\system32\osk.exe 216576 bytes executable
C:\WINDOWS\system32\osuninst.dll 68096 bytes executable
C:\WINDOWS\system32\perfd00C.dat 34108 bytes
C:\WINDOWS\system32\perfdisk.dll 27136 bytes executable
C:\WINDOWS\system32\perffilt.h 140 bytes
C:\WINDOWS\system32\perffilt.ini 1293 bytes
C:\WINDOWS\system32\perfh009.dat 382026 bytes
C:\WINDOWS\system32\perfh00C.dat 447222 bytes
C:\WINDOWS\system32\perfi009.dat 272128 bytes
C:\WINDOWS\system32\perfi00C.dat 322810 bytes
C:\WINDOWS\system32\perfmon.exe 15872 bytes executable
C:\WINDOWS\system32\perfmon.msc 57862 bytes
C:\WINDOWS\system32\perfnet.dll 17408 bytes executable
C:\WINDOWS\system32\perfos.dll 26624 bytes executable
C:\WINDOWS\system32\perfproc.dll 35840 bytes executable
C:\WINDOWS\system32\PerfStringBackup.INI 956332 bytes
C:\WINDOWS\system32\perfts.dll 12288 bytes executable
C:\WINDOWS\system32\perfwci.h 435 bytes
C:\WINDOWS\system32\perfwci.ini 2994 bytes
C:\WINDOWS\system32\PfModNT.sys 6752 bytes executable
C:\WINDOWS\system32\phon.ime 79360 bytes executable
C:\WINDOWS\system32\phon.tbl 4071 bytes
C:\WINDOWS\system32\phoncode.tbl 43242 bytes
C:\WINDOWS\system32\phonptr.tbl 2714 bytes
C:\WINDOWS\system32\photowiz.dll 172032 bytes executable
C:\WINDOWS\system32\picn20.dll 38912 bytes executable
C:\WINDOWS\system32\pid.dll 35328 bytes executable
C:\WINDOWS\system32\pschdprf.ini 14073 bytes
C:\WINDOWS\system32\pscript.sep 51 bytes
C:\WINDOWS\system32\PSIKey.dll 1335296 bytes executable
C:\WINDOWS\system32\psnppagn.dll 8192 bytes executable
C:\WINDOWS\system32\pstorec.dll 43520 bytes executable
C:\WINDOWS\system32\pstorsvc.dll 34304 bytes executable
C:\WINDOWS\system32\PTxSCP.ocx 1206272 bytes executable
C:\WINDOWS\system32\pubprn.vbs 3862 bytes
C:\WINDOWS\system32\px.dll 514808 bytes executable
C:\WINDOWS\system32\pxafs.dll 129784 bytes executable
C:\WINDOWS\system32\pxcpya64.exe 63144 bytes executable
C:\WINDOWS\system32\pxcpyi64.exe 108544 bytes executable
C:\WINDOWS\system32\pxdrv.dll 477944 bytes executable
C:\WINDOWS\system32\pxhpinst.exe 67240 bytes executable
C:\WINDOWS\system32\pxinsa64.exe 62632 bytes executable
C:\WINDOWS\system32\pxinsi64.exe 115880 bytes executable
C:\WINDOWS\system32\pxmas.dll 183032 bytes executable
C:\WINDOWS\system32\pxsfs.dll 1309432 bytes executable
C:\WINDOWS\system32\pxwave.dll 379640 bytes executable
C:\WINDOWS\system32\pxwma.dll 151552 bytes executable
C:\WINDOWS\system32\qappsrv.exe 17408 bytes executable
C:\WINDOWS\system32\qasf.dll 211456 bytes executable
C:\WINDOWS\system32\qcap.dll 192512 bytes executable
C:\WINDOWS\system32\qdv.dll 279040 bytes executable
C:\WINDOWS\system32\qdvd.dll 386048 bytes executable
C:\WINDOWS\system32\qedit.dll 563200 bytes executable
C:\WINDOWS\system32\qedwipes.dll 733696 bytes executable
C:\WINDOWS\system32\qmgr.dll 382464 bytes executable
C:\WINDOWS\system32\qmgrprxy.dll 18944 bytes executable
C:\WINDOWS\system32\qosname.dll 8192 bytes executable
C:\WINDOWS\system32\replace.exe 12800 bytes executable
C:\WINDOWS\system32\reset.exe 10240 bytes executable
C:\WINDOWS\system32\Restore
C:\WINDOWS\system32\resutils.dll 58880 bytes executable
C:\WINDOWS\system32\ReWire.dll 225280 bytes executable
C:\WINDOWS\system32\rexec.exe 14848 bytes executable
C:\WINDOWS\system32\riched20.dll 433152 bytes executable
C:\WINDOWS\system32\riched32.dll 3584 bytes executable
C:\WINDOWS\system32\RICHTEXT.SRG 111 bytes
C:\WINDOWS\system32\RICHTX32.DEP 3010 bytes
C:\WINDOWS\system32\RICHTX32.oca 64000 bytes executable
C:\WINDOWS\system32\RICHTX32.OCX 260096 bytes executable
C:\WINDOWS\system32\RLOgg.ax 186880 bytes executable
C:\WINDOWS\system32\RLSpeexDec.ax 51712 bytes executable
C:\WINDOWS\system32\RLTheoraDec.ax 67584 bytes executable
C:\WINDOWS\system32\scarddlg.dll 71168 bytes executable
C:\WINDOWS\system32\scardssp.dll 118784 bytes executable
C:\WINDOWS\system32\scardsvr.exe 100352 bytes executable
C:\WINDOWS\system32\sccbase.dll 169984 bytes executable
C:\WINDOWS\system32\sccsccp.dll 171520 bytes executable
C:\WINDOWS\system32\scecli.dll 186368 bytes executable
C:\WINDOWS\system32\scesrv.dll 328704 bytes executable
C:\WINDOWS\system32\schannel.dll 144896 bytes executable
C:\WINDOWS\system32\schedsvc.dll 193024 bytes executable
C:\WINDOWS\system32\sclgntfy.dll 22016 bytes executable
C:\WINDOWS\system32\scofr.dll 24624 bytes executable
C:\WINDOWS\system32\scredir.dll 26624 bytes executable
C:\WINDOWS\system32\scrnsave.scr 9216 bytes executable
C:\WINDOWS\system32\scrobj.dll 159744 bytes executable
C:\WINDOWS\system32\scrrnfr.dll 24626 bytes executable
C:\WINDOWS\system32\scrrun.dll 151552 bytes executable
C:\WINDOWS\system32\SDA
C:\WINDOWS\system32\sdbinst.exe 78848 bytes executable
C:\WINDOWS\system32\sdhcinst.dll 29184 bytes executable
C:\WINDOWS\system32\sl_anet.acm 86016 bytes executable
C:\WINDOWS\system32\Smab.dll 845312 bytes executable
C:\WINDOWS\system32\smbinst.exe 8192 bytes executable
C:\WINDOWS\system32\smlogcfg.dll 370688 bytes executable
C:\WINDOWS\system32\smlogsvc.exe 93184 bytes executable
C:\WINDOWS\system32\smss.exe 50688 bytes executable
C:\WINDOWS\system32\Snap32n.dll 249856 bytes executable
C:\WINDOWS\system32\sndrec32.exe 133120 bytes executable
C:\WINDOWS\system32\sndvol32.exe 139264 bytes executable
C:\WINDOWS\system32\snetcfg.exe 12507 bytes executable
C:\WINDOWS\system32\snmpapi.dll 18944 bytes executable
C:\WINDOWS\system32\snmpsnap.dll 184320 bytes executable
C:\WINDOWS\system32\SNWValid.dll 231936 bytes executable
C:\WINDOWS\system32\Snwvalid.hlp 11104 bytes
C:\WINDOWS\system32\softpub.dll 5632 bytes executable
C:\WINDOWS\system32\SoftwareDistribution
C:\WINDOWS\system32\synceng.dll 57856 bytes executable
C:\WINDOWS\system32\SynCOM.dll 77917 bytes executable
C:\WINDOWS\system32\SynCtrl.dll 114688 bytes executable
C:\WINDOWS\system32\syncui.dll 197120 bytes executable
C:\WINDOWS\system32\SynTPAPI.dll 90202 bytes executable
C:\WINDOWS\system32\SynTPCo2.dll 81920 bytes executable
C:\WINDOWS\system32\SynTPFcs.dll 69722 bytes executable
C:\WINDOWS\system32\sysdm.cpl 305152 bytes executable
C:\WINDOWS\system32\sysedit.exe 19216 bytes
C:\WINDOWS\system32\SysInfoServer.dll 24576 bytes executable
C:\WINDOWS\system32\sysinv.dll 15872 bytes executable
C:\WINDOWS\system32\syskey.exe 37888 bytes executable
C:\WINDOWS\system32\sysmon.ocx 220672 bytes executable
C:\WINDOWS\system32\sysocmgr.exe 107520 bytes executable
C:\WINDOWS\system32\sysprint.sep 3214 bytes
C:\WINDOWS\system32\sysprtj.sep 3577 bytes
C:\WINDOWS\system32\syssetup.dll 1005056 bytes executable
C:\WINDOWS\system32\system.drv 3360 bytes
C:\WINDOWS\system32\systray.exe 3072 bytes executable
C:\WINDOWS\system32\t2embed.dll 118272 bytes executable
C:\WINDOWS\system32\TABCTL32.OCX 209608 bytes executable
C:\WINDOWS\system32\tafysijw.ini 577948 bytes
C:\WINDOWS\system32\tapi.dll 19200 bytes
C:\WINDOWS\system32\tapi3.dll 860160 bytes executable
C:\WINDOWS\system32\tapi32.dll 181760 bytes executable
C:\WINDOWS\system32\tree.com 11264 bytes executable
C:\WINDOWS\system32\trkwks.dll 90624 bytes executable
C:\WINDOWS\system32\tsappcmp.dll 52224 bytes executable
C:\WINDOWS\system32\tsbyuv.dll 8192 bytes executable
C:\WINDOWS\system32\tscfgwmi.dll 94208 bytes executable
C:\WINDOWS\system32\tscon.exe 15360 bytes executable
C:\WINDOWS\system32\tscupgrd.exe 44544 bytes executable
C:\WINDOWS\system32\tsd32.dll 15360 bytes executable
C:\WINDOWS\system32\tsddd.dll 12168 bytes executable
C:\WINDOWS\system32\tsdiscon.exe 14848 bytes executable
C:\WINDOWS\system32\tskill.exe 16896 bytes executable
C:\WINDOWS\system32\tslabels.h 3286 bytes
C:\WINDOWS\system32\tslabels.ini 27768 bytes
C:\WINDOWS\system32\tsshutdn.exe 17408 bytes executable
C:\WINDOWS\system32\tssoft32.acm 8192 bytes executable
C:\WINDOWS\system32\twext.dll 44032 bytes executable
C:\WINDOWS\system32\TwnLib20.dll 106496 bytes executable
C:\WINDOWS\system32\TwnLib4.dll 364544 bytes executable
C:\WINDOWS\system32\version.dll 18944 bytes executable
C:\WINDOWS\system32\VFind.exe 49152 bytes executable
C:\WINDOWS\system32\vfpodbc.dll 20535 bytes executable
C:\WINDOWS\system32\vfwwdm32.dll 54784 bytes executable
C:\WINDOWS\system32\vga.dll 9344 bytes executable
C:\WINDOWS\system32\vga.drv 2176 bytes
C:\WINDOWS\system32\vga256.dll 51456 bytes executable
C:\WINDOWS\system32\vga64k.dll 18176 bytes executable
C:\WINDOWS\system32\VGAunistlog.ini 165 bytes
C:\WINDOWS\system32\vidcap.ax 28672 bytes executable
C:\WINDOWS\system32\VisualSoftCrypt.dll 275968 bytes executable
C:\WINDOWS\system32\vjoy.dll 4608 bytes executable
C:\WINDOWS\system32\vmhelper.dll 286992 bytes executable
C:\WINDOWS\system32\VModes.exe 40960 bytes executable
C:\WINDOWS\system32\vp6vfw.dll 442368 bytes executable
C:\WINDOWS\system32\Vsflex7L.ocx 419488 bytes executable
C:\WINDOWS\system32\vssadmin.exe 34304 bytes executable
C:\WINDOWS\system32\vssapi.dll 430592 bytes executable
C:\WINDOWS\system32\vssvc.exe 295424 bytes executable
C:\WINDOWS\system32\wbdbase.ita 867840 bytes
C:\WINDOWS\system32\wbdbase.nld 1095680 bytes
C:\WINDOWS\system32\wbdbase.sve 937984 bytes
C:\WINDOWS\system32\wbem
C:\WINDOWS\system32\wbsecdrv.inf 3036 bytes
C:\WINDOWS\system32\wbsecdrv.sys 17664 bytes executable
C:\WINDOWS\system32\wbsecsvc.exe 241664 bytes executable
C:\WINDOWS\system32\wdfapi.dll 4096 bytes executable
C:\WINDOWS\system32\wdfmgr.exe 8704 bytes executable
C:\WINDOWS\system32\wdigest.dll 49152 bytes executable
C:\WINDOWS\system32\wdl.trm 4096 bytes
C:\WINDOWS\system32\wdmaud.drv 23552 bytes executable
C:\WINDOWS\system32\webc3dsx(2).ax 50718 bytes executable
C:\WINDOWS\system32\webc3dsx(3).ax 50718 bytes executable
C:\WINDOWS\system32\webc3dsx.ax 50718 bytes executable
C:\WINDOWS\system32\webc3ext.dll 49152 bytes executable
C:\WINDOWS\system32\usrfaxa.dll 86073 bytes executable
C:\WINDOWS\system32\usrlbva.dll 53305 bytes executable
C:\WINDOWS\system32\usrlogon.cmd 1263 bytes
C:\WINDOWS\system32\usrmlnka.exe 77891 bytes executable
C:\WINDOWS\system32\usrprbda.exe 61508 bytes executable
C:\WINDOWS\system32\usrrtosa.dll 77883 bytes executable
C:\WINDOWS\system32\usrsdpia.dll 49211 bytes executable
C:\WINDOWS\system32\usrshuta.exe 69700 bytes executable
C:\WINDOWS\system32\usrsvpia.dll 41019 bytes executable
C:\WINDOWS\system32\usrv42a.dll 102457 bytes executable
C:\WINDOWS\system32\usrv80a.dll 49209 bytes executable
C:\WINDOWS\system32\usrvoica.dll 45116 bytes executable
C:\WINDOWS\system32\usrvpa.dll 49211 bytes executable
C:\WINDOWS\system32\utildll.dll 26112 bytes executable
C:\WINDOWS\system32\utilman.exe 50176 bytes executable
C:\WINDOWS\system32\uwdf.exe 8704 bytes executable
C:\WINDOWS\system32\uxtheme.dll 219648 bytes executable
C:\WINDOWS\system32\v7vga.rom 18832 bytes
C:\WINDOWS\system32\comm.drv 10544 bytes
C:\WINDOWS\system32\command.com 52103 bytes
C:\WINDOWS\system32\commdlg.dll 33904 bytes
C:\WINDOWS\system32\comp.exe 15872 bytes executable
C:\WINDOWS\system32\compact.exe 18432 bytes executable
C:\WINDOWS\system32\compatUI.dll 253440 bytes executable
C:\WINDOWS\system32\compmgmt.msc 37357 bytes
C:\WINDOWS\system32\compobj.dll 30160 bytes
C:\WINDOWS\system32\compstui.dll 230912 bytes executable
C:\WINDOWS\system32\comrepl.dll 97792 bytes executable
C:\WINDOWS\system32\comres.dll 851968 bytes executable
C:\WINDOWS\system32\comsnap.dll 147456 bytes executable
C:\WINDOWS\system32\comsvcs.dll 1267200 bytes executable
C:\WINDOWS\system32\comuid.dll 540160 bytes executable
C:\WINDOWS\system32\config
C:\WINDOWS\system32\CONFIG.NT 3072 bytes
C:\WINDOWS\system32\CONFIG.TMP 3072 bytes
C:\WINDOWS\system32\confmsp.dll 346112 bytes executable
C:\WINDOWS\system32\conime.exe 27648 bytes executable
C:\WINDOWS\system32\console.dll 67072 bytes executable
C:\WINDOWS\system32\control.exe 8192 bytes executable
C:\WINDOWS\system32\convert.exe 13824 bytes executable
C:\WINDOWS\system32\corpol.dll 35328 bytes executable
C:\WINDOWS\system32\country.sys 27097 bytes
C:\WINDOWS\system32\cppenv25.dll 27648 bytes executable
C:\WINDOWS\system32\winscard.dll 100352 bytes executable
C:\WINDOWS\system32\winshfhc.dll 17408 bytes executable
C:\WINDOWS\system32\WINSIZE.DLL 4080 bytes
C:\WINDOWS\system32\winsock.dll 2864 bytes
C:\WINDOWS\system32\WINSP.IME 156672 bytes executable
C:\WINDOWS\system32\WINSP.MB 1564868 bytes
C:\WINDOWS\system32\winspool.drv 146944 bytes executable
C:\WINDOWS\system32\winspool.exe 2112 bytes
C:\WINDOWS\system32\winsrv.dll 293376 bytes executable
C:\WINDOWS\system32\winsta.dll 53760 bytes executable
C:\WINDOWS\system32\winstrm.dll 21504 bytes executable
C:\WINDOWS\system32\wintrust.dll 176640 bytes executable
C:\WINDOWS\system32\winver.exe 5632 bytes executable
C:\WINDOWS\system32\WINZM.IME 156672 bytes executable
C:\WINDOWS\system32\WINZM.MB 1223500 bytes
C:\WINDOWS\system32\wisptis.exe 194560 bytes executable
C:\WINDOWS\system32\wjisyfat.dll 86080 bytes executable
C:\WINDOWS\system32\wjview.exe 171792 bytes executable
C:\WINDOWS\system32\wkssvc.dll 132096 bytes executable
C:\WINDOWS\system32\WLANUTL.dll 106496 bytes executable
C:\WINDOWS\system32\wldap32.dll 172544 bytes executable
C:\WINDOWS\system32\wlnotify.dll 94208 bytes executable
C:\WINDOWS\system32\wmadmod.dll 757248 bytes executable
C:\WINDOWS\system32\WMADMOE.dll 1117696 bytes executable
C:\WINDOWS\system32\wmasf.dll 222208 bytes executable
C:\WINDOWS\system32\wmaudsdk.dll 163600 bytes executable
C:\WINDOWS\system32\wmdmlog.dll 33792 bytes executable
C:\WINDOWS\system32\wmdmps.dll 37376 bytes executable
C:\WINDOWS\system32\wmdrmdev.dll 429056 bytes executable
C:\WINDOWS\system32\wmdrmnet.dll 348672 bytes executable
C:\WINDOWS\system32\wmdrmsdk.dll 535040 bytes executable
C:\WINDOWS\system32\mssip32.dll 4608 bytes executable
C:\WINDOWS\system32\msstdfmt.dll 118784 bytes executable
C:\WINDOWS\system32\msstkprp.dll 94208 bytes executable
C:\WINDOWS\system32\msswch.dll 13312 bytes executable
C:\WINDOWS\system32\msswchx.exe 6656 bytes executable
C:\WINDOWS\system32\mstask.dll 281600 bytes executable
C:\WINDOWS\system32\mstext35.dll 166672 bytes executable
C:\WINDOWS\system32\mstext40.dll 258077 bytes executable
C:\WINDOWS\system32\mstime.dll 532480 bytes executable
C:\WINDOWS\system32\mstinit.exe 12288 bytes executable
C:\WINDOWS\system32\mstlsapi.dll 115712 bytes executable
C:\WINDOWS\system32\mstsc.exe 411648 bytes executable
C:\WINDOWS\system32\mstscax.dll 655360 bytes executable
C:\WINDOWS\system32\msutb.dll 195584 bytes executable
C:\WINDOWS\system32\msv1_0.dll 129536 bytes executable
C:\WINDOWS\system32\msvbvm50.dll 1355776 bytes executable
C:\WINDOWS\system32\MSVBVM60.DLL 1386496 bytes executable
C:\WINDOWS\system32\msvci70.dll 54784 bytes executable
C:\WINDOWS\system32\msvcirt.dll 54784 bytes executable
C:\WINDOWS\system32\msvcp50.dll 565760 bytes executable
C:\WINDOWS\system32\msvcp60.dll 413696 bytes executable
C:\WINDOWS\system32\msvcp70.dll 487424 bytes executable
C:\WINDOWS\system32\msvcp71.dll 499712 bytes executable
C:\WINDOWS\system32\msvcr70.dll 344064 bytes executable
C:\WINDOWS\system32\msvcr71.dll 348160 bytes executable
C:\WINDOWS\system32\msvcrt.dll 343040 bytes executable
C:\WINDOWS\system32\MSVCRT10.DLL 210944 bytes executable
C:\WINDOWS\system32\setup.exe 23040 bytes executable
C:\WINDOWS\system32\setupapi.dll 1003520 bytes executable
C:\WINDOWS\system32\setupdll.dll 421376 bytes executable
C:\WINDOWS\system32\setver.exe 12067 bytes
C:\WINDOWS\system32\sfc.dll 5120 bytes executable
C:\WINDOWS\system32\sfc.exe 10240 bytes executable
C:\WINDOWS\system32\sfcfiles.dll 1548288 bytes executable
C:\WINDOWS\system32\sfc_os.dll 142336 bytes executable
C:\WINDOWS\system32\sfmapi.dll 23552 bytes executable
C:\WINDOWS\system32\sfxbe321.dll 73216 bytes executable
C:\WINDOWS\system32\sfxbe322.dll 77312 bytes executable
C:\WINDOWS\system32\sfxbe323.dll 74240 bytes executable
C:\WINDOWS\system32\sfxbe324.dll 78336 bytes executable
C:\WINDOWS\system32\sfxfe32.exe 53760 bytes executable
C:\WINDOWS\system32\sfxfe321.exe 58368 bytes executable
C:\WINDOWS\system32\shadow.exe 15360 bytes executable
C:\WINDOWS\system32\share.exe 882 bytes
C:\WINDOWS\system32\shdoclc.dll 572416 bytes executable
C:\WINDOWS\system32\shdocvw.bak 1483776 bytes executable
C:\WINDOWS\system32\shdocvw.dll 1498624 bytes executable
C:\WINDOWS\system32\shell.dll 5120 bytes
C:\WINDOWS\system32\shell32.dll 8509952 bytes executable
C:\WINDOWS\system32\ShellDHCP
C:\WINDOWS\system32\ShellExt
C:\WINDOWS\system32\shellstyle.dll 435712 bytes executable
C:\WINDOWS\system32\shfolder.dll 25088 bytes executable
C:\WINDOWS\system32\dfrg.msc 41131 bytes
C:\WINDOWS\system32\dfrgfat.exe 82432 bytes executable
C:\WINDOWS\system32\dfrgntfs.exe 104960 bytes executable
C:\WINDOWS\system32\dfrgres.dll 55808 bytes executable
C:\WINDOWS\system32\dfrgsnap.dll 39424 bytes executable
C:\WINDOWS\system32\dfrgui.dll 123904 bytes executable
C:\WINDOWS\system32\dfsshlex.dll 28672 bytes executable
C:\WINDOWS\system32\dgnet.dll 115200 bytes executable
C:\WINDOWS\system32\dgrpsetu.dll 176157 bytes executable
C:\WINDOWS\system32\dgsetup.dll 86044 bytes executable
C:\WINDOWS\system32\dhcp
C:\WINDOWS\system32\dhcpcsvc.dll 112128 bytes executable
C:\WINDOWS\system32\dhcpmon.dll 401408 bytes executable
C:\WINDOWS\system32\dhcpsapi.dll 78848 bytes executable
C:\WINDOWS\system32\diactfrm.dll 395264 bytes executable
C:\WINDOWS\system32\diantz.exe 85504 bytes executable
C:\WINDOWS\system32\digest.dll 68608 bytes executable
C:\WINDOWS\system32\dimap.dll 44032 bytes executable
C:\WINDOWS\system32\dinput.dll 165376 bytes executable
C:\WINDOWS\system32\dinput8.dll 187904 bytes executable
C:\WINDOWS\system32\DiracSplitter.ax 179200 bytes executable
C:\WINDOWS\system32\DirectX
C:\WINDOWS\system32\diskcomp.com 9216 bytes executable
C:\WINDOWS\system32\diskcopy.com 7168 bytes executable
C:\WINDOWS\system32\diskcopy.dll 1502208 bytes executable
C:\WINDOWS\system32\diskmgmt.msc 33311 bytes
C:\WINDOWS\system32\diskpart.exe 167936 bytes executable
C:\WINDOWS\system32\diskperf.exe 19456 bytes executable
C:\WINDOWS\system32\dmusic.dll 104448 bytes executable
C:\WINDOWS\system32\dmutil.dll 58880 bytes executable
C:\WINDOWS\system32\dmview.ocx 61440 bytes executable
C:\WINDOWS\system32\dnsapi.dll 148480 bytes executable
C:\WINDOWS\system32\dnsrslvr.dll 45568 bytes executable
C:\WINDOWS\system32\docprop.dll 47616 bytes executable
C:\WINDOWS\system32\docprop2.dll 48640 bytes executable
C:\WINDOWS\system32\doskey.exe 10752 bytes executable
C:\WINDOWS\system32\dosx.exe 54080 bytes
C:\WINDOWS\system32\dpcdll.dll 97792 bytes executable
C:\WINDOWS\system32\dplay.dll 33040 bytes executable
C:\WINDOWS\system32\dplaysvr.exe 30208 bytes executable
C:\WINDOWS\system32\dplayx.dll 229888 bytes executable
C:\WINDOWS\system32\dpmodemx.dll 24064 bytes executable
C:\WINDOWS\system32\dpnaddr.dll 3584 bytes executable
C:\WINDOWS\system32\dpnet.dll 375296 bytes executable
C:\WINDOWS\system32\dpnhpast.dll 35328 bytes executable
C:\WINDOWS\system32\dpnhupnp.dll 60928 bytes executable
C:\WINDOWS\system32\mprmsg.dll 114688 bytes executable
C:\WINDOWS\system32\mscpx32r.dLL 12288 bytes executable
C:\WINDOWS\system32\msencode.dll 94282 bytes executable
C:\WINDOWS\system32\mshearts.exe 128000 bytes executable
C:\WINDOWS\system32\msjet40.dll 1507356 bytes executable
C:\WINDOWS\system32\mspdox35.dll 250128 bytes executable
C:\WINDOWS\system32\mssign32.dll 36352 bytes executable
C:\WINDOWS\system32\msvcrt20.dll 253952 bytes executable
C:\WINDOWS\system32\msxmlr.dll 30720 bytes executable
C:\WINDOWS\system32\mycomput.dll 90624 bytes executable
C:\WINDOWS\system32\nddenb32.dll 19456 bytes executable
C:\WINDOWS\system32\netrap.dll 12288 bytes executable
C:\WINDOWS\system32\noise.chs 1696 bytes
C:\WINDOWS\system32\npp
C:\WINDOWS\system32\ntlsapi.dll 8192 bytes executable
C:\WINDOWS\system32\objsel.dll 288768 bytes executable
C:\WINDOWS\system32\odbcjt32.dll 278559 bytes executable
C:\WINDOWS\system32\ole2.dll 39744 bytes
C:\WINDOWS\system32\osuninst.exe 41984 bytes executable
C:\WINDOWS\system32\perfd009.dat 28626 bytes
C:\WINDOWS\system32\pidgen.dll 24064 bytes executable
C:\WINDOWS\system32\prcp.nls 83748 bytes
C:\WINDOWS\system32\pschdprf.dll 10752 bytes executable
C:\WINDOWS\system32\qprocess.exe 20992 bytes executable
C:\WINDOWS\system32\rasauto.dll 89088 bytes executable
C:\WINDOWS\system32\rcbdyctl.dll 103424 bytes executable
C:\WINDOWS\system32\rend.dll 107520 bytes executable
C:\WINDOWS\system32\ega.cpi 127213 bytes
C:\WINDOWS\system32\els.dll 187392 bytes executable
C:\WINDOWS\system32\emptyregdb.dat 21892 bytes
C:\WINDOWS\system32\en-US
C:\WINDOWS\system32\encapi.dll 20480 bytes executable
C:\WINDOWS\system32\encdec.dll 186368 bytes executable
C:\WINDOWS\system32\EqnClass.Dll 103424 bytes executable
C:\WINDOWS\system32\ersvc.dll 23040 bytes executable
C:\WINDOWS\system32\es.dll 243200 bytes executable
C:\WINDOWS\system32\esent.dll 1097728 bytes executable
C:\WINDOWS\system32\esent97.dll 1114896 bytes executable
C:\WINDOWS\system32\esentprf.dll 17408 bytes executable
C:\WINDOWS\system32\esentprf.hxx 6708 bytes
C:\WINDOWS\system32\esentprf.ini 1015477 bytes
C:\WINDOWS\system32\esentutl.exe 39424 bytes executable
C:\WINDOWS\system32\ftp.exe 46080 bytes executable
C:\WINDOWS\system32\ftsrch.dll 177152 bytes executable
C:\WINDOWS\system32\netsetup.cpl 25600 bytes executable
C:\WINDOWS\system32\netsetup.exe 332800 bytes executable
C:\WINDOWS\system32\netsh.exe 88576 bytes executable
C:\WINDOWS\system32\netshell.dll 1723904 bytes executable
C:\WINDOWS\system32\netstat.exe 37888 bytes executable
C:\WINDOWS\system32\netui0.dll 83456 bytes executable
C:\WINDOWS\system32\netui1.dll 245760 bytes executable
C:\WINDOWS\system32\netui2.dll 312832 bytes executable
C:\WINDOWS\system32\newdev.dll 251392 bytes executable
C:\WINDOWS\system32\NewmsrdkForKey
C:\WINDOWS\system32\NexPlayerX.dll 561152 bytes executable
C:\WINDOWS\system32\nlhtml.dll 103936 bytes executable
C:\WINDOWS\system32\nlsdl.dll 24576 bytes executable
**************************************************************************
.
Completion time: 2007-11-09 18:05:06 - machine was rebooted
.
--- E O F ---
ComboFix 07-11-08.1 - michel virginie 2007-11-09 17:51:12.1 - NTFSx86
Running from: C:\Documents and Settings\michel virginie\Bureau\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk
C:\Documents and Settings\michel virginie\Application Data\inst.exe
C:\Documents and Settings\michel virginie\Favoris\Online Security Guide.lnk
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\dbyjerdp.dllbox
C:\WINDOWS\system32\slqvwhtm.dllbox
C:\WINDOWS\system32\tzmsuned.dllbox
C:\WINDOWS\system32\vdacgcxf.dllbox
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_IPRIP
-------\Iprip
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-09 to 2007-11-09 ))))))))))))))))))))))))))))))))))))
.
2007-11-09 17:48 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-09 16:04 <REP> d-------- C:\VundoFix Backups
2007-11-09 16:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2007-11-09 15:59 <REP> d-------- C:\Temp
2007-11-08 08:25 71,680 --------- C:\WINDOWS\system32\drivers\PAVDRV51.SYS
2007-11-08 08:25 248 --a------ C:\WINDOWS\system32\PavCPL.dat
2007-11-08 08:24 <REP> d-------- C:\WINDOWS\system32\PAV
2007-11-08 08:23 <REP> d-------- C:\Program Files\Panda Software
2007-11-08 08:23 45,056 --a------ C:\WINDOWS\system32\avldr.dll
2007-11-08 08:11 80,448 --a------ C:\WINDOWS\system32\axkkwaeb.dll
2007-11-08 08:08 86,080 --a------ C:\WINDOWS\system32\wjisyfat.dll
2007-11-04 21:05 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\Grisoft
2007-11-04 18:16 <REP> d-------- C:\Program Files\CCleaner
2007-11-04 16:18 35,328 --a------ C:\WINDOWS\system32\xxywxus.dll
2007-11-04 16:17 32,768 --a------ C:\Documents and Settings\michel virginie\pdf.exe
2007-11-04 14:35 1,208 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-04 12:15 <REP> d-------- C:\WINDOWS\AU_Temp
2007-11-04 05:37 78,912 --a------ C:\WINDOWS\system32\wptwkpkc.dll
2007-11-04 05:31 278,601 ---hs---- C:\WINDOWS\system32\npqss.bak2
2007-11-03 17:37 <REP> d-------- C:\Program Files\Incomplete
2007-11-03 17:31 6,465 ---hs---- C:\WINDOWS\system32\npqss.bak1
2007-11-03 17:26 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2007-11-03 17:24 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\BitTorrent
2007-11-03 17:23 35,328 --a------ C:\WINDOWS\system32\ddcbayv.dll
2007-11-03 17:07 <REP> d-------- C:\Documents and Settings\michel virginie\Incomplete
2007-11-03 17:06 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\LimeWire
2007-11-02 17:40 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\Skype
2007-11-02 17:39 <REP> d-------- C:\Program Files\Skype
2007-11-02 17:39 <REP> d-------- C:\Program Files\Fichiers communs\Skype
2007-11-02 17:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2007-11-01 19:07 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\BSplayer Pro
2007-11-01 19:07 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\BSplayer
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-09 12:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-08 20:58 22 ----a-w C:\WINDOWS\Fonts\a.zip
2007-11-08 07:44 --------- d-----w C:\Program Files\eMule
2007-11-08 07:23 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-04 17:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom
2007-11-04 11:15 86,094 ----a-w C:\WINDOWS\BPMNT.dll
2007-11-04 11:15 1,163,344 ----a-w C:\WINDOWS\vsapi32.dll
2007-11-04 10:52 71,749 ----a-w C:\WINDOWS\hcextoutput.dll
2007-11-04 10:52 267,845 ----a-w C:\WINDOWS\tsc.exe
2007-11-02 19:51 --------- d-----w C:\Program Files\Teamspeak2_RC2
2007-10-03 18:40 --------- d-----w C:\Program Files\QuickTime
2007-10-01 16:12 --------- d-----w C:\Documents and Settings\michel virginie\Application Data\OpenOffice.org2
2007-09-27 06:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-09-22 11:15 --------- d-----w C:\Documents and Settings\michel virginie\Application Data\Viewpoint
2007-09-22 11:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-09-20 05:32 --------- d-----w C:\Program Files\Java
2007-09-19 16:32 --------- d-----w C:\Program Files\OpenOffice.org 2.2
2007-09-18 17:42 --------- d-----w C:\Program Files\Trend Micro
2007-09-18 17:09 77,824 ----a-w C:\WINDOWS\uinst001.exe
2007-09-13 09:05 --------- d-----w C:\Program Files\Illustrate
2007-09-13 09:05 --------- d-----w C:\Documents and Settings\michel virginie\Application Data\AccurateRip
2007-09-11 14:44 --------- d-----w C:\Program Files\DivX
2007-07-25 17:16 94,208 ----a-w C:\Documents and Settings\michel virginie\Application Data\ezplay.sys
2007-07-25 17:16 47,360 ----a-w C:\Documents and Settings\michel virginie\Application Data\pcouffin.sys
2004-05-10 15:43 62,865 -c--a-w C:\WINDOWS\inf\IM\odysseyIM3.sys
2004-05-10 15:43 45,056 ----a-w C:\WINDOWS\inf\IM\imdinst.exe
2004-05-10 15:43 12,739 -c--a-w C:\WINDOWS\inf\IM\odNetInstall.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62ebb3d7-ed78-45dc-8953-dd7cd434370b}]
2007-11-08 08:11 80448 --a------ C:\WINDOWS\system32\axkkwaeb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [2005-08-03 14:32 C:\WINDOWS\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [2005-03-08 02:33 C:\WINDOWS\system32\VTTimer.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 14:44]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 14:43]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" []
"oouserv6.exe"="C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe" []
"4c05167c"="C:\WINDOWS\system32\wjisyfat.dll" [2007-11-08 08:08]
"APVXDWIN"="C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.exe" [2007-01-25 18:50]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-09-27 12:28]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
avldr.dll 2006-07-14 13:46 45056 C:\WINDOWS\system32\avldr.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"MessagerStarter Wanadoo"=C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo
"WooCnxMon"=C:\PROGRA~1\Wanadoo\CnxMon.exe
"autoclk"=autoclk.exe
"WOOWATCH"=C:\PROGRA~1\Wanadoo\Watch.exe
"WOOTASKBARICON"=C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
"BDNewsAgent"=C:\Program Files\Softwin\BitDefender Free Edition\\bdnagent.exe
"WinampAgent"=C:\Program Files\Winamp\winampa.exe
"NeroCheck"=C:\WINDOWS\system32\\NeroCheck.exe
"adiras"=adiras.exe
"Prism_Utility"=Prismsta.exe
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
"RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
"eDonkey2000"="C:\Program Files\eDonkey2000\eDonkey2000.exe" -t
"OoPDFSettingsv6.exe"=C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
"oouserv6.exe"=C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe
"SunJavaUpdateSched"=C:\Program Files\Java\j2re1.4.2_10\bin\jusched.exe
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"SoundMan"=SOUNDMAN.EXE
"Openwares LiveUpdate"=C:\Program Files\LiveUpdate\LiveUpdate.exe
"OSD"=C:\Program Files\OSD\OSD.EXE
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
"VirusScan Online"=C:\Program Files\McAfee.com\VSO\mcvsshld.exe
"OASClnt"=C:\Program Files\McAfee.com\VSO\oasclnt.exe
"MCAgentExe"=c:\PROGRA~1\mcafee.com\agent\mcagent.exe
"MCUpdateExe"=C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
"MSKAGENTEXE"=C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
"MSKDetectorExe"=C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
"_AntiSpyware"=c:\progra~1\mcafee\MCAFEE~3\masalert.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-09 18:00:30
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\system32\fc.exe 14848 bytes executable
C:\WINDOWS\system32\mmtask.tsk 1152 bytes
C:\WINDOWS\system32\rsmsink.exe 24576 bytes executable
C:\WINDOWS\system32\iasacct.dll 23552 bytes executable
C:\WINDOWS\system32\iasads.dll 41472 bytes executable
C:\WINDOWS\system32\iashlpr.dll 32256 bytes executable
C:\WINDOWS\system32\iasnap.dll 62464 bytes executable
C:\WINDOWS\system32\iaspolcy.dll 17920 bytes executable
C:\WINDOWS\system32\iasrad.dll 119808 bytes executable
C:\WINDOWS\system32\iasrecst.dll 141312 bytes executable
C:\WINDOWS\system32\iassam.dll 86528 bytes executable
C:\WINDOWS\system32\iassdo.dll 253440 bytes executable
C:\WINDOWS\system32\iassvcs.dll 62976 bytes executable
C:\WINDOWS\system32\icaapi.dll 11264 bytes executable
C:\WINDOWS\system32\iccvid.dll 80384 bytes executable
C:\WINDOWS\system32\icfgnt5.dll 16384 bytes executable
C:\WINDOWS\system32\icm32.dll 254976 bytes executable
C:\WINDOWS\system32\icmp.dll 3584 bytes executable
C:\WINDOWS\system32\icmui.dll 56320 bytes executable
C:\WINDOWS\system32\icrav03.rat 8798 bytes
C:\WINDOWS\system32\icsxml
C:\WINDOWS\system32\icwdial.dll 73728 bytes executable
C:\WINDOWS\system32\icwphbk.dll 65536 bytes executable
C:\WINDOWS\system32\ideograf.uce 60458 bytes
C:\WINDOWS\system32\idndl.dll 26112 bytes executable
C:\WINDOWS\system32\c_10000.nls 66082 bytes
C:\WINDOWS\system32\c_10001.nls 162850 bytes
C:\WINDOWS\system32\c_10002.nls 195618 bytes
C:\WINDOWS\system32\c_10003.nls 177698 bytes
C:\WINDOWS\system32\c_10006.nls 66082 bytes
C:\WINDOWS\system32\c_10007.nls 66082 bytes
C:\WINDOWS\system32\c_10008.nls 173602 bytes
C:\WINDOWS\system32\c_10010.nls 66082 bytes
C:\WINDOWS\system32\c_10017.nls 66082 bytes
C:\WINDOWS\system32\c_10029.nls 66082 bytes
C:\WINDOWS\system32\c_10079.nls 66082 bytes
C:\WINDOWS\system32\c_10081.nls 66082 bytes
C:\WINDOWS\system32\c_10082.nls 66082 bytes
C:\WINDOWS\system32\c_1026.nls 66082 bytes
C:\WINDOWS\system32\c_1250.nls 66082 bytes
C:\WINDOWS\system32\c_1251.nls 66082 bytes
C:\WINDOWS\system32\c_1252.nls 66082 bytes
C:\WINDOWS\system32\c_1253.nls 66082 bytes
C:\WINDOWS\system32\c_1254.nls 66082 bytes
C:\WINDOWS\system32\c_1255.nls 66082 bytes
C:\WINDOWS\system32\c_1256.nls 66082 bytes
C:\WINDOWS\system32\c_1257.nls 66082 bytes
C:\WINDOWS\system32\c_28599.nls 66082 bytes
C:\WINDOWS\system32\c_28603.nls 66082 bytes
C:\WINDOWS\system32\c_28605.nls 66082 bytes
C:\WINDOWS\system32\c_437.nls 66594 bytes
C:\WINDOWS\system32\c_500.nls 66082 bytes
C:\WINDOWS\system32\c_737.nls 66594 bytes
C:\WINDOWS\system32\c_775.nls 66594 bytes
C:\WINDOWS\system32\c_850.nls 66594 bytes
C:\WINDOWS\system32\c_852.nls 66594 bytes
C:\WINDOWS\system32\c_855.nls 66594 bytes
C:\WINDOWS\system32\c_857.nls 66594 bytes
C:\WINDOWS\system32\c_860.nls 66594 bytes
C:\WINDOWS\system32\c_861.nls 66594 bytes
C:\WINDOWS\system32\c_863.nls 66594 bytes
C:\WINDOWS\system32\c_865.nls 66594 bytes
C:\WINDOWS\system32\c_866.nls 66594 bytes
C:\WINDOWS\system32\c_869.nls 66594 bytes
C:\WINDOWS\system32\c_874.nls 66594 bytes
C:\WINDOWS\system32\c_875.nls 66082 bytes
C:\WINDOWS\system32\credui.dll 165888 bytes executable
C:\WINDOWS\system32\c_037.nls 66082 bytes
C:\WINDOWS\system32\c_1258.nls 66082 bytes
C:\WINDOWS\system32\c_28598.nls 66082 bytes
C:\WINDOWS\system32\c_932.nls 162850 bytes
C:\WINDOWS\system32\dbgeng.dll 847872 bytes executable
C:\WINDOWS\system32\devmgr.dll 290816 bytes executable
C:\WINDOWS\system32\dispex.dll 45083 bytes executable
C:\WINDOWS\system32\DKRNL.JAX 24 bytes
C:\WINDOWS\system32\dmsynth.dll 103424 bytes executable
C:\WINDOWS\system32\dpnlobby.dll 3584 bytes executable
C:\WINDOWS\system32\dsauth.dll 62976 bytes executable
C:\WINDOWS\system32\dswave.dll 19456 bytes executable
C:\WINDOWS\system32\edlin.exe 13010 bytes
C:\WINDOWS\system32\eudcedit.exe 195072 bytes executable
C:\WINDOWS\system32\dbghelp.dll 640000 bytes executable
C:\WINDOWS\system32\dbmsrpcn.dll 24576 bytes executable
C:\WINDOWS\system32\dbnetlib.dll 110592 bytes executable
C:\WINDOWS\system32\dbnmpntw.dll 28672 bytes executable
C:\WINDOWS\system32\Dcache.bin 1788 bytes
C:\WINDOWS\system32\dciman32.dll 8704 bytes executable
C:\WINDOWS\system32\dcomcnfg.exe 5120 bytes executable
C:\WINDOWS\system32\ddcbayv.dll 35328 bytes executable
C:\WINDOWS\system32\ddeml.dll 39424 bytes
C:\WINDOWS\system32\ddeshare.exe 31744 bytes executable
C:\WINDOWS\system32\ddraw.dll 266240 bytes executable
C:\WINDOWS\system32\ddrawex.dll 27136 bytes executable
C:\WINDOWS\system32\debug.exe 21162 bytes
C:\WINDOWS\system32\declrds.ax 47104 bytes executable
C:\WINDOWS\system32\defrag.exe 25088 bytes executable
C:\WINDOWS\system32\desk.cpl 138240 bytes executable
C:\WINDOWS\system32\deskadp.dll 16896 bytes executable
C:\WINDOWS\system32\deskmon.dll 16896 bytes executable
C:\WINDOWS\system32\deskperf.dll 18944 bytes executable
C:\WINDOWS\system32\desktop.ini 2 bytes
C:\WINDOWS\system32\devenum.dll 59904 bytes executable
C:\WINDOWS\system32\devmgmt.msc 32738 bytes
C:\WINDOWS\system32\divxdec_0407.dll 89600 bytes executable
C:\WINDOWS\system32\divxdec_040c.dll 90112 bytes executable
C:\WINDOWS\system32\divxdec_0411.dll 89600 bytes executable
C:\WINDOWS\system32\dsdmo.dll 181760 bytes executable
C:\WINDOWS\system32\dsdmoprp.dll 72192 bytes executable
C:\WINDOWS\system32\dskquota.dll 93696 bytes executable
C:\WINDOWS\system32\dskquoui.dll 150016 bytes executable
C:\WINDOWS\system32\dsound.dll 367616 bytes executable
C:\WINDOWS\system32\dsound.vxd 81 bytes
C:\WINDOWS\system32\dsound3d.dll 1294336 bytes executable
C:\WINDOWS\system32\dsprop.dll 145408 bytes executable
C:\WINDOWS\system32\dsprpres.dll 4096 bytes executable
C:\WINDOWS\system32\dsquery.dll 240640 bytes executable
C:\WINDOWS\system32\dssec.dat 218003 bytes
C:\WINDOWS\system32\dssec.dll 52736 bytes executable
C:\WINDOWS\system32\dssenh.dll 137216 bytes executable
C:\WINDOWS\system32\dsuiext.dll 113664 bytes executable
C:\WINDOWS\system32\feclient.dll 21504 bytes executable
C:\WINDOWS\system32\filemgmt.dll 348160 bytes executable
C:\WINDOWS\system32\find.exe 9216 bytes executable
C:\WINDOWS\system32\findstr.exe 29184 bytes executable
C:\WINDOWS\system32\finger.exe 10240 bytes executable
C:\WINDOWS\system32\firewall.cpl 80384 bytes executable
C:\WINDOWS\system32\fixmapi.exe 3072 bytes executable
C:\WINDOWS\system32\fldrclnr.dll 88064 bytes executable
C:\WINDOWS\system32\fltlib.dll 16896 bytes executable
C:\WINDOWS\system32\fltmc.exe 23040 bytes executable
C:\WINDOWS\system32\fmifs.dll 16384 bytes executable
C:\WINDOWS\system32\FNTCACHE.DAT 482720 bytes
C:\WINDOWS\system32\fontext.dll 386560 bytes executable
C:\WINDOWS\system32\fontsub.dll 80896 bytes executable
C:\WINDOWS\system32\fontview.exe 21504 bytes executable
C:\WINDOWS\system32\forcedos.exe 7168 bytes executable
C:\WINDOWS\system32\format.com 25600 bytes executable
C:\WINDOWS\system32\fr-fr
C:\WINDOWS\system32\framebuf.dll 9344 bytes executable
C:\WINDOWS\system32\freecell.exe 55808 bytes executable
C:\WINDOWS\system32\fsmgmt.msc 32409 bytes
C:\WINDOWS\system32\fsquirt.exe 193024 bytes executable
C:\WINDOWS\system32\fsusd.dll 81920 bytes executable
C:\WINDOWS\system32\npptools.dll 55296 bytes executable
C:\WINDOWS\system32\npqss.bak1 6465 bytes
C:\WINDOWS\system32\npqss.bak2 278601 bytes
C:\WINDOWS\system32\npqss.ini 256421 bytes
C:\WINDOWS\system32\nscompat.tlb 23392 bytes
C:\WINDOWS\system32\nslookup.exe 79360 bytes executable
C:\WINDOWS\system32\ntbackup.chm 79238 bytes
C:\WINDOWS\system32\ntbackup.exe 1166336 bytes executable
C:\WINDOWS\system32\ntbackup.hlp 68824 bytes
C:\WINDOWS\system32\ntdll.dll 733184 bytes executable
C:\WINDOWS\system32\ntdos.sys 27916 bytes
C:\WINDOWS\system32\ntdos404.sys 29146 bytes
C:\WINDOWS\system32\ntdos411.sys 29370 bytes
C:\WINDOWS\system32\ntdos412.sys 29274 bytes
C:\WINDOWS\system32\ntdos804.sys 29146 bytes
C:\WINDOWS\system32\ntdsapi.dll 67072 bytes executable
C:\WINDOWS\system32\ntimage.gif 48794 bytes
C:\WINDOWS\system32\ntio.sys 34000 bytes
C:\WINDOWS\system32\ntio404.sys 34560 bytes
C:\WINDOWS\system32\ntio411.sys 35648 bytes
C:\WINDOWS\system32\ntio412.sys 35424 bytes
C:\WINDOWS\system32\ntio804.sys 34560 bytes
C:\WINDOWS\system32\ntkrnlpa.exe 2059648 bytes executable
C:\WINDOWS\system32\ntlanman.dll 43520 bytes executable
C:\WINDOWS\system32\ntlanui.dll 59392 bytes executable
C:\WINDOWS\system32\ntlanui2.dll 14848 bytes executable
C:\WINDOWS\system32\iprtprio.dll 4096 bytes executable
C:\WINDOWS\system32\iprtrmgr.dll 169984 bytes executable
C:\WINDOWS\system32\ipsec6.exe 46080 bytes executable
C:\WINDOWS\system32\ipsecsnp.dll 361472 bytes executable
C:\WINDOWS\system32\ipsecsvc.dll 184320 bytes executable
C:\WINDOWS\system32\ipsink.ax 16384 bytes executable
C:\WINDOWS\system32\ipsmsnap.dll 388096 bytes executable
C:\WINDOWS\system32\ipv6.exe 53760 bytes executable
C:\WINDOWS\system32\ipv6mon.dll 59904 bytes executable
C:\WINDOWS\system32\ipxmontr.dll 91648 bytes executable
C:\WINDOWS\system32\ipxpromn.dll 74240 bytes executable
C:\WINDOWS\system32\ipxrip.dll 21504 bytes executable
C:\WINDOWS\system32\ipxroute.exe 24576 bytes executable
C:\WINDOWS\system32\ipxrtmgr.dll 39936 bytes executable
C:\WINDOWS\system32\ipxsap.dll 66560 bytes executable
C:\WINDOWS\system32\ipxwan.dll 20992 bytes executable
C:\WINDOWS\system32\ir32_32.dll 199168 bytes executable
C:\WINDOWS\system32\ir41_32.ax 848384 bytes executable
C:\WINDOWS\system32\ir41_32.dll 756736 bytes executable
C:\WINDOWS\system32\ir41_qc.dll 120320 bytes executable
C:\WINDOWS\system32\kbd101.dll 6144 bytes executable
C:\WINDOWS\system32\kbd101a.dll 6144 bytes executable
C:\WINDOWS\system32\kbd101b.dll 6144 bytes executable
C:\WINDOWS\system32\kbd101c.dll 6144 bytes executable
C:\WINDOWS\system32\kbd103.dll 5632 bytes executable
C:\WINDOWS\system32\kbd106.dll 6144 bytes executable
C:\WINDOWS\system32\kbd106n.dll 6144 bytes executable
C:\WINDOWS\system32\KBDAL.DLL 6656 bytes executable
C:\WINDOWS\system32\kbdax2.dll 6144 bytes executable
C:\WINDOWS\system32\kbdaze.dll 5632 bytes executable
C:\WINDOWS\system32\kbdazel.dll 5632 bytes executable
C:\WINDOWS\system32\kbdbe.dll 6144 bytes executable
C:\WINDOWS\system32\kbdbene.dll 6144 bytes executable
C:\WINDOWS\system32\kbdblr.dll 5632 bytes executable
C:\WINDOWS\system32\kbdbr.dll 6144 bytes executable
C:\WINDOWS\system32\kbdbu.dll 5632 bytes executable
C:\WINDOWS\system32\kbdca.dll 6144 bytes executable
C:\WINDOWS\system32\kbdcan.dll 7680 bytes executable
C:\WINDOWS\system32\kbdcr.dll 6656 bytes executable
C:\WINDOWS\system32\kbdcz.dll 7168 bytes executable
C:\WINDOWS\system32\kbdcz1.dll 6656 bytes executable
C:\WINDOWS\system32\kbdcz2.dll 6656 bytes executable
C:\WINDOWS\system32\kbdda.dll 6144 bytes executable
C:\WINDOWS\system32\kbddv.dll 5120 bytes executable
C:\WINDOWS\system32\kbdes.dll 6144 bytes executable
C:\WINDOWS\system32\kbdest.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfc.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfi.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfi1.dll 7168 bytes executable
C:\WINDOWS\system32\kbdfo.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfr.dll 6144 bytes executable
C:\WINDOWS\system32\kbdlk41a.dll 6656 bytes executable
C:\WINDOWS\system32\kbdlk41j.dll 6144 bytes executable
C:\WINDOWS\system32\kbdlt.dll 5632 bytes executable
C:\WINDOWS\system32\kbdlt1.dll 5632 bytes executable
C:\WINDOWS\system32\kbdlv.dll 6144 bytes executable
C:\WINDOWS\system32\kbdlv1.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmac.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmaori.dll 5632 bytes executable
C:\WINDOWS\system32\kbdmlt47.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmlt48.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmon.dll 5632 bytes executable
C:\WINDOWS\system32\kbdne.dll 6144 bytes executable
C:\WINDOWS\system32\kbdnec.dll 7168 bytes executable
C:\WINDOWS\system32\kbdnec95.dll 7168 bytes executable
C:\WINDOWS\system32\kbdnecAT.dll 9216 bytes executable
C:\WINDOWS\system32\kbdnecNT.dll 7680 bytes executable
C:\WINDOWS\system32\kbdno.dll 6144 bytes executable
C:\WINDOWS\system32\kbdno1.dll 7168 bytes executable
C:\WINDOWS\system32\kbdpl.dll 6656 bytes executable
C:\WINDOWS\system32\LAPRXY.dll 11264 bytes executable
C:\WINDOWS\system32\lcphrase.tbl 211938 bytes
C:\WINDOWS\system32\lcptr.tbl 24114 bytes
C:\WINDOWS\system32\LegitCheckControl.dll 1476992 bytes executable
C:\WINDOWS\system32\lfbmp10N.dll 34304 bytes executable
C:\WINDOWS\system32\lfbmp13n.dll 57344 bytes executable
C:\WINDOWS\system32\LFBMP62N.DLL 22016 bytes executable
C:\WINDOWS\system32\LFCMP10N.DLL 266752 bytes executable
C:\WINDOWS\system32\lfcmp13n.dll 401408 bytes executable
C:\WINDOWS\system32\LFCMP62N.DLL 158720 bytes executable
C:\WINDOWS\system32\lffax10N.dll 77824 bytes executable
C:\WINDOWS\system32\lffax13n.dll 98304 bytes executable
C:\WINDOWS\system32\lfgif13n.dll 69632 bytes executable
C:\WINDOWS\system32\lfpng13n.dll 159744 bytes executable
C:\WINDOWS\system32\lftif10N.dll 122368 bytes executable
C:\WINDOWS\system32\lftif13n.dll 155648 bytes executable
C:\WINDOWS\system32\lhacm.acm 34064 bytes executable
C:\WINDOWS\system32\libdivx.dll 1044480 bytes executable
C:\WINDOWS\system32\licdll.dll 424960 bytes executable
C:\WINDOWS\system32\licmgr10.dll 22528 bytes executable
C:\WINDOWS\system32\licwmi.dll 58880 bytes executable
C:\WINDOWS\system32\mciavi32.dll 85504 bytes executable
C:\WINDOWS\system32\mcicda.dll 17408 bytes executable
C:\WINDOWS\system32\mciole16.dll 8192 bytes
C:\WINDOWS\system32\mciole32.dll 7680 bytes executable
C:\WINDOWS\system32\mciqtz32.dll 35328 bytes executable
C:\WINDOWS\system32\mciseq.dll 23040 bytes executable
C:\WINDOWS\system32\mciseq.drv 25280 bytes
C:\WINDOWS\system32\mciwave.dll 23552 bytes executable
C:\WINDOWS\system32\mciwave.drv 28160 bytes
C:\WINDOWS\system32\mcoinstall.exe 28672 bytes executable
C:\WINDOWS\system32\mdaccore.rsp 228 bytes
C:\WINDOWS\system32\mdhcp.dll 50176 bytes executable
C:\WINDOWS\system32\mdminst.dll 120320 bytes executable
C:\WINDOWS\system32\mdwmdmsp.dll 147968 bytes executable
C:\WINDOWS\system32\mem.exe 39434 bytes
C:\WINDOWS\system32\mf3216.dll 40960 bytes executable
C:\WINDOWS\system32\mfc40.dll 924432 bytes executable
C:\WINDOWS\system32\mfc40loc.dll 45568 bytes executable
C:\WINDOWS\system32\mfc40u.dll 927504 bytes executable
C:\WINDOWS\system32\mfc42.dll 1028096 bytes executable
C:\WINDOWS\system32\mmutilse.dll 119808 bytes executable
C:\WINDOWS\system32\mnmdd.dll 34560 bytes executable
C:\WINDOWS\system32\mnmsrvc.exe 32768 bytes executable
C:\WINDOWS\system32\mobsync.dll 210432 bytes executable
C:\WINDOWS\system32\mobsync.exe 144384 bytes executable
C:\WINDOWS\system32\mode.com 19456 bytes executable
C:\WINDOWS\system32\modemui.dll 156160 bytes executable
C:\WINDOWS\system32\modex.dll 10112 bytes executable
C:\WINDOWS\system32\more.com 15872 bytes executable
C:\WINDOWS\system32\moricons.dll 216064 bytes executable
C:\WINDOWS\system32\mountvol.exe 8192 bytes executable
C:\WINDOWS\system32\mouse.drv 2032 bytes
C:\WINDOWS\system32\MP43DECD.dll 259072 bytes executable
C:\WINDOWS\system32\MP43DMOD.dll 4096 bytes executable
C:\WINDOWS\system32\MP4SDECD.dll 317440 bytes executable
C:\WINDOWS\system32\MP4SDMOD.dll 4096 bytes executable
C:\WINDOWS\system32\mpeg2data.ax 118272 bytes executable
C:\WINDOWS\system32\mpg2splt.ax 148992 bytes executable
C:\WINDOWS\system32\MPG4DECD.dll 259072 bytes executable
C:\WINDOWS\system32\MPG4DMOD.dll 4096 bytes executable
C:\WINDOWS\system32\mpg4ds32.ax 262144 bytes executable
C:\WINDOWS\system32\mplay32.exe 124928 bytes executable
C:\WINDOWS\system32\mpnotify.exe 22016 bytes executable
C:\WINDOWS\system32\mpr.dll 59904 bytes executable
C:\WINDOWS\system32\mprapi.dll 87040 bytes executable
C:\WINDOWS\system32\mprddm.dll 69120 bytes executable
C:\WINDOWS\system32\mprdim.dll 49152 bytes executable
C:\WINDOWS\system32\msexch35.dll 344064 bytes executable
C:\WINDOWS\system32\msexch40.dll 512029 bytes executable
C:\WINDOWS\system32\msexcl35.dll 252688 bytes executable
C:\WINDOWS\system32\msexcl40.dll 319517 bytes executable
C:\WINDOWS\system32\MSFLXGRD.OCX 200976 bytes executable
C:\WINDOWS\system32\msftedit.dll 539136 bytes executable
C:\WINDOWS\system32\msg.exe 22528 bytes executable
C:\WINDOWS\system32\msg711.acm 9216 bytes executable
C:\WINDOWS\system32\msg723.acm 118784 bytes executable
C:\WINDOWS\system32\msgina.dll 1004032 bytes executable
C:\WINDOWS\system32\msgsm32.acm 19968 bytes executable
C:\WINDOWS\system32\msgsvc.dll 33792 bytes executable
C:\WINDOWS\system32\msh261.drv 188416 bytes executable
C:\WINDOWS\system32\msh263.drv 294912 bytes executable
C:\WINDOWS\system32\msyuv.dll 17408 bytes executable
C:\WINDOWS\system32\mtxclu.dll 66560 bytes executable
C:\WINDOWS\system32\mtxdm.dll 20480 bytes executable
C:\WINDOWS\system32\mtxex.dll 4096 bytes executable
C:\WINDOWS\system32\mtxlegih.dll 25088 bytes executable
C:\WINDOWS\system32\mtxoci.dll 91136 bytes executable
C:\WINDOWS\system32\mucltui.dll 271224 bytes executable
C:\WINDOWS\system32\mucltui.dll.mui 30072 bytes executable
C:\WINDOWS\system32\mui
C:\WINDOWS\system32\muweb.dll 207736 bytes executable
C:\WINDOWS\system32\muzika.xm 50492 bytes
C:\WINDOWS\system32\ole2disp.dll 169520 bytes
C:\WINDOWS\system32\ole2nls.dll 153008 bytes
C:\WINDOWS\system32\ole32.dll 1284608 bytes executable
C:\WINDOWS\system32\oleacc.dll 163328 bytes executable
C:\WINDOWS\system32\oleaccrc.dll 18944 bytes executable
C:\WINDOWS\system32\Oleaut32.1 490256 bytes executable
C:\WINDOWS\system32\oleaut32.dll 549376 bytes executable
C:\WINDOWS\system32\olecli.dll 83456 bytes
C:\WINDOWS\system32\olecli32.dll 75264 bytes executable
C:\WINDOWS\system32\olecnv32.dll 37888 bytes executable
C:\WINDOWS\system32\oledlg.dll 124928 bytes executable
C:\WINDOWS\system32\oleprn.dll 110592 bytes executable
C:\WINDOWS\system32\olepro32.dll 83456 bytes executable
C:\WINDOWS\system32\olesvr.dll 24064 bytes
C:\WINDOWS\system32\olesvr32.dll 22016 bytes executable
C:\WINDOWS\system32\olethk32.dll 69120 bytes executable
C:\WINDOWS\system32\Omcamext.ax 38925 bytes executable
C:\WINDOWS\system32\omcamext.dll 53248 bytes executable
C:\WINDOWS\system32\omcamsti.dll 36864 bytes executable
C:\WINDOWS\system32\OmCamUSD.dll 16452 bytes executable
C:\WINDOWS\system32\oobe
C:\WINDOWS\system32\OoneZipPopup.dll 452608 bytes executable
C:\WINDOWS\system32\OoPdfManagerPopup.dll 587776 bytes executable
C:\WINDOWS\system32\opengl32.dll 713728 bytes executable
C:\WINDOWS\system32\osk.exe 216576 bytes executable
C:\WINDOWS\system32\osuninst.dll 68096 bytes executable
C:\WINDOWS\system32\perfd00C.dat 34108 bytes
C:\WINDOWS\system32\perfdisk.dll 27136 bytes executable
C:\WINDOWS\system32\perffilt.h 140 bytes
C:\WINDOWS\system32\perffilt.ini 1293 bytes
C:\WINDOWS\system32\perfh009.dat 382026 bytes
C:\WINDOWS\system32\perfh00C.dat 447222 bytes
C:\WINDOWS\system32\perfi009.dat 272128 bytes
C:\WINDOWS\system32\perfi00C.dat 322810 bytes
C:\WINDOWS\system32\perfmon.exe 15872 bytes executable
C:\WINDOWS\system32\perfmon.msc 57862 bytes
C:\WINDOWS\system32\perfnet.dll 17408 bytes executable
C:\WINDOWS\system32\perfos.dll 26624 bytes executable
C:\WINDOWS\system32\perfproc.dll 35840 bytes executable
C:\WINDOWS\system32\PerfStringBackup.INI 956332 bytes
C:\WINDOWS\system32\perfts.dll 12288 bytes executable
C:\WINDOWS\system32\perfwci.h 435 bytes
C:\WINDOWS\system32\perfwci.ini 2994 bytes
C:\WINDOWS\system32\PfModNT.sys 6752 bytes executable
C:\WINDOWS\system32\phon.ime 79360 bytes executable
C:\WINDOWS\system32\phon.tbl 4071 bytes
C:\WINDOWS\system32\phoncode.tbl 43242 bytes
C:\WINDOWS\system32\phonptr.tbl 2714 bytes
C:\WINDOWS\system32\photowiz.dll 172032 bytes executable
C:\WINDOWS\system32\picn20.dll 38912 bytes executable
C:\WINDOWS\system32\pid.dll 35328 bytes executable
C:\WINDOWS\system32\pschdprf.ini 14073 bytes
C:\WINDOWS\system32\pscript.sep 51 bytes
C:\WINDOWS\system32\PSIKey.dll 1335296 bytes executable
C:\WINDOWS\system32\psnppagn.dll 8192 bytes executable
C:\WINDOWS\system32\pstorec.dll 43520 bytes executable
C:\WINDOWS\system32\pstorsvc.dll 34304 bytes executable
C:\WINDOWS\system32\PTxSCP.ocx 1206272 bytes executable
C:\WINDOWS\system32\pubprn.vbs 3862 bytes
C:\WINDOWS\system32\px.dll 514808 bytes executable
C:\WINDOWS\system32\pxafs.dll 129784 bytes executable
C:\WINDOWS\system32\pxcpya64.exe 63144 bytes executable
C:\WINDOWS\system32\pxcpyi64.exe 108544 bytes executable
C:\WINDOWS\system32\pxdrv.dll 477944 bytes executable
C:\WINDOWS\system32\pxhpinst.exe 67240 bytes executable
C:\WINDOWS\system32\pxinsa64.exe 62632 bytes executable
C:\WINDOWS\system32\pxinsi64.exe 115880 bytes executable
C:\WINDOWS\system32\pxmas.dll 183032 bytes executable
C:\WINDOWS\system32\pxsfs.dll 1309432 bytes executable
C:\WINDOWS\system32\pxwave.dll 379640 bytes executable
C:\WINDOWS\system32\pxwma.dll 151552 bytes executable
C:\WINDOWS\system32\qappsrv.exe 17408 bytes executable
C:\WINDOWS\system32\qasf.dll 211456 bytes executable
C:\WINDOWS\system32\qcap.dll 192512 bytes executable
C:\WINDOWS\system32\qdv.dll 279040 bytes executable
C:\WINDOWS\system32\qdvd.dll 386048 bytes executable
C:\WINDOWS\system32\qedit.dll 563200 bytes executable
C:\WINDOWS\system32\qedwipes.dll 733696 bytes executable
C:\WINDOWS\system32\qmgr.dll 382464 bytes executable
C:\WINDOWS\system32\qmgrprxy.dll 18944 bytes executable
C:\WINDOWS\system32\qosname.dll 8192 bytes executable
C:\WINDOWS\system32\replace.exe 12800 bytes executable
C:\WINDOWS\system32\reset.exe 10240 bytes executable
C:\WINDOWS\system32\Restore
C:\WINDOWS\system32\resutils.dll 58880 bytes executable
C:\WINDOWS\system32\ReWire.dll 225280 bytes executable
C:\WINDOWS\system32\rexec.exe 14848 bytes executable
C:\WINDOWS\system32\riched20.dll 433152 bytes executable
C:\WINDOWS\system32\riched32.dll 3584 bytes executable
C:\WINDOWS\system32\RICHTEXT.SRG 111 bytes
C:\WINDOWS\system32\RICHTX32.DEP 3010 bytes
C:\WINDOWS\system32\RICHTX32.oca 64000 bytes executable
C:\WINDOWS\system32\RICHTX32.OCX 260096 bytes executable
C:\WINDOWS\system32\RLOgg.ax 186880 bytes executable
C:\WINDOWS\system32\RLSpeexDec.ax 51712 bytes executable
C:\WINDOWS\system32\RLTheoraDec.ax 67584 bytes executable
C:\WINDOWS\system32\scarddlg.dll 71168 bytes executable
C:\WINDOWS\system32\scardssp.dll 118784 bytes executable
C:\WINDOWS\system32\scardsvr.exe 100352 bytes executable
C:\WINDOWS\system32\sccbase.dll 169984 bytes executable
C:\WINDOWS\system32\sccsccp.dll 171520 bytes executable
C:\WINDOWS\system32\scecli.dll 186368 bytes executable
C:\WINDOWS\system32\scesrv.dll 328704 bytes executable
C:\WINDOWS\system32\schannel.dll 144896 bytes executable
C:\WINDOWS\system32\schedsvc.dll 193024 bytes executable
C:\WINDOWS\system32\sclgntfy.dll 22016 bytes executable
C:\WINDOWS\system32\scofr.dll 24624 bytes executable
C:\WINDOWS\system32\scredir.dll 26624 bytes executable
C:\WINDOWS\system32\scrnsave.scr 9216 bytes executable
C:\WINDOWS\system32\scrobj.dll 159744 bytes executable
C:\WINDOWS\system32\scrrnfr.dll 24626 bytes executable
C:\WINDOWS\system32\scrrun.dll 151552 bytes executable
C:\WINDOWS\system32\SDA
C:\WINDOWS\system32\sdbinst.exe 78848 bytes executable
C:\WINDOWS\system32\sdhcinst.dll 29184 bytes executable
C:\WINDOWS\system32\sl_anet.acm 86016 bytes executable
C:\WINDOWS\system32\Smab.dll 845312 bytes executable
C:\WINDOWS\system32\smbinst.exe 8192 bytes executable
C:\WINDOWS\system32\smlogcfg.dll 370688 bytes executable
C:\WINDOWS\system32\smlogsvc.exe 93184 bytes executable
C:\WINDOWS\system32\smss.exe 50688 bytes executable
C:\WINDOWS\system32\Snap32n.dll 249856 bytes executable
C:\WINDOWS\system32\sndrec32.exe 133120 bytes executable
C:\WINDOWS\system32\sndvol32.exe 139264 bytes executable
C:\WINDOWS\system32\snetcfg.exe 12507 bytes executable
C:\WINDOWS\system32\snmpapi.dll 18944 bytes executable
C:\WINDOWS\system32\snmpsnap.dll 184320 bytes executable
C:\WINDOWS\system32\SNWValid.dll 231936 bytes executable
C:\WINDOWS\system32\Snwvalid.hlp 11104 bytes
C:\WINDOWS\system32\softpub.dll 5632 bytes executable
C:\WINDOWS\system32\SoftwareDistribution
C:\WINDOWS\system32\synceng.dll 57856 bytes executable
C:\WINDOWS\system32\SynCOM.dll 77917 bytes executable
C:\WINDOWS\system32\SynCtrl.dll 114688 bytes executable
C:\WINDOWS\system32\syncui.dll 197120 bytes executable
C:\WINDOWS\system32\SynTPAPI.dll 90202 bytes executable
C:\WINDOWS\system32\SynTPCo2.dll 81920 bytes executable
C:\WINDOWS\system32\SynTPFcs.dll 69722 bytes executable
C:\WINDOWS\system32\sysdm.cpl 305152 bytes executable
C:\WINDOWS\system32\sysedit.exe 19216 bytes
C:\WINDOWS\system32\SysInfoServer.dll 24576 bytes executable
C:\WINDOWS\system32\sysinv.dll 15872 bytes executable
C:\WINDOWS\system32\syskey.exe 37888 bytes executable
C:\WINDOWS\system32\sysmon.ocx 220672 bytes executable
C:\WINDOWS\system32\sysocmgr.exe 107520 bytes executable
C:\WINDOWS\system32\sysprint.sep 3214 bytes
C:\WINDOWS\system32\sysprtj.sep 3577 bytes
C:\WINDOWS\system32\syssetup.dll 1005056 bytes executable
C:\WINDOWS\system32\system.drv 3360 bytes
C:\WINDOWS\system32\systray.exe 3072 bytes executable
C:\WINDOWS\system32\t2embed.dll 118272 bytes executable
C:\WINDOWS\system32\TABCTL32.OCX 209608 bytes executable
C:\WINDOWS\system32\tafysijw.ini 577948 bytes
C:\WINDOWS\system32\tapi.dll 19200 bytes
C:\WINDOWS\system32\tapi3.dll 860160 bytes executable
C:\WINDOWS\system32\tapi32.dll 181760 bytes executable
C:\WINDOWS\system32\tree.com 11264 bytes executable
C:\WINDOWS\system32\trkwks.dll 90624 bytes executable
C:\WINDOWS\system32\tsappcmp.dll 52224 bytes executable
C:\WINDOWS\system32\tsbyuv.dll 8192 bytes executable
C:\WINDOWS\system32\tscfgwmi.dll 94208 bytes executable
C:\WINDOWS\system32\tscon.exe 15360 bytes executable
C:\WINDOWS\system32\tscupgrd.exe 44544 bytes executable
C:\WINDOWS\system32\tsd32.dll 15360 bytes executable
C:\WINDOWS\system32\tsddd.dll 12168 bytes executable
C:\WINDOWS\system32\tsdiscon.exe 14848 bytes executable
C:\WINDOWS\system32\tskill.exe 16896 bytes executable
C:\WINDOWS\system32\tslabels.h 3286 bytes
C:\WINDOWS\system32\tslabels.ini 27768 bytes
C:\WINDOWS\system32\tsshutdn.exe 17408 bytes executable
C:\WINDOWS\system32\tssoft32.acm 8192 bytes executable
C:\WINDOWS\system32\twext.dll 44032 bytes executable
C:\WINDOWS\system32\TwnLib20.dll 106496 bytes executable
C:\WINDOWS\system32\TwnLib4.dll 364544 bytes executable
C:\WINDOWS\system32\version.dll 18944 bytes executable
C:\WINDOWS\system32\VFind.exe 49152 bytes executable
C:\WINDOWS\system32\vfpodbc.dll 20535 bytes executable
C:\WINDOWS\system32\vfwwdm32.dll 54784 bytes executable
C:\WINDOWS\system32\vga.dll 9344 bytes executable
C:\WINDOWS\system32\vga.drv 2176 bytes
C:\WINDOWS\system32\vga256.dll 51456 bytes executable
C:\WINDOWS\system32\vga64k.dll 18176 bytes executable
C:\WINDOWS\system32\VGAunistlog.ini 165 bytes
C:\WINDOWS\system32\vidcap.ax 28672 bytes executable
C:\WINDOWS\system32\VisualSoftCrypt.dll 275968 bytes executable
C:\WINDOWS\system32\vjoy.dll 4608 bytes executable
C:\WINDOWS\system32\vmhelper.dll 286992 bytes executable
C:\WINDOWS\system32\VModes.exe 40960 bytes executable
C:\WINDOWS\system32\vp6vfw.dll 442368 bytes executable
C:\WINDOWS\system32\Vsflex7L.ocx 419488 bytes executable
C:\WINDOWS\system32\vssadmin.exe 34304 bytes executable
C:\WINDOWS\system32\vssapi.dll 430592 bytes executable
C:\WINDOWS\system32\vssvc.exe 295424 bytes executable
C:\WINDOWS\system32\wbdbase.ita 867840 bytes
C:\WINDOWS\system32\wbdbase.nld 1095680 bytes
C:\WINDOWS\system32\wbdbase.sve 937984 bytes
C:\WINDOWS\system32\wbem
C:\WINDOWS\system32\wbsecdrv.inf 3036 bytes
C:\WINDOWS\system32\wbsecdrv.sys 17664 bytes executable
C:\WINDOWS\system32\wbsecsvc.exe 241664 bytes executable
C:\WINDOWS\system32\wdfapi.dll 4096 bytes executable
C:\WINDOWS\system32\wdfmgr.exe 8704 bytes executable
C:\WINDOWS\system32\wdigest.dll 49152 bytes executable
C:\WINDOWS\system32\wdl.trm 4096 bytes
C:\WINDOWS\system32\wdmaud.drv 23552 bytes executable
C:\WINDOWS\system32\webc3dsx(2).ax 50718 bytes executable
C:\WINDOWS\system32\webc3dsx(3).ax 50718 bytes executable
C:\WINDOWS\system32\webc3dsx.ax 50718 bytes executable
C:\WINDOWS\system32\webc3ext.dll 49152 bytes executable
C:\WINDOWS\system32\usrfaxa.dll 86073 bytes executable
C:\WINDOWS\system32\usrlbva.dll 53305 bytes executable
C:\WINDOWS\system32\usrlogon.cmd 1263 bytes
C:\WINDOWS\system32\usrmlnka.exe 77891 bytes executable
C:\WINDOWS\system32\usrprbda.exe 61508 bytes executable
C:\WINDOWS\system32\usrrtosa.dll 77883 bytes executable
C:\WINDOWS\system32\usrsdpia.dll 49211 bytes executable
C:\WINDOWS\system32\usrshuta.exe 69700 bytes executable
C:\WINDOWS\system32\usrsvpia.dll 41019 bytes executable
C:\WINDOWS\system32\usrv42a.dll 102457 bytes executable
C:\WINDOWS\system32\usrv80a.dll 49209 bytes executable
C:\WINDOWS\system32\usrvoica.dll 45116 bytes executable
C:\WINDOWS\system32\usrvpa.dll 49211 bytes executable
C:\WINDOWS\system32\utildll.dll 26112 bytes executable
C:\WINDOWS\system32\utilman.exe 50176 bytes executable
C:\WINDOWS\system32\uwdf.exe 8704 bytes executable
C:\WINDOWS\system32\uxtheme.dll 219648 bytes executable
C:\WINDOWS\system32\v7vga.rom 18832 bytes
C:\WINDOWS\system32\comm.drv 10544 bytes
C:\WINDOWS\system32\command.com 52103 bytes
C:\WINDOWS\system32\commdlg.dll 33904 bytes
C:\WINDOWS\system32\comp.exe 15872 bytes executable
C:\WINDOWS\system32\compact.exe 18432 bytes executable
C:\WINDOWS\system32\compatUI.dll 253440 bytes executable
C:\WINDOWS\system32\compmgmt.msc 37357 bytes
C:\WINDOWS\system32\compobj.dll 30160 bytes
C:\WINDOWS\system32\compstui.dll 230912 bytes executable
C:\WINDOWS\system32\comrepl.dll 97792 bytes executable
C:\WINDOWS\system32\comres.dll 851968 bytes executable
C:\WINDOWS\system32\comsnap.dll 147456 bytes executable
C:\WINDOWS\system32\comsvcs.dll 1267200 bytes executable
C:\WINDOWS\system32\comuid.dll 540160 bytes executable
C:\WINDOWS\system32\config
C:\WINDOWS\system32\CONFIG.NT 3072 bytes
C:\WINDOWS\system32\CONFIG.TMP 3072 bytes
C:\WINDOWS\system32\confmsp.dll 346112 bytes executable
C:\WINDOWS\system32\conime.exe 27648 bytes executable
C:\WINDOWS\system32\console.dll 67072 bytes executable
C:\WINDOWS\system32\control.exe 8192 bytes executable
C:\WINDOWS\system32\convert.exe 13824 bytes executable
C:\WINDOWS\system32\corpol.dll 35328 bytes executable
C:\WINDOWS\system32\country.sys 27097 bytes
C:\WINDOWS\system32\cppenv25.dll 27648 bytes executable
C:\WINDOWS\system32\winscard.dll 100352 bytes executable
C:\WINDOWS\system32\winshfhc.dll 17408 bytes executable
C:\WINDOWS\system32\WINSIZE.DLL 4080 bytes
C:\WINDOWS\system32\winsock.dll 2864 bytes
C:\WINDOWS\system32\WINSP.IME 156672 bytes executable
C:\WINDOWS\system32\WINSP.MB 1564868 bytes
C:\WINDOWS\system32\winspool.drv 146944 bytes executable
C:\WINDOWS\system32\winspool.exe 2112 bytes
C:\WINDOWS\system32\winsrv.dll 293376 bytes executable
C:\WINDOWS\system32\winsta.dll 53760 bytes executable
C:\WINDOWS\system32\winstrm.dll 21504 bytes executable
C:\WINDOWS\system32\wintrust.dll 176640 bytes executable
C:\WINDOWS\system32\winver.exe 5632 bytes executable
C:\WINDOWS\system32\WINZM.IME 156672 bytes executable
C:\WINDOWS\system32\WINZM.MB 1223500 bytes
C:\WINDOWS\system32\wisptis.exe 194560 bytes executable
C:\WINDOWS\system32\wjisyfat.dll 86080 bytes executable
C:\WINDOWS\system32\wjview.exe 171792 bytes executable
C:\WINDOWS\system32\wkssvc.dll 132096 bytes executable
C:\WINDOWS\system32\WLANUTL.dll 106496 bytes executable
C:\WINDOWS\system32\wldap32.dll 172544 bytes executable
C:\WINDOWS\system32\wlnotify.dll 94208 bytes executable
C:\WINDOWS\system32\wmadmod.dll 757248 bytes executable
C:\WINDOWS\system32\WMADMOE.dll 1117696 bytes executable
C:\WINDOWS\system32\wmasf.dll 222208 bytes executable
C:\WINDOWS\system32\wmaudsdk.dll 163600 bytes executable
C:\WINDOWS\system32\wmdmlog.dll 33792 bytes executable
C:\WINDOWS\system32\wmdmps.dll 37376 bytes executable
C:\WINDOWS\system32\wmdrmdev.dll 429056 bytes executable
C:\WINDOWS\system32\wmdrmnet.dll 348672 bytes executable
C:\WINDOWS\system32\wmdrmsdk.dll 535040 bytes executable
C:\WINDOWS\system32\mssip32.dll 4608 bytes executable
C:\WINDOWS\system32\msstdfmt.dll 118784 bytes executable
C:\WINDOWS\system32\msstkprp.dll 94208 bytes executable
C:\WINDOWS\system32\msswch.dll 13312 bytes executable
C:\WINDOWS\system32\msswchx.exe 6656 bytes executable
C:\WINDOWS\system32\mstask.dll 281600 bytes executable
C:\WINDOWS\system32\mstext35.dll 166672 bytes executable
C:\WINDOWS\system32\mstext40.dll 258077 bytes executable
C:\WINDOWS\system32\mstime.dll 532480 bytes executable
C:\WINDOWS\system32\mstinit.exe 12288 bytes executable
C:\WINDOWS\system32\mstlsapi.dll 115712 bytes executable
C:\WINDOWS\system32\mstsc.exe 411648 bytes executable
C:\WINDOWS\system32\mstscax.dll 655360 bytes executable
C:\WINDOWS\system32\msutb.dll 195584 bytes executable
C:\WINDOWS\system32\msv1_0.dll 129536 bytes executable
C:\WINDOWS\system32\msvbvm50.dll 1355776 bytes executable
C:\WINDOWS\system32\MSVBVM60.DLL 1386496 bytes executable
C:\WINDOWS\system32\msvci70.dll 54784 bytes executable
C:\WINDOWS\system32\msvcirt.dll 54784 bytes executable
C:\WINDOWS\system32\msvcp50.dll 565760 bytes executable
C:\WINDOWS\system32\msvcp60.dll 413696 bytes executable
C:\WINDOWS\system32\msvcp70.dll 487424 bytes executable
C:\WINDOWS\system32\msvcp71.dll 499712 bytes executable
C:\WINDOWS\system32\msvcr70.dll 344064 bytes executable
C:\WINDOWS\system32\msvcr71.dll 348160 bytes executable
C:\WINDOWS\system32\msvcrt.dll 343040 bytes executable
C:\WINDOWS\system32\MSVCRT10.DLL 210944 bytes executable
C:\WINDOWS\system32\setup.exe 23040 bytes executable
C:\WINDOWS\system32\setupapi.dll 1003520 bytes executable
C:\WINDOWS\system32\setupdll.dll 421376 bytes executable
C:\WINDOWS\system32\setver.exe 12067 bytes
C:\WINDOWS\system32\sfc.dll 5120 bytes executable
C:\WINDOWS\system32\sfc.exe 10240 bytes executable
C:\WINDOWS\system32\sfcfiles.dll 1548288 bytes executable
C:\WINDOWS\system32\sfc_os.dll 142336 bytes executable
C:\WINDOWS\system32\sfmapi.dll 23552 bytes executable
C:\WINDOWS\system32\sfxbe321.dll 73216 bytes executable
C:\WINDOWS\system32\sfxbe322.dll 77312 bytes executable
C:\WINDOWS\system32\sfxbe323.dll 74240 bytes executable
C:\WINDOWS\system32\sfxbe324.dll 78336 bytes executable
C:\WINDOWS\system32\sfxfe32.exe 53760 bytes executable
C:\WINDOWS\system32\sfxfe321.exe 58368 bytes executable
C:\WINDOWS\system32\shadow.exe 15360 bytes executable
C:\WINDOWS\system32\share.exe 882 bytes
C:\WINDOWS\system32\shdoclc.dll 572416 bytes executable
C:\WINDOWS\system32\shdocvw.bak 1483776 bytes executable
C:\WINDOWS\system32\shdocvw.dll 1498624 bytes executable
C:\WINDOWS\system32\shell.dll 5120 bytes
C:\WINDOWS\system32\shell32.dll 8509952 bytes executable
C:\WINDOWS\system32\ShellDHCP
C:\WINDOWS\system32\ShellExt
C:\WINDOWS\system32\shellstyle.dll 435712 bytes executable
C:\WINDOWS\system32\shfolder.dll 25088 bytes executable
C:\WINDOWS\system32\dfrg.msc 41131 bytes
C:\WINDOWS\system32\dfrgfat.exe 82432 bytes executable
C:\WINDOWS\system32\dfrgntfs.exe 104960 bytes executable
C:\WINDOWS\system32\dfrgres.dll 55808 bytes executable
C:\WINDOWS\system32\dfrgsnap.dll 39424 bytes executable
C:\WINDOWS\system32\dfrgui.dll 123904 bytes executable
C:\WINDOWS\system32\dfsshlex.dll 28672 bytes executable
C:\WINDOWS\system32\dgnet.dll 115200 bytes executable
C:\WINDOWS\system32\dgrpsetu.dll 176157 bytes executable
C:\WINDOWS\system32\dgsetup.dll 86044 bytes executable
C:\WINDOWS\system32\dhcp
C:\WINDOWS\system32\dhcpcsvc.dll 112128 bytes executable
C:\WINDOWS\system32\dhcpmon.dll 401408 bytes executable
C:\WINDOWS\system32\dhcpsapi.dll 78848 bytes executable
C:\WINDOWS\system32\diactfrm.dll 395264 bytes executable
C:\WINDOWS\system32\diantz.exe 85504 bytes executable
C:\WINDOWS\system32\digest.dll 68608 bytes executable
C:\WINDOWS\system32\dimap.dll 44032 bytes executable
C:\WINDOWS\system32\dinput.dll 165376 bytes executable
C:\WINDOWS\system32\dinput8.dll 187904 bytes executable
C:\WINDOWS\system32\DiracSplitter.ax 179200 bytes executable
C:\WINDOWS\system32\DirectX
C:\WINDOWS\system32\diskcomp.com 9216 bytes executable
C:\WINDOWS\system32\diskcopy.com 7168 bytes executable
C:\WINDOWS\system32\diskcopy.dll 1502208 bytes executable
C:\WINDOWS\system32\diskmgmt.msc 33311 bytes
C:\WINDOWS\system32\diskpart.exe 167936 bytes executable
C:\WINDOWS\system32\diskperf.exe 19456 bytes executable
C:\WINDOWS\system32\dmusic.dll 104448 bytes executable
C:\WINDOWS\system32\dmutil.dll 58880 bytes executable
C:\WINDOWS\system32\dmview.ocx 61440 bytes executable
C:\WINDOWS\system32\dnsapi.dll 148480 bytes executable
C:\WINDOWS\system32\dnsrslvr.dll 45568 bytes executable
C:\WINDOWS\system32\docprop.dll 47616 bytes executable
C:\WINDOWS\system32\docprop2.dll 48640 bytes executable
C:\WINDOWS\system32\doskey.exe 10752 bytes executable
C:\WINDOWS\system32\dosx.exe 54080 bytes
C:\WINDOWS\system32\dpcdll.dll 97792 bytes executable
C:\WINDOWS\system32\dplay.dll 33040 bytes executable
C:\WINDOWS\system32\dplaysvr.exe 30208 bytes executable
C:\WINDOWS\system32\dplayx.dll 229888 bytes executable
C:\WINDOWS\system32\dpmodemx.dll 24064 bytes executable
C:\WINDOWS\system32\dpnaddr.dll 3584 bytes executable
C:\WINDOWS\system32\dpnet.dll 375296 bytes executable
C:\WINDOWS\system32\dpnhpast.dll 35328 bytes executable
C:\WINDOWS\system32\dpnhupnp.dll 60928 bytes executable
C:\WINDOWS\system32\mprmsg.dll 114688 bytes executable
C:\WINDOWS\system32\mscpx32r.dLL 12288 bytes executable
C:\WINDOWS\system32\msencode.dll 94282 bytes executable
C:\WINDOWS\system32\mshearts.exe 128000 bytes executable
C:\WINDOWS\system32\msjet40.dll 1507356 bytes executable
C:\WINDOWS\system32\mspdox35.dll 250128 bytes executable
C:\WINDOWS\system32\mssign32.dll 36352 bytes executable
C:\WINDOWS\system32\msvcrt20.dll 253952 bytes executable
C:\WINDOWS\system32\msxmlr.dll 30720 bytes executable
C:\WINDOWS\system32\mycomput.dll 90624 bytes executable
C:\WINDOWS\system32\nddenb32.dll 19456 bytes executable
C:\WINDOWS\system32\netrap.dll 12288 bytes executable
C:\WINDOWS\system32\noise.chs 1696 bytes
C:\WINDOWS\system32\npp
C:\WINDOWS\system32\ntlsapi.dll 8192 bytes executable
C:\WINDOWS\system32\objsel.dll 288768 bytes executable
C:\WINDOWS\system32\odbcjt32.dll 278559 bytes executable
C:\WINDOWS\system32\ole2.dll 39744 bytes
C:\WINDOWS\system32\osuninst.exe 41984 bytes executable
C:\WINDOWS\system32\perfd009.dat 28626 bytes
C:\WINDOWS\system32\pidgen.dll 24064 bytes executable
C:\WINDOWS\system32\prcp.nls 83748 bytes
C:\WINDOWS\system32\pschdprf.dll 10752 bytes executable
C:\WINDOWS\system32\qprocess.exe 20992 bytes executable
C:\WINDOWS\system32\rasauto.dll 89088 bytes executable
C:\WINDOWS\system32\rcbdyctl.dll 103424 bytes executable
C:\WINDOWS\system32\rend.dll 107520 bytes executable
C:\WINDOWS\system32\ega.cpi 127213 bytes
C:\WINDOWS\system32\els.dll 187392 bytes executable
C:\WINDOWS\system32\emptyregdb.dat 21892 bytes
C:\WINDOWS\system32\en-US
C:\WINDOWS\system32\encapi.dll 20480 bytes executable
C:\WINDOWS\system32\encdec.dll 186368 bytes executable
C:\WINDOWS\system32\EqnClass.Dll 103424 bytes executable
C:\WINDOWS\system32\ersvc.dll 23040 bytes executable
C:\WINDOWS\system32\es.dll 243200 bytes executable
C:\WINDOWS\system32\esent.dll 1097728 bytes executable
C:\WINDOWS\system32\esent97.dll 1114896 bytes executable
C:\WINDOWS\system32\esentprf.dll 17408 bytes executable
C:\WINDOWS\system32\esentprf.hxx 6708 bytes
C:\WINDOWS\system32\esentprf.ini 1015477 bytes
C:\WINDOWS\system32\esentutl.exe 39424 bytes executable
C:\WINDOWS\system32\ftp.exe 46080 bytes executable
C:\WINDOWS\system32\ftsrch.dll 177152 bytes executable
C:\WINDOWS\system32\netsetup.cpl 25600 bytes executable
C:\WINDOWS\system32\netsetup.exe 332800 bytes executable
C:\WINDOWS\system32\netsh.exe 88576 bytes executable
C:\WINDOWS\system32\netshell.dll 1723904 bytes executable
C:\WINDOWS\system32\netstat.exe 37888 bytes executable
C:\WINDOWS\system32\netui0.dll 83456 bytes executable
C:\WINDOWS\system32\netui1.dll 245760 bytes executable
C:\WINDOWS\system32\netui2.dll 312832 bytes executable
C:\WINDOWS\system32\newdev.dll 251392 bytes executable
C:\WINDOWS\system32\NewmsrdkForKey
C:\WINDOWS\system32\NexPlayerX.dll 561152 bytes executable
C:\WINDOWS\system32\nlhtml.dll 103936 bytes executable
C:\WINDOWS\system32\nlsdl.dll 24576 bytes executable
**************************************************************************
.
Completion time: 2007-11-09 18:05:06 - machine was rebooted
.
--- E O F ---
Copie (Ctrl+C) le texte ci-dessous :
Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précedemment copié.
Sauvegarde ce fichier sous le nom de CFScript.txt
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
Comme l'image le montre, fait glisser CFScript.txt sur Combofix.exe
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
poste le rapport obtenu et un rapport hijack this
File::
C:\WINDOWS\system32\axkkwaeb.dll
C:\WINDOWS\system32\wjisyfat.dll
C:\WINDOWS\system32\xxywxus.dll
C:\WINDOWS\system32\wptwkpkc.dll
C:\WINDOWS\system32\npqss.bak2
C:\WINDOWS\system32\npqss.bak1
C:\WINDOWS\system32\ddcbayv.dll
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62ebb3d7-ed78-45dc-8953-dd7cd434370b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"4c05167c"="-
Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précedemment copié.
Sauvegarde ce fichier sous le nom de CFScript.txt
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
Comme l'image le montre, fait glisser CFScript.txt sur Combofix.exe
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
poste le rapport obtenu et un rapport hijack this
Bonjour!!
Alors voila mes rapports.
ComboFix 07-11-08.1 - michel virginie 2007-11-10 7:53:52.2 - NTFSx86
Running from: C:\Documents and Settings\michel virginie\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\michel virginie\Bureau\CFScript.txt
* Created a new restore point
FILE
C:\WINDOWS\system32\axkkwaeb.dll
C:\WINDOWS\system32\ddcbayv.dll
C:\WINDOWS\system32\npqss.bak1
C:\WINDOWS\system32\npqss.bak2
C:\WINDOWS\system32\wjisyfat.dll
C:\WINDOWS\system32\wptwkpkc.dll
C:\WINDOWS\system32\xxywxus.dll
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\axkkwaeb.dll
C:\WINDOWS\system32\ddcbayv.dll
C:\WINDOWS\system32\npqss.bak1
C:\WINDOWS\system32\npqss.bak2
C:\WINDOWS\system32\wjisyfat.dll
C:\WINDOWS\system32\wptwkpkc.dll
C:\WINDOWS\system32\xxywxus.dll
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-10 to 2007-11-10 ))))))))))))))))))))))))))))))))))))
.
2007-11-09 17:48 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-09 16:04 <REP> d-------- C:\VundoFix Backups
2007-11-09 16:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2007-11-09 15:59 <REP> d-------- C:\Temp
2007-11-08 08:25 71,680 --------- C:\WINDOWS\system32\drivers\PAVDRV51.SYS
2007-11-08 08:25 248 --a------ C:\WINDOWS\system32\PavCPL.dat
2007-11-08 08:24 <REP> d-------- C:\WINDOWS\system32\PAV
2007-11-08 08:23 <REP> d-------- C:\Program Files\Panda Software
2007-11-08 08:23 45,056 --a------ C:\WINDOWS\system32\avldr.dll
2007-11-04 21:05 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\Grisoft
2007-11-04 18:16 <REP> d-------- C:\Program Files\CCleaner
2007-11-04 16:17 32,768 --a------ C:\Documents and Settings\michel virginie\pdf.exe
2007-11-04 14:35 1,208 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-04 12:15 <REP> d-------- C:\WINDOWS\AU_Temp
2007-11-03 17:37 <REP> d-------- C:\Program Files\Incomplete
2007-11-03 17:26 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2007-11-03 17:24 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\BitTorrent
2007-11-03 17:07 <REP> d-------- C:\Documents and Settings\michel virginie\Incomplete
2007-11-02 17:40 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\Skype
2007-11-02 17:39 <REP> d-------- C:\Program Files\Skype
2007-11-02 17:39 <REP> d-------- C:\Program Files\Fichiers communs\Skype
2007-11-02 17:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2007-11-01 19:07 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\BSplayer Pro
2007-11-01 19:07 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\BSplayer
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-09 12:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-08 20:58 22 ----a-w C:\WINDOWS\Fonts\a.zip
2007-11-08 07:23 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-04 17:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom
2007-11-04 11:15 86,094 ----a-w C:\WINDOWS\BPMNT.dll
2007-11-04 11:15 1,163,344 ----a-w C:\WINDOWS\vsapi32.dll
2007-11-04 10:52 71,749 ----a-w C:\WINDOWS\hcextoutput.dll
2007-11-04 10:52 267,845 ----a-w C:\WINDOWS\tsc.exe
2007-11-02 19:51 --------- d-----w C:\Program Files\Teamspeak2_RC2
2007-10-03 18:40 --------- d-----w C:\Program Files\QuickTime
2007-10-01 16:12 --------- d-----w C:\Documents and Settings\michel virginie\Application Data\OpenOffice.org2
2007-09-27 06:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-09-22 11:15 --------- d-----w C:\Documents and Settings\michel virginie\Application Data\Viewpoint
2007-09-22 11:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-09-20 05:32 --------- d-----w C:\Program Files\Java
2007-09-19 16:32 --------- d-----w C:\Program Files\OpenOffice.org 2.2
2007-09-18 17:42 --------- d-----w C:\Program Files\Trend Micro
2007-09-18 17:09 77,824 ----a-w C:\WINDOWS\uinst001.exe
2007-09-13 09:05 --------- d-----w C:\Program Files\Illustrate
2007-09-13 09:05 --------- d-----w C:\Documents and Settings\michel virginie\Application Data\AccurateRip
2007-09-11 14:44 --------- d-----w C:\Program Files\DivX
2007-07-25 17:16 94,208 ----a-w C:\Documents and Settings\michel virginie\Application Data\ezplay.sys
2007-07-25 17:16 47,360 ----a-w C:\Documents and Settings\michel virginie\Application Data\pcouffin.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [2005-08-03 14:32 C:\WINDOWS\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [2005-03-08 02:33 C:\WINDOWS\system32\VTTimer.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 14:44]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 14:43]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" []
"oouserv6.exe"="C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe" []
"4c05167c"="C:\WINDOWS\system32\wjisyfat.dll" []
"APVXDWIN"="C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.exe" [2007-01-25 18:50]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-09-27 12:28]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
avldr.dll 2006-07-14 13:46 45056 C:\WINDOWS\system32\avldr.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"MessagerStarter Wanadoo"=C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo
"WooCnxMon"=C:\PROGRA~1\Wanadoo\CnxMon.exe
"autoclk"=autoclk.exe
"WOOWATCH"=C:\PROGRA~1\Wanadoo\Watch.exe
"WOOTASKBARICON"=C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
"BDNewsAgent"=C:\Program Files\Softwin\BitDefender Free Edition\\bdnagent.exe
"WinampAgent"=C:\Program Files\Winamp\winampa.exe
"NeroCheck"=C:\WINDOWS\system32\\NeroCheck.exe
"adiras"=adiras.exe
"Prism_Utility"=Prismsta.exe
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
"RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
"eDonkey2000"="C:\Program Files\eDonkey2000\eDonkey2000.exe" -t
"OoPDFSettingsv6.exe"=C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
"oouserv6.exe"=C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe
"SunJavaUpdateSched"=C:\Program Files\Java\j2re1.4.2_10\bin\jusched.exe
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"SoundMan"=SOUNDMAN.EXE
"Openwares LiveUpdate"=C:\Program Files\LiveUpdate\LiveUpdate.exe
"OSD"=C:\Program Files\OSD\OSD.EXE
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
"VirusScan Online"=C:\Program Files\McAfee.com\VSO\mcvsshld.exe
"OASClnt"=C:\Program Files\McAfee.com\VSO\oasclnt.exe
"MCAgentExe"=c:\PROGRA~1\mcafee.com\agent\mcagent.exe
"MCUpdateExe"=C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
"MSKAGENTEXE"=C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
"MSKDetectorExe"=C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
"_AntiSpyware"=c:\progra~1\mcafee\MCAFEE~3\masalert.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-10 08:05:29
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\system32\fc.exe 14848 bytes executable
C:\WINDOWS\system32\mmtask.tsk 1152 bytes
C:\WINDOWS\system32\rsmsink.exe 24576 bytes executable
C:\WINDOWS\system32\iasacct.dll 23552 bytes executable
C:\WINDOWS\system32\iasads.dll 41472 bytes executable
C:\WINDOWS\system32\iashlpr.dll 32256 bytes executable
C:\WINDOWS\system32\iasnap.dll 62464 bytes executable
C:\WINDOWS\system32\iaspolcy.dll 17920 bytes executable
C:\WINDOWS\system32\iasrad.dll 119808 bytes executable
C:\WINDOWS\system32\iasrecst.dll 141312 bytes executable
C:\WINDOWS\system32\iassam.dll 86528 bytes executable
C:\WINDOWS\system32\iassdo.dll 253440 bytes executable
C:\WINDOWS\system32\iassvcs.dll 62976 bytes executable
C:\WINDOWS\system32\icaapi.dll 11264 bytes executable
C:\WINDOWS\system32\iccvid.dll 80384 bytes executable
C:\WINDOWS\system32\icfgnt5.dll 16384 bytes executable
C:\WINDOWS\system32\icm32.dll 254976 bytes executable
C:\WINDOWS\system32\icmp.dll 3584 bytes executable
C:\WINDOWS\system32\icmui.dll 56320 bytes executable
C:\WINDOWS\system32\icrav03.rat 8798 bytes
C:\WINDOWS\system32\icsxml
C:\WINDOWS\system32\icwdial.dll 73728 bytes executable
C:\WINDOWS\system32\icwphbk.dll 65536 bytes executable
C:\WINDOWS\system32\ideograf.uce 60458 bytes
C:\WINDOWS\system32\idndl.dll 26112 bytes executable
C:\WINDOWS\system32\c_10000.nls 66082 bytes
C:\WINDOWS\system32\c_10001.nls 162850 bytes
C:\WINDOWS\system32\c_10002.nls 195618 bytes
C:\WINDOWS\system32\c_10003.nls 177698 bytes
C:\WINDOWS\system32\c_10006.nls 66082 bytes
C:\WINDOWS\system32\c_10007.nls 66082 bytes
C:\WINDOWS\system32\c_10008.nls 173602 bytes
C:\WINDOWS\system32\c_10010.nls 66082 bytes
C:\WINDOWS\system32\c_10017.nls 66082 bytes
C:\WINDOWS\system32\c_10029.nls 66082 bytes
C:\WINDOWS\system32\c_10079.nls 66082 bytes
C:\WINDOWS\system32\c_10081.nls 66082 bytes
C:\WINDOWS\system32\c_10082.nls 66082 bytes
C:\WINDOWS\system32\c_1026.nls 66082 bytes
C:\WINDOWS\system32\c_1250.nls 66082 bytes
C:\WINDOWS\system32\c_1251.nls 66082 bytes
C:\WINDOWS\system32\c_1252.nls 66082 bytes
C:\WINDOWS\system32\c_1253.nls 66082 bytes
C:\WINDOWS\system32\c_1254.nls 66082 bytes
C:\WINDOWS\system32\c_1255.nls 66082 bytes
C:\WINDOWS\system32\c_1256.nls 66082 bytes
C:\WINDOWS\system32\c_1257.nls 66082 bytes
C:\WINDOWS\system32\c_28599.nls 66082 bytes
C:\WINDOWS\system32\c_28603.nls 66082 bytes
C:\WINDOWS\system32\c_28605.nls 66082 bytes
C:\WINDOWS\system32\c_437.nls 66594 bytes
C:\WINDOWS\system32\c_500.nls 66082 bytes
C:\WINDOWS\system32\c_737.nls 66594 bytes
C:\WINDOWS\system32\c_775.nls 66594 bytes
C:\WINDOWS\system32\c_850.nls 66594 bytes
C:\WINDOWS\system32\c_852.nls 66594 bytes
C:\WINDOWS\system32\c_855.nls 66594 bytes
C:\WINDOWS\system32\c_857.nls 66594 bytes
C:\WINDOWS\system32\c_860.nls 66594 bytes
C:\WINDOWS\system32\c_861.nls 66594 bytes
C:\WINDOWS\system32\c_863.nls 66594 bytes
C:\WINDOWS\system32\c_865.nls 66594 bytes
C:\WINDOWS\system32\c_866.nls 66594 bytes
C:\WINDOWS\system32\c_869.nls 66594 bytes
C:\WINDOWS\system32\c_874.nls 66594 bytes
C:\WINDOWS\system32\c_875.nls 66082 bytes
C:\WINDOWS\system32\credui.dll 165888 bytes executable
C:\WINDOWS\system32\c_037.nls 66082 bytes
C:\WINDOWS\system32\c_1258.nls 66082 bytes
C:\WINDOWS\system32\c_28598.nls 66082 bytes
C:\WINDOWS\system32\c_932.nls 162850 bytes
C:\WINDOWS\system32\dbgeng.dll 847872 bytes executable
C:\WINDOWS\system32\devmgr.dll 290816 bytes executable
C:\WINDOWS\system32\dispex.dll 45083 bytes executable
C:\WINDOWS\system32\DKRNL.JAX 24 bytes
C:\WINDOWS\system32\dmsynth.dll 103424 bytes executable
C:\WINDOWS\system32\dpnlobby.dll 3584 bytes executable
C:\WINDOWS\system32\dsauth.dll 62976 bytes executable
C:\WINDOWS\system32\dswave.dll 19456 bytes executable
C:\WINDOWS\system32\edlin.exe 13010 bytes
C:\WINDOWS\system32\eudcedit.exe 195072 bytes executable
C:\WINDOWS\system32\dbghelp.dll 640000 bytes executable
C:\WINDOWS\system32\dbmsrpcn.dll 24576 bytes executable
C:\WINDOWS\system32\dbnetlib.dll 110592 bytes executable
C:\WINDOWS\system32\dbnmpntw.dll 28672 bytes executable
C:\WINDOWS\system32\Dcache.bin 1788 bytes
C:\WINDOWS\system32\dciman32.dll 8704 bytes executable
C:\WINDOWS\system32\dcomcnfg.exe 5120 bytes executable
C:\WINDOWS\system32\ddeml.dll 39424 bytes
C:\WINDOWS\system32\ddeshare.exe 31744 bytes executable
C:\WINDOWS\system32\ddraw.dll 266240 bytes executable
C:\WINDOWS\system32\ddrawex.dll 27136 bytes executable
C:\WINDOWS\system32\debug.exe 21162 bytes
C:\WINDOWS\system32\declrds.ax 47104 bytes executable
C:\WINDOWS\system32\defrag.exe 25088 bytes executable
C:\WINDOWS\system32\desk.cpl 138240 bytes executable
C:\WINDOWS\system32\deskadp.dll 16896 bytes executable
C:\WINDOWS\system32\deskmon.dll 16896 bytes executable
C:\WINDOWS\system32\deskperf.dll 18944 bytes executable
C:\WINDOWS\system32\desktop.ini 2 bytes
C:\WINDOWS\system32\devenum.dll 59904 bytes executable
C:\WINDOWS\system32\devmgmt.msc 32738 bytes
C:\WINDOWS\system32\divxdec_0407.dll 89600 bytes executable
C:\WINDOWS\system32\divxdec_040c.dll 90112 bytes executable
C:\WINDOWS\system32\divxdec_0411.dll 89600 bytes executable
C:\WINDOWS\system32\dsdmo.dll 181760 bytes executable
C:\WINDOWS\system32\dsdmoprp.dll 72192 bytes executable
C:\WINDOWS\system32\dskquota.dll 93696 bytes executable
C:\WINDOWS\system32\dskquoui.dll 150016 bytes executable
C:\WINDOWS\system32\dsound.dll 367616 bytes executable
C:\WINDOWS\system32\dsound.vxd 81 bytes
C:\WINDOWS\system32\dsound3d.dll 1294336 bytes executable
C:\WINDOWS\system32\dsprop.dll 145408 bytes executable
C:\WINDOWS\system32\dsprpres.dll 4096 bytes executable
C:\WINDOWS\system32\dsquery.dll 240640 bytes executable
C:\WINDOWS\system32\dssec.dat 218003 bytes
C:\WINDOWS\system32\dssec.dll 52736 bytes executable
C:\WINDOWS\system32\dssenh.dll 137216 bytes executable
C:\WINDOWS\system32\dsuiext.dll 113664 bytes executable
C:\WINDOWS\system32\feclient.dll 21504 bytes executable
C:\WINDOWS\system32\filemgmt.dll 348160 bytes executable
C:\WINDOWS\system32\find.exe 9216 bytes executable
C:\WINDOWS\system32\findstr.exe 29184 bytes executable
C:\WINDOWS\system32\finger.exe 10240 bytes executable
C:\WINDOWS\system32\firewall.cpl 80384 bytes executable
C:\WINDOWS\system32\fixmapi.exe 3072 bytes executable
C:\WINDOWS\system32\fldrclnr.dll 88064 bytes executable
C:\WINDOWS\system32\fltlib.dll 16896 bytes executable
C:\WINDOWS\system32\fltmc.exe 23040 bytes executable
C:\WINDOWS\system32\fmifs.dll 16384 bytes executable
C:\WINDOWS\system32\FNTCACHE.DAT 482720 bytes
C:\WINDOWS\system32\fontext.dll 386560 bytes executable
C:\WINDOWS\system32\fontsub.dll 80896 bytes executable
C:\WINDOWS\system32\fontview.exe 21504 bytes executable
C:\WINDOWS\system32\forcedos.exe 7168 bytes executable
C:\WINDOWS\system32\format.com 25600 bytes executable
C:\WINDOWS\system32\fr-fr
C:\WINDOWS\system32\framebuf.dll 9344 bytes executable
C:\WINDOWS\system32\freecell.exe 55808 bytes executable
C:\WINDOWS\system32\fsmgmt.msc 32409 bytes
C:\WINDOWS\system32\fsquirt.exe 193024 bytes executable
C:\WINDOWS\system32\fsusd.dll 81920 bytes executable
C:\WINDOWS\system32\npptools.dll 55296 bytes executable
C:\WINDOWS\system32\npqss.ini 256421 bytes
C:\WINDOWS\system32\nscompat.tlb 23392 bytes
C:\WINDOWS\system32\nslookup.exe 79360 bytes executable
C:\WINDOWS\system32\ntbackup.chm 79238 bytes
C:\WINDOWS\system32\ntbackup.exe 1166336 bytes executable
C:\WINDOWS\system32\ntbackup.hlp 68824 bytes
C:\WINDOWS\system32\ntdll.dll 733184 bytes executable
C:\WINDOWS\system32\ntdos.sys 27916 bytes
C:\WINDOWS\system32\ntdos404.sys 29146 bytes
C:\WINDOWS\system32\ntdos411.sys 29370 bytes
C:\WINDOWS\system32\ntdos412.sys 29274 bytes
C:\WINDOWS\system32\ntdos804.sys 29146 bytes
C:\WINDOWS\system32\ntdsapi.dll 67072 bytes executable
C:\WINDOWS\system32\ntimage.gif 48794 bytes
C:\WINDOWS\system32\ntio.sys 34000 bytes
C:\WINDOWS\system32\ntio404.sys 34560 bytes
C:\WINDOWS\system32\ntio411.sys 35648 bytes
C:\WINDOWS\system32\ntio412.sys 35424 bytes
C:\WINDOWS\system32\ntio804.sys 34560 bytes
C:\WINDOWS\system32\ntkrnlpa.exe 2059648 bytes executable
C:\WINDOWS\system32\ntlanman.dll 43520 bytes executable
C:\WINDOWS\system32\ntlanui.dll 59392 bytes executable
C:\WINDOWS\system32\ntlanui2.dll 14848 bytes executable
C:\WINDOWS\system32\iprtprio.dll 4096 bytes executable
C:\WINDOWS\system32\iprtrmgr.dll 169984 bytes executable
C:\WINDOWS\system32\ipsec6.exe 46080 bytes executable
C:\WINDOWS\system32\ipsecsnp.dll 361472 bytes executable
C:\WINDOWS\system32\ipsecsvc.dll 184320 bytes executable
C:\WINDOWS\system32\ipsink.ax 16384 bytes executable
C:\WINDOWS\system32\ipsmsnap.dll 388096 bytes executable
C:\WINDOWS\system32\ipv6.exe 53760 bytes executable
C:\WINDOWS\system32\ipv6mon.dll 59904 bytes executable
C:\WINDOWS\system32\ipxmontr.dll 91648 bytes executable
C:\WINDOWS\system32\ipxpromn.dll 74240 bytes executable
C:\WINDOWS\system32\ipxrip.dll 21504 bytes executable
C:\WINDOWS\system32\ipxroute.exe 24576 bytes executable
C:\WINDOWS\system32\ipxrtmgr.dll 39936 bytes executable
C:\WINDOWS\system32\ipxsap.dll 66560 bytes executable
C:\WINDOWS\system32\ipxwan.dll 20992 bytes executable
C:\WINDOWS\system32\ir32_32.dll 199168 bytes executable
C:\WINDOWS\system32\ir41_32.ax 848384 bytes executable
C:\WINDOWS\system32\ir41_32.dll 756736 bytes executable
C:\WINDOWS\system32\ir41_qc.dll 120320 bytes executable
C:\WINDOWS\system32\kbd101.dll 6144 bytes executable
C:\WINDOWS\system32\kbd101a.dll 6144 bytes executable
C:\WINDOWS\system32\kbd101b.dll 6144 bytes executable
C:\WINDOWS\system32\kbd101c.dll 6144 bytes executable
C:\WINDOWS\system32\kbd103.dll 5632 bytes executable
C:\WINDOWS\system32\kbd106.dll 6144 bytes executable
C:\WINDOWS\system32\kbd106n.dll 6144 bytes executable
C:\WINDOWS\system32\KBDAL.DLL 6656 bytes executable
C:\WINDOWS\system32\kbdax2.dll 6144 bytes executable
C:\WINDOWS\system32\kbdaze.dll 5632 bytes executable
C:\WINDOWS\system32\kbdazel.dll 5632 bytes executable
C:\WINDOWS\system32\kbdbe.dll 6144 bytes executable
C:\WINDOWS\system32\kbdbene.dll 6144 bytes executable
C:\WINDOWS\system32\kbdblr.dll 5632 bytes executable
C:\WINDOWS\system32\kbdbr.dll 6144 bytes executable
C:\WINDOWS\system32\kbdbu.dll 5632 bytes executable
C:\WINDOWS\system32\kbdca.dll 6144 bytes executable
C:\WINDOWS\system32\kbdcan.dll 7680 bytes executable
C:\WINDOWS\system32\kbdcr.dll 6656 bytes executable
C:\WINDOWS\system32\kbdcz.dll 7168 bytes executable
C:\WINDOWS\system32\kbdcz1.dll 6656 bytes executable
C:\WINDOWS\system32\kbdcz2.dll 6656 bytes executable
C:\WINDOWS\system32\kbdda.dll 6144 bytes executable
C:\WINDOWS\system32\kbddv.dll 5120 bytes executable
C:\WINDOWS\system32\kbdes.dll 6144 bytes executable
C:\WINDOWS\system32\kbdest.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfc.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfi.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfi1.dll 7168 bytes executable
C:\WINDOWS\system32\kbdfo.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfr.dll 6144 bytes executable
C:\WINDOWS\system32\kbdlk41a.dll 6656 bytes executable
C:\WINDOWS\system32\kbdlk41j.dll 6144 bytes executable
C:\WINDOWS\system32\kbdlt.dll 5632 bytes executable
C:\WINDOWS\system32\kbdlt1.dll 5632 bytes executable
C:\WINDOWS\system32\kbdlv.dll 6144 bytes executable
C:\WINDOWS\system32\kbdlv1.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmac.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmaori.dll 5632 bytes executable
C:\WINDOWS\system32\kbdmlt47.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmlt48.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmon.dll 5632 bytes executable
C:\WINDOWS\system32\kbdne.dll 6144 bytes executable
C:\WINDOWS\system32\kbdnec.dll 7168 bytes executable
C:\WINDOWS\system32\kbdnec95.dll 7168 bytes executable
C:\WINDOWS\system32\kbdnecAT.dll 9216 bytes executable
C:\WINDOWS\system32\kbdnecNT.dll 7680 bytes executable
C:\WINDOWS\system32\kbdno.dll 6144 bytes executable
C:\WINDOWS\system32\kbdno1.dll 7168 bytes executable
C:\WINDOWS\system32\kbdpl.dll 6656 bytes executable
C:\WINDOWS\system32\LAPRXY.dll 11264 bytes executable
C:\WINDOWS\system32\lcphrase.tbl 211938 bytes
C:\WINDOWS\system32\lcptr.tbl 24114 bytes
C:\WINDOWS\system32\LegitCheckControl.dll 1476992 bytes executable
C:\WINDOWS\system32\lfbmp10N.dll 34304 bytes executable
C:\WINDOWS\system32\lfbmp13n.dll 57344 bytes executable
C:\WINDOWS\system32\LFBMP62N.DLL 22016 bytes executable
C:\WINDOWS\system32\LFCMP10N.DLL 266752 bytes executable
C:\WINDOWS\system32\lfcmp13n.dll 401408 bytes executable
C:\WINDOWS\system32\LFCMP62N.DLL 158720 bytes executable
C:\WINDOWS\system32\lffax10N.dll 77824 bytes executable
C:\WINDOWS\system32\lffax13n.dll 98304 bytes executable
C:\WINDOWS\system32\lfgif13n.dll 69632 bytes executable
C:\WINDOWS\system32\lfpng13n.dll 159744 bytes executable
C:\WINDOWS\system32\lftif10N.dll 122368 bytes executable
C:\WINDOWS\system32\lftif13n.dll 155648 bytes executable
C:\WINDOWS\system32\lhacm.acm 34064 bytes executable
C:\WINDOWS\system32\libdivx.dll 1044480 bytes executable
C:\WINDOWS\system32\licdll.dll 424960 bytes executable
C:\WINDOWS\system32\licmgr10.dll 22528 bytes executable
C:\WINDOWS\system32\licwmi.dll 58880 bytes executable
C:\WINDOWS\system32\mciavi32.dll 85504 bytes executable
C:\WINDOWS\system32\mcicda.dll 17408 bytes executable
C:\WINDOWS\system32\mciole16.dll 8192 bytes
C:\WINDOWS\system32\mciole32.dll 7680 bytes executable
C:\WINDOWS\system32\mciqtz32.dll 35328 bytes executable
C:\WINDOWS\system32\mciseq.dll 23040 bytes executable
C:\WINDOWS\system32\mciseq.drv 25280 bytes
C:\WINDOWS\system32\mciwave.dll 23552 bytes executable
C:\WINDOWS\system32\mciwave.drv 28160 bytes
C:\WINDOWS\system32\mcoinstall.exe 28672 bytes executable
C:\WINDOWS\system32\mdaccore.rsp 228 bytes
C:\WINDOWS\system32\mdhcp.dll 50176 bytes executable
C:\WINDOWS\system32\mdminst.dll 120320 bytes executable
C:\WINDOWS\system32\mdwmdmsp.dll 147968 bytes executable
C:\WINDOWS\system32\mem.exe 39434 bytes
C:\WINDOWS\system32\mf3216.dll 40960 bytes executable
C:\WINDOWS\system32\mfc40.dll 924432 bytes executable
C:\WINDOWS\system32\mfc40loc.dll 45568 bytes executable
C:\WINDOWS\system32\mfc40u.dll 927504 bytes executable
C:\WINDOWS\system32\mfc42.dll 1028096 bytes executable
C:\WINDOWS\system32\mmutilse.dll 119808 bytes executable
C:\WINDOWS\system32\mnmdd.dll 34560 bytes executable
C:\WINDOWS\system32\mnmsrvc.exe 32768 bytes executable
C:\WINDOWS\system32\mobsync.dll 210432 bytes executable
C:\WINDOWS\system32\mobsync.exe 144384 bytes executable
C:\WINDOWS\system32\mode.com 19456 bytes executable
C:\WINDOWS\system32\modemui.dll 156160 bytes executable
C:\WINDOWS\system32\modex.dll 10112 bytes executable
C:\WINDOWS\system32\more.com 15872 bytes executable
C:\WINDOWS\system32\moricons.dll 216064 bytes executable
C:\WINDOWS\system32\mountvol.exe 8192 bytes executable
C:\WINDOWS\system32\mouse.drv 2032 bytes
C:\WINDOWS\system32\MP43DECD.dll 259072 bytes executable
C:\WINDOWS\system32\MP43DMOD.dll 4096 bytes executable
C:\WINDOWS\system32\MP4SDECD.dll 317440 bytes executable
C:\WINDOWS\system32\MP4SDMOD.dll 4096 bytes executable
C:\WINDOWS\system32\mpeg2data.ax 118272 bytes executable
C:\WINDOWS\system32\mpg2splt.ax 148992 bytes executable
C:\WINDOWS\system32\MPG4DECD.dll 259072 bytes executable
C:\WINDOWS\system32\MPG4DMOD.dll 4096 bytes executable
C:\WINDOWS\system32\mpg4ds32.ax 262144 bytes executable
C:\WINDOWS\system32\mplay32.exe 124928 bytes executable
C:\WINDOWS\system32\mpnotify.exe 22016 bytes executable
C:\WINDOWS\system32\mpr.dll 59904 bytes executable
C:\WINDOWS\system32\mprapi.dll 87040 bytes executable
C:\WINDOWS\system32\mprddm.dll 69120 bytes executable
C:\WINDOWS\system32\mprdim.dll 49152 bytes executable
C:\WINDOWS\system32\msexch35.dll 344064 bytes executable
C:\WINDOWS\system32\msexch40.dll 512029 bytes executable
C:\WINDOWS\system32\msexcl35.dll 252688 bytes executable
C:\WINDOWS\system32\msexcl40.dll 319517 bytes executable
C:\WINDOWS\system32\MSFLXGRD.OCX 200976 bytes executable
C:\WINDOWS\system32\msftedit.dll 539136 bytes executable
C:\WINDOWS\system32\msg.exe 22528 bytes executable
C:\WINDOWS\system32\msg711.acm 9216 bytes executable
C:\WINDOWS\system32\msg723.acm 118784 bytes executable
C:\WINDOWS\system32\msgina.dll 1004032 bytes executable
C:\WINDOWS\system32\msgsm32.acm 19968 bytes executable
C:\WINDOWS\system32\msgsvc.dll 33792 bytes executable
C:\WINDOWS\system32\msh261.drv 188416 bytes executable
C:\WINDOWS\system32\msh263.drv 294912 bytes executable
C:\WINDOWS\system32\msyuv.dll 17408 bytes executable
C:\WINDOWS\system32\mtxclu.dll 66560 bytes executable
C:\WINDOWS\system32\mtxdm.dll 20480 bytes executable
C:\WINDOWS\system32\mtxex.dll 4096 bytes executable
C:\WINDOWS\system32\mtxlegih.dll 25088 bytes executable
C:\WINDOWS\system32\mtxoci.dll 91136 bytes executable
C:\WINDOWS\system32\mucltui.dll 271224 bytes executable
C:\WINDOWS\system32\mucltui.dll.mui 30072 bytes executable
C:\WINDOWS\system32\mui
C:\WINDOWS\system32\muweb.dll 207736 bytes executable
C:\WINDOWS\system32\muzika.xm 50492 bytes
C:\WINDOWS\system32\ole2disp.dll 169520 bytes
C:\WINDOWS\system32\ole2nls.dll 153008 bytes
C:\WINDOWS\system32\ole32.dll 1284608 bytes executable
C:\WINDOWS\system32\oleacc.dll 163328 bytes executable
C:\WINDOWS\system32\oleaccrc.dll 18944 bytes executable
C:\WINDOWS\system32\Oleaut32.1 490256 bytes executable
C:\WINDOWS\system32\oleaut32.dll 549376 bytes executable
C:\WINDOWS\system32\olecli.dll 83456 bytes
C:\WINDOWS\system32\olecli32.dll 75264 bytes executable
C:\WINDOWS\system32\olecnv32.dll 37888 bytes executable
C:\WINDOWS\system32\oledlg.dll 124928 bytes executable
C:\WINDOWS\system32\oleprn.dll 110592 bytes executable
C:\WINDOWS\system32\olepro32.dll 83456 bytes executable
C:\WINDOWS\system32\olesvr.dll 24064 bytes
C:\WINDOWS\system32\olesvr32.dll 22016 bytes executable
C:\WINDOWS\system32\olethk32.dll 69120 bytes executable
C:\WINDOWS\system32\Omcamext.ax 38925 bytes executable
C:\WINDOWS\system32\omcamext.dll 53248 bytes executable
C:\WINDOWS\system32\omcamsti.dll 36864 bytes executable
C:\WINDOWS\system32\OmCamUSD.dll 16452 bytes executable
C:\WINDOWS\system32\oobe
C:\WINDOWS\system32\OoneZipPopup.dll 452608 bytes executable
C:\WINDOWS\system32\OoPdfManagerPopup.dll 587776 bytes executable
C:\WINDOWS\system32\opengl32.dll 713728 bytes executable
C:\WINDOWS\system32\osk.exe 216576 bytes executable
C:\WINDOWS\system32\osuninst.dll 68096 bytes executable
C:\WINDOWS\system32\perfd00C.dat 34108 bytes
C:\WINDOWS\system32\perfdisk.dll 27136 bytes executable
C:\WINDOWS\system32\perffilt.h 140 bytes
C:\WINDOWS\system32\perffilt.ini 1293 bytes
C:\WINDOWS\system32\perfh009.dat 382026 bytes
C:\WINDOWS\system32\perfh00C.dat 447222 bytes
C:\WINDOWS\system32\perfi009.dat 272128 bytes
C:\WINDOWS\system32\perfi00C.dat 322810 bytes
C:\WINDOWS\system32\perfmon.exe 15872 bytes executable
C:\WINDOWS\system32\perfmon.msc 57862 bytes
C:\WINDOWS\system32\perfnet.dll 17408 bytes executable
C:\WINDOWS\system32\perfos.dll 26624 bytes executable
C:\WINDOWS\system32\perfproc.dll 35840 bytes executable
C:\WINDOWS\system32\PerfStringBackup.INI 956332 bytes
C:\WINDOWS\system32\perfts.dll 12288 bytes executable
C:\WINDOWS\system32\perfwci.h 435 bytes
C:\WINDOWS\system32\perfwci.ini 2994 bytes
C:\WINDOWS\system32\PfModNT.sys 6752 bytes executable
C:\WINDOWS\system32\phon.ime 79360 bytes executable
C:\WINDOWS\system32\phon.tbl 4071 bytes
C:\WINDOWS\system32\phoncode.tbl 43242 bytes
C:\WINDOWS\system32\phonptr.tbl 2714 bytes
C:\WINDOWS\system32\photowiz.dll 172032 bytes executable
C:\WINDOWS\system32\picn20.dll 38912 bytes executable
C:\WINDOWS\system32\pid.dll 35328 bytes executable
C:\WINDOWS\system32\pschdprf.ini 14073 bytes
C:\WINDOWS\system32\pscript.sep 51 bytes
C:\WINDOWS\system32\PSIKey.dll 1335296 bytes executable
C:\WINDOWS\system32\psnppagn.dll 8192 bytes executable
C:\WINDOWS\system32\pstorec.dll 43520 bytes executable
C:\WINDOWS\system32\pstorsvc.dll 34304 bytes executable
C:\WINDOWS\system32\PTxSCP.ocx 1206272 bytes executable
C:\WINDOWS\system32\pubprn.vbs 3862 bytes
C:\WINDOWS\system32\px.dll 514808 bytes executable
C:\WINDOWS\system32\pxafs.dll 129784 bytes executable
C:\WINDOWS\system32\pxcpya64.exe 63144 bytes executable
C:\WINDOWS\system32\pxcpyi64.exe 108544 bytes executable
C:\WINDOWS\system32\pxdrv.dll 477944 bytes executable
C:\WINDOWS\system32\pxhpinst.exe 67240 bytes executable
C:\WINDOWS\system32\pxinsa64.exe 62632 bytes executable
C:\WINDOWS\system32\pxinsi64.exe 115880 bytes executable
C:\WINDOWS\system32\pxmas.dll 183032 bytes executable
C:\WINDOWS\system32\pxsfs.dll 1309432 bytes executable
C:\WINDOWS\system32\pxwave.dll 379640 bytes executable
C:\WINDOWS\system32\pxwma.dll 151552 bytes executable
C:\WINDOWS\system32\qappsrv.exe 17408 bytes executable
C:\WINDOWS\system32\qasf.dll 211456 bytes executable
C:\WINDOWS\system32\qcap.dll 192512 bytes executable
C:\WINDOWS\system32\qdv.dll 279040 bytes executable
C:\WINDOWS\system32\qdvd.dll 386048 bytes executable
C:\WINDOWS\system32\qedit.dll 563200 bytes executable
C:\WINDOWS\system32\qedwipes.dll 733696 bytes executable
C:\WINDOWS\system32\qmgr.dll 382464 bytes executable
C:\WINDOWS\system32\qmgrprxy.dll 18944 bytes executable
C:\WINDOWS\system32\qosname.dll 8192 bytes executable
C:\WINDOWS\system32\replace.exe 12800 bytes executable
C:\WINDOWS\system32\reset.exe 10240 bytes executable
C:\WINDOWS\system32\Restore
C:\WINDOWS\system32\resutils.dll 58880 bytes executable
C:\WINDOWS\system32\ReWire.dll 225280 bytes executable
C:\WINDOWS\system32\rexec.exe 14848 bytes executable
C:\WINDOWS\system32\riched20.dll 433152 bytes executable
C:\WINDOWS\system32\riched32.dll 3584 bytes executable
C:\WINDOWS\system32\RICHTEXT.SRG 111 bytes
C:\WINDOWS\system32\RICHTX32.DEP 3010 bytes
C:\WINDOWS\system32\RICHTX32.oca 64000 bytes executable
C:\WINDOWS\system32\RICHTX32.OCX 260096 bytes executable
C:\WINDOWS\system32\RLOgg.ax 186880 bytes executable
C:\WINDOWS\system32\RLSpeexDec.ax 51712 bytes executable
C:\WINDOWS\system32\RLTheoraDec.ax 67584 bytes executable
C:\WINDOWS\system32\scarddlg.dll 71168 bytes executable
C:\WINDOWS\system32\scardssp.dll 118784 bytes executable
C:\WINDOWS\system32\scardsvr.exe 100352 bytes executable
C:\WINDOWS\system32\sccbase.dll 169984 bytes executable
C:\WINDOWS\system32\sccsccp.dll 171520 bytes executable
C:\WINDOWS\system32\scecli.dll 186368 bytes executable
C:\WINDOWS\system32\scesrv.dll 328704 bytes executable
C:\WINDOWS\system32\schannel.dll 144896 bytes executable
C:\WINDOWS\system32\schedsvc.dll 193024 bytes executable
C:\WINDOWS\system32\sclgntfy.dll 22016 bytes executable
C:\WINDOWS\system32\scofr.dll 24624 bytes executable
C:\WINDOWS\system32\scredir.dll 26624 bytes executable
C:\WINDOWS\system32\scrnsave.scr 9216 bytes executable
C:\WINDOWS\system32\scrobj.dll 159744 bytes executable
C:\WINDOWS\system32\scrrnfr.dll 24626 bytes executable
C:\WINDOWS\system32\scrrun.dll 151552 bytes executable
C:\WINDOWS\system32\SDA
C:\WINDOWS\system32\sdbinst.exe 78848 bytes executable
C:\WINDOWS\system32\sdhcinst.dll 29184 bytes executable
C:\WINDOWS\system32\sl_anet.acm 86016 bytes executable
C:\WINDOWS\system32\Smab.dll 845312 bytes executable
C:\WINDOWS\system32\smbinst.exe 8192 bytes executable
C:\WINDOWS\system32\smlogcfg.dll 370688 bytes executable
C:\WINDOWS\system32\smlogsvc.exe 93184 bytes executable
C:\WINDOWS\system32\smss.exe 50688 bytes executable
C:\WINDOWS\system32\Snap32n.dll 249856 bytes executable
C:\WINDOWS\system32\sndrec32.exe 133120 bytes executable
C:\WINDOWS\system32\sndvol32.exe 139264 bytes executable
C:\WINDOWS\system32\snetcfg.exe 12507 bytes executable
C:\WINDOWS\system32\snmpapi.dll 18944 bytes executable
C:\WINDOWS\system32\snmpsnap.dll 184320 bytes executable
C:\WINDOWS\system32\SNWValid.dll 231936 bytes executable
C:\WINDOWS\system32\Snwvalid.hlp 11104 bytes
C:\WINDOWS\system32\softpub.dll 5632 bytes executable
C:\WINDOWS\system32\SoftwareDistribution
C:\WINDOWS\system32\synceng.dll 57856 bytes executable
C:\WINDOWS\system32\SynCOM.dll 77917 bytes executable
C:\WINDOWS\system32\SynCtrl.dll 114688 bytes executable
C:\WINDOWS\system32\syncui.dll 197120 bytes executable
C:\WINDOWS\system32\SynTPAPI.dll 90202 bytes executable
C:\WINDOWS\system32\SynTPCo2.dll 81920 bytes executable
C:\WINDOWS\system32\SynTPFcs.dll 69722 bytes executable
C:\WINDOWS\system32\sysdm.cpl 305152 bytes executable
C:\WINDOWS\system32\sysedit.exe 19216 bytes
C:\WINDOWS\system32\SysInfoServer.dll 24576 bytes executable
C:\WINDOWS\system32\sysinv.dll 15872 bytes executable
C:\WINDOWS\system32\syskey.exe 37888 bytes executable
C:\WINDOWS\system32\sysmon.ocx 220672 bytes executable
C:\WINDOWS\system32\sysocmgr.exe 107520 bytes executable
C:\WINDOWS\system32\sysprint.sep 3214 bytes
C:\WINDOWS\system32\sysprtj.sep 3577 bytes
C:\WINDOWS\system32\syssetup.dll 1005056 bytes executable
C:\WINDOWS\system32\system.drv 3360 bytes
C:\WINDOWS\system32\systray.exe 3072 bytes executable
C:\WINDOWS\system32\t2embed.dll 118272 bytes executable
C:\WINDOWS\system32\TABCTL32.OCX 209608 bytes executable
C:\WINDOWS\system32\tafysijw.ini 1027788 bytes
C:\WINDOWS\system32\tapi.dll 19200 bytes
C:\WINDOWS\system32\tapi3.dll 860160 bytes executable
C:\WINDOWS\system32\tapi32.dll 181760 bytes executable
C:\WINDOWS\system32\tree.com 11264 bytes executable
C:\WINDOWS\system32\trkwks.dll 90624 bytes executable
C:\WINDOWS\system32\tsappcmp.dll 52224 bytes executable
C:\WINDOWS\system32\tsbyuv.dll 8192 bytes executable
C:\WINDOWS\system32\tscfgwmi.dll 94208 bytes executable
C:\WINDOWS\system32\tscon.exe 15360 bytes executable
C:\WINDOWS\system32\tscupgrd.exe 44544 bytes executable
C:\WINDOWS\system32\tsd32.dll 15360 bytes executable
C:\WINDOWS\system32\tsddd.dll 12168 bytes executable
C:\WINDOWS\system32\tsdiscon.exe 14848 bytes executable
C:\WINDOWS\system32\tskill.exe 16896 bytes executable
C:\WINDOWS\system32\tslabels.h 3286 bytes
C:\WINDOWS\system32\tslabels.ini 27768 bytes
C:\WINDOWS\system32\tsshutdn.exe 17408 bytes executable
C:\WINDOWS\system32\tssoft32.acm 8192 bytes executable
C:\WINDOWS\system32\twext.dll 44032 bytes executable
C:\WINDOWS\system32\TwnLib20.dll 106496 bytes executable
C:\WINDOWS\system32\TwnLib4.dll 364544 bytes executable
C:\WINDOWS\system32\version.dll 18944 bytes executable
C:\WINDOWS\system32\VFind.exe 49152 bytes executable
C:\WINDOWS\system32\vfpodbc.dll 20535 bytes executable
C:\WINDOWS\system32\vfwwdm32.dll 54784 bytes executable
C:\WINDOWS\system32\vga.dll 9344 bytes executable
C:\WINDOWS\system32\vga.drv 2176 bytes
C:\WINDOWS\system32\vga256.dll 51456 bytes executable
C:\WINDOWS\system32\vga64k.dll 18176 bytes executable
C:\WINDOWS\system32\VGAunistlog.ini 165 bytes
C:\WINDOWS\system32\vidcap.ax 28672 bytes executable
C:\WINDOWS\system32\VisualSoftCrypt.dll 275968 bytes executable
C:\WINDOWS\system32\vjoy.dll 4608 bytes executable
C:\WINDOWS\system32\vmhelper.dll 286992 bytes executable
C:\WINDOWS\system32\VModes.exe 40960 bytes executable
C:\WINDOWS\system32\vp6vfw.dll 442368 bytes executable
C:\WINDOWS\system32\Vsflex7L.ocx 419488 bytes executable
C:\WINDOWS\system32\vssadmin.exe 34304 bytes executable
C:\WINDOWS\system32\vssapi.dll 430592 bytes executable
C:\WINDOWS\system32\vssvc.exe 295424 bytes executable
C:\WINDOWS\system32\wbdbase.ita 867840 bytes
C:\WINDOWS\system32\wbdbase.nld 1095680 bytes
C:\WINDOWS\system32\wbdbase.sve 937984 bytes
C:\WINDOWS\system32\wbem
C:\WINDOWS\system32\wbsecdrv.inf 3036 bytes
C:\WINDOWS\system32\wbsecdrv.sys 17664 bytes executable
C:\WINDOWS\system32\wbsecsvc.exe 241664 bytes executable
C:\WINDOWS\system32\wdfapi.dll 4096 bytes executable
C:\WINDOWS\system32\wdfmgr.exe 8704 bytes executable
C:\WINDOWS\system32\wdigest.dll 49152 bytes executable
C:\WINDOWS\system32\wdl.trm 4096 bytes
C:\WINDOWS\system32\wdmaud.drv 23552 bytes executable
C:\WINDOWS\system32\webc3dsx(2).ax 50718 bytes executable
C:\WINDOWS\system32\webc3dsx(3).ax 50718 bytes executable
C:\WINDOWS\system32\webc3dsx.ax 50718 bytes executable
C:\WINDOWS\system32\webc3ext.dll 49152 bytes executable
C:\WINDOWS\system32\usrfaxa.dll 86073 bytes executable
C:\WINDOWS\system32\usrlbva.dll 53305 bytes executable
C:\WINDOWS\system32\usrlogon.cmd 1263 bytes
C:\WINDOWS\system32\usrmlnka.exe 77891 bytes executable
C:\WINDOWS\system32\usrprbda.exe 61508 bytes executable
C:\WINDOWS\system32\usrrtosa.dll 77883 bytes executable
C:\WINDOWS\system32\usrsdpia.dll 49211 bytes executable
C:\WINDOWS\system32\usrshuta.exe 69700 bytes executable
C:\WINDOWS\system32\usrsvpia.dll 41019 bytes executable
C:\WINDOWS\system32\usrv42a.dll 102457 bytes executable
C:\WINDOWS\system32\usrv80a.dll 49209 bytes executable
C:\WINDOWS\system32\usrvoica.dll 45116 bytes executable
C:\WINDOWS\system32\usrvpa.dll 49211 bytes executable
C:\WINDOWS\system32\utildll.dll 26112 bytes executable
C:\WINDOWS\system32\utilman.exe 50176 bytes executable
C:\WINDOWS\system32\uwdf.exe 8704 bytes executable
C:\WINDOWS\system32\uxtheme.dll 219648 bytes executable
C:\WINDOWS\system32\v7vga.rom 18832 bytes
C:\WINDOWS\system32\comm.drv 10544 bytes
C:\WINDOWS\system32\command.com 52103 bytes
C:\WINDOWS\system32\commdlg.dll 33904 bytes
C:\WINDOWS\system32\comp.exe 15872 bytes executable
C:\WINDOWS\system32\compact.exe 18432 bytes executable
C:\WINDOWS\system32\compatUI.dll 253440 bytes executable
C:\WINDOWS\system32\compmgmt.msc 37357 bytes
C:\WINDOWS\system32\compobj.dll 30160 bytes
C:\WINDOWS\system32\compstui.dll 230912 bytes executable
C:\WINDOWS\system32\comrepl.dll 97792 bytes executable
C:\WINDOWS\system32\comres.dll 851968 bytes executable
C:\WINDOWS\system32\comsnap.dll 147456 bytes executable
C:\WINDOWS\system32\comsvcs.dll 1267200 bytes executable
C:\WINDOWS\system32\comuid.dll 540160 bytes executable
C:\WINDOWS\system32\config
C:\WINDOWS\system32\CONFIG.NT 3072 bytes
C:\WINDOWS\system32\CONFIG.TMP 3072 bytes
C:\WINDOWS\system32\confmsp.dll 346112 bytes executable
C:\WINDOWS\system32\conime.exe 27648 bytes executable
C:\WINDOWS\system32\console.dll 67072 bytes executable
C:\WINDOWS\system32\control.exe 8192 bytes executable
C:\WINDOWS\system32\convert.exe 13824 bytes executable
C:\WINDOWS\system32\corpol.dll 35328 bytes executable
C:\WINDOWS\system32\country.sys 27097 bytes
C:\WINDOWS\system32\cppenv25.dll 27648 bytes executable
C:\WINDOWS\system32\winscard.dll 100352 bytes executable
C:\WINDOWS\system32\winshfhc.dll 17408 bytes executable
C:\WINDOWS\system32\WINSIZE.DLL 4080 bytes
C:\WINDOWS\system32\winsock.dll 2864 bytes
C:\WINDOWS\system32\WINSP.IME 156672 bytes executable
C:\WINDOWS\system32\WINSP.MB 1564868 bytes
C:\WINDOWS\system32\winspool.drv 146944 bytes executable
C:\WINDOWS\system32\winspool.exe 2112 bytes
C:\WINDOWS\system32\winsrv.dll 293376 bytes executable
C:\WINDOWS\system32\winsta.dll 53760 bytes executable
C:\WINDOWS\system32\winstrm.dll 21504 bytes executable
C:\WINDOWS\system32\wintrust.dll 176640 bytes executable
C:\WINDOWS\system32\winver.exe 5632 bytes executable
C:\WINDOWS\system32\WINZM.IME 156672 bytes executable
C:\WINDOWS\system32\WINZM.MB 1223500 bytes
C:\WINDOWS\system32\wisptis.exe 194560 bytes executable
C:\WINDOWS\system32\wjview.exe 171792 bytes executable
C:\WINDOWS\system32\wkssvc.dll 132096 bytes executable
C:\WINDOWS\system32\WLANUTL.dll 106496 bytes executable
C:\WINDOWS\system32\wldap32.dll 172544 bytes executable
C:\WINDOWS\system32\wlnotify.dll 94208 bytes executable
C:\WINDOWS\system32\wmadmod.dll 757248 bytes executable
C:\WINDOWS\system32\WMADMOE.dll 1117696 bytes executable
C:\WINDOWS\system32\wmasf.dll 222208 bytes executable
C:\WINDOWS\system32\wmaudsdk.dll 163600 bytes executable
C:\WINDOWS\system32\wmdmlog.dll 33792 bytes executable
C:\WINDOWS\system32\wmdmps.dll 37376 bytes executable
C:\WINDOWS\system32\wmdrmdev.dll 429056 bytes executable
C:\WINDOWS\system32\wmdrmnet.dll 348672 bytes executable
C:\WINDOWS\system32\wmdrmsdk.dll 535040 bytes executable
C:\WINDOWS\system32\mssip32.dll 4608 bytes executable
C:\WINDOWS\system32\msstdfmt.dll 118784 bytes executable
C:\WINDOWS\system32\msstkprp.dll 94208 bytes executable
C:\WINDOWS\system32\msswch.dll 13312 bytes executable
C:\WINDOWS\system32\msswchx.exe 6656 bytes executable
C:\WINDOWS\system32\mstask.dll 281600 bytes executable
C:\WINDOWS\system32\mstext35.dll 166672 bytes executable
C:\WINDOWS\system32\mstext40.dll 258077 bytes executable
C:\WINDOWS\system32\mstime.dll 532480 bytes executable
C:\WINDOWS\system32\mstinit.exe 12288 bytes executable
C:\WINDOWS\system32\mstlsapi.dll 115712 bytes executable
C:\WINDOWS\system32\mstsc.exe 411648 bytes executable
C:\WINDOWS\system32\mstscax.dll 655360 bytes executable
C:\WINDOWS\system32\msutb.dll 195584 bytes executable
C:\WINDOWS\system32\msv1_0.dll 129536 bytes executable
C:\WINDOWS\system32\msvbvm50.dll 1355776 bytes executable
C:\WINDOWS\system32\MSVBVM60.DLL 1386496 bytes executable
C:\WINDOWS\system32\msvci70.dll 54784 bytes executable
C:\WINDOWS\system32\msvcirt.dll 54784 bytes executable
C:\WINDOWS\system32\msvcp50.dll 565760 bytes executable
C:\WINDOWS\system32\msvcp60.dll 413696 bytes executable
C:\WINDOWS\system32\msvcp70.dll 487424 bytes executable
C:\WINDOWS\system32\msvcp71.dll 499712 bytes executable
C:\WINDOWS\system32\msvcr70.dll 344064 bytes executable
C:\WINDOWS\system32\msvcr71.dll 348160 bytes executable
C:\WINDOWS\system32\msvcrt.dll 343040 bytes executable
C:\WINDOWS\system32\MSVCRT10.DLL 210944 bytes executable
C:\WINDOWS\system32\setup.exe 23040 bytes executable
C:\WINDOWS\system32\setupapi.dll 1003520 bytes executable
C:\WINDOWS\system32\setupdll.dll 421376 bytes executable
C:\WINDOWS\system32\setver.exe 12067 bytes
C:\WINDOWS\system32\sfc.dll 5120 bytes executable
C:\WINDOWS\system32\sfc.exe 10240 bytes executable
C:\WINDOWS\system32\sfcfiles.dll 1548288 bytes executable
C:\WINDOWS\system32\sfc_os.dll 142336 bytes executable
C:\WINDOWS\system32\sfmapi.dll 23552 bytes executable
C:\WINDOWS\system32\sfxbe321.dll 73216 bytes executable
C:\WINDOWS\system32\sfxbe322.dll 77312 bytes executable
C:\WINDOWS\system32\sfxbe323.dll 74240 bytes executable
C:\WINDOWS\system32\sfxbe324.dll 78336 bytes executable
C:\WINDOWS\system32\sfxfe32.exe 53760 bytes executable
C:\WINDOWS\system32\sfxfe321.exe 58368 bytes executable
C:\WINDOWS\system32\shadow.exe 15360 bytes executable
C:\WINDOWS\system32\share.exe 882 bytes
C:\WINDOWS\system32\shdoclc.dll 572416 bytes executable
C:\WINDOWS\system32\shdocvw.bak 1483776 bytes executable
C:\WINDOWS\system32\shdocvw.dll 1498624 bytes executable
C:\WINDOWS\system32\shell.dll 5120 bytes
C:\WINDOWS\system32\shell32.dll 8509952 bytes executable
C:\WINDOWS\system32\ShellDHCP
C:\WINDOWS\system32\ShellExt
C:\WINDOWS\system32\shellstyle.dll 435712 bytes executable
C:\WINDOWS\system32\shfolder.dll 25088 bytes executable
C:\WINDOWS\system32\dfrg.msc 41131 bytes
C:\WINDOWS\system32\dfrgfat.exe 82432 bytes executable
C:\WINDOWS\system32\dfrgntfs.exe 104960 bytes executable
C:\WINDOWS\system32\dfrgres.dll 55808 bytes executable
C:\WINDOWS\system32\dfrgsnap.dll 39424 bytes executable
C:\WINDOWS\system32\dfrgui.dll 123904 bytes executable
C:\WINDOWS\system32\dfsshlex.dll 28672 bytes executable
C:\WINDOWS\system32\dgnet.dll 115200 bytes executable
C:\WINDOWS\system32\dgrpsetu.dll 176157 bytes executable
C:\WINDOWS\system32\dgsetup.dll 86044 bytes executable
C:\WINDOWS\system32\dhcp
C:\WINDOWS\system32\dhcpcsvc.dll 112128 bytes executable
C:\WINDOWS\system32\dhcpmon.dll 401408 bytes executable
C:\WINDOWS\system32\dhcpsapi.dll 78848 bytes executable
C:\WINDOWS\system32\diactfrm.dll 395264 bytes executable
C:\WINDOWS\system32\diantz.exe 85504 bytes executable
C:\WINDOWS\system32\digest.dll 68608 bytes executable
C:\WINDOWS\system32\dimap.dll 44032 bytes executable
C:\WINDOWS\system32\dinput.dll 165376 bytes executable
C:\WINDOWS\system32\dinput8.dll 187904 bytes executable
C:\WINDOWS\system32\DiracSplitter.ax 179200 bytes executable
C:\WINDOWS\system32\DirectX
C:\WINDOWS\system32\diskcomp.com 9216 bytes executable
C:\WINDOWS\system32\diskcopy.com 7168 bytes executable
C:\WINDOWS\system32\diskcopy.dll 1502208 bytes executable
C:\WINDOWS\system32\diskmgmt.msc 33311 bytes
C:\WINDOWS\system32\diskpart.exe 167936 bytes executable
C:\WINDOWS\system32\diskperf.exe 19456 bytes executable
C:\WINDOWS\system32\dmusic.dll 104448 bytes executable
C:\WINDOWS\system32\dmutil.dll 58880 bytes executable
C:\WINDOWS\system32\dmview.ocx 61440 bytes executable
C:\WINDOWS\system32\dnsapi.dll 148480 bytes executable
C:\WINDOWS\system32\dnsrslvr.dll 45568 bytes executable
C:\WINDOWS\system32\docprop.dll 47616 bytes executable
C:\WINDOWS\system32\docprop2.dll 48640 bytes executable
C:\WINDOWS\system32\doskey.exe 10752 bytes executable
C:\WINDOWS\system32\dosx.exe 54080 bytes
C:\WINDOWS\system32\dpcdll.dll 97792 bytes executable
C:\WINDOWS\system32\dplay.dll 33040 bytes executable
C:\WINDOWS\system32\dplaysvr.exe 30208 bytes executable
C:\WINDOWS\system32\dplayx.dll 229888 bytes executable
C:\WINDOWS\system32\dpmodemx.dll 24064 bytes executable
C:\WINDOWS\system32\dpnaddr.dll 3584 bytes executable
C:\WINDOWS\system32\dpnet.dll 375296 bytes executable
C:\WINDOWS\system32\dpnhpast.dll 35328 bytes executable
C:\WINDOWS\system32\dpnhupnp.dll 60928 bytes executable
C:\WINDOWS\system32\mprmsg.dll 114688 bytes executable
C:\WINDOWS\system32\mscpx32r.dLL 12288 bytes executable
C:\WINDOWS\system32\msencode.dll 94282 bytes executable
C:\WINDOWS\system32\mshearts.exe 128000 bytes executable
C:\WINDOWS\system32\msjet40.dll 1507356 bytes executable
C:\WINDOWS\system32\mspdox35.dll 250128 bytes executable
C:\WINDOWS\system32\mssign32.dll 36352 bytes executable
C:\WINDOWS\system32\msvcrt20.dll 253952 bytes executable
C:\WINDOWS\system32\msxmlr.dll 30720 bytes executable
C:\WINDOWS\system32\mycomput.dll 90624 bytes executable
C:\WINDOWS\system32\nddenb32.dll 19456 bytes executable
C:\WINDOWS\system32\netrap.dll 12288 bytes executable
C:\WINDOWS\system32\noise.chs 1696 bytes
C:\WINDOWS\system32\npp
C:\WINDOWS\system32\ntlsapi.dll 8192 bytes executable
C:\WINDOWS\system32\objsel.dll 288768 bytes executable
C:\WINDOWS\system32\odbcjt32.dll 278559 bytes executable
C:\WINDOWS\system32\ole2.dll 39744 bytes
C:\WINDOWS\system32\osuninst.exe 41984 bytes executable
C:\WINDOWS\system32\perfd009.dat 28626 bytes
C:\WINDOWS\system32\pidgen.dll 24064 bytes executable
C:\WINDOWS\system32\prcp.nls 83748 bytes
C:\WINDOWS\system32\pschdprf.dll 10752 bytes executable
C:\WINDOWS\system32\qprocess.exe 20992 bytes executable
C:\WINDOWS\system32\rasauto.dll 89088 bytes executable
C:\WINDOWS\system32\rcbdyctl.dll 103424 bytes executable
C:\WINDOWS\system32\rend.dll 107520 bytes executable
C:\WINDOWS\system32\ega.cpi 127213 bytes
C:\WINDOWS\system32\els.dll 187392 bytes executable
C:\WINDOWS\system32\emptyregdb.dat 21892 bytes
C:\WINDOWS\system32\en-US
C:\WINDOWS\system32\encapi.dll 20480 bytes executable
C:\WINDOWS\system32\encdec.dll 186368 bytes executable
C:\WINDOWS\system32\EqnClass.Dll 103424 bytes executable
C:\WINDOWS\system32\ersvc.dll 23040 bytes executable
C:\WINDOWS\system32\es.dll 243200 bytes executable
C:\WINDOWS\system32\esent.dll 1097728 bytes executable
C:\WINDOWS\system32\esent97.dll 1114896 bytes executable
C:\WINDOWS\system32\esentprf.dll 17408 bytes executable
C:\WINDOWS\system32\esentprf.hxx 6708 bytes
C:\WINDOWS\system32\esentprf.ini 1015477 bytes
C:\WINDOWS\system32\esentutl.exe 39424 bytes executable
C:\WINDOWS\system32\ftp.exe 46080 bytes executable
C:\WINDOWS\system32\ftsrch.dll 177152 bytes executable
C:\WINDOWS\system32\netsetup.cpl 25600 bytes executable
C:\WINDOWS\system32\netsetup.exe 332800 bytes executable
C:\WINDOWS\system32\netsh.exe 88576 bytes executable
C:\WINDOWS\system32\netshell.dll 1723904 bytes executable
C:\WINDOWS\system32\netstat.exe 37888 bytes executable
C:\WINDOWS\system32\netui0.dll 83456 bytes executable
C:\WINDOWS\system32\netui1.dll 245760 bytes executable
C:\WINDOWS\system32\netui2.dll 312832 bytes executable
C:\WINDOWS\system32\newdev.dll 251392 bytes executable
C:\WINDOWS\system32\NewmsrdkForKey
C:\WINDOWS\system32\NexPlayerX.dll 561152 bytes executable
C:\WINDOWS\system32\nlhtml.dll 103936 bytes executable
C:\WINDOWS\system32\nlsdl.dll 24576 bytes executable
C:\WINDOWS\system32\nlsfunc.exe 7116 bytes
C:\WINDOWS\system32\nmevtmsg.dll 12288 bytes executable
C:\WINDOWS\system32\nmmkcert.dll 28672 bytes executable
C:\WINDOWS\system32\ie4uinit.exe 34304 bytes executable
C:\WINDOWS\system32\ieakeng.dll 139264 bytes executable
C:\WINDOWS\system32\ieaksie.dll 221696 bytes executable
C:\WINDOWS\system32\ieakui.dll 245760 bytes executable
C:\WINDOWS\system32\iedkcs32.dll 323584 bytes executable
C:\WINDOWS\system32\ieencode.dll 81920 bytes executable
C:\WINDOWS\system32\iepeers.dll 251904 bytes executable
C:\WINDOWS\system32\iernonce.dll 49152 bytes executable
C:\WINDOWS\system32\iesetup.dll 63488 bytes executable
C:\WINDOWS\system32\ieudinit.exe 13824 bytes executable
C:\WINDOWS\system32\ieuinit.inf 46298 bytes
C:\WINDOWS\system32\iexpress.exe 114688 bytes executable
C:\WINDOWS\system32\ifmon.dll 142848 bytes executable
C:\WINDOWS\system32\ifsutil.dll 70656 bytes executable
C:\WINDOWS\system32\igmpagnt.dll 8192 bytes executable
C:\WINDOWS\system32\ijl10.dll 137728 bytes executable
C:\WINDOWS\system32\logonui.exe.manifest 488 bytes
C:\WINDOWS\system32\lpdsvc.dll 23040 bytes executable
C:\WINDOWS\system32\lpk.dll 22016 bytes executable
C:\WINDOWS\system32\lpq.exe 6144 bytes executable
C:\WINDOWS\system32\lpr.exe 9216 bytes executable
C:\WINDOWS\system32\lprhelp.dll 10240 bytes executable
C:\WINDOWS\system32\lprmon.dll 19456 bytes executable
C:\WINDOWS\system32\lprmonui.dll 9216 bytes executable
C:\WINDOWS\system32\lsasrv.dll 728576 bytes executable
C:\WINDOWS\system32\lsass.exe 13312 bytes executable
C:\WINDOWS\system32\ltclr13n.dll 1693696 bytes executable
C:\WINDOWS\system32\LTDIS10N.dll 231424 bytes executable
C:\WINDOWS\system32\ltdis13n.dll 299008 bytes executable
C:\WINDOWS\system32\ltefx10N.dll 221696 bytes executable
C:\WINDOWS\system32\ltefx13n.dll 206336 bytes executable
C:\WINDOWS\system32\ltfil10N.DLL 103424 bytes executable
C:\WINDOWS\system32\ltfil13n.dll 163840 bytes executable
C:\WINDOWS\system32\LTFIL62N.DLL 43008 bytes executable
C:\WINDOWS\system32\ltimg10N.dll 114176 bytes executable
C:\WINDOWS\system32\ltimg13n.dll 450560 bytes executable
C:\WINDOWS\system32\LTIMG62N.DLL 78336 bytes executable
C:\WINDOWS\system32\ltkrn10N.dll 297472 bytes executable
C:\WINDOWS\system32\ltkrn13n.dll 462848 bytes executable
C:\WINDOWS\system32\LTKRN62N.DLL 207872 bytes executable
C:\WINDOWS\system32\LTSCR10N.DLL 142848 bytes executable
C:\WINDOWS\system32\mfc42u.dll 981760 bytes executable
C:\WINDOWS\system32\mfc70.dll 974848 bytes executable
C:\WINDOWS\system32\mfc70u.dll 964608 bytes executable
C:\WINDOWS\system32\mfc71.dll 1060864 bytes executable
C:\WINDOWS\system32\mfc71u.dll 1047552 bytes executable
C:\WINDOWS\system32\mfcsubs.dll 22528 bytes executable
C:\WINDOWS\system32\MFPLAT.dll 212992 bytes executable
C:\WINDOWS\system32\mgmtapi.dll 14848 bytes executable
C:\WINDOWS\system32\mib.bin 46258 bytes
C:\WINDOWS\system32\Microsoft
C:\WINDOWS\system32\midimap.dll 18944 bytes executable
C:\WINDOWS\system32\miglibnt.dll 60928 bytes executable
C:\WINDOWS\system32\migpwd.exe 52736 bytes executable
C:\WINDOWS\system32\mimefilt.dll 18944 bytes executable
C:\WINDOWS\system32\miniime.tpl 11776 bytes executable
C:\WINDOWS\system32\mlang.dat 673088 bytes
C:\WINDOWS\system32\mlang.dll 586240 bytes executable
C:\WINDOWS\system32\mll_hp.dll 3584 bytes executable
C:\WINDOWS\system32\mll_mtf.dll 7680 bytes executable
C:\WINDOWS\system32\mll_qic.dll 5632 bytes executable
C:\WINDOWS\system32\mmc.exe 816128 bytes executable
C:\WINDOWS\system32\mmcbase.dll 79872 bytes executable
C:\WINDOWS\system32\mmcndmgr.dll 1198080 bytes executable
C:\WINDOWS\system32\mmcshext.dll 50688 bytes executable
C:\WINDOWS\system32\mmdriver.inf 1490 bytes
C:\WINDOWS\system32\mmdrv.dll 12288 bytes executable
C:\WINDOWS\system32\mmfutil.dll 17920 bytes executable
C:\WINDOWS\system32\mmsys.cpl 626176 bytes executable
C:\WINDOWS\system32\mmsystem.dll 70688 bytes
C:\WINDOWS\system32\mprui.dll 47616 bytes executable
C:\WINDOWS\system32\mrinfo.exe 14336 bytes executable
C:\WINDOWS\system32\MRT.exe 18089592 bytes executable
C:\WINDOWS\system32\msaatext.dll 102912 bytes executable
C:\WINDOWS\system32\msacm.dll 61312 bytes
C:\WINDOWS\system32\msacm32.dll 72192 bytes executable
C:\WINDOWS\system32\msacm32.drv 20992 bytes executable
C:\WINDOWS\system32\msadds32.ax 221184 bytes executable
C:\WINDOWS\system32\msadp32.acm 14848 bytes executable
C:\WINDOWS\system32\msafd.dll 3584 bytes executable
C:\WINDOWS\system32\msapsspc.dll 86016 bytes executable
C:\WINDOWS\system32\msasn1.dll 57344 bytes executable
C:\WINDOWS\system32\msaud32.acm 294912 bytes executable
C:\WINDOWS\system32\msaudite.dll 77312 bytes executable
C:\WINDOWS\system32\msawt.dll 154384 bytes executable
C:\WINDOWS\system32\mscat32.dll 7168 bytes executable
C:\WINDOWS\system32\mscdexnt.exe 817 bytes
C:\WINDOWS\system32\mschrt20.ocx 1009336 bytes executable
C:\WINDOWS\system32\mscms.dll 74240 bytes executable
C:\WINDOWS\system32\mscomct2.ocx 647872 bytes executable
C:\WINDOWS\system32\mscomctl.ocx 1081616 bytes executable
C:\WINDOWS\system32\msconf.dll 69632 bytes executable
C:\WINDOWS\system32\mscoree.dll 271360 bytes executable
C:\WINDOWS\system32\mscorier.dll 16896 bytes executable
C:\WINDOWS\system32\mscories.dll 106496 bytes executable
C:\WINDOWS\system32\msjetoledb40.dll 358976 bytes executable
C:\WINDOWS\system32\msjint35.dll 123664 bytes executable
C:\WINDOWS\system32\msjint40.dll 184351 bytes executable
C:\WINDOWS\system32\msjt4jlt.dll 1238288 bytes executable
C:\WINDOWS\system32\msjter35.dll 24848 bytes executable
C:\WINDOWS\system32\msjter40.dll 53279 bytes executable
C:\WINDOWS\system32\msjtes40.dll 241693 bytes executable
C:\WINDOWS\system32\mslbui.dll 25600 bytes executable
C:\WINDOWS\system32\msls31.dll 146432 bytes executable
C:\WINDOWS\system32\msltus35.dll 168720 bytes executable
C:\WINDOWS\system32\msltus40.dll 213023 bytes executable
C:\WINDOWS\system32\msmapi32.ocx 137000 bytes executable
C:\WINDOWS\system32\msnetobj.dll 179712 bytes executable
C:\WINDOWS\system32\msnsspc.dll 290816 bytes executable
C:\WINDOWS\system32\msobjs.dll 37376 bytes executable
C:\WINDOWS\system32\msoeacct.dll 252928 bytes executable
C:\WINDOWS\system32\msoert2.dll 105984 bytes executable
C:\WINDOWS\system32\msorc32r.dll 24576 bytes executable
C:\WINDOWS\system32\msorcl32.dll 143360 bytes executable
C:\WINDOWS\system32\mspaint.exe 347648 bytes executable
C:\WINDOWS\system32\mspatcha.dll 30208 bytes executable
C:\WINDOWS\system32\mspbde40.dll 348189 bytes executable
C:\WINDOWS\system32\ntmarta.dll 119808 bytes executable
C:\WINDOWS\system32\ntmsapi.dll 40960 bytes executable
C:\WINDOWS\system32\NtmsData
C:\WINDOWS\system32\ntmsdba.dll 181248 bytes executable
C:\WINDOWS\system32\ntmsevt.dll 45056 bytes executable
C:\WINDOWS\system32\ntmsmgr.dll 496640 bytes executable
C:\WINDOWS\system32\ntmsmgr.msc 25901 bytes
C:\WINDOWS\system32\ntmsoprq.msc 32590 bytes
C:\WINDOWS\system32\ntmssvc.dll 438272 bytes executable
C:\WINDOWS\system32\ntoskrnl.exe 2182400 bytes executable
C:\WINDOWS\system32\ntprint.dll 91648 bytes executable
C:\WINDOWS\system32\ntsd.exe 31744 bytes executable
C:\WINDOWS\system32\ntsdexts.dll 36864 bytes executable
C:\WINDOWS\system32\ntshrui.dll 145920 bytes executable
C:\WINDOWS\system32\ntsim.sys 6016 bytes executable
C:\WINDOWS\system32\ntvdm.exe 420864 bytes executable
C:\WINDOWS\system32\ntvdmd.dll 13312 bytes executable
C:\WINDOWS\system32\nusrmgr.cpl 261120 bytes executable
C:\WINDOWS\system32\nwc.cpl.manifest 749 bytes
C:\WINDOWS\system32\nwprovau.dll 145920 bytes executable
C:\WINDOWS\system32\oajuvbap.ini 577467 bytes
C:\WINDOWS\system32\oakley.dll 267776 bytes executable
C:\WINDOWS\system32\occache.dll 97280 bytes executable
C:\WINDOWS\system32\ocmanage.dll 62976 bytes executable
C:\WINDOWS\system32\odbc16gt.dll 26224 bytes
C:\WINDOWS\system32\odbc32.dll 249856 bytes executable
C:\WINDOWS\system32\odbc32gt.dll 16384 bytes executable
C:\WINDOWS\system32\odbcad32.exe 32768 bytes executable
C:\WINDOWS\system32\odbcbcp.dll 24576 bytes executable
C:\WINDOWS\system32\odbcconf.dll 135168 bytes executable
C:\WINDOWS\system32\odbcconf.exe 69632 bytes executable
C:\WINDOWS\system32\odbcconf.rsp 4310 bytes
C:\WINDOWS\system32\odbccp32.cpl 32768 bytes executable
C:\WINDOWS\system32\odbccp32.dll 106496 bytes executable
C:\WINDOWS\system32\odbccr32.dll 65536 bytes executable
C:\WINDOWS\system32\odbccu32.dll 65536 bytes executable
C:\WINDOWS\system32\odbcint.dll 98304 bytes executable
C:\WINDOWS\system32\Odbcjet.cnt 7348 bytes
C:\WINDOWS\system32\Odbcjet.hlp 171967 bytes
C:\WINDOWS\system32\odbcji32.dll 61712 bytes executable
C:\WINDOWS\system32\pifmgr.dll 35328 bytes executable
C:\WINDOWS\system32\ping.exe 19456 bytes executable
C:\WINDOWS\system32\ping6.exe 34304 bytes executable
C:\WINDOWS\system32\PINTLGNT.IME 482304 bytes executable
C:\WINDOWS\system32\PINTLPAD.HLP 14821 bytes
C:\WINDOWS\system32\PINTLPAE.HLP 16254 bytes
C:\WINDOWS\system32\pjlmon.dll 15360 bytes executable
C:\WINDOWS\system32\plustab.dll 30720 bytes executable
C:\WINDOWS\system32\pmspl.dll 46592 bytes
C:\WINDOWS\system32\pngfilt.dll 39424 bytes executable
C:\WINDOWS\system32\pnrpnsp.dll 48640 bytes executable
C:\WINDOWS\system32\polstore.dll 106496 bytes executable
C:\WINDOWS\system32\popup.ocx 29184 bytes executable
**************************************************************************
.
Completion time: 2007-11-10 8:10:39 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-09 18:05
.
--- E O F ---
Logfile of HijackThis v1.99.1
Scan saved at 11:19:25, on 10/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE
C:\Program Files\Windows Live\Messenger\msnmsg
Alors voila mes rapports.
ComboFix 07-11-08.1 - michel virginie 2007-11-10 7:53:52.2 - NTFSx86
Running from: C:\Documents and Settings\michel virginie\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\michel virginie\Bureau\CFScript.txt
* Created a new restore point
FILE
C:\WINDOWS\system32\axkkwaeb.dll
C:\WINDOWS\system32\ddcbayv.dll
C:\WINDOWS\system32\npqss.bak1
C:\WINDOWS\system32\npqss.bak2
C:\WINDOWS\system32\wjisyfat.dll
C:\WINDOWS\system32\wptwkpkc.dll
C:\WINDOWS\system32\xxywxus.dll
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\axkkwaeb.dll
C:\WINDOWS\system32\ddcbayv.dll
C:\WINDOWS\system32\npqss.bak1
C:\WINDOWS\system32\npqss.bak2
C:\WINDOWS\system32\wjisyfat.dll
C:\WINDOWS\system32\wptwkpkc.dll
C:\WINDOWS\system32\xxywxus.dll
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-10 to 2007-11-10 ))))))))))))))))))))))))))))))))))))
.
2007-11-09 17:48 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-09 16:04 <REP> d-------- C:\VundoFix Backups
2007-11-09 16:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2007-11-09 15:59 <REP> d-------- C:\Temp
2007-11-08 08:25 71,680 --------- C:\WINDOWS\system32\drivers\PAVDRV51.SYS
2007-11-08 08:25 248 --a------ C:\WINDOWS\system32\PavCPL.dat
2007-11-08 08:24 <REP> d-------- C:\WINDOWS\system32\PAV
2007-11-08 08:23 <REP> d-------- C:\Program Files\Panda Software
2007-11-08 08:23 45,056 --a------ C:\WINDOWS\system32\avldr.dll
2007-11-04 21:05 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\Grisoft
2007-11-04 18:16 <REP> d-------- C:\Program Files\CCleaner
2007-11-04 16:17 32,768 --a------ C:\Documents and Settings\michel virginie\pdf.exe
2007-11-04 14:35 1,208 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-04 12:15 <REP> d-------- C:\WINDOWS\AU_Temp
2007-11-03 17:37 <REP> d-------- C:\Program Files\Incomplete
2007-11-03 17:26 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2007-11-03 17:24 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\BitTorrent
2007-11-03 17:07 <REP> d-------- C:\Documents and Settings\michel virginie\Incomplete
2007-11-02 17:40 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\Skype
2007-11-02 17:39 <REP> d-------- C:\Program Files\Skype
2007-11-02 17:39 <REP> d-------- C:\Program Files\Fichiers communs\Skype
2007-11-02 17:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2007-11-01 19:07 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\BSplayer Pro
2007-11-01 19:07 <REP> d-------- C:\Documents and Settings\michel virginie\Application Data\BSplayer
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-09 12:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-08 20:58 22 ----a-w C:\WINDOWS\Fonts\a.zip
2007-11-08 07:23 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-04 17:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom
2007-11-04 11:15 86,094 ----a-w C:\WINDOWS\BPMNT.dll
2007-11-04 11:15 1,163,344 ----a-w C:\WINDOWS\vsapi32.dll
2007-11-04 10:52 71,749 ----a-w C:\WINDOWS\hcextoutput.dll
2007-11-04 10:52 267,845 ----a-w C:\WINDOWS\tsc.exe
2007-11-02 19:51 --------- d-----w C:\Program Files\Teamspeak2_RC2
2007-10-03 18:40 --------- d-----w C:\Program Files\QuickTime
2007-10-01 16:12 --------- d-----w C:\Documents and Settings\michel virginie\Application Data\OpenOffice.org2
2007-09-27 06:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-09-22 11:15 --------- d-----w C:\Documents and Settings\michel virginie\Application Data\Viewpoint
2007-09-22 11:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-09-20 05:32 --------- d-----w C:\Program Files\Java
2007-09-19 16:32 --------- d-----w C:\Program Files\OpenOffice.org 2.2
2007-09-18 17:42 --------- d-----w C:\Program Files\Trend Micro
2007-09-18 17:09 77,824 ----a-w C:\WINDOWS\uinst001.exe
2007-09-13 09:05 --------- d-----w C:\Program Files\Illustrate
2007-09-13 09:05 --------- d-----w C:\Documents and Settings\michel virginie\Application Data\AccurateRip
2007-09-11 14:44 --------- d-----w C:\Program Files\DivX
2007-07-25 17:16 94,208 ----a-w C:\Documents and Settings\michel virginie\Application Data\ezplay.sys
2007-07-25 17:16 47,360 ----a-w C:\Documents and Settings\michel virginie\Application Data\pcouffin.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [2005-08-03 14:32 C:\WINDOWS\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [2005-03-08 02:33 C:\WINDOWS\system32\VTTimer.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 14:44]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 14:43]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" []
"oouserv6.exe"="C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe" []
"4c05167c"="C:\WINDOWS\system32\wjisyfat.dll" []
"APVXDWIN"="C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.exe" [2007-01-25 18:50]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-09-27 12:28]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
avldr.dll 2006-07-14 13:46 45056 C:\WINDOWS\system32\avldr.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"MessagerStarter Wanadoo"=C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo
"WooCnxMon"=C:\PROGRA~1\Wanadoo\CnxMon.exe
"autoclk"=autoclk.exe
"WOOWATCH"=C:\PROGRA~1\Wanadoo\Watch.exe
"WOOTASKBARICON"=C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
"BDNewsAgent"=C:\Program Files\Softwin\BitDefender Free Edition\\bdnagent.exe
"WinampAgent"=C:\Program Files\Winamp\winampa.exe
"NeroCheck"=C:\WINDOWS\system32\\NeroCheck.exe
"adiras"=adiras.exe
"Prism_Utility"=Prismsta.exe
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
"RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
"eDonkey2000"="C:\Program Files\eDonkey2000\eDonkey2000.exe" -t
"OoPDFSettingsv6.exe"=C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
"oouserv6.exe"=C:\Program Files\OFFICE ONE6.5\program\oouserv6.exe
"SunJavaUpdateSched"=C:\Program Files\Java\j2re1.4.2_10\bin\jusched.exe
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"SoundMan"=SOUNDMAN.EXE
"Openwares LiveUpdate"=C:\Program Files\LiveUpdate\LiveUpdate.exe
"OSD"=C:\Program Files\OSD\OSD.EXE
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
"VirusScan Online"=C:\Program Files\McAfee.com\VSO\mcvsshld.exe
"OASClnt"=C:\Program Files\McAfee.com\VSO\oasclnt.exe
"MCAgentExe"=c:\PROGRA~1\mcafee.com\agent\mcagent.exe
"MCUpdateExe"=C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
"MSKAGENTEXE"=C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
"MSKDetectorExe"=C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
"_AntiSpyware"=c:\progra~1\mcafee\MCAFEE~3\masalert.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-10 08:05:29
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\system32\fc.exe 14848 bytes executable
C:\WINDOWS\system32\mmtask.tsk 1152 bytes
C:\WINDOWS\system32\rsmsink.exe 24576 bytes executable
C:\WINDOWS\system32\iasacct.dll 23552 bytes executable
C:\WINDOWS\system32\iasads.dll 41472 bytes executable
C:\WINDOWS\system32\iashlpr.dll 32256 bytes executable
C:\WINDOWS\system32\iasnap.dll 62464 bytes executable
C:\WINDOWS\system32\iaspolcy.dll 17920 bytes executable
C:\WINDOWS\system32\iasrad.dll 119808 bytes executable
C:\WINDOWS\system32\iasrecst.dll 141312 bytes executable
C:\WINDOWS\system32\iassam.dll 86528 bytes executable
C:\WINDOWS\system32\iassdo.dll 253440 bytes executable
C:\WINDOWS\system32\iassvcs.dll 62976 bytes executable
C:\WINDOWS\system32\icaapi.dll 11264 bytes executable
C:\WINDOWS\system32\iccvid.dll 80384 bytes executable
C:\WINDOWS\system32\icfgnt5.dll 16384 bytes executable
C:\WINDOWS\system32\icm32.dll 254976 bytes executable
C:\WINDOWS\system32\icmp.dll 3584 bytes executable
C:\WINDOWS\system32\icmui.dll 56320 bytes executable
C:\WINDOWS\system32\icrav03.rat 8798 bytes
C:\WINDOWS\system32\icsxml
C:\WINDOWS\system32\icwdial.dll 73728 bytes executable
C:\WINDOWS\system32\icwphbk.dll 65536 bytes executable
C:\WINDOWS\system32\ideograf.uce 60458 bytes
C:\WINDOWS\system32\idndl.dll 26112 bytes executable
C:\WINDOWS\system32\c_10000.nls 66082 bytes
C:\WINDOWS\system32\c_10001.nls 162850 bytes
C:\WINDOWS\system32\c_10002.nls 195618 bytes
C:\WINDOWS\system32\c_10003.nls 177698 bytes
C:\WINDOWS\system32\c_10006.nls 66082 bytes
C:\WINDOWS\system32\c_10007.nls 66082 bytes
C:\WINDOWS\system32\c_10008.nls 173602 bytes
C:\WINDOWS\system32\c_10010.nls 66082 bytes
C:\WINDOWS\system32\c_10017.nls 66082 bytes
C:\WINDOWS\system32\c_10029.nls 66082 bytes
C:\WINDOWS\system32\c_10079.nls 66082 bytes
C:\WINDOWS\system32\c_10081.nls 66082 bytes
C:\WINDOWS\system32\c_10082.nls 66082 bytes
C:\WINDOWS\system32\c_1026.nls 66082 bytes
C:\WINDOWS\system32\c_1250.nls 66082 bytes
C:\WINDOWS\system32\c_1251.nls 66082 bytes
C:\WINDOWS\system32\c_1252.nls 66082 bytes
C:\WINDOWS\system32\c_1253.nls 66082 bytes
C:\WINDOWS\system32\c_1254.nls 66082 bytes
C:\WINDOWS\system32\c_1255.nls 66082 bytes
C:\WINDOWS\system32\c_1256.nls 66082 bytes
C:\WINDOWS\system32\c_1257.nls 66082 bytes
C:\WINDOWS\system32\c_28599.nls 66082 bytes
C:\WINDOWS\system32\c_28603.nls 66082 bytes
C:\WINDOWS\system32\c_28605.nls 66082 bytes
C:\WINDOWS\system32\c_437.nls 66594 bytes
C:\WINDOWS\system32\c_500.nls 66082 bytes
C:\WINDOWS\system32\c_737.nls 66594 bytes
C:\WINDOWS\system32\c_775.nls 66594 bytes
C:\WINDOWS\system32\c_850.nls 66594 bytes
C:\WINDOWS\system32\c_852.nls 66594 bytes
C:\WINDOWS\system32\c_855.nls 66594 bytes
C:\WINDOWS\system32\c_857.nls 66594 bytes
C:\WINDOWS\system32\c_860.nls 66594 bytes
C:\WINDOWS\system32\c_861.nls 66594 bytes
C:\WINDOWS\system32\c_863.nls 66594 bytes
C:\WINDOWS\system32\c_865.nls 66594 bytes
C:\WINDOWS\system32\c_866.nls 66594 bytes
C:\WINDOWS\system32\c_869.nls 66594 bytes
C:\WINDOWS\system32\c_874.nls 66594 bytes
C:\WINDOWS\system32\c_875.nls 66082 bytes
C:\WINDOWS\system32\credui.dll 165888 bytes executable
C:\WINDOWS\system32\c_037.nls 66082 bytes
C:\WINDOWS\system32\c_1258.nls 66082 bytes
C:\WINDOWS\system32\c_28598.nls 66082 bytes
C:\WINDOWS\system32\c_932.nls 162850 bytes
C:\WINDOWS\system32\dbgeng.dll 847872 bytes executable
C:\WINDOWS\system32\devmgr.dll 290816 bytes executable
C:\WINDOWS\system32\dispex.dll 45083 bytes executable
C:\WINDOWS\system32\DKRNL.JAX 24 bytes
C:\WINDOWS\system32\dmsynth.dll 103424 bytes executable
C:\WINDOWS\system32\dpnlobby.dll 3584 bytes executable
C:\WINDOWS\system32\dsauth.dll 62976 bytes executable
C:\WINDOWS\system32\dswave.dll 19456 bytes executable
C:\WINDOWS\system32\edlin.exe 13010 bytes
C:\WINDOWS\system32\eudcedit.exe 195072 bytes executable
C:\WINDOWS\system32\dbghelp.dll 640000 bytes executable
C:\WINDOWS\system32\dbmsrpcn.dll 24576 bytes executable
C:\WINDOWS\system32\dbnetlib.dll 110592 bytes executable
C:\WINDOWS\system32\dbnmpntw.dll 28672 bytes executable
C:\WINDOWS\system32\Dcache.bin 1788 bytes
C:\WINDOWS\system32\dciman32.dll 8704 bytes executable
C:\WINDOWS\system32\dcomcnfg.exe 5120 bytes executable
C:\WINDOWS\system32\ddeml.dll 39424 bytes
C:\WINDOWS\system32\ddeshare.exe 31744 bytes executable
C:\WINDOWS\system32\ddraw.dll 266240 bytes executable
C:\WINDOWS\system32\ddrawex.dll 27136 bytes executable
C:\WINDOWS\system32\debug.exe 21162 bytes
C:\WINDOWS\system32\declrds.ax 47104 bytes executable
C:\WINDOWS\system32\defrag.exe 25088 bytes executable
C:\WINDOWS\system32\desk.cpl 138240 bytes executable
C:\WINDOWS\system32\deskadp.dll 16896 bytes executable
C:\WINDOWS\system32\deskmon.dll 16896 bytes executable
C:\WINDOWS\system32\deskperf.dll 18944 bytes executable
C:\WINDOWS\system32\desktop.ini 2 bytes
C:\WINDOWS\system32\devenum.dll 59904 bytes executable
C:\WINDOWS\system32\devmgmt.msc 32738 bytes
C:\WINDOWS\system32\divxdec_0407.dll 89600 bytes executable
C:\WINDOWS\system32\divxdec_040c.dll 90112 bytes executable
C:\WINDOWS\system32\divxdec_0411.dll 89600 bytes executable
C:\WINDOWS\system32\dsdmo.dll 181760 bytes executable
C:\WINDOWS\system32\dsdmoprp.dll 72192 bytes executable
C:\WINDOWS\system32\dskquota.dll 93696 bytes executable
C:\WINDOWS\system32\dskquoui.dll 150016 bytes executable
C:\WINDOWS\system32\dsound.dll 367616 bytes executable
C:\WINDOWS\system32\dsound.vxd 81 bytes
C:\WINDOWS\system32\dsound3d.dll 1294336 bytes executable
C:\WINDOWS\system32\dsprop.dll 145408 bytes executable
C:\WINDOWS\system32\dsprpres.dll 4096 bytes executable
C:\WINDOWS\system32\dsquery.dll 240640 bytes executable
C:\WINDOWS\system32\dssec.dat 218003 bytes
C:\WINDOWS\system32\dssec.dll 52736 bytes executable
C:\WINDOWS\system32\dssenh.dll 137216 bytes executable
C:\WINDOWS\system32\dsuiext.dll 113664 bytes executable
C:\WINDOWS\system32\feclient.dll 21504 bytes executable
C:\WINDOWS\system32\filemgmt.dll 348160 bytes executable
C:\WINDOWS\system32\find.exe 9216 bytes executable
C:\WINDOWS\system32\findstr.exe 29184 bytes executable
C:\WINDOWS\system32\finger.exe 10240 bytes executable
C:\WINDOWS\system32\firewall.cpl 80384 bytes executable
C:\WINDOWS\system32\fixmapi.exe 3072 bytes executable
C:\WINDOWS\system32\fldrclnr.dll 88064 bytes executable
C:\WINDOWS\system32\fltlib.dll 16896 bytes executable
C:\WINDOWS\system32\fltmc.exe 23040 bytes executable
C:\WINDOWS\system32\fmifs.dll 16384 bytes executable
C:\WINDOWS\system32\FNTCACHE.DAT 482720 bytes
C:\WINDOWS\system32\fontext.dll 386560 bytes executable
C:\WINDOWS\system32\fontsub.dll 80896 bytes executable
C:\WINDOWS\system32\fontview.exe 21504 bytes executable
C:\WINDOWS\system32\forcedos.exe 7168 bytes executable
C:\WINDOWS\system32\format.com 25600 bytes executable
C:\WINDOWS\system32\fr-fr
C:\WINDOWS\system32\framebuf.dll 9344 bytes executable
C:\WINDOWS\system32\freecell.exe 55808 bytes executable
C:\WINDOWS\system32\fsmgmt.msc 32409 bytes
C:\WINDOWS\system32\fsquirt.exe 193024 bytes executable
C:\WINDOWS\system32\fsusd.dll 81920 bytes executable
C:\WINDOWS\system32\npptools.dll 55296 bytes executable
C:\WINDOWS\system32\npqss.ini 256421 bytes
C:\WINDOWS\system32\nscompat.tlb 23392 bytes
C:\WINDOWS\system32\nslookup.exe 79360 bytes executable
C:\WINDOWS\system32\ntbackup.chm 79238 bytes
C:\WINDOWS\system32\ntbackup.exe 1166336 bytes executable
C:\WINDOWS\system32\ntbackup.hlp 68824 bytes
C:\WINDOWS\system32\ntdll.dll 733184 bytes executable
C:\WINDOWS\system32\ntdos.sys 27916 bytes
C:\WINDOWS\system32\ntdos404.sys 29146 bytes
C:\WINDOWS\system32\ntdos411.sys 29370 bytes
C:\WINDOWS\system32\ntdos412.sys 29274 bytes
C:\WINDOWS\system32\ntdos804.sys 29146 bytes
C:\WINDOWS\system32\ntdsapi.dll 67072 bytes executable
C:\WINDOWS\system32\ntimage.gif 48794 bytes
C:\WINDOWS\system32\ntio.sys 34000 bytes
C:\WINDOWS\system32\ntio404.sys 34560 bytes
C:\WINDOWS\system32\ntio411.sys 35648 bytes
C:\WINDOWS\system32\ntio412.sys 35424 bytes
C:\WINDOWS\system32\ntio804.sys 34560 bytes
C:\WINDOWS\system32\ntkrnlpa.exe 2059648 bytes executable
C:\WINDOWS\system32\ntlanman.dll 43520 bytes executable
C:\WINDOWS\system32\ntlanui.dll 59392 bytes executable
C:\WINDOWS\system32\ntlanui2.dll 14848 bytes executable
C:\WINDOWS\system32\iprtprio.dll 4096 bytes executable
C:\WINDOWS\system32\iprtrmgr.dll 169984 bytes executable
C:\WINDOWS\system32\ipsec6.exe 46080 bytes executable
C:\WINDOWS\system32\ipsecsnp.dll 361472 bytes executable
C:\WINDOWS\system32\ipsecsvc.dll 184320 bytes executable
C:\WINDOWS\system32\ipsink.ax 16384 bytes executable
C:\WINDOWS\system32\ipsmsnap.dll 388096 bytes executable
C:\WINDOWS\system32\ipv6.exe 53760 bytes executable
C:\WINDOWS\system32\ipv6mon.dll 59904 bytes executable
C:\WINDOWS\system32\ipxmontr.dll 91648 bytes executable
C:\WINDOWS\system32\ipxpromn.dll 74240 bytes executable
C:\WINDOWS\system32\ipxrip.dll 21504 bytes executable
C:\WINDOWS\system32\ipxroute.exe 24576 bytes executable
C:\WINDOWS\system32\ipxrtmgr.dll 39936 bytes executable
C:\WINDOWS\system32\ipxsap.dll 66560 bytes executable
C:\WINDOWS\system32\ipxwan.dll 20992 bytes executable
C:\WINDOWS\system32\ir32_32.dll 199168 bytes executable
C:\WINDOWS\system32\ir41_32.ax 848384 bytes executable
C:\WINDOWS\system32\ir41_32.dll 756736 bytes executable
C:\WINDOWS\system32\ir41_qc.dll 120320 bytes executable
C:\WINDOWS\system32\kbd101.dll 6144 bytes executable
C:\WINDOWS\system32\kbd101a.dll 6144 bytes executable
C:\WINDOWS\system32\kbd101b.dll 6144 bytes executable
C:\WINDOWS\system32\kbd101c.dll 6144 bytes executable
C:\WINDOWS\system32\kbd103.dll 5632 bytes executable
C:\WINDOWS\system32\kbd106.dll 6144 bytes executable
C:\WINDOWS\system32\kbd106n.dll 6144 bytes executable
C:\WINDOWS\system32\KBDAL.DLL 6656 bytes executable
C:\WINDOWS\system32\kbdax2.dll 6144 bytes executable
C:\WINDOWS\system32\kbdaze.dll 5632 bytes executable
C:\WINDOWS\system32\kbdazel.dll 5632 bytes executable
C:\WINDOWS\system32\kbdbe.dll 6144 bytes executable
C:\WINDOWS\system32\kbdbene.dll 6144 bytes executable
C:\WINDOWS\system32\kbdblr.dll 5632 bytes executable
C:\WINDOWS\system32\kbdbr.dll 6144 bytes executable
C:\WINDOWS\system32\kbdbu.dll 5632 bytes executable
C:\WINDOWS\system32\kbdca.dll 6144 bytes executable
C:\WINDOWS\system32\kbdcan.dll 7680 bytes executable
C:\WINDOWS\system32\kbdcr.dll 6656 bytes executable
C:\WINDOWS\system32\kbdcz.dll 7168 bytes executable
C:\WINDOWS\system32\kbdcz1.dll 6656 bytes executable
C:\WINDOWS\system32\kbdcz2.dll 6656 bytes executable
C:\WINDOWS\system32\kbdda.dll 6144 bytes executable
C:\WINDOWS\system32\kbddv.dll 5120 bytes executable
C:\WINDOWS\system32\kbdes.dll 6144 bytes executable
C:\WINDOWS\system32\kbdest.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfc.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfi.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfi1.dll 7168 bytes executable
C:\WINDOWS\system32\kbdfo.dll 6144 bytes executable
C:\WINDOWS\system32\kbdfr.dll 6144 bytes executable
C:\WINDOWS\system32\kbdlk41a.dll 6656 bytes executable
C:\WINDOWS\system32\kbdlk41j.dll 6144 bytes executable
C:\WINDOWS\system32\kbdlt.dll 5632 bytes executable
C:\WINDOWS\system32\kbdlt1.dll 5632 bytes executable
C:\WINDOWS\system32\kbdlv.dll 6144 bytes executable
C:\WINDOWS\system32\kbdlv1.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmac.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmaori.dll 5632 bytes executable
C:\WINDOWS\system32\kbdmlt47.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmlt48.dll 6144 bytes executable
C:\WINDOWS\system32\kbdmon.dll 5632 bytes executable
C:\WINDOWS\system32\kbdne.dll 6144 bytes executable
C:\WINDOWS\system32\kbdnec.dll 7168 bytes executable
C:\WINDOWS\system32\kbdnec95.dll 7168 bytes executable
C:\WINDOWS\system32\kbdnecAT.dll 9216 bytes executable
C:\WINDOWS\system32\kbdnecNT.dll 7680 bytes executable
C:\WINDOWS\system32\kbdno.dll 6144 bytes executable
C:\WINDOWS\system32\kbdno1.dll 7168 bytes executable
C:\WINDOWS\system32\kbdpl.dll 6656 bytes executable
C:\WINDOWS\system32\LAPRXY.dll 11264 bytes executable
C:\WINDOWS\system32\lcphrase.tbl 211938 bytes
C:\WINDOWS\system32\lcptr.tbl 24114 bytes
C:\WINDOWS\system32\LegitCheckControl.dll 1476992 bytes executable
C:\WINDOWS\system32\lfbmp10N.dll 34304 bytes executable
C:\WINDOWS\system32\lfbmp13n.dll 57344 bytes executable
C:\WINDOWS\system32\LFBMP62N.DLL 22016 bytes executable
C:\WINDOWS\system32\LFCMP10N.DLL 266752 bytes executable
C:\WINDOWS\system32\lfcmp13n.dll 401408 bytes executable
C:\WINDOWS\system32\LFCMP62N.DLL 158720 bytes executable
C:\WINDOWS\system32\lffax10N.dll 77824 bytes executable
C:\WINDOWS\system32\lffax13n.dll 98304 bytes executable
C:\WINDOWS\system32\lfgif13n.dll 69632 bytes executable
C:\WINDOWS\system32\lfpng13n.dll 159744 bytes executable
C:\WINDOWS\system32\lftif10N.dll 122368 bytes executable
C:\WINDOWS\system32\lftif13n.dll 155648 bytes executable
C:\WINDOWS\system32\lhacm.acm 34064 bytes executable
C:\WINDOWS\system32\libdivx.dll 1044480 bytes executable
C:\WINDOWS\system32\licdll.dll 424960 bytes executable
C:\WINDOWS\system32\licmgr10.dll 22528 bytes executable
C:\WINDOWS\system32\licwmi.dll 58880 bytes executable
C:\WINDOWS\system32\mciavi32.dll 85504 bytes executable
C:\WINDOWS\system32\mcicda.dll 17408 bytes executable
C:\WINDOWS\system32\mciole16.dll 8192 bytes
C:\WINDOWS\system32\mciole32.dll 7680 bytes executable
C:\WINDOWS\system32\mciqtz32.dll 35328 bytes executable
C:\WINDOWS\system32\mciseq.dll 23040 bytes executable
C:\WINDOWS\system32\mciseq.drv 25280 bytes
C:\WINDOWS\system32\mciwave.dll 23552 bytes executable
C:\WINDOWS\system32\mciwave.drv 28160 bytes
C:\WINDOWS\system32\mcoinstall.exe 28672 bytes executable
C:\WINDOWS\system32\mdaccore.rsp 228 bytes
C:\WINDOWS\system32\mdhcp.dll 50176 bytes executable
C:\WINDOWS\system32\mdminst.dll 120320 bytes executable
C:\WINDOWS\system32\mdwmdmsp.dll 147968 bytes executable
C:\WINDOWS\system32\mem.exe 39434 bytes
C:\WINDOWS\system32\mf3216.dll 40960 bytes executable
C:\WINDOWS\system32\mfc40.dll 924432 bytes executable
C:\WINDOWS\system32\mfc40loc.dll 45568 bytes executable
C:\WINDOWS\system32\mfc40u.dll 927504 bytes executable
C:\WINDOWS\system32\mfc42.dll 1028096 bytes executable
C:\WINDOWS\system32\mmutilse.dll 119808 bytes executable
C:\WINDOWS\system32\mnmdd.dll 34560 bytes executable
C:\WINDOWS\system32\mnmsrvc.exe 32768 bytes executable
C:\WINDOWS\system32\mobsync.dll 210432 bytes executable
C:\WINDOWS\system32\mobsync.exe 144384 bytes executable
C:\WINDOWS\system32\mode.com 19456 bytes executable
C:\WINDOWS\system32\modemui.dll 156160 bytes executable
C:\WINDOWS\system32\modex.dll 10112 bytes executable
C:\WINDOWS\system32\more.com 15872 bytes executable
C:\WINDOWS\system32\moricons.dll 216064 bytes executable
C:\WINDOWS\system32\mountvol.exe 8192 bytes executable
C:\WINDOWS\system32\mouse.drv 2032 bytes
C:\WINDOWS\system32\MP43DECD.dll 259072 bytes executable
C:\WINDOWS\system32\MP43DMOD.dll 4096 bytes executable
C:\WINDOWS\system32\MP4SDECD.dll 317440 bytes executable
C:\WINDOWS\system32\MP4SDMOD.dll 4096 bytes executable
C:\WINDOWS\system32\mpeg2data.ax 118272 bytes executable
C:\WINDOWS\system32\mpg2splt.ax 148992 bytes executable
C:\WINDOWS\system32\MPG4DECD.dll 259072 bytes executable
C:\WINDOWS\system32\MPG4DMOD.dll 4096 bytes executable
C:\WINDOWS\system32\mpg4ds32.ax 262144 bytes executable
C:\WINDOWS\system32\mplay32.exe 124928 bytes executable
C:\WINDOWS\system32\mpnotify.exe 22016 bytes executable
C:\WINDOWS\system32\mpr.dll 59904 bytes executable
C:\WINDOWS\system32\mprapi.dll 87040 bytes executable
C:\WINDOWS\system32\mprddm.dll 69120 bytes executable
C:\WINDOWS\system32\mprdim.dll 49152 bytes executable
C:\WINDOWS\system32\msexch35.dll 344064 bytes executable
C:\WINDOWS\system32\msexch40.dll 512029 bytes executable
C:\WINDOWS\system32\msexcl35.dll 252688 bytes executable
C:\WINDOWS\system32\msexcl40.dll 319517 bytes executable
C:\WINDOWS\system32\MSFLXGRD.OCX 200976 bytes executable
C:\WINDOWS\system32\msftedit.dll 539136 bytes executable
C:\WINDOWS\system32\msg.exe 22528 bytes executable
C:\WINDOWS\system32\msg711.acm 9216 bytes executable
C:\WINDOWS\system32\msg723.acm 118784 bytes executable
C:\WINDOWS\system32\msgina.dll 1004032 bytes executable
C:\WINDOWS\system32\msgsm32.acm 19968 bytes executable
C:\WINDOWS\system32\msgsvc.dll 33792 bytes executable
C:\WINDOWS\system32\msh261.drv 188416 bytes executable
C:\WINDOWS\system32\msh263.drv 294912 bytes executable
C:\WINDOWS\system32\msyuv.dll 17408 bytes executable
C:\WINDOWS\system32\mtxclu.dll 66560 bytes executable
C:\WINDOWS\system32\mtxdm.dll 20480 bytes executable
C:\WINDOWS\system32\mtxex.dll 4096 bytes executable
C:\WINDOWS\system32\mtxlegih.dll 25088 bytes executable
C:\WINDOWS\system32\mtxoci.dll 91136 bytes executable
C:\WINDOWS\system32\mucltui.dll 271224 bytes executable
C:\WINDOWS\system32\mucltui.dll.mui 30072 bytes executable
C:\WINDOWS\system32\mui
C:\WINDOWS\system32\muweb.dll 207736 bytes executable
C:\WINDOWS\system32\muzika.xm 50492 bytes
C:\WINDOWS\system32\ole2disp.dll 169520 bytes
C:\WINDOWS\system32\ole2nls.dll 153008 bytes
C:\WINDOWS\system32\ole32.dll 1284608 bytes executable
C:\WINDOWS\system32\oleacc.dll 163328 bytes executable
C:\WINDOWS\system32\oleaccrc.dll 18944 bytes executable
C:\WINDOWS\system32\Oleaut32.1 490256 bytes executable
C:\WINDOWS\system32\oleaut32.dll 549376 bytes executable
C:\WINDOWS\system32\olecli.dll 83456 bytes
C:\WINDOWS\system32\olecli32.dll 75264 bytes executable
C:\WINDOWS\system32\olecnv32.dll 37888 bytes executable
C:\WINDOWS\system32\oledlg.dll 124928 bytes executable
C:\WINDOWS\system32\oleprn.dll 110592 bytes executable
C:\WINDOWS\system32\olepro32.dll 83456 bytes executable
C:\WINDOWS\system32\olesvr.dll 24064 bytes
C:\WINDOWS\system32\olesvr32.dll 22016 bytes executable
C:\WINDOWS\system32\olethk32.dll 69120 bytes executable
C:\WINDOWS\system32\Omcamext.ax 38925 bytes executable
C:\WINDOWS\system32\omcamext.dll 53248 bytes executable
C:\WINDOWS\system32\omcamsti.dll 36864 bytes executable
C:\WINDOWS\system32\OmCamUSD.dll 16452 bytes executable
C:\WINDOWS\system32\oobe
C:\WINDOWS\system32\OoneZipPopup.dll 452608 bytes executable
C:\WINDOWS\system32\OoPdfManagerPopup.dll 587776 bytes executable
C:\WINDOWS\system32\opengl32.dll 713728 bytes executable
C:\WINDOWS\system32\osk.exe 216576 bytes executable
C:\WINDOWS\system32\osuninst.dll 68096 bytes executable
C:\WINDOWS\system32\perfd00C.dat 34108 bytes
C:\WINDOWS\system32\perfdisk.dll 27136 bytes executable
C:\WINDOWS\system32\perffilt.h 140 bytes
C:\WINDOWS\system32\perffilt.ini 1293 bytes
C:\WINDOWS\system32\perfh009.dat 382026 bytes
C:\WINDOWS\system32\perfh00C.dat 447222 bytes
C:\WINDOWS\system32\perfi009.dat 272128 bytes
C:\WINDOWS\system32\perfi00C.dat 322810 bytes
C:\WINDOWS\system32\perfmon.exe 15872 bytes executable
C:\WINDOWS\system32\perfmon.msc 57862 bytes
C:\WINDOWS\system32\perfnet.dll 17408 bytes executable
C:\WINDOWS\system32\perfos.dll 26624 bytes executable
C:\WINDOWS\system32\perfproc.dll 35840 bytes executable
C:\WINDOWS\system32\PerfStringBackup.INI 956332 bytes
C:\WINDOWS\system32\perfts.dll 12288 bytes executable
C:\WINDOWS\system32\perfwci.h 435 bytes
C:\WINDOWS\system32\perfwci.ini 2994 bytes
C:\WINDOWS\system32\PfModNT.sys 6752 bytes executable
C:\WINDOWS\system32\phon.ime 79360 bytes executable
C:\WINDOWS\system32\phon.tbl 4071 bytes
C:\WINDOWS\system32\phoncode.tbl 43242 bytes
C:\WINDOWS\system32\phonptr.tbl 2714 bytes
C:\WINDOWS\system32\photowiz.dll 172032 bytes executable
C:\WINDOWS\system32\picn20.dll 38912 bytes executable
C:\WINDOWS\system32\pid.dll 35328 bytes executable
C:\WINDOWS\system32\pschdprf.ini 14073 bytes
C:\WINDOWS\system32\pscript.sep 51 bytes
C:\WINDOWS\system32\PSIKey.dll 1335296 bytes executable
C:\WINDOWS\system32\psnppagn.dll 8192 bytes executable
C:\WINDOWS\system32\pstorec.dll 43520 bytes executable
C:\WINDOWS\system32\pstorsvc.dll 34304 bytes executable
C:\WINDOWS\system32\PTxSCP.ocx 1206272 bytes executable
C:\WINDOWS\system32\pubprn.vbs 3862 bytes
C:\WINDOWS\system32\px.dll 514808 bytes executable
C:\WINDOWS\system32\pxafs.dll 129784 bytes executable
C:\WINDOWS\system32\pxcpya64.exe 63144 bytes executable
C:\WINDOWS\system32\pxcpyi64.exe 108544 bytes executable
C:\WINDOWS\system32\pxdrv.dll 477944 bytes executable
C:\WINDOWS\system32\pxhpinst.exe 67240 bytes executable
C:\WINDOWS\system32\pxinsa64.exe 62632 bytes executable
C:\WINDOWS\system32\pxinsi64.exe 115880 bytes executable
C:\WINDOWS\system32\pxmas.dll 183032 bytes executable
C:\WINDOWS\system32\pxsfs.dll 1309432 bytes executable
C:\WINDOWS\system32\pxwave.dll 379640 bytes executable
C:\WINDOWS\system32\pxwma.dll 151552 bytes executable
C:\WINDOWS\system32\qappsrv.exe 17408 bytes executable
C:\WINDOWS\system32\qasf.dll 211456 bytes executable
C:\WINDOWS\system32\qcap.dll 192512 bytes executable
C:\WINDOWS\system32\qdv.dll 279040 bytes executable
C:\WINDOWS\system32\qdvd.dll 386048 bytes executable
C:\WINDOWS\system32\qedit.dll 563200 bytes executable
C:\WINDOWS\system32\qedwipes.dll 733696 bytes executable
C:\WINDOWS\system32\qmgr.dll 382464 bytes executable
C:\WINDOWS\system32\qmgrprxy.dll 18944 bytes executable
C:\WINDOWS\system32\qosname.dll 8192 bytes executable
C:\WINDOWS\system32\replace.exe 12800 bytes executable
C:\WINDOWS\system32\reset.exe 10240 bytes executable
C:\WINDOWS\system32\Restore
C:\WINDOWS\system32\resutils.dll 58880 bytes executable
C:\WINDOWS\system32\ReWire.dll 225280 bytes executable
C:\WINDOWS\system32\rexec.exe 14848 bytes executable
C:\WINDOWS\system32\riched20.dll 433152 bytes executable
C:\WINDOWS\system32\riched32.dll 3584 bytes executable
C:\WINDOWS\system32\RICHTEXT.SRG 111 bytes
C:\WINDOWS\system32\RICHTX32.DEP 3010 bytes
C:\WINDOWS\system32\RICHTX32.oca 64000 bytes executable
C:\WINDOWS\system32\RICHTX32.OCX 260096 bytes executable
C:\WINDOWS\system32\RLOgg.ax 186880 bytes executable
C:\WINDOWS\system32\RLSpeexDec.ax 51712 bytes executable
C:\WINDOWS\system32\RLTheoraDec.ax 67584 bytes executable
C:\WINDOWS\system32\scarddlg.dll 71168 bytes executable
C:\WINDOWS\system32\scardssp.dll 118784 bytes executable
C:\WINDOWS\system32\scardsvr.exe 100352 bytes executable
C:\WINDOWS\system32\sccbase.dll 169984 bytes executable
C:\WINDOWS\system32\sccsccp.dll 171520 bytes executable
C:\WINDOWS\system32\scecli.dll 186368 bytes executable
C:\WINDOWS\system32\scesrv.dll 328704 bytes executable
C:\WINDOWS\system32\schannel.dll 144896 bytes executable
C:\WINDOWS\system32\schedsvc.dll 193024 bytes executable
C:\WINDOWS\system32\sclgntfy.dll 22016 bytes executable
C:\WINDOWS\system32\scofr.dll 24624 bytes executable
C:\WINDOWS\system32\scredir.dll 26624 bytes executable
C:\WINDOWS\system32\scrnsave.scr 9216 bytes executable
C:\WINDOWS\system32\scrobj.dll 159744 bytes executable
C:\WINDOWS\system32\scrrnfr.dll 24626 bytes executable
C:\WINDOWS\system32\scrrun.dll 151552 bytes executable
C:\WINDOWS\system32\SDA
C:\WINDOWS\system32\sdbinst.exe 78848 bytes executable
C:\WINDOWS\system32\sdhcinst.dll 29184 bytes executable
C:\WINDOWS\system32\sl_anet.acm 86016 bytes executable
C:\WINDOWS\system32\Smab.dll 845312 bytes executable
C:\WINDOWS\system32\smbinst.exe 8192 bytes executable
C:\WINDOWS\system32\smlogcfg.dll 370688 bytes executable
C:\WINDOWS\system32\smlogsvc.exe 93184 bytes executable
C:\WINDOWS\system32\smss.exe 50688 bytes executable
C:\WINDOWS\system32\Snap32n.dll 249856 bytes executable
C:\WINDOWS\system32\sndrec32.exe 133120 bytes executable
C:\WINDOWS\system32\sndvol32.exe 139264 bytes executable
C:\WINDOWS\system32\snetcfg.exe 12507 bytes executable
C:\WINDOWS\system32\snmpapi.dll 18944 bytes executable
C:\WINDOWS\system32\snmpsnap.dll 184320 bytes executable
C:\WINDOWS\system32\SNWValid.dll 231936 bytes executable
C:\WINDOWS\system32\Snwvalid.hlp 11104 bytes
C:\WINDOWS\system32\softpub.dll 5632 bytes executable
C:\WINDOWS\system32\SoftwareDistribution
C:\WINDOWS\system32\synceng.dll 57856 bytes executable
C:\WINDOWS\system32\SynCOM.dll 77917 bytes executable
C:\WINDOWS\system32\SynCtrl.dll 114688 bytes executable
C:\WINDOWS\system32\syncui.dll 197120 bytes executable
C:\WINDOWS\system32\SynTPAPI.dll 90202 bytes executable
C:\WINDOWS\system32\SynTPCo2.dll 81920 bytes executable
C:\WINDOWS\system32\SynTPFcs.dll 69722 bytes executable
C:\WINDOWS\system32\sysdm.cpl 305152 bytes executable
C:\WINDOWS\system32\sysedit.exe 19216 bytes
C:\WINDOWS\system32\SysInfoServer.dll 24576 bytes executable
C:\WINDOWS\system32\sysinv.dll 15872 bytes executable
C:\WINDOWS\system32\syskey.exe 37888 bytes executable
C:\WINDOWS\system32\sysmon.ocx 220672 bytes executable
C:\WINDOWS\system32\sysocmgr.exe 107520 bytes executable
C:\WINDOWS\system32\sysprint.sep 3214 bytes
C:\WINDOWS\system32\sysprtj.sep 3577 bytes
C:\WINDOWS\system32\syssetup.dll 1005056 bytes executable
C:\WINDOWS\system32\system.drv 3360 bytes
C:\WINDOWS\system32\systray.exe 3072 bytes executable
C:\WINDOWS\system32\t2embed.dll 118272 bytes executable
C:\WINDOWS\system32\TABCTL32.OCX 209608 bytes executable
C:\WINDOWS\system32\tafysijw.ini 1027788 bytes
C:\WINDOWS\system32\tapi.dll 19200 bytes
C:\WINDOWS\system32\tapi3.dll 860160 bytes executable
C:\WINDOWS\system32\tapi32.dll 181760 bytes executable
C:\WINDOWS\system32\tree.com 11264 bytes executable
C:\WINDOWS\system32\trkwks.dll 90624 bytes executable
C:\WINDOWS\system32\tsappcmp.dll 52224 bytes executable
C:\WINDOWS\system32\tsbyuv.dll 8192 bytes executable
C:\WINDOWS\system32\tscfgwmi.dll 94208 bytes executable
C:\WINDOWS\system32\tscon.exe 15360 bytes executable
C:\WINDOWS\system32\tscupgrd.exe 44544 bytes executable
C:\WINDOWS\system32\tsd32.dll 15360 bytes executable
C:\WINDOWS\system32\tsddd.dll 12168 bytes executable
C:\WINDOWS\system32\tsdiscon.exe 14848 bytes executable
C:\WINDOWS\system32\tskill.exe 16896 bytes executable
C:\WINDOWS\system32\tslabels.h 3286 bytes
C:\WINDOWS\system32\tslabels.ini 27768 bytes
C:\WINDOWS\system32\tsshutdn.exe 17408 bytes executable
C:\WINDOWS\system32\tssoft32.acm 8192 bytes executable
C:\WINDOWS\system32\twext.dll 44032 bytes executable
C:\WINDOWS\system32\TwnLib20.dll 106496 bytes executable
C:\WINDOWS\system32\TwnLib4.dll 364544 bytes executable
C:\WINDOWS\system32\version.dll 18944 bytes executable
C:\WINDOWS\system32\VFind.exe 49152 bytes executable
C:\WINDOWS\system32\vfpodbc.dll 20535 bytes executable
C:\WINDOWS\system32\vfwwdm32.dll 54784 bytes executable
C:\WINDOWS\system32\vga.dll 9344 bytes executable
C:\WINDOWS\system32\vga.drv 2176 bytes
C:\WINDOWS\system32\vga256.dll 51456 bytes executable
C:\WINDOWS\system32\vga64k.dll 18176 bytes executable
C:\WINDOWS\system32\VGAunistlog.ini 165 bytes
C:\WINDOWS\system32\vidcap.ax 28672 bytes executable
C:\WINDOWS\system32\VisualSoftCrypt.dll 275968 bytes executable
C:\WINDOWS\system32\vjoy.dll 4608 bytes executable
C:\WINDOWS\system32\vmhelper.dll 286992 bytes executable
C:\WINDOWS\system32\VModes.exe 40960 bytes executable
C:\WINDOWS\system32\vp6vfw.dll 442368 bytes executable
C:\WINDOWS\system32\Vsflex7L.ocx 419488 bytes executable
C:\WINDOWS\system32\vssadmin.exe 34304 bytes executable
C:\WINDOWS\system32\vssapi.dll 430592 bytes executable
C:\WINDOWS\system32\vssvc.exe 295424 bytes executable
C:\WINDOWS\system32\wbdbase.ita 867840 bytes
C:\WINDOWS\system32\wbdbase.nld 1095680 bytes
C:\WINDOWS\system32\wbdbase.sve 937984 bytes
C:\WINDOWS\system32\wbem
C:\WINDOWS\system32\wbsecdrv.inf 3036 bytes
C:\WINDOWS\system32\wbsecdrv.sys 17664 bytes executable
C:\WINDOWS\system32\wbsecsvc.exe 241664 bytes executable
C:\WINDOWS\system32\wdfapi.dll 4096 bytes executable
C:\WINDOWS\system32\wdfmgr.exe 8704 bytes executable
C:\WINDOWS\system32\wdigest.dll 49152 bytes executable
C:\WINDOWS\system32\wdl.trm 4096 bytes
C:\WINDOWS\system32\wdmaud.drv 23552 bytes executable
C:\WINDOWS\system32\webc3dsx(2).ax 50718 bytes executable
C:\WINDOWS\system32\webc3dsx(3).ax 50718 bytes executable
C:\WINDOWS\system32\webc3dsx.ax 50718 bytes executable
C:\WINDOWS\system32\webc3ext.dll 49152 bytes executable
C:\WINDOWS\system32\usrfaxa.dll 86073 bytes executable
C:\WINDOWS\system32\usrlbva.dll 53305 bytes executable
C:\WINDOWS\system32\usrlogon.cmd 1263 bytes
C:\WINDOWS\system32\usrmlnka.exe 77891 bytes executable
C:\WINDOWS\system32\usrprbda.exe 61508 bytes executable
C:\WINDOWS\system32\usrrtosa.dll 77883 bytes executable
C:\WINDOWS\system32\usrsdpia.dll 49211 bytes executable
C:\WINDOWS\system32\usrshuta.exe 69700 bytes executable
C:\WINDOWS\system32\usrsvpia.dll 41019 bytes executable
C:\WINDOWS\system32\usrv42a.dll 102457 bytes executable
C:\WINDOWS\system32\usrv80a.dll 49209 bytes executable
C:\WINDOWS\system32\usrvoica.dll 45116 bytes executable
C:\WINDOWS\system32\usrvpa.dll 49211 bytes executable
C:\WINDOWS\system32\utildll.dll 26112 bytes executable
C:\WINDOWS\system32\utilman.exe 50176 bytes executable
C:\WINDOWS\system32\uwdf.exe 8704 bytes executable
C:\WINDOWS\system32\uxtheme.dll 219648 bytes executable
C:\WINDOWS\system32\v7vga.rom 18832 bytes
C:\WINDOWS\system32\comm.drv 10544 bytes
C:\WINDOWS\system32\command.com 52103 bytes
C:\WINDOWS\system32\commdlg.dll 33904 bytes
C:\WINDOWS\system32\comp.exe 15872 bytes executable
C:\WINDOWS\system32\compact.exe 18432 bytes executable
C:\WINDOWS\system32\compatUI.dll 253440 bytes executable
C:\WINDOWS\system32\compmgmt.msc 37357 bytes
C:\WINDOWS\system32\compobj.dll 30160 bytes
C:\WINDOWS\system32\compstui.dll 230912 bytes executable
C:\WINDOWS\system32\comrepl.dll 97792 bytes executable
C:\WINDOWS\system32\comres.dll 851968 bytes executable
C:\WINDOWS\system32\comsnap.dll 147456 bytes executable
C:\WINDOWS\system32\comsvcs.dll 1267200 bytes executable
C:\WINDOWS\system32\comuid.dll 540160 bytes executable
C:\WINDOWS\system32\config
C:\WINDOWS\system32\CONFIG.NT 3072 bytes
C:\WINDOWS\system32\CONFIG.TMP 3072 bytes
C:\WINDOWS\system32\confmsp.dll 346112 bytes executable
C:\WINDOWS\system32\conime.exe 27648 bytes executable
C:\WINDOWS\system32\console.dll 67072 bytes executable
C:\WINDOWS\system32\control.exe 8192 bytes executable
C:\WINDOWS\system32\convert.exe 13824 bytes executable
C:\WINDOWS\system32\corpol.dll 35328 bytes executable
C:\WINDOWS\system32\country.sys 27097 bytes
C:\WINDOWS\system32\cppenv25.dll 27648 bytes executable
C:\WINDOWS\system32\winscard.dll 100352 bytes executable
C:\WINDOWS\system32\winshfhc.dll 17408 bytes executable
C:\WINDOWS\system32\WINSIZE.DLL 4080 bytes
C:\WINDOWS\system32\winsock.dll 2864 bytes
C:\WINDOWS\system32\WINSP.IME 156672 bytes executable
C:\WINDOWS\system32\WINSP.MB 1564868 bytes
C:\WINDOWS\system32\winspool.drv 146944 bytes executable
C:\WINDOWS\system32\winspool.exe 2112 bytes
C:\WINDOWS\system32\winsrv.dll 293376 bytes executable
C:\WINDOWS\system32\winsta.dll 53760 bytes executable
C:\WINDOWS\system32\winstrm.dll 21504 bytes executable
C:\WINDOWS\system32\wintrust.dll 176640 bytes executable
C:\WINDOWS\system32\winver.exe 5632 bytes executable
C:\WINDOWS\system32\WINZM.IME 156672 bytes executable
C:\WINDOWS\system32\WINZM.MB 1223500 bytes
C:\WINDOWS\system32\wisptis.exe 194560 bytes executable
C:\WINDOWS\system32\wjview.exe 171792 bytes executable
C:\WINDOWS\system32\wkssvc.dll 132096 bytes executable
C:\WINDOWS\system32\WLANUTL.dll 106496 bytes executable
C:\WINDOWS\system32\wldap32.dll 172544 bytes executable
C:\WINDOWS\system32\wlnotify.dll 94208 bytes executable
C:\WINDOWS\system32\wmadmod.dll 757248 bytes executable
C:\WINDOWS\system32\WMADMOE.dll 1117696 bytes executable
C:\WINDOWS\system32\wmasf.dll 222208 bytes executable
C:\WINDOWS\system32\wmaudsdk.dll 163600 bytes executable
C:\WINDOWS\system32\wmdmlog.dll 33792 bytes executable
C:\WINDOWS\system32\wmdmps.dll 37376 bytes executable
C:\WINDOWS\system32\wmdrmdev.dll 429056 bytes executable
C:\WINDOWS\system32\wmdrmnet.dll 348672 bytes executable
C:\WINDOWS\system32\wmdrmsdk.dll 535040 bytes executable
C:\WINDOWS\system32\mssip32.dll 4608 bytes executable
C:\WINDOWS\system32\msstdfmt.dll 118784 bytes executable
C:\WINDOWS\system32\msstkprp.dll 94208 bytes executable
C:\WINDOWS\system32\msswch.dll 13312 bytes executable
C:\WINDOWS\system32\msswchx.exe 6656 bytes executable
C:\WINDOWS\system32\mstask.dll 281600 bytes executable
C:\WINDOWS\system32\mstext35.dll 166672 bytes executable
C:\WINDOWS\system32\mstext40.dll 258077 bytes executable
C:\WINDOWS\system32\mstime.dll 532480 bytes executable
C:\WINDOWS\system32\mstinit.exe 12288 bytes executable
C:\WINDOWS\system32\mstlsapi.dll 115712 bytes executable
C:\WINDOWS\system32\mstsc.exe 411648 bytes executable
C:\WINDOWS\system32\mstscax.dll 655360 bytes executable
C:\WINDOWS\system32\msutb.dll 195584 bytes executable
C:\WINDOWS\system32\msv1_0.dll 129536 bytes executable
C:\WINDOWS\system32\msvbvm50.dll 1355776 bytes executable
C:\WINDOWS\system32\MSVBVM60.DLL 1386496 bytes executable
C:\WINDOWS\system32\msvci70.dll 54784 bytes executable
C:\WINDOWS\system32\msvcirt.dll 54784 bytes executable
C:\WINDOWS\system32\msvcp50.dll 565760 bytes executable
C:\WINDOWS\system32\msvcp60.dll 413696 bytes executable
C:\WINDOWS\system32\msvcp70.dll 487424 bytes executable
C:\WINDOWS\system32\msvcp71.dll 499712 bytes executable
C:\WINDOWS\system32\msvcr70.dll 344064 bytes executable
C:\WINDOWS\system32\msvcr71.dll 348160 bytes executable
C:\WINDOWS\system32\msvcrt.dll 343040 bytes executable
C:\WINDOWS\system32\MSVCRT10.DLL 210944 bytes executable
C:\WINDOWS\system32\setup.exe 23040 bytes executable
C:\WINDOWS\system32\setupapi.dll 1003520 bytes executable
C:\WINDOWS\system32\setupdll.dll 421376 bytes executable
C:\WINDOWS\system32\setver.exe 12067 bytes
C:\WINDOWS\system32\sfc.dll 5120 bytes executable
C:\WINDOWS\system32\sfc.exe 10240 bytes executable
C:\WINDOWS\system32\sfcfiles.dll 1548288 bytes executable
C:\WINDOWS\system32\sfc_os.dll 142336 bytes executable
C:\WINDOWS\system32\sfmapi.dll 23552 bytes executable
C:\WINDOWS\system32\sfxbe321.dll 73216 bytes executable
C:\WINDOWS\system32\sfxbe322.dll 77312 bytes executable
C:\WINDOWS\system32\sfxbe323.dll 74240 bytes executable
C:\WINDOWS\system32\sfxbe324.dll 78336 bytes executable
C:\WINDOWS\system32\sfxfe32.exe 53760 bytes executable
C:\WINDOWS\system32\sfxfe321.exe 58368 bytes executable
C:\WINDOWS\system32\shadow.exe 15360 bytes executable
C:\WINDOWS\system32\share.exe 882 bytes
C:\WINDOWS\system32\shdoclc.dll 572416 bytes executable
C:\WINDOWS\system32\shdocvw.bak 1483776 bytes executable
C:\WINDOWS\system32\shdocvw.dll 1498624 bytes executable
C:\WINDOWS\system32\shell.dll 5120 bytes
C:\WINDOWS\system32\shell32.dll 8509952 bytes executable
C:\WINDOWS\system32\ShellDHCP
C:\WINDOWS\system32\ShellExt
C:\WINDOWS\system32\shellstyle.dll 435712 bytes executable
C:\WINDOWS\system32\shfolder.dll 25088 bytes executable
C:\WINDOWS\system32\dfrg.msc 41131 bytes
C:\WINDOWS\system32\dfrgfat.exe 82432 bytes executable
C:\WINDOWS\system32\dfrgntfs.exe 104960 bytes executable
C:\WINDOWS\system32\dfrgres.dll 55808 bytes executable
C:\WINDOWS\system32\dfrgsnap.dll 39424 bytes executable
C:\WINDOWS\system32\dfrgui.dll 123904 bytes executable
C:\WINDOWS\system32\dfsshlex.dll 28672 bytes executable
C:\WINDOWS\system32\dgnet.dll 115200 bytes executable
C:\WINDOWS\system32\dgrpsetu.dll 176157 bytes executable
C:\WINDOWS\system32\dgsetup.dll 86044 bytes executable
C:\WINDOWS\system32\dhcp
C:\WINDOWS\system32\dhcpcsvc.dll 112128 bytes executable
C:\WINDOWS\system32\dhcpmon.dll 401408 bytes executable
C:\WINDOWS\system32\dhcpsapi.dll 78848 bytes executable
C:\WINDOWS\system32\diactfrm.dll 395264 bytes executable
C:\WINDOWS\system32\diantz.exe 85504 bytes executable
C:\WINDOWS\system32\digest.dll 68608 bytes executable
C:\WINDOWS\system32\dimap.dll 44032 bytes executable
C:\WINDOWS\system32\dinput.dll 165376 bytes executable
C:\WINDOWS\system32\dinput8.dll 187904 bytes executable
C:\WINDOWS\system32\DiracSplitter.ax 179200 bytes executable
C:\WINDOWS\system32\DirectX
C:\WINDOWS\system32\diskcomp.com 9216 bytes executable
C:\WINDOWS\system32\diskcopy.com 7168 bytes executable
C:\WINDOWS\system32\diskcopy.dll 1502208 bytes executable
C:\WINDOWS\system32\diskmgmt.msc 33311 bytes
C:\WINDOWS\system32\diskpart.exe 167936 bytes executable
C:\WINDOWS\system32\diskperf.exe 19456 bytes executable
C:\WINDOWS\system32\dmusic.dll 104448 bytes executable
C:\WINDOWS\system32\dmutil.dll 58880 bytes executable
C:\WINDOWS\system32\dmview.ocx 61440 bytes executable
C:\WINDOWS\system32\dnsapi.dll 148480 bytes executable
C:\WINDOWS\system32\dnsrslvr.dll 45568 bytes executable
C:\WINDOWS\system32\docprop.dll 47616 bytes executable
C:\WINDOWS\system32\docprop2.dll 48640 bytes executable
C:\WINDOWS\system32\doskey.exe 10752 bytes executable
C:\WINDOWS\system32\dosx.exe 54080 bytes
C:\WINDOWS\system32\dpcdll.dll 97792 bytes executable
C:\WINDOWS\system32\dplay.dll 33040 bytes executable
C:\WINDOWS\system32\dplaysvr.exe 30208 bytes executable
C:\WINDOWS\system32\dplayx.dll 229888 bytes executable
C:\WINDOWS\system32\dpmodemx.dll 24064 bytes executable
C:\WINDOWS\system32\dpnaddr.dll 3584 bytes executable
C:\WINDOWS\system32\dpnet.dll 375296 bytes executable
C:\WINDOWS\system32\dpnhpast.dll 35328 bytes executable
C:\WINDOWS\system32\dpnhupnp.dll 60928 bytes executable
C:\WINDOWS\system32\mprmsg.dll 114688 bytes executable
C:\WINDOWS\system32\mscpx32r.dLL 12288 bytes executable
C:\WINDOWS\system32\msencode.dll 94282 bytes executable
C:\WINDOWS\system32\mshearts.exe 128000 bytes executable
C:\WINDOWS\system32\msjet40.dll 1507356 bytes executable
C:\WINDOWS\system32\mspdox35.dll 250128 bytes executable
C:\WINDOWS\system32\mssign32.dll 36352 bytes executable
C:\WINDOWS\system32\msvcrt20.dll 253952 bytes executable
C:\WINDOWS\system32\msxmlr.dll 30720 bytes executable
C:\WINDOWS\system32\mycomput.dll 90624 bytes executable
C:\WINDOWS\system32\nddenb32.dll 19456 bytes executable
C:\WINDOWS\system32\netrap.dll 12288 bytes executable
C:\WINDOWS\system32\noise.chs 1696 bytes
C:\WINDOWS\system32\npp
C:\WINDOWS\system32\ntlsapi.dll 8192 bytes executable
C:\WINDOWS\system32\objsel.dll 288768 bytes executable
C:\WINDOWS\system32\odbcjt32.dll 278559 bytes executable
C:\WINDOWS\system32\ole2.dll 39744 bytes
C:\WINDOWS\system32\osuninst.exe 41984 bytes executable
C:\WINDOWS\system32\perfd009.dat 28626 bytes
C:\WINDOWS\system32\pidgen.dll 24064 bytes executable
C:\WINDOWS\system32\prcp.nls 83748 bytes
C:\WINDOWS\system32\pschdprf.dll 10752 bytes executable
C:\WINDOWS\system32\qprocess.exe 20992 bytes executable
C:\WINDOWS\system32\rasauto.dll 89088 bytes executable
C:\WINDOWS\system32\rcbdyctl.dll 103424 bytes executable
C:\WINDOWS\system32\rend.dll 107520 bytes executable
C:\WINDOWS\system32\ega.cpi 127213 bytes
C:\WINDOWS\system32\els.dll 187392 bytes executable
C:\WINDOWS\system32\emptyregdb.dat 21892 bytes
C:\WINDOWS\system32\en-US
C:\WINDOWS\system32\encapi.dll 20480 bytes executable
C:\WINDOWS\system32\encdec.dll 186368 bytes executable
C:\WINDOWS\system32\EqnClass.Dll 103424 bytes executable
C:\WINDOWS\system32\ersvc.dll 23040 bytes executable
C:\WINDOWS\system32\es.dll 243200 bytes executable
C:\WINDOWS\system32\esent.dll 1097728 bytes executable
C:\WINDOWS\system32\esent97.dll 1114896 bytes executable
C:\WINDOWS\system32\esentprf.dll 17408 bytes executable
C:\WINDOWS\system32\esentprf.hxx 6708 bytes
C:\WINDOWS\system32\esentprf.ini 1015477 bytes
C:\WINDOWS\system32\esentutl.exe 39424 bytes executable
C:\WINDOWS\system32\ftp.exe 46080 bytes executable
C:\WINDOWS\system32\ftsrch.dll 177152 bytes executable
C:\WINDOWS\system32\netsetup.cpl 25600 bytes executable
C:\WINDOWS\system32\netsetup.exe 332800 bytes executable
C:\WINDOWS\system32\netsh.exe 88576 bytes executable
C:\WINDOWS\system32\netshell.dll 1723904 bytes executable
C:\WINDOWS\system32\netstat.exe 37888 bytes executable
C:\WINDOWS\system32\netui0.dll 83456 bytes executable
C:\WINDOWS\system32\netui1.dll 245760 bytes executable
C:\WINDOWS\system32\netui2.dll 312832 bytes executable
C:\WINDOWS\system32\newdev.dll 251392 bytes executable
C:\WINDOWS\system32\NewmsrdkForKey
C:\WINDOWS\system32\NexPlayerX.dll 561152 bytes executable
C:\WINDOWS\system32\nlhtml.dll 103936 bytes executable
C:\WINDOWS\system32\nlsdl.dll 24576 bytes executable
C:\WINDOWS\system32\nlsfunc.exe 7116 bytes
C:\WINDOWS\system32\nmevtmsg.dll 12288 bytes executable
C:\WINDOWS\system32\nmmkcert.dll 28672 bytes executable
C:\WINDOWS\system32\ie4uinit.exe 34304 bytes executable
C:\WINDOWS\system32\ieakeng.dll 139264 bytes executable
C:\WINDOWS\system32\ieaksie.dll 221696 bytes executable
C:\WINDOWS\system32\ieakui.dll 245760 bytes executable
C:\WINDOWS\system32\iedkcs32.dll 323584 bytes executable
C:\WINDOWS\system32\ieencode.dll 81920 bytes executable
C:\WINDOWS\system32\iepeers.dll 251904 bytes executable
C:\WINDOWS\system32\iernonce.dll 49152 bytes executable
C:\WINDOWS\system32\iesetup.dll 63488 bytes executable
C:\WINDOWS\system32\ieudinit.exe 13824 bytes executable
C:\WINDOWS\system32\ieuinit.inf 46298 bytes
C:\WINDOWS\system32\iexpress.exe 114688 bytes executable
C:\WINDOWS\system32\ifmon.dll 142848 bytes executable
C:\WINDOWS\system32\ifsutil.dll 70656 bytes executable
C:\WINDOWS\system32\igmpagnt.dll 8192 bytes executable
C:\WINDOWS\system32\ijl10.dll 137728 bytes executable
C:\WINDOWS\system32\logonui.exe.manifest 488 bytes
C:\WINDOWS\system32\lpdsvc.dll 23040 bytes executable
C:\WINDOWS\system32\lpk.dll 22016 bytes executable
C:\WINDOWS\system32\lpq.exe 6144 bytes executable
C:\WINDOWS\system32\lpr.exe 9216 bytes executable
C:\WINDOWS\system32\lprhelp.dll 10240 bytes executable
C:\WINDOWS\system32\lprmon.dll 19456 bytes executable
C:\WINDOWS\system32\lprmonui.dll 9216 bytes executable
C:\WINDOWS\system32\lsasrv.dll 728576 bytes executable
C:\WINDOWS\system32\lsass.exe 13312 bytes executable
C:\WINDOWS\system32\ltclr13n.dll 1693696 bytes executable
C:\WINDOWS\system32\LTDIS10N.dll 231424 bytes executable
C:\WINDOWS\system32\ltdis13n.dll 299008 bytes executable
C:\WINDOWS\system32\ltefx10N.dll 221696 bytes executable
C:\WINDOWS\system32\ltefx13n.dll 206336 bytes executable
C:\WINDOWS\system32\ltfil10N.DLL 103424 bytes executable
C:\WINDOWS\system32\ltfil13n.dll 163840 bytes executable
C:\WINDOWS\system32\LTFIL62N.DLL 43008 bytes executable
C:\WINDOWS\system32\ltimg10N.dll 114176 bytes executable
C:\WINDOWS\system32\ltimg13n.dll 450560 bytes executable
C:\WINDOWS\system32\LTIMG62N.DLL 78336 bytes executable
C:\WINDOWS\system32\ltkrn10N.dll 297472 bytes executable
C:\WINDOWS\system32\ltkrn13n.dll 462848 bytes executable
C:\WINDOWS\system32\LTKRN62N.DLL 207872 bytes executable
C:\WINDOWS\system32\LTSCR10N.DLL 142848 bytes executable
C:\WINDOWS\system32\mfc42u.dll 981760 bytes executable
C:\WINDOWS\system32\mfc70.dll 974848 bytes executable
C:\WINDOWS\system32\mfc70u.dll 964608 bytes executable
C:\WINDOWS\system32\mfc71.dll 1060864 bytes executable
C:\WINDOWS\system32\mfc71u.dll 1047552 bytes executable
C:\WINDOWS\system32\mfcsubs.dll 22528 bytes executable
C:\WINDOWS\system32\MFPLAT.dll 212992 bytes executable
C:\WINDOWS\system32\mgmtapi.dll 14848 bytes executable
C:\WINDOWS\system32\mib.bin 46258 bytes
C:\WINDOWS\system32\Microsoft
C:\WINDOWS\system32\midimap.dll 18944 bytes executable
C:\WINDOWS\system32\miglibnt.dll 60928 bytes executable
C:\WINDOWS\system32\migpwd.exe 52736 bytes executable
C:\WINDOWS\system32\mimefilt.dll 18944 bytes executable
C:\WINDOWS\system32\miniime.tpl 11776 bytes executable
C:\WINDOWS\system32\mlang.dat 673088 bytes
C:\WINDOWS\system32\mlang.dll 586240 bytes executable
C:\WINDOWS\system32\mll_hp.dll 3584 bytes executable
C:\WINDOWS\system32\mll_mtf.dll 7680 bytes executable
C:\WINDOWS\system32\mll_qic.dll 5632 bytes executable
C:\WINDOWS\system32\mmc.exe 816128 bytes executable
C:\WINDOWS\system32\mmcbase.dll 79872 bytes executable
C:\WINDOWS\system32\mmcndmgr.dll 1198080 bytes executable
C:\WINDOWS\system32\mmcshext.dll 50688 bytes executable
C:\WINDOWS\system32\mmdriver.inf 1490 bytes
C:\WINDOWS\system32\mmdrv.dll 12288 bytes executable
C:\WINDOWS\system32\mmfutil.dll 17920 bytes executable
C:\WINDOWS\system32\mmsys.cpl 626176 bytes executable
C:\WINDOWS\system32\mmsystem.dll 70688 bytes
C:\WINDOWS\system32\mprui.dll 47616 bytes executable
C:\WINDOWS\system32\mrinfo.exe 14336 bytes executable
C:\WINDOWS\system32\MRT.exe 18089592 bytes executable
C:\WINDOWS\system32\msaatext.dll 102912 bytes executable
C:\WINDOWS\system32\msacm.dll 61312 bytes
C:\WINDOWS\system32\msacm32.dll 72192 bytes executable
C:\WINDOWS\system32\msacm32.drv 20992 bytes executable
C:\WINDOWS\system32\msadds32.ax 221184 bytes executable
C:\WINDOWS\system32\msadp32.acm 14848 bytes executable
C:\WINDOWS\system32\msafd.dll 3584 bytes executable
C:\WINDOWS\system32\msapsspc.dll 86016 bytes executable
C:\WINDOWS\system32\msasn1.dll 57344 bytes executable
C:\WINDOWS\system32\msaud32.acm 294912 bytes executable
C:\WINDOWS\system32\msaudite.dll 77312 bytes executable
C:\WINDOWS\system32\msawt.dll 154384 bytes executable
C:\WINDOWS\system32\mscat32.dll 7168 bytes executable
C:\WINDOWS\system32\mscdexnt.exe 817 bytes
C:\WINDOWS\system32\mschrt20.ocx 1009336 bytes executable
C:\WINDOWS\system32\mscms.dll 74240 bytes executable
C:\WINDOWS\system32\mscomct2.ocx 647872 bytes executable
C:\WINDOWS\system32\mscomctl.ocx 1081616 bytes executable
C:\WINDOWS\system32\msconf.dll 69632 bytes executable
C:\WINDOWS\system32\mscoree.dll 271360 bytes executable
C:\WINDOWS\system32\mscorier.dll 16896 bytes executable
C:\WINDOWS\system32\mscories.dll 106496 bytes executable
C:\WINDOWS\system32\msjetoledb40.dll 358976 bytes executable
C:\WINDOWS\system32\msjint35.dll 123664 bytes executable
C:\WINDOWS\system32\msjint40.dll 184351 bytes executable
C:\WINDOWS\system32\msjt4jlt.dll 1238288 bytes executable
C:\WINDOWS\system32\msjter35.dll 24848 bytes executable
C:\WINDOWS\system32\msjter40.dll 53279 bytes executable
C:\WINDOWS\system32\msjtes40.dll 241693 bytes executable
C:\WINDOWS\system32\mslbui.dll 25600 bytes executable
C:\WINDOWS\system32\msls31.dll 146432 bytes executable
C:\WINDOWS\system32\msltus35.dll 168720 bytes executable
C:\WINDOWS\system32\msltus40.dll 213023 bytes executable
C:\WINDOWS\system32\msmapi32.ocx 137000 bytes executable
C:\WINDOWS\system32\msnetobj.dll 179712 bytes executable
C:\WINDOWS\system32\msnsspc.dll 290816 bytes executable
C:\WINDOWS\system32\msobjs.dll 37376 bytes executable
C:\WINDOWS\system32\msoeacct.dll 252928 bytes executable
C:\WINDOWS\system32\msoert2.dll 105984 bytes executable
C:\WINDOWS\system32\msorc32r.dll 24576 bytes executable
C:\WINDOWS\system32\msorcl32.dll 143360 bytes executable
C:\WINDOWS\system32\mspaint.exe 347648 bytes executable
C:\WINDOWS\system32\mspatcha.dll 30208 bytes executable
C:\WINDOWS\system32\mspbde40.dll 348189 bytes executable
C:\WINDOWS\system32\ntmarta.dll 119808 bytes executable
C:\WINDOWS\system32\ntmsapi.dll 40960 bytes executable
C:\WINDOWS\system32\NtmsData
C:\WINDOWS\system32\ntmsdba.dll 181248 bytes executable
C:\WINDOWS\system32\ntmsevt.dll 45056 bytes executable
C:\WINDOWS\system32\ntmsmgr.dll 496640 bytes executable
C:\WINDOWS\system32\ntmsmgr.msc 25901 bytes
C:\WINDOWS\system32\ntmsoprq.msc 32590 bytes
C:\WINDOWS\system32\ntmssvc.dll 438272 bytes executable
C:\WINDOWS\system32\ntoskrnl.exe 2182400 bytes executable
C:\WINDOWS\system32\ntprint.dll 91648 bytes executable
C:\WINDOWS\system32\ntsd.exe 31744 bytes executable
C:\WINDOWS\system32\ntsdexts.dll 36864 bytes executable
C:\WINDOWS\system32\ntshrui.dll 145920 bytes executable
C:\WINDOWS\system32\ntsim.sys 6016 bytes executable
C:\WINDOWS\system32\ntvdm.exe 420864 bytes executable
C:\WINDOWS\system32\ntvdmd.dll 13312 bytes executable
C:\WINDOWS\system32\nusrmgr.cpl 261120 bytes executable
C:\WINDOWS\system32\nwc.cpl.manifest 749 bytes
C:\WINDOWS\system32\nwprovau.dll 145920 bytes executable
C:\WINDOWS\system32\oajuvbap.ini 577467 bytes
C:\WINDOWS\system32\oakley.dll 267776 bytes executable
C:\WINDOWS\system32\occache.dll 97280 bytes executable
C:\WINDOWS\system32\ocmanage.dll 62976 bytes executable
C:\WINDOWS\system32\odbc16gt.dll 26224 bytes
C:\WINDOWS\system32\odbc32.dll 249856 bytes executable
C:\WINDOWS\system32\odbc32gt.dll 16384 bytes executable
C:\WINDOWS\system32\odbcad32.exe 32768 bytes executable
C:\WINDOWS\system32\odbcbcp.dll 24576 bytes executable
C:\WINDOWS\system32\odbcconf.dll 135168 bytes executable
C:\WINDOWS\system32\odbcconf.exe 69632 bytes executable
C:\WINDOWS\system32\odbcconf.rsp 4310 bytes
C:\WINDOWS\system32\odbccp32.cpl 32768 bytes executable
C:\WINDOWS\system32\odbccp32.dll 106496 bytes executable
C:\WINDOWS\system32\odbccr32.dll 65536 bytes executable
C:\WINDOWS\system32\odbccu32.dll 65536 bytes executable
C:\WINDOWS\system32\odbcint.dll 98304 bytes executable
C:\WINDOWS\system32\Odbcjet.cnt 7348 bytes
C:\WINDOWS\system32\Odbcjet.hlp 171967 bytes
C:\WINDOWS\system32\odbcji32.dll 61712 bytes executable
C:\WINDOWS\system32\pifmgr.dll 35328 bytes executable
C:\WINDOWS\system32\ping.exe 19456 bytes executable
C:\WINDOWS\system32\ping6.exe 34304 bytes executable
C:\WINDOWS\system32\PINTLGNT.IME 482304 bytes executable
C:\WINDOWS\system32\PINTLPAD.HLP 14821 bytes
C:\WINDOWS\system32\PINTLPAE.HLP 16254 bytes
C:\WINDOWS\system32\pjlmon.dll 15360 bytes executable
C:\WINDOWS\system32\plustab.dll 30720 bytes executable
C:\WINDOWS\system32\pmspl.dll 46592 bytes
C:\WINDOWS\system32\pngfilt.dll 39424 bytes executable
C:\WINDOWS\system32\pnrpnsp.dll 48640 bytes executable
C:\WINDOWS\system32\polstore.dll 106496 bytes executable
C:\WINDOWS\system32\popup.ocx 29184 bytes executable
**************************************************************************
.
Completion time: 2007-11-10 8:10:39 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-09 18:05
.
--- E O F ---
Logfile of HijackThis v1.99.1
Scan saved at 11:19:25, on 10/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE
C:\Program Files\Windows Live\Messenger\msnmsg
