Message "warning potential spyware operation&

Question

Bonjour à tous,
comme de nombreuses personnes avant moi j'ai un problème avec ce message "warning potential spyware operation" qui vient toujours me déranger.
Apparement tout le monde a trouver une solution, mais moi j'ai rien compris à la procédure à suivre. Pouvez-vous m'éxpliquer clairement chaques étapes à suivres ?
Merci beaucoup par avance.

Utilisateur anonyme · Answer

Salut,
> Télécharge SDFix sur ton bureau

>Ouvre le dossier SDFix qui à été créé sur le Bureau et double clique sur RunThis.bat pour lancer le script.
-  Appuie sur Y pour commencer le processus de nettoyage.
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
- Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
-  Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
-Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse 

A+

Le sioux · Answer

Bonsoir DIID

A mon sens, SDFix n est pas a  utiliser avant d avoir eu un rapport HijackThis qui prouve l utilité de celui ci...

Tuto : "générer un rapport" http://pageperso.aol.fr/balltrap34/demohijack.htm

Commence par envoyer a DIID un rapport HijackThis, fais ce qui suit :

HijackThis

Télécharge  hijackthis sur ton bureau.


Ferme toutes les autres fenêtres, tous les autres programmes. Pas de connexion Internet.

Double clique dessus pour lancer l installation . Accepte la licence qui va apparaître  par " I agree" .

Puis clique sur "Do a system scan and save a logfile"

Ferme hijackThis et fait un copier-coller du rapport en entier et poste le ici en réponse.

Note : le rapport se trouve dans c:\Program Files\Trend Micro\HijackThis  

Salut.

GeoGeo · Answer

Bonjour à tous et merci pour votre aide,
j'ai suivi les instructions de "Le sioux", voilà mon rapport :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:16:12, on 24/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\CmWatch.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS	snp2std.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\srvreg.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\autos.exe
C:\WINDOWS\system32\winsos.exe
C:\WINDOWS\system32\shovth.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32eg.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\proper.exe
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\system32\bronto.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS	snp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - HKLM\..\Run: [sis32] C:\WINDOWS\system32\winsos.exe
O4 - HKLM\..\Run: [winroot] C:\WINDOWS\system32\winsn.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [srvreg] C:\WINDOWS\system32\srvreg.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - HKCU\..\Run: [StartUp] C:\WINDOWS\Temp\checkmem.exe /optimize speed
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: infos.exe
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: autos.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

GeoGeo · Answer

Au fait, j'en profite aussi pour vous dire que en même temps que ce message a commencé à apparaitre j'ai également eu le droit à des restrictions en vigueur sur mon panneau de configuration. Donc si c'est lié et que vous pouvez également m'aider je serait ravi ! Merci beaucoup !!!!

Le sioux · Answer

Bonsoir GeoGeo

Tout cela est lié, le fautif : SmitFraud

Besoin d'un autre rapport avant de passer au nettoyage.

 SmitfraudFix de S!Ri, balltrap34 et moe31 

Télécharge SmitfraudFix de S!Ri, balltrap34 et moe31  

http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Dézippe le puis

* Installe le à la racine de C

Tu crees un nouveau dossier, via clic droit "créer /nouveau dossier que tu nommes SmitfraudFix  --> C:\SmitfraudFix

Regarde  un exemple  a E )   « Faire un répertoire dédié »  https://forum.pcastuces.com/sujet.asp?f=25&s=3902

* double clic sur l'exe pour le décompresser et lancer le fix.
Utilisation ----- option 1 - Recherche :
* Double clique sur smitfraudfix.cmd 
* Sélectionne 1 pour créer un rapport des fichiers responsables de l'infection.
* Poste le rapport ici


process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

@ suivre

GeoGeo · Answer

Merci,
j'éspère que j'ai procédé correctement, voilà le rapport :

SmitFraudFix v2.274

Rapport fait à 19:53:32,65, 24/12/2007
Executé à partir de C:\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\proper.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\CmWatch.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\srvreg.exe
C:\WINDOWS\system32\shovth.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Windows Live\installer\WLSetupSvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32eg.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\bronto.dll PRESENT !
C:\WINDOWS\system32\proper.exe PRESENT !
C:\WINDOWS\system32\winter.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Guisse


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Guisse\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

C:\DOCUME~1\Guisse\MENUDM~1\PROGRA~1\DMARRA~1\infos.exe PRESENT !
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\autos.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Guisse\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix.exe by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\system32\wowfx.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/1000 PM Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{6C1AD0EB-FE5E-4CA8-BD9A-197A2DFB0187}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6C1AD0EB-FE5E-4CA8-BD9A-197A2DFB0187}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{6C1AD0EB-FE5E-4CA8-BD9A-197A2DFB0187}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin



Merci encore, et joyeux noël.

Le sioux · Answer

Re

Let's go ;)


1) Redémarre en mode sans échec

Regarde ici si besoin avant ici  : http://pageperso.aol.fr/loraline60/mode_sans_echec.htm
Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement, appuie sur la touche [F8]  (ou [F5]  sur certains pc) jusqu'à l'affichage du menu des options avancées de Windows.
Sélectionner "Mode sans échec" et appuie sur  [Entrée] 
Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre. 

Ouvre le fichier texte sauvegardé sur le Bureau afin de suivre les instructions comme il faut.

2) SmitfraudFix de S!Ri, balltrap34 et moe31

* Double clique sur Smitfraudfix.cmd
* Sélectionne 2 pour supprimer les fichiers responsables de l'infection.

A la question Voulez-vous nettoyer le registre ? répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection.
Le fix déterminera si le fichier wininet.dll est infecté.

A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.
* Redémarre en mode normal et poste le rapport ici

N.B.: Cette étape élimine les fichiers infectieux détectés à l'étape #1
Note L'option 2 de l'outil supprime le fond d'écran !

3) Rapports

Fais redémarrer ton PC et poste le rapport de SmitFraudFix et un nouveau rapport HijackThis stp et dis moi si tu constate des améliorations ...

@ suivre

Bon réveillon et Joyeux Noel !

GeoGeo · Answer

Merci beaucoup,
Après avoir tout fait ce que vous m'avez dit les restrictions sont toujours présentes, le message "warning..." est apparut en français maintenant !
Voilà les rapports (en premier le SmitFraudFix puis le HijackThis:


------------------------------- Rapport SmitFraudFix :

SmitFraudFix v2.274

Rapport fait à 15:57:38,64, 25/12/2007
Executé à partir de C:\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


192.168.200.3	ad.doubleclick.net
192.168.200.3	ad.fastclick.net
192.168.200.3	ads.fastclick.net
192.168.200.3	atdmt.com
192.168.200.3	awaps.net
192.168.200.3	banner.fastclick.net
192.168.200.3	banners.fastclick.net
192.168.200.3	click.atdmt.com
192.168.200.3	clicks.atdmt.com
192.168.200.3	engine.awaps.net
192.168.200.3	fastclick.net
192.168.200.3	ftp.avp.ch
192.168.200.3	ftp.kasperskylab.ru
192.168.200.3	updates5.kaspersky-labs.com
192.168.200.3	www.awaps.net
192.168.200.3	www.symantec.com
192.168.200.3	www.viruslist.ru

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\system32\bronto.dll supprimé
C:\WINDOWS\system32\proper.exe supprimé
C:\WINDOWS\system32\winter.exe supprimé
C:\DOCUME~1\Guisse\MENUDM~1\PROGRA~1\DMARRA~1\infos.exe supprimé
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\autos.exe supprimé

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix.exe by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{6C1AD0EB-FE5E-4CA8-BD9A-197A2DFB0187}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6C1AD0EB-FE5E-4CA8-BD9A-197A2DFB0187}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{6C1AD0EB-FE5E-4CA8-BD9A-197A2DFB0187}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


------------------------------- Rapport HijackThis :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:06:00, on 25/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\CmWatch.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\srvreg.exe
C:\WINDOWS\system32\shovth.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\suspend.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS	snp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [sis32] C:\WINDOWS\system32\winsos.exe
O4 - HKLM\..\Run: [winroot] C:\WINDOWS\system32\winsn.exe
O4 - HKLM\..\Run: [Medichi] medichi.exe
O4 - HKLM\..\Run: [Medichi2] medichi2.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [srvreg] C:\WINDOWS\system32\srvreg.exe
O4 - HKCU\..\Run: [StartUp] C:\WINDOWS\Temp\checkmem.exe /optimize speed
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

Le sioux · Answer

Bonsoir Geogeo

On s'occupera des restrictions dans peu de temps ;)

Je te conseille d'enregistrer la page en sélectionnant toutes les lignes puis de copier cette sélection dans un fichier texte sur ton PC pour pouvoir appliquer la procédure correctement.
(Note: tu n'auras pas accès à Internet à partir du moment ou te redémarreras en mode sans échec)
Il faut exécuter toutes les étapes, sans interruption, dans l'ordre exact indiqué ci-dessous.
Si un élément te paraît obscur, demande des explications avant de commencer la désinfection

1) Télécharge 

* SDFix d' AndyManchesta 

  http://downloads.andymanchesta.com/RemovalTools/SDFix.exe   sur ton Bureau.

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. N y touche pas pour l instant.

2) Redémarre en mode sans échec

Regarde ici si besoin avant ici  : http://pageperso.aol.fr/loraline60/mode_sans_echec.htm
Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement, appuie sur la touche [F8]  (ou [F5]  sur certains pc) jusqu'à l'affichage du menu des options avancées de Windows.
Sélectionner "Mode sans échec" et appuie sur  [Entrée] 
Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre. 

Ouvre le fichier texte sauvegardé sur le Bureau afin de suivre les instructions comme il faut.

3) SDFix
    * Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
    * Appuie sur Y pour commencer le processus de nettoyage.
    * Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
    * Appuie sur une touche pour redémarrer le PC.
    * Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
    * Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
    * Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
·	Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.

4) Rapports :

Poste un nouveau rapport HijackThis et le rapport de SDFix en réponse.

@ suivre

GeoGeo · Answer

Voilà les rapports :

----------------------------------------------------- SDFix :


SDFix: Version 1.119

Run by Guisse on 25/12/2007 at 12:40

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services: 


Infected beep.sys Found!

beep.sys File Locations:

"C:\WINDOWS\system32\dllcache\beep.sys" 37888 24/12/2007 13:32 
"C:\WINDOWS\system32\drivers\beep.sys" 37888 24/12/2007 13:32 

Infected File Listed Below:

C:\WINDOWS\system32\dllcache\beep.sys
C:\WINDOWS\system32\drivers\beep.sys

Trojan File copied to Backups Folder
Attempting to replace beep.sys with original version... 

Original beep.sys Restored
 

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files: 

Trojan Files Found:

C:\Documents and Settings\Guisse\Application Data\antivirus.exe  - Deleted
C:\autorun.inf  - Deleted
C:\WINDOWS\system\System.exe  - Deleted
C:\WINDOWS\system32\drivers\drivers.exe  - Deleted
C:\WINDOWS\system32\Setup\setup.exe  - Deleted
C:\WINDOWS\system32\system32.exe  - Deleted
C:\WINDOWS\system32\winsn.exe  - Deleted
C:\WINDOWS\system32\winsos.exe  - Deleted
C:\WINDOWS\Temp	emp.exe  - Deleted
C:\WINDOWS\windows.exe  - Deleted




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found. 

C:\WINDOWS\system32
No streams found. 

C:\WINDOWS\system32\svchost.exe
No streams found.
 
C:\WINDOWS\system32
toskrnl.exe
No streams found.
 


                                 Final Check:

catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-25 13:04:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:1f,06,55,ec,af,87,c5,b7,b3,ec,16,15,8b,a7,4e,60,85,79,2e,56,73,..
"p0"="J:\Logiciel\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,35,59,f7,ee,c2,35,0e,7d,fd,4b,3f,b3,13,8a,86,20,cb,..
"khjeh"=hex:90,8c,c4,77,d9,1e,61,cb,21,da,62,78,24,5f,31,08,d8,0c,51,7f,a3,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:0e,c5,5c,08,70,d5,23,a3,72,08,8d,04,b0,a4,1c,78,50,88,4d,06,f1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:1f,06,55,ec,af,87,c5,b7,b3,ec,16,15,8b,a7,4e,60,85,79,2e,56,73,..
"p0"="J:\Logiciel\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,35,59,f7,ee,c2,35,0e,7d,fd,4b,3f,b3,13,8a,86,20,cb,..
"khjeh"=hex:90,8c,c4,77,d9,1e,61,cb,21,da,62,78,24,5f,31,08,d8,0c,51,7f,a3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:0e,c5,5c,08,70,d5,23,a3,72,08,8d,04,b0,a4,1c,78,50,88,4d,06,f1,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\xd8\x2022\x20ac|\xff\xff\xff\xff\22\x2022\x20ac|\xf9\x20229~\2]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\Software\Adobe\FeatureSubscriptions\DVAAdobeDocMeta\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\Registered"

scanning hidden files ...


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 2


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player"
"C:\Program Files\Azureus\Azureus.exe"="C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Documents and Settings\Guisse\LimeWire\LimeWire.exe"="C:\Documents and Settings\Guisse\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"="C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Pinnacle\Studio 11\programs\RM.exe"="C:\Program Files\Pinnacle\Studio 11\programs\RM.exe:*:Enabled:Render Manager"
"C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe"="C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe:*:Enabled:Studio"
"C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe"="C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile"
"C:\Program Files\Pinnacle\Studio 11\programs\umi.exe"="C:\Program Files\Pinnacle\Studio 11\programs\umi.exe:*:Enabled:umi"
"C:\Program Files\webcamXP\webcamXP.exe"="C:\Program Files\webcamXP\webcamXP.exe:*:Disabled:webcamXP 2007"
"%windir%\system32\winav.exe"="%windir%\system32\winav.exe:*:Enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"%windir%\system32\winav.exe"="%windir%\system32\winav.exe:*:Enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Wed 19 Dec 2007        89,088 ..SH. --- "C:\F82EC657.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Config.Msi\Config.Msi.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Downloaded Videos\Downloaded Videos.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Downloads\Downloads.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Mes t‚l‚chargements\Mes t‚l‚chargements.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\SmitfraudFix\SmitfraudFix.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Documents and Settings\Guisse\Guisse.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\Worms Armageddon - New Edition.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Mes Documents\Excel\Excel.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\AppPatch\AppPatch.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Cursors\Cursors.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Debug\Debug.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\EHome\EHome.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Help\Help.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\ime\ime.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Media\Media.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\msagent\msagent.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS
etwork diagnostic
etwork diagnostic.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Registration\Registration.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWSepairepair.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\security\security.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SHELLNEW\SHELLNEW.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\SoftwareDistribution.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\srchasst\srchasst.exe"
Wed 19 Dec 2007        89,088 ..SH. --- "C:\WINDOWS\system32\shovth.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS	wain_32	wain_32.exe"
Wed 17 Oct 2007         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Documents and Settings\Guisse\Bureau\Bureau.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Documents and Settings\Guisse\Incomplete\Incomplete.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Documents and Settings\Guisse\Shared\Shared.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\DATA.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DXLayouts\DXLayouts.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\FESfx\FESfx.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\graphics.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\ReadMe\ReadMe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\Tweaks\Tweaks.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\User.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\SysFiles\SysFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\Vista Inspirat 2.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Cache\MSDERelASP4\MSDERelASP4.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Downloaded Installations\{1325121E-7DD9-4F29-87AF-BD524658E50B}\{1325121E-7DD9-4F29-87AF-BD524658E50B}.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Downloaded Installations\{8B452438-5E8A-4745-B0F5-48B4AC0CAFEC}\{8B452438-5E8A-4745-B0F5-48B4AC0CAFEC}.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Downloaded Installations\{FC906D5C-91F9-4DA4-A765-6DCBB669F317}\{FC906D5C-91F9-4DA4-A765-6DCBB669F317}.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Driver Cache\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\ime\imjp8_1\imjp8_1.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\ime\imkr6_1\imkr6_1.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\ime\shared\shared.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\java\classes\classes.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\java\Packages\Packages.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\Framework.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\msagent\chars\chars.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\msagent\intl\intl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\{AA936DF4-2B08-4B1F-B071-72192E287704}.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Themes.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\security\Database\Database.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\security\logs\logs.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\security	emplates	emplates.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\ServicePackFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\AuthCabs\AuthCabs.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\Download\Download.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\EventCache\EventCache.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\WebSetup\WebSetup.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\srchasst\chars\chars.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\1033\1033.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\1036\1036.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\CatRoot2\CatRoot2.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\Com\Com.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\config\config.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ias\ias.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\icsxml\icsxml.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\Lang\Lang.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32
pp
pp.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\oobe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32asas.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\Restore\Restore.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\RTCOM\RTCOM.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\URTTemp\URTTemp.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\usmt\usmt.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\wbem\wbem.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Temp\IntelChip\IntelChip.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Temp\WLXPL_DX\WLXPL_DX.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Temp\_avast4_\_avast4_.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS	wain_32\N067U\N067U.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS	wain_32\snp2std\snp2std.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_fdbc5a54\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_fdbc5a54.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_9d1c6ce0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_9d1c6ce0.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6e02dfe5\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6e02dfe5.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_c351f8e3\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_c351f8e3.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_9e223a7a\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_9e223a7a.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Manifests\Manifests.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9a\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9a.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries.Resources_6595b64144ccf1df_6.0.0.0_fr-FR_9d8c4a39\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries.Resources_6595b64144ccf1df_6.0.0.0_fr-FR_9d8c4a39.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1740_x-ww_7cb8ab44\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1740_x-ww_7cb8ab44.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1816_x-ww_7d33ba0e\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1816_x-ww_7d33ba0e.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1873_x-ww_7d39bb85\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1873_x-ww_7d39bb85.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1891_x-ww_7d3bbc01\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1891_x-ww_7d3bbc01.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_fr_457ebf3d\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_fr_457ebf3d.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.10.0_x-ww_712befd8\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.10.0_x-ww_712befd8.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.10.0_x-ww_d8862ba3\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.10.0_x-ww_d8862ba3.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a.exe"
Tue 16 Oct 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Documents and Settings\Guisse\Bureau\100OLYMP\100OLYMP.exe"
Sat 30 Apr 2005         4,348 A..H. --- "C:\Documents and Settings\Guisse\Mes documents\Sauvegarde de la licence\drmv1key.bak"
Fri 16 Dec 2005            20 A..H. --- "C:\Documents and Settings\Guisse\Mes documents\Sauvegarde de la licence\drmv1lic.bak"
Sat 30 Apr 2005           400 A.SH. --- "C:\Documents and Settings\Guisse\Mes documents\Sauvegarde de la licence\drmv2key.bak"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Documents and Settings\Guisse\My Documents\My Videos\My Videos.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Gfx\Gfx.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Image\Image.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\ImgHoles\ImgHoles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Mission\Mission.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Resource\Resource.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Streams\Streams.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\1UpMenu\1UpMenu.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\Background Stuff\Background Stuff.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\ButtonBorders\ButtonBorders.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\CreateTeam\CreateTeam.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\gameoptions.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\GrafittiFill.seq\GrafittiFill.seq.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\GrafittiUndo.seq\GrafittiUndo.seq.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\GrafittiEdit.seq\GrafittiEdit.seq.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\GrafittiBin.seq\GrafittiBin.seq.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\GrafittiBorder.seq\GrafittiBorder.seq.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\GrafittiBrushSize.seq\GrafittiBrushSize.seq.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\GrafittiCircles.seq\GrafittiCircles.seq.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\GrafittiExit.seq\GrafittiExit.seq.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\GrafittiInvert.seq\GrafittiInvert.seq.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\GrafittiImport.seq\GrafittiImport.seq.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\GrafittiTunnels.seq\GrafittiTunnels.seq.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\HostJoinScreen\HostJoinScreen.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\Intro\Intro.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\MainMenu\MainMenu.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\MapedMisc\MapedMisc.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\MissionMenu\MissionMenu.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\Multiplay\Multiplay.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\NetworkMenu\NetworkMenu.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\optionsmenu\optionsmenu.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\OptionsSpecial\OptionsSpecial.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\palettes\palettes.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\ServerLobby\ServerLobby.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\TeamInfo\TeamInfo.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\water\water.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\WeaponEditor\WeaponEditor.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Capture\Capture.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Flags\Flags.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Games\Games.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Graves\Graves.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Import\Import.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\SavedLevels\SavedLevels.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Speech.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Teams\Teams.exe"
Mon  5 May 2003       348,160 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\AACMP4.EXE"
Thu  7 Feb 2002        94,208 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\lpaccodec.dll"
Fri  2 Feb 2001        40,960 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\lpac_codec_api.dll"
Tue 13 Apr 2004       212,992 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\OFR.EXE"
Fri 17 Jan 2003       278,528 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\PNCRT.dll"
Mon  5 May 2003        16,384 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\RMADEC.EXE"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\Help\Help.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\iColorFolder\iColorFolder.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\Icons\Icons.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\PackFiles\PackFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\ResFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResHacker\ResHacker.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\Tools\Tools.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\UninstFiles\UninstFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\Wallpapers\Wallpapers.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Help\Tours\htmlTour\htmlTour.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Help\Tours\mmTour\mmTour.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Help\Tours\WindowsMediaPlayer\WindowsMediaPlayer.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\ime\chsime\applets\applets.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\ime\CHTIME\Applets\Applets.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\ime\imjp8_1\applets\applets.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\ime\imjp8_1\DICTS\DICTS.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\ime\imkr6_1\applets\applets.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\ime\sharedeses.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\java\Packages\Data\Data.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\v1.0.3705.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\v1.1.4322.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\v2.0.50727.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Binaries\Binaries.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Config\Config.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Database\Database.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\DataColl\DataColl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Indices\Indices.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Logs\Logs.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\OfflineCache\OfflineCache.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\PackageStore\PackageStore.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\System.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\UploadLB\Binaries\Binaries.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\UploadLB\Config\Config.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Inspirat2\Inspirat2.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Luna\Luna.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Vista\Vista.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\AuthCabs\7971f918-a847-4430-9279-4a52d1efe18d\7971f918-a847-4430-9279-4a52d1efe18d.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\Logs.exe"
Fri 26 Oct 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ad213d081e2675ef87a62c73b8abf209\BIT5.tmp"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\Download\d3c2d09b276caa4aac6cb42653aaddc6\d3c2d09b276caa4aac6cb42653aaddc6.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\Default.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\SelfUpdate\Registered\Registered.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\7971F918-A847-4430-9279-4A52D1EFE18D.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\9482F4B4-E343-43B6-B170-9A65BC822C77.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\srchasst\mui\040C\040C.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\config\systemprofile\systemprofile.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\DirectX\Dinput\Dinput.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\drivers\etc\etc.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\IME\CINTLGNT\CINTLGNT.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\IME\PINTLGNT\PINTLGNT.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\IME\TINTLGNT\TINTLGNT.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\Macromed\Flash\Flash.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\MsDtc\Trace\Trace.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\mui\000C\000C.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\mui\0409\0409.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\mui\040C\040C.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\actsetup\actsetup.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\error\error.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\icserror\icserror.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\images\images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\isperror\isperror.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobeegerroregerror.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\setup\setup.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\spool\PRINTERS\PRINTERS.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\wbem\AutoRecover\AutoRecover.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\wbem\Logs\Logs.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\wbem\Performance\Performance.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\wbem\Repository\Repository.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\wbem\xml\xml.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\amd64_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_beca5f1f\amd64_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_beca5f1f.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\amd64_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_d780e993\amd64_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_d780e993.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\amd64_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_6f34654e\amd64_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_6f34654e.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\amd64_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_dd406c19\amd64_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_dd406c19.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\amd64_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_2aad8370\amd64_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_2aad8370.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_x-ww_527a1c68\x86_policy.6.0.Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_x-ww_527a1c68.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Documents and Settings\Guisse\LimeWire	hemesed_themeed_theme.exe"
Tue  7 Aug 2007     1,081,344 A..H. --- "C:\Documents and Settings\Guisse\Mes documents\Geoffrey\Rapport Thomas BEPA\~WRD0001.tmp"
Sat 30 Apr 2005         4,348 A..H. --- "C:\Documents and Settings\Guisse\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Wed  2 Nov 2005            20 A..H. --- "C:\Documents and Settings\Guisse\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Sat 30 Apr 2005           400 A.SH. --- "C:\Documents and Settings\Guisse\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Sat 30 Apr 2005         4,348 A..H. --- "C:\Documents and Settings\Guisse\Mes documents\Sauvegarde de la licence\Sauvegarde de la licence\drmv1key.bak"
Sun 26 Nov 2006            20 A..H. --- "C:\Documents and Settings\Guisse\Mes documents\Sauvegarde de la licence\Sauvegarde de la licence\drmv1lic.bak"
Mon 30 Jan 2006           488 A.SH. --- "C:\Documents and Settings\Guisse\Mes documents\Sauvegarde de la licence\Sauvegarde de la licence\drmv2key.bak"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\-Beach\-Beach.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\-Desert\-Desert.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\-Farm\-Farm.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\-Forest\-Forest.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\-Hell\-Hell.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Art\Art.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Cheese\Cheese.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Construction\Construction.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Desert\Desert.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Dungeon\Dungeon.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Easter\Easter.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Forest\Forest.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Fruit\Fruit.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Gulf\Gulf.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Hell\Hell.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Hospital\Hospital.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Jungle\Jungle.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Manhattan\Manhattan.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Medieval\Medieval.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Music\Music.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Pirate\Pirate.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Snow\Snow.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Space\Space.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Sports\Sports.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Tentacle\Tentacle.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Time\Time.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Tools\Tools.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Tribal\Tribal.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Custom\Urban\Urban.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\-Beach\-Beach.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\-Desert\-Desert.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\-Farm\-Farm.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\-Forest\-Forest.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\-Hell\-Hell.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Art\Art.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Cheese\Cheese.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Construction\Construction.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Desert\Desert.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Dungeon\Dungeon.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Easter\Easter.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Forest\Forest.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Fruit\Fruit.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Gulf\Gulf.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Hell\Hell.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Hospital\Hospital.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Jungle\Jungle.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Manhattan\Manhattan.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Medieval\Medieval.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Music\Music.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Pirate\Pirate.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Snow\Snow.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Space\Space.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Sports\Sports.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Tentacle\Tentacle.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Time\Time.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Tools\Tools.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Tribal\Tribal.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Level\Urban\Urban.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Resource\DUTCH\DUTCH.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Resource\ENGLISH\ENGLISH.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Resource\FRENCH\FRENCH.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Resource\GERMAN\GERMAN.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Resource\ITALIAN\ITALIAN.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Resource\Portuguese\Portuguese.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Resource\SPANISH\SPANISH.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Resource\SWEDISH\SWEDISH.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\User\Fanfare\Fanfare.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Water\Blue\Blue.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Water\Green\Green.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Water\Purple\Purple.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Water\Red\Red.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Water\yellow\yellow.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\Wav\Effects\Effects.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\CreateTeam\CPUPlayers\CPUPlayers.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\CreateTeam\Graves\Graves.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\CreateTeam\Specials\Specials.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\CratePercentage\CratePercentage.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\HealthCrate\HealthCrate.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\HotseatDelay\HotseatDelay.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\MineFuse.tga\MineFuse.tga.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\Objects\Objects.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\RetreatTime\RetreatTime.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\RopeRetreat\RopeRetreat.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\RoundTime\RoundTime.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\Stockpiling\Stockpiling.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\SuddenDeathModes\SuddenDeathModes.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\TurnTime\TurnTime.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\WaterRiseSpeed\WaterRiseSpeed.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\winsrequired\winsrequired.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\gameoptions\WormEnergy\WormEnergy.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\HostJoinScreen\Allies\Allies.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\HostJoinScreen\BigReadyBulb.seq\BigReadyBulb.seq.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\HostJoinScreen\Handicap\Handicap.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\HostJoinScreen\ReadyYN.seq\ReadyYN.seq.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\HostJoinScreen\RoundTime\RoundTime.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\HostJoinScreen\Teleport\Teleport.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\HostJoinScreen\TurnTime\TurnTime.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\HostJoinScreen\winsrequired\winsrequired.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\HostJoinScreen\WormEnergy\WormEnergy.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\HostJoinScreen\WormsInTeam\WormsInTeam.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\MapedMisc\Borders\Borders.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\MapedMisc\BridgeCount\BridgeCount.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\MapedMisc\brushes\brushes.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\MapedMisc\ObjectCount\ObjectCount.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\MapedMisc\PieBig\PieBig.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\MapedMisc\PieSmall\PieSmall.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\MapedMisc\SmallWater\SmallWater.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\Multiplay\PieSmall\PieSmall.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\NetworkMenu\DataTransferframes\DataTransferframes.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\NetworkMenu\WormnetFrames\WormnetFrames.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\ServerLobby\flags\flags.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\ServerLobby\WormnetFrames\WormnetFrames.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\WeaponEditor\Ammo\Ammo.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\WeaponEditor\Crates\Crates.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\WeaponEditor\Delay\Delay.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\graphics\WeaponEditor\Power\Power.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Flags\Default\Default.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Ace Ventura\Ace Ventura.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Africaan\Africaan.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Age of Empires\Age of Empires.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\American\American.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Angry Scots\Angry Scots.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Australian\Australian.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Brak\Brak.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Brooklyn\Brooklyn.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Brummie\Brummie.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Bugs Bunny\Bugs Bunny.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Cad\Cad.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Cyberworms\Cyberworms.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Daffy Duck\Daffy Duck.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Danish-Pyrus\Danish-Pyrus.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Double-Oh-Seven\Double-Oh-Seven.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Drill Sergeant\Drill Sergeant.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Dutch\Dutch.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\FFX\FFX.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Finnish\Finnish.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Formula One\Formula One.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\French\French.exe"
Wed 19 Dec 2007        89,088 ...H. ---

Le sioux · Answer

Re

Je vais finir de regarder ton rapport tout a l heure mais j aurai voulu un nouveau rapport Hijackthis stp.

@ suivre

GeoGeo · Answer

désolé en fait le forum a coupé mon message (trop long) voilà la fin du rapport SDFix suivi du rapport HijackThis :

Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Futurama\Futurama.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Geezer\Geezer.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\German\German.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Goofed\Goofed.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Greek\Greek.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Grim\Grim.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Hispanic\Hispanic.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Hoagie\Hoagie.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Hungarian\Hungarian.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Irish\Irish.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Italian\Italian.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Jock\Jock.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Kamikaze\Kamikaze.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Kidz\Kidz.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Ludek Sobota\Ludek Sobota.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Mafia\Mafia.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Mortal Kombat\Mortal Kombat.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Norwegian\Norwegian.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Pirates of Caribbean\Pirates of Caribbean.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Polish\Polish.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Portuguese\Portuguese.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Rasta\Rasta.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Redneck\Redneck.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Rushki\Rushki.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Russian\Russian.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Scouser\Scouser.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Simpsons\Simpsons.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Smooth Babe\Smooth Babe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Soul Man\Soul Man.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Spanish\Spanish.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Stiff Upper Lip\Stiff Upper Lip.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Stooges\Stooges.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Swedish\Swedish.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Team17 Test\Team17 Test.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Terminator\Terminator.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\The Raj\The Raj.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Thespian\Thespian.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Troll\Troll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Tykes\Tykes.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\US Sports\US Sports.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Wacky\Wacky.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Whoopsie\Whoopsie.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\User\Speech\Wideboy\Wideboy.exe"
Sun 21 Jul 2002        45,056 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\AC3\AC3ENC.DLL"
Wed 20 Feb 2002        98,304 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\AC3\AZID.DLL"
Fri 11 Apr 2003        73,766 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\atrc3260.dll"
Fri 11 Apr 2003        45,099 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\auth3260.dll"
Fri 11 Apr 2003        65,575 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\cook3260.dll"
Fri 11 Apr 2003       102,437 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\drv13260.dll"
Fri 11 Apr 2003       176,165 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\drv23260.dll"
Fri 11 Apr 2003       208,935 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\drv33260.dll"
Fri 11 Apr 2003       217,127 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\drv43260.dll"
Tue 15 Apr 2003       976,896 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\pnen3260.dll"
Fri 11 Apr 2003       348,203 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\pnvi3260.dll"
Fri 11 Apr 2003        53,289 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\pnxr3260.dll"
Fri 11 Apr 2003        45,101 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commonamf3260.dll"
Fri 11 Apr 2003       135,213 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commonare3260.dll"
Mon 14 Oct 2002        57,344 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commonims3290.dll"
Fri 11 Apr 2003       163,885 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commonmff3260.dll"
Mon 14 Oct 2002       737,280 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commonmse3290.dll"
Mon 14 Oct 2002       245,760 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commonmwr3260.dll"
Fri 11 Apr 2003       245,805 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commonnlt3260.dll"
Mon 14 Oct 2002       245,760 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commonorw3290.dll"
Mon 14 Oct 2002       114,688 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commontae3290.dll"
Mon 14 Oct 2002        65,536 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commontin3290.dll"
Mon 14 Oct 2002       163,840 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commontve3290.dll"
Fri 11 Apr 2003        45,093 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commonv103260.dll"
Fri 11 Apr 2003        98,341 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commonv203260.dll"
Fri 11 Apr 2003        94,247 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commonv303260.dll"
Fri 11 Apr 2003        90,151 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commonv403260.dll"
Fri 11 Apr 2003       159,785 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Commonvre3260.dll"
Mon 14 Oct 2002       102,400 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\sipr3260.dll"
Fri 11 Apr 2003        61,485 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\smpl3260.dll"
Fri 11 Apr 2003       106,541 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\vsrl3260.dll"
Fri 11 Apr 2003        86,061 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\xmlp3261.dll"
Fri 11 Apr 2003       159,787 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Common\zipf3260.dll"
Sun 23 Feb 2003        64,512 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\MusePack\MPPDEC.EXE"
Sat 26 Oct 2002        79,360 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\MusePack\MPPENC.EXE"
Mon  4 Mar 2002       352,299 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\PsyTEL\AACENC.EXE"
Mon  5 May 2003       348,160 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\PsyTEL\AACMP4.EXE"
Mon  4 Mar 2002       221,184 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\PsyTEL\FASTENC.EXE"
Thu  6 Sep 2001       688,128 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\PsyTEL\IA32MATH.DLL"
Fri 14 Feb 2003       910,152 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Shorten\CYGWIN1.DLL"
Sun 20 Apr 2003        60,928 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Shorten\SHORTEN.EXE"
Wed  8 Oct 2003        75,264 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Speex\speexdec.exe"
Wed  8 Oct 2003        77,312 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\Speex\speexenc.exe"
Tue 18 Feb 2003       103,936 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\WavPack\WAVPACK.EXE"
Tue 18 Feb 2003       102,912 ...H. --- "C:\Program Files\Fichiers communs\Ahead\AudioPlugins\WavPack\WVUNPACK.EXE"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\iColorFolder\doc\doc.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\10_cmdial32.dll\10_cmdial32.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\11_console.dll\11_console.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\12_credui.dll\12_credui.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\13_desk.cpl\13_desk.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\14_explorer.exe\14_explorer.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\15_fontext.dll\15_fontext.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\16_hdwwiz.cpl\16_hdwwiz.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\17_helpctr.exe\17_helpctr.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\18_hotplug.dll\18_hotplug.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\19_inetcpl.cpl\19_inetcpl.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\1_access.cpl\1_access.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\20_inetcplc.dll\20_inetcplc.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\21_intl.cpl\21_intl.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\22_joy.cpl\22_joy.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\23_keymgr.dll\23_keymgr.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\24_logon.scr\24_logon.scr.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\25_main.cpl\25_main.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\26_migwiz.exe\26_migwiz.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\27_mmsys.cpl\27_mmsys.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\28_moricons.dll\28_moricons.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\29_msgina.dll\29_msgina.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\2_ahui.exe\2_ahui.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\30_mshtml.dll\30_mshtml.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\31_mspaint.exe\31_mspaint.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\32_mstask.dll\32_mstask.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\33_mstscax.dll\33_mstscax.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\34_mydocs.dll\34_mydocs.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\35_narrator.exe\35_narrator.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\36_ncpa.cpl\36_ncpa.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\37_netid.dll\37_netid.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\38_netshell.dll\38_netshell.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\39_newdev.dll\39_newdev.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\3_appwiz.cpl\3_appwiz.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\40_notepad.exe\40_notepad.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\41_ntshrui.dll\41_ntshrui.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\42_nusrmgr.cpl\42_nusrmgr.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\43_occache.dll\43_occache.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\44_powercfg.cpl\44_powercfg.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\45_printui.dll\45_printui.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\46_rasdlg.dll\46_rasdlg.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\47_regedit.exe\47_regedit.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\48_shdoclc.dll\48_shdoclc.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\49_shdocvw.dll\49_shdocvw.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\4_batmeter.dll\4_batmeter.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\50_shell32.dll\50_shell32.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\51_shimgvw.dll\51_shimgvw.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\52_shlwapi.dll\52_shlwapi.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\53_sndrec32.exe\53_sndrec32.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\54_sndvol32.exe\54_sndvol32.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\55_stobject.dll\55_stobject.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\56_sysdm.cpl\56_sysdm.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\57_sysocmgr.exe\57_sysocmgr.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\58_syssetup.dll\58_syssetup.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\59_taskmgr.exe\59_taskmgr.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\5_browseui.dll\5_browseui.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\60_telephon.cpl\60_telephon.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\61_themeui.dll\61_themeui.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\62_timedate.cpl\62_timedate.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\63_url.dll\63_url.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\64_urlmon.dll\64_urlmon.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\65_webcheck.dll\65_webcheck.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\66_wiaacmgr.exe\66_wiaacmgr.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\67_wiashext.dll\67_wiashext.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\68_wininet.dll\68_wininet.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\69_WINNTBBU.DLL\69_WINNTBBU.DLL.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\6_cabview.dll\6_cabview.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\70_winsrv.dll\70_winsrv.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\71_wscui.cpl\71_wscui.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\72_wuauclt.exe\72_wuauclt.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\73_wuauclt1.exe\73_wuauclt1.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\74_wuaucpl.cpl\74_wuaucpl.cpl.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\75_xpsp2res.dll\75_xpsp2res.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\76_zipfldr.dll\76_zipfldr.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\77_logonui.exe\77_logonui.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\78_iexplore.exe\78_iexplore.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\79_msimn.exe\79_msimn.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\7_calc.exe\7_calc.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\80_msoeres.dll\80_msoeres.dll.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\81_moviemk.exe\81_moviemk.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\8_cleanmgr.exe\8_cleanmgr.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\ResFiles\9_cmd.exe\9_cmd.exe.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Data\Data.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Docklets\Docklets.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Icons\Icons.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Languages\Languages.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\License_files\License_files.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Tools\Tools.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\Data\Data.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\Languages\Languages.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\License_files\License_files.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberAPI\UberAPI.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\Languages\Languages.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Audio.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\Cnt.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Css\Css.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Img.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Scr\Scr.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Video\Video.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\1033.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1036\1036.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\ASP.NETClientFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\CONFIG.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fr\fr.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW1816\SHADOW1816.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\Updates.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\1033.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\ASP.NETWebAdminFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\CONFIG.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\Microsoft .NET Framework 2.0.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild\MSBuild.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RedistList\RedistList.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Config\Cache\Cache.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\OfflineCache\Personal_32#040c\Personal_32#040c.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\blurbs.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\CompatCtr.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\css\css.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\dialogs\dialogs.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\DVDUpgrd\DVDUpgrd.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\ErrMsg\ErrMsg.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\errors\errors.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\images\images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\NetDiag\NetDiag.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\panels\panels.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Systemcc.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Remote Assistance.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\scripts\scripts.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\sysinfo.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\UpdateCtr\UpdateCtr.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\SoftwareDistribution\Download\d3c2d09b276caa4aac6cb42653aaddc6\update\update.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\html\dslmain\dslmain.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\html\iconnect\iconnect.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\html\isptype\isptype.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\html\mouse\mouse.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\html\sconnect\sconnect.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\mui\041e\041e.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\DriverFiles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\spool\drivers\color\color.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\spool\drivers\w32x86\w32x86.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\spool\prtprocs\w32x86\w32x86.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\wbem\mof\good\good.exe"
Sun 29 Apr 2007       389,120 A.SH. --- "C:\Documents and Settings\Guisse\Mes documents\Geoffrey\Remettre dans portable\Photos\SIVF1.tmp"
Wed 19 Dec 2007        89,088 ...H. --- "C:\Games\Worms Armageddon - New Edition\DATA\User\Speech\English\English.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\Help\_design\_css\_css.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\Help\_design\_img\_img.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\iColorFolder\skins\Vista Inspirat\Vista Inspirat.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Defaults\DefaultIcons\DefaultIcons.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Defaults\DefaultIndicator\DefaultIndicator.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Defaults\DefaultPoof\DefaultPoof.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Defaults\DefaultSkin\DefaultSkin.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Docklets\RocketClock\RocketClock.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\Chinese\Chinese.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\Czech\Czech.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\English\English.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\French\French.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\German\German.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\Korean\Korean.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\Polish\Polish.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\shared\shared.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\Spanish\Spanish.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\TraditionalChinese\TraditionalChinese.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\Turkish\Turkish.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\Aero Milk\Aero Milk.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\AstroGlass\AstroGlass.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\AstroGrey\AstroGrey.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\AstroIron\AstroIron.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\AstroLife\AstroLife.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\AstroOrange\AstroOrange.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\AstroSteel\AstroSteel.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\Blank\Blank.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\Brushed\Brushed.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\CrystalXP.net\CrystalXP.net.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\Inspirat\Inspirat.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\Luminous\Luminous.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\Milk1\Milk1.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\Milk2\Milk2.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\Minired\Minired.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\Painting\Painting.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\ProtoClay\ProtoClay.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\ProtoGlass\ProtoGlass.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\ProtoIron\ProtoIron.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\ProtoSea\ProtoSea.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\ProtoSky\ProtoSky.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\ProtoSteel\ProtoSteel.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\ProtoTree\ProtoTree.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\Simply\Simply.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\Special-RD\Special-RD.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\ToonBLue\ToonBLue.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\Vista\Vista.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\VistaBlack\VistaBlack.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\WhiteCristal\WhiteCristal.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Skins\ZaKtoon\ZaKtoon.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\Data\About\About.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\Plugins\iBounce\iBounce.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\Plugins\iZoom\iZoom.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\Wav.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\Btn.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\WMarks.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MUI\0409\0409.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MUI\040C\040C.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\AppConfig.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\App_Code.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Data\App_Data.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_GlobalResources\App_GlobalResources.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\App_LocalResources.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\Images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\Providers.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Security.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\Browsers.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI\0409\0409.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\images\16x16\16x16.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\images\24x24\24x24.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\images\32x32\32x32.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\images\48x48\48x48.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\images\Centers\Centers.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\images\Expando\Expando.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\subpanels.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Common\Common.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Css\Css.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\graphics\graphics.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Remote Assistance.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Inspirat2\Shell\AeroBlue\AeroBlue.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Inspirat2\Shell\AeroBlack\AeroBlack.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Inspirat2\Shell\ClassicXP\ClassicXP.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Inspirat2\Shell\NormalColor\NormalColor.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Luna\Shell\Homestead\Homestead.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Luna\Shell\Metallic\Metallic.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Luna\Shell\NormalColor\NormalColor.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Vista\Shell\NormalColor\NormalColor.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Vista\Shell\VISTA12\VISTA12.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Vista\Shell\VISTA2\VISTA2.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Resources\Themes\Vista\Shell\VISTA22\VISTA22.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\oobe\html\mouse\images\images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\i386\i386.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\spool\drivers\w32x86\3\3.exe"
Sun 17 Jun 2007       446,464 A.SH. --- "C:\Documents and Settings\Guisse\Mes documents\Photos\Photos ann‚e 2007\Mariage Flo-Claude\Mariage Claude1\SIV10.tmp"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Docklets\RocketClock\Images\Images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\Chinese\images\images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\Czech\images\images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\English\images\images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\French\images\images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\German\images\images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\Korean\images\images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\Polish\images\images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\shared\flags\flags.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\Spanish\images\images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\TraditionalChinese\images\images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\Help\Turkish\images\images.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\Plugins\iBounce\Source\Source.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\Plugins\iZoom\Source\Source.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\App_LocalResources.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\App_LocalResources.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\App_LocalResources.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\Permissions.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\Roles.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\Users.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\Wizard.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\Client.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\Common.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Server\Server.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\graphics\33x16pie\33x16pie.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\graphics\47x24pie\47x24pie.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\Common.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\Css.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.381\7.0.6000.381.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\App_LocalResources.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\App_LocalResources.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\App_LocalResources.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\App_LocalResources.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Common.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\Email.exe"
Wed 19 Dec 2007        89,088 ...H. --- "C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\Unsolicited.exe"

Finished! 




HijackThis :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:18:26, on 25/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\CmWatch.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS	snp2std.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\srvreg.exe
C:\WINDOWS\system32\shovth.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32eg.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS	snp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [Medichi] medichi.exe
O4 - HKLM\..\Run: [Medichi2] medichi2.exe
O4 - HKLM\..\Run: [sis32] C:\WINDOWS\system32\winsos.exe
O4 - HKLM\..\Run: [winroot] C:\WINDOWS\system32\winsn.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [srvreg] C:\WINDOWS\system32\srvreg.exe
O4 - HKCU\..\Run: [StartUp] C:\WINDOWS\Temp\checkmem.exe /optimize speed
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

Le sioux · Answer

Re

Télécharge Zebrestore http://telechargement.zebulon.fr/233-zeb-restore.html

Met le dans un dossier sur ton bureau par exemple.

* Lance Zebrestore et coche les cases suivante :

Panneau de config
Policies
Fichier Hosts
Windows Update
Regedit

et clique sur le bouton "Restaurer".

Quitte le programme.

Et dis moi si ces fonctions remarchent ;-)  ...  essaye de régler l heure entre autre.

et dis moi si tu as d autres restrictions en vigueur sur ton PC .


Refais un nouveau rapport HijackThis stp, celui ci semble identique a celui avant le passage de SDFix et ce n'est pas logique ...

@ suivre

GeoGeo · Answer

Les réstrictions sont parties ! C'est géniale ! Merci beaucoup !

Voici un nouveau rapport HijackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:47:26, on 27/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\CmWatch.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\AxBx\VirusKeeper 2008 Pro Evaluation\VirusKeeper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\srvreg.exe
C:\WINDOWS\system32\shovth.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS	snp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [Medichi] medichi.exe
O4 - HKLM\..\Run: [Medichi2] medichi2.exe
O4 - HKLM\..\Run: [sis32] C:\WINDOWS\system32\winsos.exe
O4 - HKLM\..\Run: [winroot] C:\WINDOWS\system32\winsn.exe
O4 - HKLM\..\Run: [VirusKeeper] C:\Program Files\AxBx\VirusKeeper 2008 Pro Evaluation\VirusKeeper.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [srvreg] C:\WINDOWS\system32\srvreg.exe
O4 - HKCU\..\Run: [StartUp] C:\WINDOWS\Temp\checkmem.exe /optimize speed
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O20 - AppInit_DLLs: murka.dat
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

Le sioux · Answer

Bonjour Geogeo

Cool, mais cela ne durera peut être pas car il reste encore un sacré ménage a faire ...

Télécharge  Combofix.exe de sUBs sur ton Bureau,

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Déconnecte toi du net et désactive ton antivirus  pour que Combofix puisse s'exécuter normalement

Double clique sur Combofix.exe
Mets le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan
Lorsque le scan sera terminé, un rapport apparaîtra.

Poste le en réponse.

Note : Le rapport se trouve également là : C:\Combofix.txt+

@ suivre

GeoGeo · Answer

Re,
ya un problème, quand je double-clique sur le logiciel Combofix.exe et qu'après je met "éxectuer" rien ne se passe !

Le sioux · Answer

Bonsoir

Ok, on va faire autrement :

Je te conseille d'enregistrer la page en sélectionnant toutes les lignes puis de copier cette sélection dans un fichier texte sur ton PC pour pouvoir appliquer la procédure correctement. 
(Note: tu n'auras pas accès à Internet à partir du moment ou te redémarreras en mode sans échec) 
Il faut exécuter toutes les étapes, sans interruption, dans l'ordre exact indiqué ci-dessous. 
Si un élément te paraît obscur, demande des explications avant de commencer la désinfection 

1) Télécharge 

-- OTMoveIt de Old_Timer sur ton Bureau. 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe 
N'y touche pas pour le moment. 

-- CCleaner 
https://www.ccleaner.com/ccleaner/download 
Choisi de préférence la version SLIM-No Toolbar. 
Installe-le en prenant soin de décocher les diverses options dont la barre Yahoo et la mise à jour. 
Lance CCleaner puis Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Pour les autres paramètres, laisse-le avec ses réglages par défaut. 
Ferme le programme pour l’instant. 

-- La version d'essai d'AVG Anti-Spyware 7.5 depuis http://www.grisoft.com/doc/downloads-products/ww/crp/0?prd=triasw 
Installe la puis...Lancer AVG Anti-Spyware. 
Clique sur le menu Mise à jour. 
Dans le paragraphe Mise à jour manuelle, cliquer sur le bouton Commencer la mise à jour. 
Attends la fin de cette mise à jour puis ferme le programme. 
Ne pas lancer d'analyse maintenant 

2) Redémarre en mode sans échec 

Regarde ici si besoin avant ici : http://pageperso.aol.fr/loraline60/mode_sans_echec.htm 
Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement, appuie sur la touche [F8] (ou [F5] sur certains pc) jusqu'à l'affichage du menu des options avancées de Windows. 
Sélectionner "Mode sans échec" et appuie sur [Entrée] 
Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre. 

Ouvre le fichier texte sauvegardé sur le Bureau afin de suivre les instructions comme il faut. 

3) Lance HijackThis. 

Lance Hijackthis en double cliquant sur son raccourci sur le Bureau. 
Clique sur Scan Only et coche les lignes suivantes : 

O4 - HKLM\..\Run: [Medichi] medichi.exe 
O4 - HKLM\..\Run: [Medichi2] medichi2.exe 
O4 - HKLM\..\Run: [sis32] C:\WINDOWS\system32\winsos.exe 
O4 - HKLM\..\Run: [winroot] C:\WINDOWS\system32\winsn.exe 
O4 - HKCU\..\Run: [srvreg] C:\WINDOWS\system32\srvreg.exe 

Ferme toutes les autres fenêtres, tous les autres programmes. 

Clique sur Fix Checked puis clique sur OK 
Puis ferme hijackthis. 

4) OTMoveIt de Old_Timer

Double clique sur OTMoveIt.exe pour le lancer. 
Copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt : 
Paste List of Files/Folders to be moved. 

C:\WINDOWS\system32\srvreg.exe 
C:\WINDOWS\system32\medichi.exe 
C:\WINDOWS\system32\medichi2.exe 

Clique sur MoveIt! pour lancer la suppression. 
Le résultat apparaîtra dans le cadre Results. 
Clique sur Exit pour fermer. 

Il te sera peut-être demander de redémarrer le PC pour achever la suppression. 
si c'est le cas accepte par Yes. 

5) Lance AVG Anti-Spyware 7.5 

--Réglages 
Clique sur le menu Analyse (de la barre d'outils). 
Clique sur l'onglet Paramètres. 
Dans Comment réagir? clique sur Actions recommandées et choisir Quarantaine. 
Dans Comment faire l'analyse ? et dans Programmes potentiellement dangereux, vérifier que toutes les cases soient cochées. 
Dans Rapports cocher "générer un rapport après chaque analyse" 

-- Scan 
Dans l'onglet Analyse 
Clique sur Analyse complète du système. 
Important : Ne pas ouvrir de fenêtre, ne pas lancer de programme pendant l'exécution de AVG Anti-Spyware, car cela pourrait interférer avec le processus de recherche. 
Cliquer sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.(C:\Programfiles\AVG Antispyware 7.5\Reports) 

Tres important : A la fin de l'analyse, clique sur " Appliquer toutes les actions" 

Puis ferme AVG Anti-Spyware. 

6) Suppression de fichiers inutiles avec CCleaner 

Lance CCleaner en double-cliquant sur son raccourci sur le bureau. 
Puis dans le menu Nettoyeur 
Clique sur Analyse (laisser travailler cela peut durer longtemps la 1ere fois) 
Clique sur le bouton Lancer le nettoyage. 
Clique une seconde fois sur le bouton Lancer le nettoyage puis ferme CCleaner. 

7) Rapports 

Fais redémarrer ton PC en mode normal puis poste en réponse : 

* Le rapport d’OTMoveIt situé dans C:\_OTMoveIt\MovedFiles (contenu du fichier C:\_OTMoveIt\MovedFiles\********_******.log - les *** sont des chiffres représentant la date et l'heure) 

 * Le rapport d'AVG Antispyware 7.5 (qui se trouve C:\Programfiles\AVG Antispyware 7.5\Reports)

* Un nouveau rapport HijackThis.

Bon courage, a plus.

GeoGeo · Answer

Bonsoir, désolé de ne pas avoir donné de nouvelles mais j'ai été absent ces jours ci.
J'ai un problème par rapport à AVG antispyware, je n'arrive pas à l'installer. Il me dit toujours que ça marche pas et qu'il faut que je réinstalle le logiciel. Je fait comment ?

Utilisateur anonyme · Answer

Salut GeoGeo et bien sûr Le sioux, bonne année à vous.

Essaye avec cette version : http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware

Le sioux · Answer

Bonsoir géo géo

Salut DIID , meilleurs voeux a vous deux.

Geo geo desinstalle le et reinsatlle le , il arrive qu aAvg Antispyware soit "capricieux"

@ +

GeoGeo · Answer

Bonjour à vous et bonne année 2008,
J'arrive toujours pas à ouvrir AVG Antispyare. Voilà ce qu'il me met :
http://img214.imageshack.us/img214/1616/ffffih1.png
Je sais pas ce que je doit faire, quand je réinstalle c'est pareil.

Utilisateur anonyme · Answer

Salut,
Je pense que c'est ton parefeu qui bloque l'installation.
Désactive-le le temps de l'installation de AVG.

Le sioux · Answer

Bonsoir

S'il bloque, fais la manip sans utiliser AVG Antispyware,on verra ce que cela donne;)

Poste les rapports quand terminé.

@ +

GeoGeo · Answer

Merci, voilà ce que ça donne sans AVG Antispyware :

Je rappelle que les dates et heures sont fausses car mon horloge se dérègle toutes les 2 minutes !

rapport d’OTMoveIt :

C:\WINDOWS\system32\srvreg.exe moved successfully.
File/Folder C:\WINDOWS\system32\medichi.exe not found.
File/Folder C:\WINDOWS\system32\medichi2.exe not found.
 
Created on 12/29/2007 23:45:35


rapport HijackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:17:26, on 06/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\CmWatch.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\WebcamMax\wcmmon.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\AxBx\VirusKeeper 2008 Pro Evaluation\VirusKeeper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\shovth.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32eg.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684BB} - C:\Program Files\Helper\ifastseek.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\wcmmon.exe" /a
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS	snp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [VirusKeeper] C:\Program Files\AxBx\VirusKeeper 2008 Pro Evaluation\VirusKeeper.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Medichi] medichi.exe
O4 - HKLM\..\Run: [Medichi2] medichi2.exe
O4 - HKLM\..\Run: [sis32] C:\WINDOWS\system32\winsos.exe
O4 - HKLM\..\Run: [winroot] C:\WINDOWS\system32\winsn.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

GeoGeo · Answer

Bonsoir à vous, voilà ce que ça donne sans AVG Antispyware :

Je rappelle que l'heure et la date des rapports ne sont pas correct, mon horloge se dérègle toutes les 2 minutes.

Rapport OTMoveIT :

C:\WINDOWS\system32\srvreg.exe moved successfully.
File/Folder C:\WINDOWS\system32\medichi.exe not found.
File/Folder C:\WINDOWS\system32\medichi2.exe not found.
 
Created on 12/29/2007 23:45:35


Rapport HijackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:17:26, on 06/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\CmWatch.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\WebcamMax\wcmmon.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\AxBx\VirusKeeper 2008 Pro Evaluation\VirusKeeper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\shovth.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32eg.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684BB} - C:\Program Files\Helper\ifastseek.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\wcmmon.exe" /a
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS	snp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [VirusKeeper] C:\Program Files\AxBx\VirusKeeper 2008 Pro Evaluation\VirusKeeper.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Medichi] medichi.exe
O4 - HKLM\..\Run: [Medichi2] medichi2.exe
O4 - HKLM\..\Run: [sis32] C:\WINDOWS\system32\winsos.exe
O4 - HKLM\..\Run: [winroot] C:\WINDOWS\system32\winsn.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

GeoGeo · Answer

(Désolé deuxième message non volontaire)

Le sioux · Answer

Bonsoir GeoGeo

Reste un soucis avec medichi.exe  et  medichi2.exe  ... 

On va faire un recherche avec OAD  de !aur3n7 :

Télécharge OAD de !aur3n7 http://sosvirus.changelog.fr/OAD.exe 

Enregistre le sur ton Bureau 

Double clique sur le OAD pour le lancer 

medichi.exe

- Type de recherche : sélectionne l’option 6 puis valide [entrée] 

OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ai terminé. 
Le rapport de recherche s'affichera automatiquement à dès qu'il en aura terminé, sauvegarde le sur ton Bureau. 

--> Fais de même pour medichi2.exe 

Poste ces deux rapports en réponse.

@ suivre.

GeoGeo · Answer

Bonsoir, voilà ce que donne les rapports :

medichi.exe  :

 06/12/2008 ----  5:54:46,18  

----------------------------------
§§§§§§ [medichi.exe] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Medichi"="medichi.exe"

[HKEY_USERS\S-1-5-21-1606980848-179605362-1177238915-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\WINDOWS\medichi.exe"="medichi"

*******************
     [Fichier] 
*******************

c:\WINDOWS\medichi.exe


*********************
     [Même date] 
*********************

[24/12/2007 ] --- REP ---> C:\Program Files\splus   
[24/12/2007 ] --- REP ---> C:\Program Files\Trend Micro  
[24/12/2007 ] ---> C:\heroglyph-protocol.txt   
[24/12/2007 ] ---> C:apport.txt   
[24/12/2007 ] ---> C:\vitascene-protocol.txt   
[24/12/2007 ] ---> C:\WINDOWS\medichi.exe   
[24/12/2007 ] ---> C:\WINDOWS\medichi2.exe   
[24/12/2007 ] ---> C:\WINDOWS\murka.dat   
[24/12/2007 ] ---> C:\WINDOWS\system32\dumphive.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\IEDFix.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\Process.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\splus.cpl   
[24/12/2007 ] ---> C:\WINDOWS\system32\SrchSTS.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\swreg.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\swsc.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\swxcacls.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32	mp.reg   
[24/12/2007 ] ---> C:\WINDOWS\system32	mp.txt   
[24/12/2007 ] ---> C:\WINDOWS\system32\user32.dat   
[24/12/2007 ] ---> C:\WINDOWS\system32\VCCLSID.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\WS2Fix.exe   



Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------



medichi2.exe  :

 06/12/2008 ----  6:00:26,67  

----------------------------------
§§§§§§ [medichi2.exe] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Medichi2"="medichi2.exe"

[HKEY_USERS\S-1-5-21-1606980848-179605362-1177238915-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\WINDOWS\medichi2.exe"="medichi2"

*******************
     [Fichier] 
*******************

c:\WINDOWS\medichi2.exe


*********************
     [Même date] 
*********************

[24/12/2007 ] --- REP ---> C:\Program Files\splus   
[24/12/2007 ] --- REP ---> C:\Program Files\Trend Micro  
[24/12/2007 ] ---> C:\heroglyph-protocol.txt   
[24/12/2007 ] ---> C:apport.txt   
[24/12/2007 ] ---> C:\vitascene-protocol.txt   
[24/12/2007 ] ---> C:\WINDOWS\medichi.exe   
[24/12/2007 ] ---> C:\WINDOWS\medichi2.exe   
[24/12/2007 ] ---> C:\WINDOWS\murka.dat   
[24/12/2007 ] ---> C:\WINDOWS\system32\dumphive.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\IEDFix.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\Process.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\splus.cpl   
[24/12/2007 ] ---> C:\WINDOWS\system32\SrchSTS.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\swreg.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\swsc.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\swxcacls.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32	mp.reg   
[24/12/2007 ] ---> C:\WINDOWS\system32	mp.txt   
[24/12/2007 ] ---> C:\WINDOWS\system32\user32.dat   
[24/12/2007 ] ---> C:\WINDOWS\system32\VCCLSID.exe   
[24/12/2007 ] ---> C:\WINDOWS\system32\WS2Fix.exe   



Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------


Voilà pour cette étape.
Merci !

Le sioux · Answer

Re

Bien joué, on passe au nettoyage :

Je te conseille d'enregistrer la page en sélectionnant toutes les lignes puis de copier cette sélection dans un fichier texte sur ton PC pour pouvoir appliquer la procédure correctement. 
(Note: tu n'auras pas accès à Internet à partir du moment ou te redémarreras en mode sans échec) 
Il faut exécuter toutes les étapes, sans interruption, dans l'ordre exact indiqué ci-dessous. 
Si un élément te paraît obscur, demande des explications avant de commencer la désinfection 

1) Creation de Fix.reg 

Crée un nouveau document texte : 

Clic droit de souris sur le bureau, "Nouveau"> "Document Texte". Ouvre-le et copie-colle dedans de ce qui est en citation ci-dessous, (copie tout d'un trait) : 

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"Medichi2"=-
"medichi.exe"=-

[HKEY_USERS\S-1-5-21-1606980848-179605362-1177238915-1004\Software\Microsoft\Windows\Shell NoRoam\MUICache] 
"C:\WINDOWS\medichi2.exe"=-
"C:\WINDOWS\medichi.exe"=-

Puis "fichier"/"enregistrer sous" : 
dans : sur le Bureau 
Nom du fichier : Fix.reg 
Type de fichier : "tous les fichiers" 
clique sur "enregistrer" 

Note: 
* Lors de l'enregistrement, il faut choisir pour le champ "Type": "Tous les fichiers" 
* Fait bien attention que REGEDIT 4 soit sur la toute 1ere ligne 

2) Redémarre en mode sans échec 

Regarde ici si besoin avant ici : http://pageperso.aol.fr/loraline60/mode_sans_echec.htm 
Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement, appuie sur la touche [F8] (ou [F5] sur certains pc) jusqu'à l'affichage du menu des options avancées de Windows. 
Sélectionner "Mode sans échec" et appuie sur [Entrée] 
Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre. 

Ouvre le fichier texte sauvegardé sur le Bureau afin de suivre les instructions comme il faut. 

3) Utilisation du Regfix

Double clique sur regfix.reg (que tu as créé sur ton bureau) 

=> tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?" 
Si c'est bien le cas, clique sur "oui"

4) OTMoveIt de Old_Timer 

Double clique sur OTMoveIt.exe pour le lancer. 
Copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt : 
Paste List of Files/Folders to be moved. 
 
C:\WINDOWS\medichi.exe 
C:\WINDOWS\medichi2.exe 

Clique sur MoveIt! pour lancer la suppression. 
Le résultat apparaîtra dans le cadre Results. 
Clique sur Exit pour fermer. 

Il te sera peut-être demander de redémarrer le PC pour achever la suppression. 
si c'est le cas accepte par Yes. 

 5) Rapports 

Fais redémarrer ton PC en mode normal puis poste en réponse : 

* Le rapport d’OTMoveIt situé dans C:\_OTMoveIt\MovedFiles (contenu du fichier C:\_OTMoveIt\MovedFiles\********_******.log - les *** sont des chiffres représentant la date et l'heure) 

* Un nouveau rapport HijackThis. 

Bon courage, a plus

GeoGeo · Answer

Ok, merci pour les manips,
voilà les résultats :


Test OTMoveIT :

C:\WINDOWS\medichi.exe moved successfully.
C:\WINDOWS\medichi2.exe moved successfully.
 
Created on 12/06/2008 22:48:13


Test HijackThis :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:17:26, on 06/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\CmWatch.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\WebcamMax\wcmmon.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\AxBx\VirusKeeper 2008 Pro Evaluation\VirusKeeper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\shovth.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32eg.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684BB} - C:\Program Files\Helper\ifastseek.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\wcmmon.exe" /a
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS	snp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [VirusKeeper] C:\Program Files\AxBx\VirusKeeper 2008 Pro Evaluation\VirusKeeper.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Medichi] medichi.exe
O4 - HKLM\..\Run: [Medichi2] medichi2.exe
O4 - HKLM\..\Run: [sis32] C:\WINDOWS\system32\winsos.exe
O4 - HKLM\..\Run: [winroot] C:\WINDOWS\system32\winsn.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

Le sioux · Answer

Bonsoir geo geo

Je te conseille d'enregistrer la page en format HTLM afin d’appliquer la procédure comme il faut, pour cela : 

* Avec Internet Explorer 7, presse la touche Alt pour faire apparaître le menu 
- clique sur le menu Fichier (en haut à gauche), puis choisis Enregistrer sous...
- dans la boîte de dialogue Enregistrer sous, pour le champ "Enregistrer dans" (en haut), clique sur la flèche de la "liste déroulante" et choisis Bureau; pour le champ "Type", laisse Page Web complète; pour le champ "Nom du fichier", saisis Discussion en cours; termine en cliquant sur Enregistrer
Pour afficher la page (après redémarrage), double-clique sur "Discussion en cours.htm" situé sur le Bureau.
(Note: tu n'auras pas accès à Internet à partir du moment ou te redémarreras en mode sans échec)

Il faut exécuter toutes les étapes, sans interruption, dans l'ordre exact indiqué ci-dessous.
Si un élément te paraît obscur, demande des explications avant de commencer la désinfection

1) Redémarre en mode sans échec

Regarde ici si besoin avant ici  : http://pageperso.aol.fr/loraline60/mode_sans_echec.htm
Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement, appuie sur la touche [F8]  (ou [F5]  sur certains pc) jusqu'à l'affichage du menu des options avancées de Windows.
Sélectionner "Mode sans échec" et appuie sur  [Entrée] 
Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre. 

Ouvre le fichier HTLM sauvegardé sur le Bureau afin de suivre les instructions comme il faut.

2) Lance HijackThis.

Je te conseille d'enregistrer  toutes les lignes a fixer puis de copier cette sélection dans un fichier texte sur ton PC pour pouvoir appliquer la procédure correctement.

Lance Hijackthis en double cliquant sur son raccourci sur le Bureau.
Clique sur Scan Only et coche les lignes suivantes :

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Medichi] medichi.exe
O4 - HKLM\..\Run: [Medichi2] medichi2.exe
O4 - HKLM\..\Run: [sis32] C:\WINDOWS\system32\winsos.exe
O4 - HKLM\..\Run: [winroot] C:\WINDOWS\system32\winsn.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

Ferme toutes les autres fenêtres, tous les autres programmes. Pas de connections Internet.
Clique sur Fix Checked puis clique sur OK
Puis ferme hijackthis.

Si certaines lignes sont absentes, signale les en fin de procédure

3)  OTMoveIt (de Old_Timer)

Double clique sur OTMoveIt.exe pour le lancer.
Copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :
Paste List of Files/Folders to be moved.

C:\WINDOWS\system32\shovth.exe

Clique sur MoveIt! pour lancer la suppression.
Le résultat apparaîtra dans le cadre Results.
Clique sur Exit pour fermer.

Il te sera peut-être demander de redémarrer le PC pour achever la suppression.
si c'est le cas accepte par Yes.

4) Rapports

Fais redémarrer ton PC en mode normal puis poste en réponse  :

*  Le rapport d’OTMoveIt  situé dans C:\_OTMoveIt\MovedFiles (contenu du fichier C:\_OTMoveIt\MovedFiles\********_******.log - les *** sont des chiffres représentant la date et l'heure)
* Un nouveau rapport HijackThis.

@ suivre

Si on n'avance pas plus , on re essayera d'utiliser ComboFix , je te donnerai un autre lien, ou on fera autrement.

GeoGeo · Answer

Bonjour et merci beaucoup.

Voici les rapports :


Rapport OTMoveIt :


C:\WINDOWS\system32\shovth.exe moved successfully.
 
Created on 12/06/2008 17:43:53



Rapport HijackThis :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:09:19, on 06/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\CmWatch.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\WebcamMax\wcmmon.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmona.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\shovth.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684BB} - C:\Program Files\Helper\ifastseek.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\wcmmon.exe" /a
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS	snp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ctfmona] C:\WINDOWS\system32\ctfmona.exe
O4 - HKLM\..\Run: [VirusKeeper] C:\Program Files\AxBx\VirusKeeper 2008 Pro Evaluation\VirusKeeper.exe
O4 - HKLM\..\Run: [Medichi] medichi.exe
O4 - HKLM\..\Run: [Medichi2] medichi2.exe
O4 - HKLM\..\Run: [sis32] C:\WINDOWS\system32\winsos.exe
O4 - HKLM\..\Run: [winroot] C:\WINDOWS\system32\winsn.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys

Le sioux · Answer

Bonsoir Geo geo

On réessaie :

Télécharge  Combofix.exe de sUBs sur ton Bureau,

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Déconnecte toi du net et désactive ton antivirus  pour que Combofix puisse s'exécuter normalement

Double clique sur Combofix.exe
Mets le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan
Lorsque le scan sera terminé, un rapport apparaîtra.

Poste le en réponse.

Note : Le rapport se trouve également là : C:\Combofix.txt+

@ suivre

GeoGeo · Answer

Ok, voilà le rapport.

ComboFix 08-01-09.2 - Guisse 2008-01-09 19:13:17.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.1.1036.18.1325 [GMT 1:00]
Running from: C:\Documents and Settings\Guisse\Local Settings\Temporary Internet Files\Content.IE5\VVWD0QSN\ComboFix[1].exe
 * Created a new restore point

Ca ma dit que l'heure sera désormais réglé et que je n'aurai plus à y toucher !

Au fait j'ai oublié de dire que dans les manip précédantes j'ai pas trouver, dans HijackThis, les fichiers suivants :
- O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
- O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')

Voilà, merci.

Le sioux · Answer

Bonsoir geogeo

Le rapport de comboFix est plus qu'incomplet ...

@ suivre

GeoGeo · Answer

Je n'ai rien d'autre comme rapport. Je n'ai pas put utiliser votre lien Combofix car le logiciel était expiré, j'ai donc téléchargé une version plus récente de Combofix.exe de sUBs et apparament après toutes ses manipulations le message d'erreur ne viens plus, les réstrictions ont disparues, je veut pas crier victoire mais apparement ça a l'air d'allé mieux. Vous pensez qu'un rapport HijackThis pourrait confirmer ?

Le sioux · Answer

Re

Ouaips, besoin rapport Hijackthis et celui de ComboFix

@ +

GeoGeo · Answer

Bonjour, en fait mon ordi a recommencé à beugué et j'ai compris pourquoi j'avais pas de rapport complet de Combofix, mon ordi s'est arrété avant le fin. Du coup j'en ai refait un et voilà le rapport : -ComboFix 08-01-10.2 - Guisse 2008-01-10 4:14:54.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1320 [GMT 1:00] Running from: C:\Documents and Settings\Guisse\Local Settings\Temporary Internet Files\Content.IE5\QBEIJXDQ\ComboFix[1].exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . [color=red]C:\WINDOWS\system32\dllcache\beep.sys[/color] [color=red]C:\WINDOWS\system32\drivers\beep.sys[/color] C:\.exe C:\Program Files\eliteprotector C:\Program Files\Helper C:\Program Files\Helper\ifastseek.dll C:\WINDOWS\medichi.exe C:\WINDOWS\medichi2.exe C:\WINDOWS\murka.dat C:\WINDOWS\system32\1033\1033.exe C:\WINDOWS\system32\1036\1036.exe C:\WINDOWS\system32\ctfmona.exe C:\WINDOWS\system32 estore estore.exe C:\WINDOWS\system32\shovth.exe C:\WINDOWS\system32\system32.exe C:\WINDOWS\system32\user32.dat C:\WINDOWS\system32\users32.dat C:\WINDOWS\system32\winsn.exe C:\WINDOWS\system32\winsos.exe C:\WINDOWS\system32\wowfx.dll C:\WINDOWS rayicons.exe C:\WINDOWS\windisk.dll C:\WINDOWS\windows.exe . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-10 to 2008-01-10 )))))))))))))))))))))))))))))))))))) . 2008-01-10 19:11 . 2008-01-10 19:11 d-------- C:\Program Files\Philips Flat Panel Adjust 2008-01-10 04:23 . 2008-01-10 04:23 268 --ah----- C:\sqmdata09.sqm 2008-01-10 04:23 . 2008-01-10 04:23 244 --ah----- C:\sqmnoopt09.sqm 2008-01-09 19:12 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-12-29 16:44 . 2007-12-29 16:44 d-------- C:\Documents and Settings\Guisse\Application Data\Webcammax 2007-12-29 16:39 . 2007-12-29 16:39 d-------- C:\Documents and Settings\Guisse\Application Data\EasySpywareCleaner.com 2007-12-29 16:38 . 2007-12-29 20:25 d-------- C:\Program Files\EasySpywareCleaner 2007-12-29 15:15 . 2007-12-29 15:15 d-------- C:\Documents and Settings\Guisse\Application Data\Bitdefender 2007-12-29 15:14 . 2007-12-29 05:25 d-------- C:\Program Files\BitDefender 2007-12-29 08:22 . 2007-12-29 08:22 d-------- C:\Program Files\Fichiers communs\snp2std 2007-12-29 08:22 . 2007-12-29 08:22 d-------- C:\Documents and Settings\Guisse\Application Data\InstallShield 2007-12-29 08:22 . 2007-01-26 16:48 12,028,032 --a------ C:\WINDOWS\system32\drivers\snp2sxp.sys 2007-12-29 08:22 . 2006-09-15 13:21 675,840 --a------ C:\WINDOWS\vsnp2std.exe 2007-12-29 08:22 . 2006-11-29 16:11 258,048 --a------ C:\WINDOWS snp2std.exe 2007-12-29 08:22 . 2006-10-03 14:35 249,856 --a------ C:\WINDOWS\system32\vsnp2std.dll 2007-12-29 08:22 . 2007-02-05 15:25 151,552 --a------ C:\WINDOWS\system32 snp2std.dll 2007-12-29 08:22 . 2006-11-16 15:57 77,824 --a------ C:\WINDOWS\system32\csnp2std.dll 2007-12-29 08:22 . 2007-01-25 18:48 25,472 --a------ C:\WINDOWS\system32\drivers\sncamd.sys 2007-12-29 08:22 . 2004-12-09 17:23 15,497 --a------ C:\WINDOWS\snp2std.ini 2007-12-29 08:22 . 2004-12-09 17:23 13,022 --a------ C:\WINDOWS\snp2std.src 2007-12-29 05:28 . 2007-12-29 16:44 d-------- C:\Documents and Settings\All Users\Application Data\Webcammax 2007-12-29 05:27 . 2007-12-29 16:47 d-------- C:\Program Files\WebcamMax 2007-12-29 02:55 . 2007-12-29 02:55 d-------- C:\Program Files\MSECache 2007-12-27 20:25 . 2007-12-27 20:25 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-27 20:23 . 2007-12-27 20:23 d-------- C:\Program Files\CCleaner 2007-12-27 15:07 . 2007-12-27 15:07 d-------- C:\Program Files\Wanadoo Edition 2007-12-27 11:44 . 2007-12-27 11:48 d-------- C:\Program Files\Error Repair Professional 2007-12-26 01:01 . 2007-12-26 01:01 d-------- C:\Program Files\PC Inspector File Recovery 2007-12-26 01:01 . 2002-02-18 18:40 6,200 --a------ C:\WINDOWS\system32\INT13EXT.VXD 2007-12-25 15:27 . 2007-12-19 15:52 89,088 ---h----- C:\WINDOWS\system32\drivers\drivers.exe 2007-12-25 15:18 . 2007-12-19 15:52 89,088 ---h----- C:\WINDOWS\system\system.exe 2007-12-25 14:50 . 2007-12-25 14:50 d-------- C:\Program Files\GetData 2007-12-25 14:50 . 2007-12-25 15:23 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-12-25 14:15 . 2007-12-25 14:15 93 -r-hs---- C:\autorun.inf 2007-12-25 12:36 . 2007-12-25 12:37 d-------- C:\WINDOWS\ERUNT 2007-12-25 08:23 . 2007-12-25 15:33 d-------- C:\Program Files\REST2514 2007-12-25 06:34 . 2007-12-25 06:34 d-------- C:\Program Files\AxBx 2007-12-24 19:54 . 2007-12-25 15:58 2,836 --a------ C:\WINDOWS\system32 mp.reg 2007-12-24 19:52 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-12-24 19:52 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-12-24 19:52 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2007-12-24 19:52 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-12-24 19:52 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-12-24 19:52 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-12-24 19:50 . 2007-12-25 16:04 d-------- C:\SmitfraudFix 2007-12-24 14:04 . 2007-12-24 14:04 d-------- C:\Program Files\splus 2007-12-24 14:04 . 2005-10-17 18:13 447,488 --a------ C:\WINDOWS\system32\splus.cpl 2007-12-24 11:30 . 2007-12-24 11:30 d-------- C:\Program Files\Trend Micro 2007-12-20 22:40 . 2007-12-19 15:52 89,088 ---h----- C:\WINDOWS\system32\config\systemprofile\systemprofile.exe 2007-12-20 22:24 . 2007-12-20 22:41 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-20 21:31 . 2007-12-19 15:52 89,088 ---hs---- C:\F82EC657.exe 2007-12-20 21:31 . 2007-12-19 15:52 89,088 ---h----- C:\Documents and Settings\Guisse\Guisse.exe 2007-12-19 21:33 . 2007-12-19 21:33 2,359,350 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp 2007-12-19 21:33 . 2007-12-19 21:33 65,203 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-12-19 21:23 . 2007-12-19 21:33 6,116 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2007-12-16 13:51 . 2005-06-12 18:29 77,824 --a------ C:\WINDOWS\system32\fmcodec.DLL 2007-12-16 13:29 . 2007-12-16 13:45 171 --a------ C:\WINDOWS\system32 emp_0000_65-20.aok 2007-12-16 13:27 . 2007-12-16 13:27 172 --a------ C:\WINDOWS\system32 est.aok 2007-12-16 13:25 . 2007-12-16 13:26 d-------- C:\Program Files\Allok Video to FLV Converter 2007-12-16 13:25 . 2004-01-11 08:02 258,048 --a------ C:\WINDOWS\system32\GplMpgDec.ax 2007-12-16 13:25 . 2006-10-24 14:16 242,176 --a------ C:\WINDOWS\system32\fixflash.exe 2007-12-16 13:25 . 2007-04-12 14:19 129,024 --a------ C:\WINDOWS\system32\AVERM.dll 2007-12-16 13:25 . 2006-09-26 13:57 28,672 --a------ C:\WINDOWS\system32\AVEQT.dll 2007-12-15 16:40 . 2007-12-15 16:42 d-------- C:\Program Files\AdorageI-GfxDatas 2007-12-15 16:31 . 2007-12-15 16:31 51 --a------ C:\WINDOWS\system32\blue.SITENAME 2007-12-15 16:30 . 2007-12-15 17:13 455 --a------ C:\WINDOWS\VFO.VST 2007-12-15 16:29 . 2002-09-24 11:12 2,653,888 --a------ C:\WINDOWS\system32\LTRDG13n.OCX 2007-12-15 16:29 . 2002-09-24 11:12 534,192 --a------ C:\WINDOWS\system32\LTRVW13N.OCX 2007-12-15 16:29 . 2002-09-24 11:12 466,624 --a------ C:\WINDOWS\system32\LTRPR13n.DLL 2007-12-15 16:29 . 2005-07-12 14:25 401,408 --a------ C:\WINDOWS\system32\pvmjpg30.dll 2007-12-15 16:29 . 2002-09-24 11:12 194,248 --a------ C:\WINDOWS\system32\LTRFD13n.DLL 2007-12-15 16:28 . 2006-03-28 23:50 233,472 --a------ C:\WINDOWS\system32\DiskIO.dll 2007-12-15 16:28 . 2002-09-24 11:12 185,856 --a------ C:\WINDOWS\system32\lfpng13s.dll 2007-12-15 16:28 . 2006-03-28 23:45 184,320 --a------ C:\WINDOWS\system32\RALMain.dll 2007-12-15 16:28 . 2004-01-02 13:28 126,976 --------- C:\WINDOWS\system32\AVIPrAx.dll 2007-12-15 16:28 . 2002-09-24 11:12 79,360 --a------ C:\WINDOWS\system32\lfeps13s.dll 2007-12-15 16:28 . 2002-09-24 11:12 74,752 --a------ C:\WINDOWS\system32\lfgif13s.dll 2007-12-15 16:28 . 2001-12-11 23:21 73,728 --------- C:\WINDOWS\system32\MMAviAx.dll 2007-12-15 16:28 . 2003-04-21 16:11 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll 2007-12-15 16:28 . 2005-12-12 16:57 32,768 --------- C:\WINDOWS\system32\MLPagAx.dll 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.JP 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.IT 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.FR 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.ES 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.DE 2007-12-15 16:26 . 2003-11-10 17:06 16,896 --------- C:\WINDOWS\system32\PSDrvCheck.NL 2007-12-15 16:26 . 2003-10-21 10:02 16,896 --------- C:\WINDOWS\system32\PSDrvCheck.KO 2007-12-15 16:23 . 2007-12-15 16:23 d-------- C:\Program Files\Microsoft SQL Server 2007-12-15 16:23 . 2002-12-17 17:23 33,340 --a------ C:\WINDOWS\system32\dbmsqlgc.dll 2007-12-15 16:23 . 2002-10-20 15:05 24,576 --a------ C:\WINDOWS\system32\dbmsgnet.dll 2007-12-15 16:22 . 2007-12-15 16:22 d-------- C:\WINDOWS\Cache 2007-12-15 16:22 . 2003-03-19 04:04 765,952 --------- C:\WINDOWS\system32\msvcp71d.dll 2007-12-15 16:22 . 2003-03-19 04:03 544,768 --------- C:\WINDOWS\system32\msvcr71d.dll 2007-12-15 16:07 . 2007-12-15 16:07 d-------- C:\Program Files\SmartSound Software 2007-12-15 16:07 . 2007-12-15 16:08 d-------- C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc 2007-12-15 16:04 . 2007-12-29 22:16 d-------- C:\Program Files\QuickTime 2007-12-15 16:04 . 2007-12-15 16:04 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-12-15 16:03 . 2007-12-24 13:38 359 --a------ C:\WINDOWS\VFO.INI 2007-12-12 22:45 . 2007-12-21 22:52 122 --a------ C:\WINDOWS\WA.INI . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-06 16:30 --------- d-----w C:\Program Files\InfeStop 2008-12-06 15:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zabersoft 2008-12-06 15:40 --------- d-----w C:\Program Files\WinHTTrack 2008-12-06 10:36 --------- d-----w C:\Program Files\Spy-Rid 2008-12-06 10:32 --------- d-----w C:\Documents and Settings\Guisse\Application Data\spy-rid.com 2008-12-06 06:17 --------- d-----w C:\Documents and Settings\Guisse\Application Data\InfeStop.com 2008-12-06 01:51 --------- d-----w C:\Documents and Settings\Guisse\Application Data\Azureus 2008-01-10 18:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-10 03:09 --------- d-----w C:\Program Files\eMule 2008-01-09 22:37 --------- d-----w C:\Documents and Settings\Guisse\Application Data\LimeWire 2008-01-09 21:49 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-01-09 21:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-12-29 18:39 --------- d-----w C:\Program Files\LimeWire 2007-12-25 06:50 --------- d-----w C:\Program Files\Google 2007-12-24 15:13 --------- d-----w C:\Program Files\Azureus 2007-12-24 13:51 --------- d-----w C:\Program Files\Windows Live Toolbar 2007-12-24 13:26 --------- d-----w C:\Documents and Settings\Guisse\Application Data\proDAD 2007-12-24 13:24 --------- d-----w C:\Program Files\Moyea 2007-12-24 13:23 --------- d-----w C:\Program Files\Labtec 2007-12-24 13:15 --------- d-----w C:\Program Files\Windows Live 2007-12-24 13:06 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2007-12-24 12:59 --------- d-----w C:\Program Files\Pinnacle 2007-12-22 06:10 --------- d-----w C:\Program Files\DAEMON Tools SearchBar 2007-12-19 20:41 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Media\Media.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\java\Packages\Packages.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\java\Packages\Data\Data.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\java\classes\classes.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\WindowsMediaPlayer.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Video\Video.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Scr\Scr.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\WMarks.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Img.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\Btn.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Css\Css.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\Cnt.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\Wav.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Audio.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\mmTour\mmTour.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\htmlTour\htmlTour.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Help.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Cursors\Cursors.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\AppPatch\AppPatch.exe 2007-12-15 15:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pinnacle 2007-12-07 22:28 1,594,541 ----a-w C:\WINDOWS\WANEUninstaller.exe 2007-12-07 21:44 --------- d-----w C:\Program Files\Worms 3D 2007-12-03 20:33 --------- d-----w C:\Program Files\OpenOffice.org 2.3 2007-11-30 16:10 --------- d-----w C:\Program Files\Video cache view 2007-11-28 21:56 --------- d-----w C:\Program Files\Fichiers communs\Logitech 2007-11-28 21:55 --------- d-----w C:\Program Files\directx 2007-11-28 21:43 --------- d-----w C:\Program Files\webcamXP 2007-11-27 15:18 --------- d-----w C:\Program Files\CrazyPixels 2007-11-26 18:34 --------- d-----w C:\Program Files\proDAD 2007-11-26 18:19 --------- d-----w C:\Program Files\AdorageI-SAL 2007-11-25 20:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pinnacle Studio 2007-11-18 07:49 --------- d-----w C:\Documents and Settings\Guisse\Application Data\OpenOffice.org2 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-12 15:27 87,952 ----a-w C:\WINDOWS\system32\drivers\bdfndisf.sys 2007-10-24 05:26 17,920 ----a-w C:\Documents and Settings\Guisse\Application Data\GDIPFONTCACHEV1.DAT 2007-10-13 20:14 294,912 ----a-w C:\WINDOWS\HideWin.exe 2007-10-13 19:57 558,142 ----a-w C:\WINDOWS\java\Packages\R7X3FJ1N.ZIP 2007-10-13 19:57 155,995 ----a-w C:\WINDOWS\java\Packages\PN335Z7F.ZIP 2005-12-13 13:39 200,704 ----a-w C:\Program Files\ECB.exe 2005-12-13 13:38 122 ----a-w C:\Program Files\Config.ini . [color=red]Files Infected - Win32.Agent.zb[/color] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\system32\CmWatch.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2005-06-08 07:42 14565376 C:\WINDOWS\RTHDCPL.EXE] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2007-12-26 09:10 344064] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-06-29 00:09 32768] "CmCardRun"="C:\WINDOWS\system32\CmWatch.exe" [2007-12-26 09:10 229376] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-12-26 09:10 132496] "LVCOMS"="C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE" [2007-12-26 09:10 135214] "WebcamMaxMoniter"="C:\Program Files\WebcamMax\wcmmon.exe" [2007-08-01 01:55 450048] "FixCamera"="C:\WINDOWS\FixCamera.exe" [2007-02-12 14:50 20480] "tsnp2std"="C:\WINDOWS snp2std.exe" [2006-11-29 16:11 258048] "snp2std"="C:\WINDOWS\vsnp2std.exe" [2006-09-15 13:21 675840] "ctfmona"="C:\WINDOWS\system32\ctfmona.exe" [ ] "VirusKeeper"="C:\Program Files\AxBx\VirusKeeper 2008 Pro Evaluation\VirusKeeper.exe" [2007-10-24 21:23 2618240] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 14:39 294400] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Barre d'état système d'ATI CATALYST.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Barre d'état système d'ATI CATALYST.lnk backup=C:\WINDOWS\pss\Barre d'état système d'ATI CATALYST.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage] C:\Program Files\AdVantage\AdVantage.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2006-10-09 10:28 139264 C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] J:\Logiciel\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eCarteBleue-LPV-P1] --a------ 2005-12-13 14:39 200704 C:\Program Files\ECB.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera] --a------ 2007-02-12 14:50 20480 C:\WINDOWS\FixCamera.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 15:40 155648 C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2006-11-24 00:06 487424 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch] C:\Program Files\DAEMON Tools SearchBar\Search.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearchWHSE] C:\Program Files\DAEMON Tools SearchBar\whse.exe R1 kbfilter;Keyboard Filter Driver;C:\WINDOWS\system32\drivers\kbfilter.sys [2002-10-15 14:48] R1 moufiltr;Mouse Filter Driver;C:\WINDOWS\system32\drivers\moufiltr.sys [2003-01-23 14:29] R2 CamthWDM;WebcamMax, WDM Video Capture;C:\WINDOWS\system32\DRIVERS\CamthWDM.sys [2007-01-11 06:39] R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2007-11-12 16:27] R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 06:58] S3 scan;BitDefender Threat Scanner;C:\WINDOWS\System32\svchost.exe [2004-08-20 00:10] S3 se44bus;Sony Ericsson Device 068 driver (WDM);C:\WINDOWS\system32\DRIVERS\se44bus.sys [2006-11-30 13:58] S3 se44mdfl;Sony Ericsson Device 068 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se44mdfl.sys [2006-11-30 13:58] S3 se44mdm;Sony Ericsson Device 068 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se44mdm.sys [2006-11-30 13:58] S3 se44mgmt;Sony Ericsson Device 068 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se44mgmt.sys [2006-11-30 13:58] S3 se44nd5;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (NDIS);C:\WINDOWS\system32\DRIVERS\se44nd5.sys [2006-11-30 13:58] S3 se44obex;Sony Ericsson Device 068 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se44obex.sys [2006-11-30 13:58] S3 se44unic;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (WDM);C:\WINDOWS\system32\DRIVERS\se44unic.sys [2006-11-30 13:58] S3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2007-01-26 16:48] S3 StMp3Rec;Pilote de périphérique de la restauration de lecteur;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2007-02-15 14:14] S3 UMSSSTOR;C-Media Storage;C:\WINDOWS\system32\DRIVERS\UMSS.SYS [2004-07-13 11:40] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 07:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] \Shell\AutoRun\command - C:\ \Shell\open\Command - C:\F82EC657.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0aeeb6cf-a50f-11dc-8b50-0013d3a45508}] \Shell\AutoRun\command - E:\ \Shell\open\Command - D88777EE.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-10 04:31:30 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-10 4:37:32 - machine was rebooted [Guisse] ComboFix-quarantined-files.txt 2008-01-10 03:37:27 . 2007-12-13 02:05:40 --- E O F --- Et un nouveau rapport HijackThis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 04:47, on 2008-01-10 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\CmWatch.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE C:\Program Files\WebcamMax\wcmmon.exe C:\WINDOWS\FixCamera.exe C:\WINDOWS snp2std.exe C:\WINDOWS\vsnp2std.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\wcmmon.exe" /a O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS snp2std.exe O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe O4 - HKLM\..\Run: [ctfmona] C:\WINDOWS\system32\ctfmona.exe O4 - HKLM\..\Run: [VirusKeeper] C:\Program Files\AxBx\VirusKeeper 2008 Pro Evaluation\VirusKeeper.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/... O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29 O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys

Le sioux · Answer

Bonjour

Ok, il etait temps de pouvoir passer a ComboFix ...

Ton rapport contient encore beaucoup d'éléments négatifs, 2 rogues et des fichiers vérolés ; j'étais en train de t'écrire un script mais je réalise que tu as lancé ComboFix de :

C:\Documents and Settings\Guisse\Local Settings\Temporary Internet Files\Content.IE5\QBEIJXDQ\ComboFix[1].exe

:(

Je t'avais dit télécharge le sur ton Bureau, je pense que ce n'est pas raisonnable d' utiliser un script avec ComboFix placé comme il est ...

Retélécharge  Combofix.exe de sUBs sur ton Bureau.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Déconnecte toi du net et désactive ton antivirus  pour que Combofix puisse s'exécuter normalement

Double clique sur Combofix.exe
Mets le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan
Lorsque le scan sera terminé, un rapport apparaîtra.

---> Poste le en réponse.

Note : Le rapport se trouve également là : C:\Combofix.txt+

Fais aussi cela :

* Va sur VIRUS TOTAL  https://www.virustotal.com/gui/

* Clique sur  "parcourir" :  
C:\WINDOWS\system32\drivers\drivers.exe

*  Recherche le fichier à analyser, puis clique ensuite sur "send".

Il faut patienter car tu es sur une file d'attente.
Le rapport ne sera complet que lorsque tu verras la mention "FINISHED"sur la droite.

Dépose le dans ta prochaine réponse.

Tuto : http://pageperso.aol.fr/loraline60/virus_total.htm

Note : Il est possible que tu es besoin d'avoir accès aux dossiers et fichiers cachés, pour cela  "Affiche les dossiers cachés" Aide toi de  B ) Afficher les dossiers cachés  ici   https://forum.pcastuces.com/sujet.asp?f=25&s=3902  si besoin.

Fais cela aussi avec C:\WINDOWS\system32	emp_0000_65-20.aok et C:\WINDOWS\WA.INI

---> Et poste ces 3 rapports aussi.

@ suivre

GeoGeo · Answer

Bonjour, en fait j'avais exécuter Combofix via internet parceque votre version ne fonctionnait pas (il me disait qu'elle n'était plus à jour), j'en ai donc pris une autre que j'ai trouvé au bout de plusieurs essais; machinalement, au bout de nombreux essais, j'ai fait "éxecuter" au lieu d"enregistrer". Désolé.



Voilà le rapport Combofix :


ComboFix 08-01-11.1 - Guisse 2008-01-11 18:54:27.3 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.1.1036.18.1326 [GMT 1:00]
Running from: C:\Documents and Settings\Guisse\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\.exe
C:\WINDOWS\system32\1033\1033.exe
C:\WINDOWS\system32\1036\1036.exe
C:\WINDOWS\system32\restore\restore.exe
C:\WINDOWS\system32\shovth.exe
C:\WINDOWS\system32\system32.exe
C:\WINDOWS\system32\winsn.

GeoGeo · Answer

Bonjour, en fait j'avais exécuter Combofix via internet parceque votre version ne fonctionnait pas (il me disait qu'elle n'était plus à jour), j'en ai donc pris une autre que j'ai trouvé au bout de plusieurs essais; machinalement, au bout de nombreux essais, j'ai fait "éxecuter" au lieu d"enregistrer". Désolé. Voilà le rapport Combofix : ComboFix 08-01-11.1 - Guisse 2008-01-11 18:54:27.3 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1326 [GMT 1:00] Running from: C:\Documents and Settings\Guisse\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\.exe C:\WINDOWS\system32\1033\1033.exe C:\WINDOWS\system32\1036\1036.exe C:\WINDOWS\system32\restore\restore.exe C:\WINDOWS\system32\shovth.exe C:\WINDOWS\system32\system32.exe C:\WINDOWS\system32\winsn.exe C:\WINDOWS\system32\winsos.exe C:\WINDOWS\trayicons.exe C:\WINDOWS\windisk.dll C:\WINDOWS\windows.exe . ((((((((((((((((((((((((((((( Fichiers créés 2007-12-11 to 2008-01-11 )))))))))))))))))))))))))))))))))))) . 2008-01-11 18:46 . 2008-01-11 18:46 d-------- C:\WINDOWS\LastGood 2008-01-10 19:11 . 2008-01-10 19:11 d-------- C:\Program Files\Philips Flat Panel Adjust 2008-01-10 04:23 . 2008-01-10 04:23 268 --ah----- C:\sqmdata09.sqm 2008-01-10 04:23 . 2008-01-10 04:23 244 --ah----- C:\sqmnoopt09.sqm 2008-01-09 19:12 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-12-29 16:44 . 2007-12-29 16:44 d-------- C:\Documents and Settings\Guisse\Application Data\Webcammax 2007-12-29 16:39 . 2007-12-29 16:39 d-------- C:\Documents and Settings\Guisse\Application Data\EasySpywareCleaner.com 2007-12-29 16:38 . 2007-12-29 20:25 d-------- C:\Program Files\EasySpywareCleaner 2007-12-29 15:15 . 2007-12-29 15:15 d-------- C:\Documents and Settings\Guisse\Application Data\Bitdefender 2007-12-29 15:14 . 2007-12-29 05:25 d-------- C:\Program Files\BitDefender 2007-12-29 08:22 . 2007-12-29 08:22 d-------- C:\Program Files\Fichiers communs\snp2std 2007-12-29 08:22 . 2007-12-29 08:22 d-------- C:\Documents and Settings\Guisse\Application Data\InstallShield 2007-12-29 08:22 . 2007-01-26 16:48 12,028,032 --a------ C:\WINDOWS\system32\drivers\snp2sxp.sys 2007-12-29 08:22 . 2006-09-15 13:21 675,840 --a------ C:\WINDOWS\vsnp2std.exe 2007-12-29 08:22 . 2006-11-29 16:11 258,048 --a------ C:\WINDOWS\tsnp2std.exe 2007-12-29 08:22 . 2006-10-03 14:35 249,856 --a------ C:\WINDOWS\system32\vsnp2std.dll 2007-12-29 08:22 . 2007-02-05 15:25 151,552 --a------ C:\WINDOWS\system32\rsnp2std.dll 2007-12-29 08:22 . 2006-11-16 15:57 77,824 --a------ C:\WINDOWS\system32\csnp2std.dll 2007-12-29 08:22 . 2007-01-25 18:48 25,472 --a------ C:\WINDOWS\system32\drivers\sncamd.sys 2007-12-29 08:22 . 2004-12-09 17:23 15,497 --a------ C:\WINDOWS\snp2std.ini 2007-12-29 08:22 . 2004-12-09 17:23 13,022 --a------ C:\WINDOWS\snp2std.src 2007-12-29 05:28 . 2007-12-29 16:44 d-------- C:\Documents and Settings\All Users\Application Data\Webcammax 2007-12-29 05:27 . 2007-12-29 16:47 d-------- C:\Program Files\WebcamMax 2007-12-29 02:55 . 2007-12-29 02:55 d-------- C:\Program Files\MSECache 2007-12-27 20:25 . 2007-12-27 20:25 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-27 20:23 . 2007-12-27 20:23 d-------- C:\Program Files\CCleaner 2007-12-27 15:07 . 2007-12-27 15:07 d-------- C:\Program Files\Wanadoo Edition 2007-12-27 11:44 . 2007-12-27 11:48 d-------- C:\Program Files\Error Repair Professional 2007-12-26 01:01 . 2007-12-26 01:01 d-------- C:\Program Files\PC Inspector File Recovery 2007-12-26 01:01 . 2002-02-18 18:40 6,200 --a------ C:\WINDOWS\system32\INT13EXT.VXD 2007-12-25 15:27 . 2007-12-19 15:52 89,088 ---h----- C:\WINDOWS\system32\drivers\drivers.exe 2007-12-25 15:18 . 2007-12-19 15:52 89,088 ---h----- C:\WINDOWS\system\system.exe 2007-12-25 14:50 . 2007-12-25 14:50 d-------- C:\Program Files\GetData 2007-12-25 14:50 . 2007-12-25 15:23 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-12-25 14:15 . 2007-12-25 14:15 93 -r-hs---- C:\autorun.inf 2007-12-25 12:36 . 2007-12-25 12:37 d-------- C:\WINDOWS\ERUNT 2007-12-25 08:23 . 2007-12-25 15:33 d-------- C:\Program Files\REST2514 2007-12-25 06:34 . 2007-12-25 06:34 d-------- C:\Program Files\AxBx 2007-12-24 19:54 . 2007-12-25 15:58 2,836 --a------ C:\WINDOWS\system32\tmp.reg 2007-12-24 19:52 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-12-24 19:52 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-12-24 19:52 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2007-12-24 19:52 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-12-24 19:52 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-12-24 19:52 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-12-24 19:50 . 2007-12-25 16:04 d-------- C:\SmitfraudFix 2007-12-24 14:04 . 2007-12-24 14:04 d-------- C:\Program Files\splus 2007-12-24 14:04 . 2005-10-17 18:13 447,488 --a------ C:\WINDOWS\system32\splus.cpl 2007-12-24 11:30 . 2007-12-24 11:30 d-------- C:\Program Files\Trend Micro 2007-12-20 22:40 . 2007-12-19 15:52 89,088 ---h----- C:\WINDOWS\system32\config\systemprofile\systemprofile.exe 2007-12-20 22:24 . 2007-12-20 22:41 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-20 21:31 . 2007-12-19 15:52 89,088 ---hs---- C:\F82EC657.exe 2007-12-20 21:31 . 2007-12-19 15:52 89,088 ---h----- C:\Documents and Settings\Guisse\Guisse.exe 2007-12-19 21:33 . 2007-12-19 21:33 2,359,350 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp 2007-12-19 21:33 . 2007-12-19 21:33 65,203 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-12-19 21:23 . 2007-12-19 21:33 6,116 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2007-12-16 13:51 . 2005-06-12 18:29 77,824 --a------ C:\WINDOWS\system32\fmcodec.DLL 2007-12-16 13:29 . 2007-12-16 13:45 171 --a------ C:\WINDOWS\system32\temp_0000_65-20.aok 2007-12-16 13:27 . 2007-12-16 13:27 172 --a------ C:\WINDOWS\system32\test.aok 2007-12-16 13:25 . 2007-12-16 13:26 d-------- C:\Program Files\Allok Video to FLV Converter 2007-12-16 13:25 . 2004-01-11 08:02 258,048 --a------ C:\WINDOWS\system32\GplMpgDec.ax 2007-12-16 13:25 . 2006-10-24 14:16 242,176 --a------ C:\WINDOWS\system32\fixflash.exe 2007-12-16 13:25 . 2007-04-12 14:19 129,024 --a------ C:\WINDOWS\system32\AVERM.dll 2007-12-16 13:25 . 2006-09-26 13:57 28,672 --a------ C:\WINDOWS\system32\AVEQT.dll 2007-12-15 16:40 . 2007-12-15 16:42 d-------- C:\Program Files\AdorageI-GfxDatas 2007-12-15 16:31 . 2007-12-15 16:31 51 --a------ C:\WINDOWS\system32\blue.SITENAME 2007-12-15 16:30 . 2007-12-15 17:13 455 --a------ C:\WINDOWS\VFO.VST 2007-12-15 16:29 . 2002-09-24 11:12 2,653,888 --a------ C:\WINDOWS\system32\LTRDG13n.OCX 2007-12-15 16:29 . 2002-09-24 11:12 534,192 --a------ C:\WINDOWS\system32\LTRVW13N.OCX 2007-12-15 16:29 . 2002-09-24 11:12 466,624 --a------ C:\WINDOWS\system32\LTRPR13n.DLL 2007-12-15 16:29 . 2005-07-12 14:25 401,408 --a------ C:\WINDOWS\system32\pvmjpg30.dll 2007-12-15 16:29 . 2002-09-24 11:12 194,248 --a------ C:\WINDOWS\system32\LTRFD13n.DLL 2007-12-15 16:28 . 2006-03-28 23:50 233,472 --a------ C:\WINDOWS\system32\DiskIO.dll 2007-12-15 16:28 . 2002-09-24 11:12 185,856 --a------ C:\WINDOWS\system32\lfpng13s.dll 2007-12-15 16:28 . 2006-03-28 23:45 184,320 --a------ C:\WINDOWS\system32\RALMain.dll 2007-12-15 16:28 . 2004-01-02 13:28 126,976 --------- C:\WINDOWS\system32\AVIPrAx.dll 2007-12-15 16:28 . 2002-09-24 11:12 79,360 --a------ C:\WINDOWS\system32\lfeps13s.dll 2007-12-15 16:28 . 2002-09-24 11:12 74,752 --a------ C:\WINDOWS\system32\lfgif13s.dll 2007-12-15 16:28 . 2001-12-11 23:21 73,728 --------- C:\WINDOWS\system32\MMAviAx.dll 2007-12-15 16:28 . 2003-04-21 16:11 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll 2007-12-15 16:28 . 2005-12-12 16:57 32,768 --------- C:\WINDOWS\system32\MLPagAx.dll 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.JP 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.IT 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.FR 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.ES 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.DE 2007-12-15 16:26 . 2003-11-10 17:06 16,896 --------- C:\WINDOWS\system32\PSDrvCheck.NL 2007-12-15 16:26 . 2003-10-21 10:02 16,896 --------- C:\WINDOWS\system32\PSDrvCheck.KO 2007-12-15 16:23 . 2007-12-15 16:23 d-------- C:\Program Files\Microsoft SQL Server 2007-12-15 16:23 . 2002-12-17 17:23 33,340 --a------ C:\WINDOWS\system32\dbmsqlgc.dll 2007-12-15 16:23 . 2002-10-20 15:05 24,576 --a------ C:\WINDOWS\system32\dbmsgnet.dll 2007-12-15 16:22 . 2007-12-15 16:22 d-------- C:\WINDOWS\Cache 2007-12-15 16:22 . 2003-03-19 04:04 765,952 --------- C:\WINDOWS\system32\msvcp71d.dll 2007-12-15 16:22 . 2003-03-19 04:03 544,768 --------- C:\WINDOWS\system32\msvcr71d.dll 2007-12-15 16:07 . 2007-12-15 16:07 d-------- C:\Program Files\SmartSound Software 2007-12-15 16:07 . 2007-12-15 16:08 d-------- C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc 2007-12-15 16:04 . 2007-12-29 22:16 d-------- C:\Program Files\QuickTime 2007-12-15 16:04 . 2007-12-15 16:04 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-12-15 16:03 . 2007-12-24 13:38 359 --a------ C:\WINDOWS\VFO.INI 2007-12-12 22:45 . 2007-12-21 22:52 122 --a------ C:\WINDOWS\WA.INI . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-06 16:30 --------- d-----w C:\Program Files\InfeStop 2008-12-06 15:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zabersoft 2008-12-06 15:40 --------- d-----w C:\Program Files\WinHTTrack 2008-12-06 10:36 --------- d-----w C:\Program Files\Spy-Rid 2008-12-06 10:32 --------- d-----w C:\Documents and Settings\Guisse\Application Data\spy-rid.com 2008-12-06 06:17 --------- d-----w C:\Documents and Settings\Guisse\Application Data\InfeStop.com 2008-12-06 01:51 --------- d-----w C:\Documents and Settings\Guisse\Application Data\Azureus 2008-01-11 17:22 --------- d-----w C:\Program Files\eMule 2008-01-10 22:46 --------- d-----w C:\Documents and Settings\Guisse\Application Data\LimeWire 2008-01-10 18:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-09 21:49 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-01-09 21:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-12-29 18:39 --------- d-----w C:\Program Files\LimeWire 2007-12-26 08:10 229,376 ------w C:\WINDOWS\system32\cmwatch.exe 2007-12-25 06:50 --------- d-----w C:\Program Files\Google 2007-12-24 15:13 --------- d-----w C:\Program Files\Azureus 2007-12-24 13:51 --------- d-----w C:\Program Files\Windows Live Toolbar 2007-12-24 13:26 --------- d-----w C:\Documents and Settings\Guisse\Application Data\proDAD 2007-12-24 13:24 --------- d-----w C:\Program Files\Moyea 2007-12-24 13:23 --------- d-----w C:\Program Files\Labtec 2007-12-24 13:15 --------- d-----w C:\Program Files\Windows Live 2007-12-24 13:06 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2007-12-24 12:59 --------- d-----w C:\Program Files\Pinnacle 2007-12-22 06:10 --------- d-----w C:\Program Files\DAEMON Tools SearchBar 2007-12-19 20:41 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-12-19 20:33 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\srchasst\srchasst.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\srchasst\mui\[u]0[/u]40C\[u]0[/u]40C.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\srchasst\chars\chars.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Registration\Registration.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\UploadLB\Config\Config.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\UploadLB\Binaries\Binaries.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Remote Assistance.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\Unsolicited.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\Email.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Common.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\Css.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\Common.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\UpdateCtr\UpdateCtr.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\System.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\sysinfo.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\graphics\graphics.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\graphics\47x24pie\47x24pie.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\graphics\33x16pie\33x16pie.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\scripts\scripts.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Remote Assistance.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Server\Server.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\Common.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\Client.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Css\Css.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Common\Common.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\rc\rc.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\subpanels.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\panels\panels.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\NetDiag\NetDiag.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\images\images.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\images\Expando\Expando.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\images\Centers\Centers.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\images\48x48\48x48.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\images\32x32\32x32.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\images\24x24\24x24.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\images\16x16\16x16.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\errors\errors.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\ErrMsg\ErrMsg.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\DVDUpgrd\DVDUpgrd.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\dialogs\dialogs.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\css\css.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\CompatCtr.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\blurbs.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\PackageStore\PackageStore.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\OfflineCache\Personal_32#040c\Personal_32#040c.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\OfflineCache\OfflineCache.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\Logs\Logs.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\Indices\Indices.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\DataColl\DataColl.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\Database\Database.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\Config\Config.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\Config\Cache\Cache.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\PCHealth\HelpCtr\Binaries\Binaries.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Media\Media.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\java\Packages\Packages.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\java\Packages\Data\Data.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\java\classes\classes.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\WindowsMediaPlayer.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Video\Video.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Scr\Scr.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\WMarks.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Img.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\Btn.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Css\Css.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\Cnt.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\Wav.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Audio.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\mmTour\mmTour.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Tours\htmlTour\htmlTour.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Help\Help.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\Cursors\Cursors.exe 2007-12-19 14:52 89,088 ---h--w C:\WINDOWS\AppPatch\AppPatch.exe 2007-12-15 15:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pinnacle . [color=red]Files Infected - Win32.Agent.zb[/color] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\system32\CmWatch.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2005-06-08 07:42 14565376 C:\WINDOWS\RTHDCPL.EXE] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2007-12-26 09:10 344064] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-06-29 00:09 32768] "CmCardRun"="C:\WINDOWS\system32\CmWatch.exe" [2007-12-26 09:10 229376] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-12-26 09:10 132496] "LVCOMS"="C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE" [2007-12-26 09:10 135214] "WebcamMaxMoniter"="C:\Program Files\WebcamMax\wcmmon.exe" [2007-08-01 01:55 450048] "FixCamera"="C:\WINDOWS\FixCamera.exe" [2007-02-12 14:50 20480] "tsnp2std"="C:\WINDOWS\tsnp2std.exe" [2006-11-29 16:11 258048] "snp2std"="C:\WINDOWS\vsnp2std.exe" [2006-09-15 13:21 675840] "ctfmona"="C:\WINDOWS\system32\ctfmona.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "StartUp"="C:\WINDOWS\trayicons.exe" [ ] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 14:39 294400] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Barre d'état système d'ATI CATALYST.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Barre d'état système d'ATI CATALYST.lnk backup=C:\WINDOWS\pss\Barre d'état système d'ATI CATALYST.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage] C:\Program Files\AdVantage\AdVantage.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2006-10-09 10:28 139264 C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] J:\Logiciel\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eCarteBleue-LPV-P1] --a------ 2005-12-13 14:39 200704 C:\Program Files\ECB.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera] --a------ 2007-02-12 14:50 20480 C:\WINDOWS\FixCamera.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 15:40 155648 C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2006-11-24 00:06 487424 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch] C:\Program Files\DAEMON Tools SearchBar\Search.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearchWHSE] C:\Program Files\DAEMON Tools SearchBar\whse.exe R1 kbfilter;Keyboard Filter Driver;C:\WINDOWS\system32\drivers\kbfilter.sys [2002-10-15 14:48] R1 moufiltr;Mouse Filter Driver;C:\WINDOWS\system32\drivers\moufiltr.sys [2003-01-23 14:29] R2 CamthWDM;WebcamMax, WDM Video Capture;C:\WINDOWS\system32\DRIVERS\CamthWDM.sys [2007-01-11 06:39] R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2007-11-12 16:27] R3 UMSSSTOR;C-Media Storage;C:\WINDOWS\system32\DRIVERS\UMSS.SYS [2004-07-13 12:40] R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 06:58] S3 scan;BitDefender Threat Scanner;C:\WINDOWS\System32\svchost.exe [2004-08-20 00:10] S3 se44bus;Sony Ericsson Device 068 driver (WDM);C:\WINDOWS\system32\DRIVERS\se44bus.sys [2006-11-30 13:58] S3 se44mdfl;Sony Ericsson Device 068 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se44mdfl.sys [2006-11-30 13:58] S3 se44mdm;Sony Ericsson Device 068 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se44mdm.sys [2006-11-30 13:58] S3 se44mgmt;Sony Ericsson Device 068 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se44mgmt.sys [2006-11-30 13:58] S3 se44nd5;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (NDIS);C:\WINDOWS\system32\DRIVERS\se44nd5.sys [2006-11-30 13:58] S3 se44obex;Sony Ericsson Device 068 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se44obex.sys [2006-11-30 13:58] S3 se44unic;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (WDM);C:\WINDOWS\system32\DRIVERS\se44unic.sys [2006-11-30 13:58] S3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2007-01-26 16:48] S3 StMp3Rec;Pilote de périphérique de la restauration de lecteur;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2007-02-15 14:14] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 07:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] \Shell\AutoRun\command - C:\ \Shell\open\Command - C:\F82EC657.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0aeeb6cf-a50f-11dc-8b50-0013d3a45508}] \Shell\AutoRun\command - E:\ \Shell\open\Command - D88777EE.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-11 18:57:24 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-11 18:59:40 ComboFix-quarantined-files.txt 2008-01-11 17:59:37 ComboFix2.txt 2008-01-10 03:37:33 . 2008-01-11 02:03:05 --- E O F --- Fichier C:\WINDOWS\system32\drivers\drivers.exe : Antivirus Version Dernière mise à jour Résultat AhnLab-V3 2008.1.12.10 2008.01.11 Win-Trojan/Autorun.89088 AntiVir 7.6.0.46 2008.01.11 TR/Crypt.ULPM.Gen Authentium 4.93.8 2008.01.12 - Avast 4.7.1098.0 2008.01.12 - AVG 7.5.0.516 2008.01.12 PSW.Generic5.ADAR BitDefender 7.2 2008.01.13 Win32.Worm.Autorun.GD CAT-QuickHeal 9.00 2008.01.12 TrojanPSW.QQPass.aom ClamAV 0.91.2 2008.01.13 Trojan.Downloader-18693 DrWeb 4.44.0.09170 2008.01.13 Trojan.MulDrop.9985 eSafe 7.0.15.0 2008.01.10 Win32.QQPass.aom eTrust-Vet 31.3.5451 2008.01.11 Win32/Kalbto.A Ewido 4.0 2008.01.12 Trojan.QQPass.aom FileAdvisor 1 2008.01.13 - Fortinet 3.14.0.0 2008.01.13 - F-Prot 4.4.2.54 2008.01.13 W32/Trojan2.NYB F-Secure 6.70.13030.0 2008.01.12 Trojan-PSW.Win32.QQPass.aom Ikarus T3.1.1.20 2008.01.13 Trojan-PWS.Win32.QQPass.aom Kaspersky 7.0.0.125 2008.01.13 Trojan-PSW.Win32.QQPass.aom McAfee 5205 2008.01.11 Downloader.gen.a Microsoft 1.3109 2008.01.13 PWS:Win32/QQpass.KA NOD32v2 2787 2008.01.13 Win32/AutoRun.EU Norman 5.80.02 2008.01.11 W32/QQPass.GXI Panda 9.0.0.4 2008.01.12 W32/Autorun.IC.worm Prevx1 V2 2008.01.13 TROJAN.PSW.PM Rising 20.26.62.00 2008.01.13 - Sophos 4.24.0 2008.01.13 Mal/Behav-119 Sunbelt 2.2.907.0 2008.01.12 Trojan.Crypt.ULPM.Gen Symantec 10 2008.01.13 W32.SillyFDC TheHacker 6.2.9.186 2008.01.11 Trojan/PSW.QQPass.aom VBA32 3.12.2.5 2008.01.13 Trojan-PSW.Win32.QQPass.aom VirusBuster 4.3.26:9 2008.01.12 Trojan.PWS.QQPass.ALN Webwasher-Gateway 6.6.2 2008.01.13 Trojan.Crypt.ULPM.Gen Information additionnelle File size: 89088 bytes MD5: ad24f4f43c7cda75b551451475368885 SHA1: a60d5c160865e4b5b6d4d2b0a1cc0d38df10a865 PEiD: - Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=4F8FB31D00C4E4465C2D01A2F018BD001C08A565 Fichier C:\WINDOWS\system32\temp_0000_65-20.aok : Antivirus Version Dernière mise à jour Résultat AhnLab-V3 2008.1.12.10 2008.01.11 - AntiVir 7.6.0.46 2008.01.11 - Authentium 4.93.8 2008.01.12 - Avast 4.7.1098.0 2008.01.12 - AVG 7.5.0.516 2008.01.12 - BitDefender 7.2 2008.01.13 - CAT-QuickHeal 9.00 2008.01.12 - ClamAV 0.91.2 2008.01.13 - DrWeb 4.44.0.09170 2008.01.13 - eSafe 7.0.15.0 2008.01.10 - eTrust-Vet 31.3.5451 2008.01.11 - Ewido 4.0 2008.01.12 - FileAdvisor 1 2008.01.13 - Fortinet 3.14.0.0 2008.01.13 - F-Prot 4.4.2.54 2008.01.13 - F-Secure 6.70.13030.0 2008.01.12 - Ikarus T3.1.1.20 2008.01.13 - Kaspersky 7.0.0.125 2008.01.13 - McAfee 5205 2008.01.11 - Microsoft 1.3109 2008.01.13 - NOD32v2 2787 2008.01.13 - Norman 5.80.02 2008.01.11 - Panda 9.0.0.4 2008.01.12 - Prevx1 V2 2008.01.13 - Rising 20.26.62.00 2008.01.13 - Sophos 4.24.0 2008.01.13 - Sunbelt 2.2.907.0 2008.01.12 - Symantec 10 2008.01.13 - TheHacker 6.2.9.186 2008.01.11 - VBA32 3.12.2.5 2008.01.13 - VirusBuster 4.3.26:9 2008.01.12 - Webwasher-Gateway 6.6.2 2008.01.13 - Information additionnelle File size: 171 bytes MD5: eef8aeb95fb7995c339a5b7b7ffcd8a7 SHA1: e7455ef5258698fe92a417a9f9a4902078d67f5e PEiD: - Fichier C:\WINDOWS\WA.INI : Antivirus Version Dernière mise à jour Résultat AhnLab-V3 2008.1.12.10 2008.01.11 - AntiVir 7.6.0.46 2008.01.11 - Authentium 4.93.8 2008.01.12 - Avast 4.7.1098.0 2008.01.12 - AVG 7.5.0.516 2008.01.12 - BitDefender 7.2 2008.01.13 - CAT-QuickHeal 9.00 2008.01.12 - ClamAV 0.91.2 2008.01.13 - DrWeb 4.44.0.09170 2008.01.13 - eSafe 7.0.15.0 2008.01.10 - eTrust-Vet 31.3.5451 2008.01.11 - Ewido 4.0 2008.01.12 - FileAdvisor 1 2008.01.13 - Fortinet 3.14.0.0 2008.01.13 - F-Prot 4.4.2.54 2008.01.13 - F-Secure 6.70.13030.0 2008.01.12 - Ikarus T3.1.1.20 2008.01.13 - Kaspersky 7.0.0.125 2008.01.13 - McAfee 5205 2008.01.11 - Microsoft 1.3109 2008.01.13 - NOD32v2 2787 2008.01.13 - Norman 5.80.02 2008.01.11 - Panda 9.0.0.4 2008.01.12 - Prevx1 V2 2008.01.13 - Rising 20.26.62.00 2008.01.13 - Sophos 4.24.0 2008.01.13 - Sunbelt 2.2.907.0 2008.01.12 - Symantec 10 2008.01.13 - TheHacker 6.2.9.186 2008.01.11 - VBA32 3.12.2.5 2008.01.13 - VirusBuster 4.3.26:9 2008.01.12 - Webwasher-Gateway 6.6.2 2008.01.13 - Information additionnelle File size: 122 bytes MD5: 982a7192688afedc5f2634ceaee70c34 SHA1: 886ca64c4de355023cba61a4b8da9f4d7826b205 PEiD: - Voilà les rapports. Merci encore.

Le sioux · Answer

Bonsoir Geo Geo

ComboFix avec CFScript : 

*  Sélectionne le texte suivant (en gras)  dans son intégralité :


Driver::
drivers

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmona"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0aeeb6 cf-a50f-11dc-8b50-0013d3a45508}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]

File::
C:\WINDOWS\system32\drivers\drivers.exe
C:\sqmdata09.sqm
C:\sqmnoopt09.sqm
C:\Documents and Settings\Guisse\Application Data\EasySpywareCleaner.com
C:\WINDOWS\system\system.exe
C:\autorun.inf
C:\F82EC657.exe
C:\Documents and Settings\Guisse\Guisse.exe
C:\Documents and Settings\Guisse\Application Data\spy-rid.com
C:\Documents and Settings\Guisse\Application Data\InfeStop.com
C:\WINDOWS\system32\config\systemprofile\systemprofile.exe 
C:\F82EC657.exe 
C:\WINDOWS\srchasst\srchasst.exe
C:\WINDOWS\srchasst\mui\[u]0[/u]40C\[u]0[/u]40C.exe
C:\WINDOWS\srchasst\mui\40C\40C.exe
C:\WINDOWS\srchasst\chars\chars.exe
C:\WINDOWS\Registration\Registration.exe
C:\WINDOWS\PCHealth\UploadLB\Config\Config.exe
C:\WINDOWS\PCHealth\UploadLB\Binaries\Binaries.exe
C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Remote Assistance.exe
C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\Unsolicited.exe
C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\Email.exe
C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Common.exe
C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\Css.exe
C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\Common.exe
C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US.exe
C:\WINDOWS\PCHealth\HelpCtr\System\UpdateCtr\UpdateCtr.exe
C:\WINDOWS\PCHealth\HelpCtr\System\System.exe
C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\sysinfo.exe
C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\graphics\graphics.exe
C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\graphics\47x24pie\47x24pie .exe
C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\graphics\33x16pie\33x16pie .exe
C:\WINDOWS\PCHealth\HelpCtr\System\scripts\scripts.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Remote Assistance.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Server\Server.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\Common.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\Client.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Css\Css.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Common\Common.exe
C:\WINDOWS\PCHealth\HelpCtr\System\rc\rc.exe
C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\subpanels.exe
C:\WINDOWS\PCHealth\HelpCtr\System\panels\panels.exe
C:\WINDOWS\PCHealth\HelpCtr\System\NetDiag\NetDiag.exe
C:\WINDOWS\PCHealth\HelpCtr\System\images\images.exe
C:\WINDOWS\PCHealth\HelpCtr\System\images\Expando\Expando.exe
C:\WINDOWS\PCHealth\HelpCtr\System\images\Centers\Centers.exe
C:\WINDOWS\PCHealth\HelpCtr\System\images\48x48\48x48.exe
C:\WINDOWS\PCHealth\HelpCtr\System\images\32x32\32x32.exe
C:\WINDOWS\PCHealth\HelpCtr\System\images\24x24\24x24.exe
C:\WINDOWS\PCHealth\HelpCtr\System\images\16x16\16x16.exe
C:\WINDOWS\PCHealth\HelpCtr\System\errors\errors.exe
C:\WINDOWS\PCHealth\HelpCtr\System\ErrMsg\ErrMsg.exe
C:\WINDOWS\PCHealth\HelpCtr\System\DVDUpgrd\DVDUpgrd.exe
C:\WINDOWS\PCHealth\HelpCtr\System\dialogs\dialogs.exe
C:\WINDOWS\PCHealth\HelpCtr\System\css\css.exe
C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\CompatCtr.exe
C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\blurbs.exe
C:\WINDOWS\PCHealth\HelpCtr\PackageStore\PackageStore.exe
C:\WINDOWS\PCHealth\HelpCtr\OfflineCache\Personal_32#040c\Personal_32 #040c.exe
C:\WINDOWS\PCHealth\HelpCtr\OfflineCache\OfflineCache.exe
C:\WINDOWS\PCHealth\HelpCtr\Logs\Logs.exe
C:\WINDOWS\PCHealth\HelpCtr\Indices\Indices.exe
C:\WINDOWS\PCHealth\HelpCtr\DataColl\DataColl.exe
C:\WINDOWS\PCHealth\HelpCtr\Database\Database.exe
C:\WINDOWS\PCHealth\HelpCtr\Config\Config.exe
C:\WINDOWS\PCHealth\HelpCtr\Config\Cache\Cache.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\Binaries.exe
C:\WINDOWS\Media\Media.exe
C:\WINDOWS\java\Packages\Packages.exe
C:\WINDOWS\java\Packages\Data\Data.exe
C:\WINDOWS\java\classes\classes.exe
C:\WINDOWS\Help\Tours\WindowsMediaPlayer\WindowsMediaPlayer.exe
C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Video\Video.exe
C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Scr\Scr.exe
C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\WMarks.exe
C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Img.exe
C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\Btn.exe
C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Css\Css.exe
C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\Cnt.exe
C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\Wav.exe
C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Audio.exe
C:\WINDOWS\Help\Tours\mmTour\mmTour.exe
C:\WINDOWS\Help\Tours\htmlTour\htmlTour.exe
C:\WINDOWS\Help\Help.exe
C:\WINDOWS\Cursors\Cursors.exe
C:\WINDOWS\AppPatch\AppPatch.exe 
C:\WINDOWS\java\Packages\R7X3FJ1N.ZIP
C:\WINDOWS\java\Packages\PN335Z7F.ZIP
C:\Program Files\AdVantage\AdVantage.exe

Folder::
C:\Program Files\EasySpywareCleaner
C:\Program Files\AxBx
C:\Program Files\Spy-Rid
C:\Program Files\InfeStop
C:\Program Files\AdVantage\AdVantage.exe 

* Copie le texte sélectionné (CTRL+C).
* Ouvre le bloc-notes (programme>Accessoires >bloc-notes).
* Colle le texte copié dans ce bloc-notes (CTRL+V).
* Sauvegarde ce fichier sous le nom de CFScript.txt

Déconnecte toi du net et désactive ton antivirus  pour que Combofix puisse s'exécuter normalement

* Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe ( sur ton bureau)

* Une fenêtre bleue va apparaître: au message qui apparaît  Type 1 to continue, or 2 to abort , tape 1 puis valide.

* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal!

Ne touche à rien tant que le scan n'est pas terminé. 

--> Une fois le scan achevé, un rapport va s'afficher : Poste son contenu et un nouveau rapport HijackThis

(Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt )

@ suivre

Le sioux · Answer

Bonsoir Geo geo

Avant de faire la manip poste 42 , peux tu  faire ce qui suit et attendre mon "feu vert" pour la manip ci dessus stp.

Télécharge SREng de Smallfrogs :
http://www.kztechs.com/eng/download.html

Extraits tout son contenu sur ton Bureau.
Du dossier sreng2 qui se trouve maintenant sur ton Bureau, double-clique sur SREngPS.exe afin de lancer l'outil
Clique sur Smart Scan

Ensuite, clique sur le bouton [Scan]

Lorsque le scan sera terminé, clique sur le bouton [Save Reports]

Sauvegarde le rapport sur ton Bureau.

Copie/colle le contenu du fichier SREnglLOG.log dans ta prochaine réponse, s'il te plaît.

@ suivre.

GeoGeo · Answer

Bonjour, j'ai fait ce que vous m'avez demandé, voilà le rapport SREngPS : [CODE] 2008-01-14,13:30:36 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Home Edition Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed Follow item(s) have been choosed: All Boot Items (Including Registry, Startup Folders, Services and so on) Browser Add-ons Runing Processes (Including process model information) File Associations Winsock Provider Autorun.Inf HOSTS File Process Privileges Scan Boot Items Registry [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Microsoft Windows Publisher] <"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Microsoft Windows Hardware Compatibility Publisher] <"C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"> [ATI Technologies, Inc.] <"C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime> [N/A] [(Verified)Microsoft Windows Hardware Compatibility Publisher] <"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"> [Sun Microsystems, Inc.] [Logitech Inc.] <"C:\Program Files\WebcamMax\wcmmon.exe" /a> [] [] [N/A] [] [(Verified)AxBx] [] [SONIX] [Sonix] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{56F9679E-7826-4C84-81F3-532071A8BCC5}> [(Verified)Microsoft Windows] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"> [(Verified)"Adobe Systems, Incorporated"] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\Program Files\AdVantage\AdVantage.exe"> [N/A] <; "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"> [Nero AG] <; "J:\Logiciel\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\Program Files\ECB.exe" /dontopenmycards> [Orbiscom Ltd. All rights reserved.] <; C:\WINDOWS\FixCamera.exe> [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe> [Nero AG] <; "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions> [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\Program Files\DAEMON Tools SearchBar\Search.exe"> [N/A] <; "C:\Program Files\DAEMON Tools SearchBar\whse.exe"> [N/A] ================================== Startup Folders [RocketDock] C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [N/A]> [TransBar] C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [N/A]> [UberIcon] C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [N/A]> [Y'z Shadow] C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [N/A]> ================================== Services [Gestion d'applications / AppMgmt][Stopped/Manual Start] %SystemRoot%\System32\appmgmts.dll> [Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start] [ATI Smart / ATI Smart][Stopped/Auto Start] <> [Accès du périphérique d'interface utilisateur / HidServ][Stopped/Disabled] %SystemRoot%\System32\hidserv.dll> [InstallDriver Table Manager / IDriverT][Stopped/Manual Start] [NBService / NBService][Stopped/Manual Start] [PCLEPCI / PCLEPCI][Stopped/Auto Start] [Windows Live Setup Service / WLSetupSvc][Stopped/Manual Start] <"C:\Program Files\Windows Live\installer\WLSetupSvc.exe"> ================================== Drivers [ati2mtag / ati2mtag][Running/Manual Start] [BitDefender Firewall NDIS Filter Service / Bdfndisf][Running/Manual Start] [WebcamMax, WDM Video Capture / CamthWDM][Running/Auto Start] [catchme / catchme][Stopped/Manual Start] <\??\C:\DOCUME~1\Guisse\LOCALS~1\Temp\catchme.sys> [driverhardwarev2 / driverhardwarev2][Stopped/Manual Start] <\??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys> [Intel(R) PRO/1000 PCI Express Network Connection Driver / e1express][Running/Manual Start] [GMSIPCI / GMSIPCI][Stopped/Manual Start] <\??\D:\INSTALL\GMSIPCI.SYS> [Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start] [Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start] [Pinnacle Marvin Bus / MarvinBus][Running/Manual Start] [Padus ASPI Shell / pfc][Running/Manual Start] [Pilote de liaison parallèle directe / Ptilink][Running/Manual Start] [Sony Ericsson Device 068 driver (WDM) / se44bus][Stopped/Manual Start] [Sony Ericsson Device 068 USB WMC Modem Filter / se44mdfl][Stopped/Manual Start] [Sony Ericsson Device 068 USB WMC Modem Driver / se44mdm][Stopped/Manual Start] [Sony Ericsson Device 068 USB WMC Device Management Drivers (WDM) / se44mgmt][Stopped/Manual Start] [Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (NDIS) / se44nd5][Stopped/Manual Start] [Sony Ericsson Device 068 USB WMC OBEX Interface / se44obex][Stopped/Manual Start] [Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (WDM) / se44unic][Stopped/Manual Start] [Secdrv / Secdrv][Stopped/Manual Start] [USB2.0 PC Camera (SNP2STD) / SNP2STD][Stopped/Manual Start] <> [sptd / sptd][Running/Boot Start] <\SystemRoot\System32\Drivers\sptd.sys> [Pilote de périphérique de la restauration de lecteur / StMp3Rec][Stopped/Manual Start] [C-Media Storage / UMSSSTOR][Running/Manual Start]

[Codec Teletext standard / WSTCODEC][Stopped/Manual Start] ================================== Browser Add-ons [Aide pour le lien d'Adobe PDF Reader] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [ECarteBleueBrowserHelper Class] {2E03C0FD-4C48-43A7-9A54-00240C70FF16} [SSVHelper Class] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [Programme d'aide de l'Assistant de connexion Windows Live] {9030D464-4C02-4ABF-8ECC-5164760863C6} [Java Plug-in 1.6.0_03] {08B0E5C0-4FCB-11CF-AAA5-00401C608501} [BlogThisToolbarButton Class] {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} [WinHTTrackLauncher Class] {36ECAF82-3300-8F84-092E-AFF36D6C7040} [&Rechercher] {92780B25-18CC-41C8-B9BE-3C9C571A8263} [] {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A> [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} [QuickTime Object] {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} [HardwareDetection Control] {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} [Java Plug-in 1.6.0_03] {8AD9C840-044E-11D1-B3E9-00805F499D93} [InetDownload Class] {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} [Java Plug-in 1.6.0_02] {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} [Java Plug-in 1.6.0_03] {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [Java Plug-in 1.6.0_03] {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [Microsoft Outlook 8.0 Object Library] {0006F033-0000-0000-C000-000000000046} <, N/A> [Microsoft Office Outlook] {0006F03A-0000-0000-C000-000000000046} <, N/A> [QuickTime Object] {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [Aide pour le lien d'Adobe PDF Reader] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [Web Browser Applet Control] {08B0E5C0-4FCB-11CF-AAA5-00401C608501} [Windows Genuine Advantage Validation Tool] {17492023-C23A-453E-A040-C7C580BBF700} [InformationCardSigninHelper Class] {19916E01-B44E-4E31-94A4-4696DF46157B} [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} [XML DOM Document] {2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\System32\msxml3.dll, N/A> [ECarteBleueBrowserHelper Class] {2E03C0FD-4C48-43A7-9A54-00240C70FF16} [XML Document] {48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\System32\msxml3.dll, N/A> [Windows Desktop Search Combo Control] {4E430174-1673-4FF3-BF28-A3B37F6573E7} [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} [MUWebControl Class] {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} [Active Desktop Mover] {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A> [SSVHelper Class] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HardwareDetection Control] {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} [Microsoft Web Browser] {8856F961-340A-11D0-A96B-00C04FD705A2} [XML DOM Document 4.0] {88D969C0-F192-11D4-A65F-0040963251E5} [XML HTTP 4.0] {88D969C5-F192-11D4-A65F-0040963251E5} [Programme d'aide de l'Assistant de connexion Windows Live] {9030D464-4C02-4ABF-8ECC-5164760863C6} [InetDownload Class] {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} [RMGetLicense Class] {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} [AUDIO__MID Moniker Class] {CD3AFA74-B84F-48F0-9393-7EDC34128127} [AUDIO__MP3 Moniker Class] {CD3AFA76-B84F-48F0-9393-7EDC34128127} [AUDIO__X_MS_WMA Moniker Class] {CD3AFA84-B84F-48F0-9393-7EDC34128127} [VIDEO__X_MS_ASF Moniker Class] {CD3AFA8F-B84F-48F0-9393-7EDC34128127} [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} [Contrôle de l'Assistant de connexion Windows Live] {D2517915-48CE-4286-970F-921E881B8C5C} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [] {E1771B7F-98BE-407F-BA67-AA16ADA5D0C5} [XML HTTP Request] {ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\System32\msxml3.dll, N/A> [XML DOM Document 3.0] {F5078F32-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\System32\msxml3.dll, N/A> [XML HTTP 3.0] {F5078F35-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\System32\msxml3.dll, N/A> [XML DOM Document] {F6D90F11-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\System32\msxml3.dll, N/A> [XML HTTP] {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\System32\msxml3.dll, N/A> [E&xport to Microsoft Excel] [E&xporter vers Microsoft Excel] ================================== Running Processes [PID: 940 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1008 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1032 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4117] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1076 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)] [PID: 1088 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1264 / SYSTEM][C:\WINDOWS\System32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4117] [C:\WINDOWS\System32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2497] [PID: 1280 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1356 / SERVICE RÉSEAU][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1484 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\WINDOWS\System32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [PID: 1564 / SERVICE RÉSEAU][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1688 / SERVICE LOCAL][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [PID: 1904 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.1897.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0] [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\UNIDRVUI.DLL] [Microsoft Corporation, 5.2.3790.120 (srv03_qfe.031205-1652)] [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\UNIDRV.DLL] [Microsoft Corporation, 5.2.3790.184 (srv03_qfe.040410-1236)] [PID: 356 / Guisse][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4117] [C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2497] [PID: 464 / Guisse][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\WINDOWS\system32\WPDShServiceObj.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\PortableDeviceTypes.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA] [Adobe Systems, Inc., 8.0.0.0] [C:\Program Files\Fichiers communs\Ahead\Lib\NeroDigitalExt.dll] [Nero AG, 2, 0, 0, 8] [C:\Program Files\Fichiers communs\Ahead\Lib\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Fichiers communs\Ahead\Lib\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Fichiers communs\Ahead\Lib\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MFC71FRA.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 8.1.0.0] [C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll] [, 1, 0, 0, 1] [C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll] [Nero AG, 2, 6, 6, 0] [C:\Program Files\Nero\Nero 7\Nero BackItUp\MFC71U.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\WinRAR arext.dll] [N/A, ] [C:\WINDOWS\system32\lameACM.acm] 0.9.1 [PID: 704 / SYSTEM][C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE] [Microsoft Corporation, 7.00.9466] [C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\1036\mdmui.dll] [Microsoft Corporation, 7.00.9466] [PID: 796 / Guisse][C:\WINDOWS\RTHDCPL.EXE] [Realtek Semiconductor Corp., 1.1.1.9] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 816 / Guisse][C:\Program Files\ATI Technologies\ATI.ACE\cli.exe] [ATI Technologies Inc., 1.2.2006.283] [C:\WINDOWS\system32\mscoree.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll] [Microsoft Corporation, 1.1.4322.2407] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll] [Microsoft Corporation, 1.1.4322.2032] [c:\windows\microsoft.net\framework\v1.1.4322\mscorlib.dll] [Microsoft Corporation, 1.1.4322.2407] [c:\windows\assembly ativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_d9dd63dd\mscorlib.dll] [N/A, ] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll] [Microsoft Corporation, 1.1.4322.2407] [c:\program files\ati technologies\ati.ace\log.foundation.dll] [ATI Technologies Inc., 1.2.1957.31892] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSCORJIT.DLL] [Microsoft Corporation, 1.1.4322.2407] [c:\program files\ati technologies\ati.ace\cli.foundation.dll] [ATI Technologies Inc., 1.2.1957.31892] [c:\program files\ati technologies\ati.ace\log.foundation.service.dll] [ATI Technologies Inc., 1.2.2006.283] [c:\program files\ati technologies\ati.ace\log.foundation.shared.dll] [ATI Technologies Inc., 1.2.1957.31919] [c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll] [Microsoft Corporation, 1.1.4322.2407] [c:\windows\assembly ativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_c9ab94cc\system.dll] [N/A, ] [c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll] [Microsoft Corporation, 1.1.4322.2032] [c:\windows\assembly ativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_ee670409\system.windows.forms.dll] [N/A, ] [c:\program files\ati technologies\ati.ace\cli.foundation.xmanifestation.dll] [ATI Technologies Inc., 1.2.2006.283] [c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll] [Microsoft Corporation, 1.1.4322.2032] [c:\windows\assembly ativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_c9a1138b\system.xml.dll] [N/A, ] [c:\windows\assembly\gac\system.runtime.remoting\1.0.5000.0__b77a5c561934e089\system.runtime.remoting.dll] [Microsoft Corporation, 1.1.4322.2032] [c:\program files\ati technologies\ati.ace\cli.component.runtime.dll] [ATI Technologies Inc., 1.2.2006.284] [c:\program files\ati technologies\ati.ace\aem.foundation.dll] [ATI Technologies Inc., 1.2.1957.31892] [c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll] [Microsoft Corporation, 1.1.4322.2032] [c:\windows\assembly ativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_c1a765cb\system.drawing.dll] [N/A, ] [c:\windows\assembly\gac\system.windows.forms.resources\1.0.5000.0_fr_b77a5c561934e089\system.windows.forms.resources.dll] [Microsoft Corporation, 1.1.4322.573] [c:\windows\assembly\gac\accessibility\1.0.5000.0__b03f5f7f11d50a3a\accessibility.dll] [Microsoft Corporation, 1.1.4322.573] [c:\program files\ati technologies\ati.ace\cli.caste.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.275] [c:\program files\ati technologies\ati.ace\cli.component.runtime.shared.dll] [ATI Technologies Inc., 1.2.1957.31893] [c:\program files\ati technologies\ati.ace\cli.caste.graphics.shared.dll] [ATI Technologies Inc., 1.2.1962.23360] [c:\program files\ati technologies\ati.ace\dem.foundation.dll] [ATI Technologies Inc., 1.2.1957.31892] [c:\program files\ati technologies\ati.ace\dem.graphics.displaysmanager.shared.dll] [ATI Technologies Inc., 1.2.1957.31892] [c:\program files\ati technologies\ati.ace\dem.graphics.demosinfo.dll] [ATI Technologies Inc., 1.2.1958.19473] [c:\program files\ati technologies\ati.ace\dem.graphics.demosadapterinfo.dll] [ATI Technologies Inc., 1.2.1971.31260] [c:\program files\ati technologies\ati.ace\dem.graphics.dematiadapterinfo.dll] [ATI Technologies Inc., 1.2.1958.19459] [c:\program files\ati technologies\ati.ace\dem.graphics.demdriversettings.dll] [ATI Technologies Inc., 1.2.1957.31895] [c:\windows\assembly\gac\mscorlib.resources\1.0.5000.0_fr_b77a5c561934e089\mscorlib.resources.dll] [Microsoft Corporation, 1.1.4322.573] [c:\windows\assembly\gac\system.web\1.0.5000.0__b03f5f7f11d50a3a\system.web.dll] [Microsoft Corporation, 1.1.4322.2407] [c:\program files\ati technologies\ati.ace\atidemgr.dll] [ATI Technologies Inc., 1.2.2006.273] [c:\program files\ati technologies\ati.ace\dem.graphics.demosmodeinfo.dll] [ATI Technologies Inc., 1.2.1957.31895] [c:\program files\ati technologies\ati.ace\dem.graphics.dematidisplaysmanagersettings.dll] [ATI Technologies Inc., 1.2.1958.24498] [c:\program files\ati technologies\ati.ace\dem.graphics.demdisplayscoloursettings.dll] [ATI Technologies Inc., 1.2.1957.31895] [c:\program files\ati technologies\ati.ace\dem.graphics.demvideooverlaysettings.dll] [ATI Technologies Inc., 1.2.1957.31915] [c:\program files\ati technologies\ati.ace\dem.graphics.demsmartgartsettings.dll] [ATI Technologies Inc., 1.2.1957.31916] [c:\program files\ati technologies\ati.ace\dem.graphics.demumaframebuffersettings.dll] [ATI Technologies Inc., 1.2.1957.31917] [c:\program files\ati technologies\ati.ace\dem.graphics.dempowerplaysettings.dll] [ATI Technologies Inc., 1.2.1957.31921] [c:\program files\ati technologies\ati.ace\dem.graphics.demoverdrivesettings.dll] [ATI Technologies Inc., 1.2.1957.31921] [c:\program files\ati technologies\ati.ace\dem.graphics.demoverdrive3settings.dll] [ATI Technologies Inc., 1.2.1957.31919] [c:\program files\ati technologies\ati.ace\dem.graphics.demdisplaysmanageroptionssettings.dll] [ATI Technologies Inc., 1.2.1957.31917] [c:\program files\ati technologies\ati.ace\dem.graphics.workstationsettings.dll] [ATI Technologies Inc., 1.2.1957.31920] [c:\program files\ati technologies\ati.ace\dem.graphics.demdevicecommonsettings.dll] [ATI Technologies Inc., 1.2.1959.26822] [c:\program files\ati technologies\ati.ace\dem.graphics.demdevicecrtsettings.dll] [ATI Technologies Inc., 1.2.1957.31922] [c:\program files\ati technologies\ati.ace\dem.graphics.demdevicecomponentvideosettings.dll] [ATI Technologies Inc., 1.2.1957.31894] [c:\program files\ati technologies\ati.ace\dem.graphics.demdevicetvsettings.dll] [ATI Technologies Inc., 1.2.1957.31922] [c:\program files\ati technologies\ati.ace\dem.graphics.demdevicedfpsettings.dll] [ATI Technologies Inc., 1.2.1957.31922] [c:\program files\ati technologies\ati.ace\dem.graphics.demdevicelcdsettings.dll] [ATI Technologies Inc., 1.2.1957.31922] [c:\program files\ati technologies\ati.ace\dem.graphics.demvpurecoverinfo.dll] [ATI Technologies Inc., 1.2.1957.31917] [c:\program files\ati technologies\ati.ace\dem.graphics.mmoverlaysettings.dll] [ATI Technologies Inc., 1.2.1957.31916] [c:\program files\ati technologies\ati.ace\dem.graphics.mmdeintlacingsettings.dll] [ATI Technologies Inc., 1.2.1957.31916] [c:\program files\ati technologies\ati.ace\dem.graphics.demvideotheatermodesettings.dll] [ATI Technologies Inc., 1.2.1957.31916] [c:\program files\ati technologies\ati.ace\dem.graphics.demdevicetv2settings.dll] [ATI Technologies Inc., 1.2.1957.31922] [c:\program files\ati technologies\ati.ace\dem.graphics.demmultivpusettings.dll] [ATI Technologies Inc., 1.2.1962.23369] [c:\program files\ati technologies\ati.ace\dem.graphics.demdevicecommon2settings.dll] [ATI Technologies Inc., 1.2.1957.31894] [c:\windows\assembly\gac\system.management\1.0.5000.0__b03f5f7f11d50a3a\system.management.dll] [Microsoft Corporation, 1.1.4322.2032] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll] [Microsoft Corporation, 1.1.4322.2032] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\perfcounter.dll] [Microsoft Corporation, 1.1.4322.2032] [C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_perf.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll] [Microsoft Corporation, 1.1.4322.2407] [C:\Program Files\Fichiers communs\Microsoft Shared\office11\mso.dll] [Microsoft Corporation, 11.0.5606] [c:\program files\ati technologies\ati.ace\cli.aspect.multivpu.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.93] [c:\program files\ati technologies\ati.ace\cli.aspect.multivpu.graphics.shared.dll] [ATI Technologies Inc., 1.2.1971.30655] [c:\program files\ati technologies\ati.ace\cli.aspect.radeon3d.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.123] [c:\program files\ati technologies\ati.ace\cli.aspect.radeon3dlegacy.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.117] [c:\program files\ati technologies\ati.ace\cli.aspect.radeon3dlegacy.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31915] [c:\program files\ati technologies\ati.ace\cli.aspect.displayscolour2.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.59] [c:\program files\ati technologies\ati.ace\cli.aspect.displayscolour2.graphics.shared.dll] [ATI Technologies Inc., 1.2.1963.17646] [c:\program files\ati technologies\ati.ace\cli.aspect.displayscolour.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.178] [c:\program files\ati technologies\ati.ace\cli.aspect.displayscolour.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31895] [c:\program files\ati technologies\ati.ace\cli.aspect.mmvideo.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.148] [c:\program files\ati technologies\ati.ace\cli.aspect.mmvideo.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31915] [c:\program files\ati technologies\ati.ace\cli.aspect.videooverlay.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.105] [c:\program files\ati technologies\ati.ace\cli.aspect.videooverlay.graphics.runtime.shared.dll] [ATI Technologies Inc., 1.2.1957.31918] [c:\program files\ati technologies\ati.ace\dem.graphics.videooverlay.shared.dll] [ATI Technologies Inc., 1.2.1957.31893] [c:\program files\ati technologies\ati.ace\cli.aspect.smartgart.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.112] [c:\program files\ati technologies\ati.ace\cli.aspect.vpurecover.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.101] [c:\program files\ati technologies\ati.ace\cli.aspect.vpurecover.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31909] [c:\program files\ati technologies\ati.ace\cli.aspect.workstationconfig.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.97] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecrt.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.225] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecrt2.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.69] [c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.207] [c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31918] [c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd2.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.59] [c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd2.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31920] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecv.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.218] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecv.graphics.shared.dll] [ATI Technologies Inc., 1.2.1963.25996] [c:\program files\ati technologies\ati.ace\cli.aspect.customformats.graphics.shared.dll] [ATI Technologies Inc., 1.2.1963.25994] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecv2.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.74] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecv2.graphics.shared.dll] [ATI Technologies Inc., 1.2.1963.25997] [c:\program files\ati technologies\ati.ace\cli.aspect.devicetv2.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.196] [c:\program files\ati technologies\ati.ace\cli.aspect.devicetv.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.185] [c:\program files\ati technologies\ati.ace\cli.aspect.devicedfp.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.213] [c:\program files\ati technologies\ati.ace\cli.aspect.devicedfp.graphics.shared.dll] [ATI Technologies Inc., 1.2.1963.25999] [c:\program files\ati technologies\ati.ace\cli.aspect.devicedfp2.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.64] [c:\program files\ati technologies\ati.ace\cli.aspect.devicedfp2.graphics.shared.dll] [ATI Technologies Inc., 1.2.1963.26001] [c:\program files\ati technologies\ati.ace\cli.aspect.overdrive3.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.135] [c:\program files\ati technologies\ati.ace\cli.aspect.overdrive3.graphics.shared.dll] [ATI Technologies Inc., 1.2.1962.20967] [c:\program files\ati technologies\ati.ace\cli.aspect.overdrive2.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.144] [c:\program files\ati technologies\ati.ace\cli.aspect.powerplay3.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.130] [c:\program files\ati technologies\ati.ace\cli.aspect.powerplay3.graphics.shared.dll] [ATI Technologies Inc., 1.2.1975.40191] [c:\program files\ati technologies\ati.ace\cli.aspect.displaysoptions.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.165] [c:\program files\ati technologies\ati.ace\cli.aspect.integratedumaframebuffer.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.154] [c:\program files\ati technologies\ati.ace\cli.aspect.infocentre.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.160] [c:\program files\ati technologies\ati.ace\cli.aspect.infocentre.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31919] [c:\program files\ati technologies\ati.ace\cli.aspect.hotkeyshandling.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2006.81] [c:\program files\ati technologies\ati.ace\cli.aspect.hotkeyshandling.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31908] [c:\program files\ati technologies\ati.ace\cli.aspect.radeon3d.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31894] [c:\program files\ati technologies\ati.ace\cli.aspect.deviceproperty.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31894] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecrt.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31921] [c:\program files\ati technologies\ati.ace\cli.aspect.deviceproperty2.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31893] [c:\program files\ati technologies\ati.ace\cli.aspect.devicetv.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31919] [c:\program files\ati technologies\ati.ace\cli.aspect.displaysoptions.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31922] [c:\program files\ati technologies\ati.ace\apm.foundation.dll] [ATI Technologies Inc., 1.2.1957.31920] [C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [c:\windows\assembly\gac\system.resources\1.0.5000.0_fr_b77a5c561934e089\system.resources.dll] [Microsoft Corporation, 1.1.4322.573] [PID: 832 / Guisse][C:\WINDOWS\system32\CmWatch.exe] [, 1, 0, 0, 20] [PID: 1428 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\System32\SG62UUD.DLL] [CANON INC., 0.0.0.5] [C:\WINDOWS\system32\N067UFW.DLL] [CANON INC., 1.000] [PID: 1436 / Guisse][C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe] [Sun Microsystems, Inc., 6.0.30.5] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [PID: 1540 / SYSTEM][C:\WINDOWS\system32\SearchIndexer.exe] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\TQUERY.DLL] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\PROPSYS.dll] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\msstrc.dll] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\mssrch.dll] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\propdefs.dll] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\XmlLite.dll] [Microsoft Corporation, 1.00.1018.0] [C:\WINDOWS\system32\fr-fr Query.dll.mui] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\msscb.dll] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\mssprxy.dll] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [PID: 1604 / Guisse][C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE] [Logitech Inc., 8.1.2.1003] [PID: 1744 / Guisse][C:\Program Files\WebcamMax\wcmmon.exe] [N/A, ] [C:\WINDOWS\system32\Msdmo.dll] [, ] [PID: 1844 / Guisse][C:\WINDOWS\FixCamera.exe] [, 1, 0, 0, 9] [PID: 1672 / Guisse][C:\WINDOWS snp2std.exe] [SONIX, 1, 1, 3, 8] [C:\WINDOWS\system32\msdmo.dll] [, ] [C:\WINDOWS\system32\vsnp2std.dll] [Sonix, 1, 1, 7, 0] [PID: 376 / Guisse][C:\WINDOWS\vsnp2std.exe] [Sonix, 1, 1, 7, 0] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 508 / Guisse][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1452 / Guisse][C:\WINDOWS\system32\shovth.exe] [N/A, ] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [PID: 3236 / SERVICE LOCAL][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 3380 / Guisse][C:\Program Files\ATI Technologies\ATI.ACE\cli.exe] [ATI Technologies Inc., 1.2.2006.283] [C:\WINDOWS\system32\mscoree.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll] [Microsoft Corporation, 1.1.4322.2407] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll] [Microsoft Corporation, 1.1.4322.2032] [c:\windows\microsoft.net\framework\v1.1.4322\mscorlib.dll] [Microsoft Corporation, 1.1.4322.2407] [c:\windows\assembly ativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_d9dd63dd\mscorlib.dll] [N/A, ] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll] [Microsoft Corporation, 1.1.4322.2407] [c:\program files\ati technologies\ati.ace\log.foundation.dll] [ATI Technologies Inc., 1.2.1957.31892] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSCORJIT.DLL] [Microsoft Corporation, 1.1.4322.2407] [c:\program files\ati technologies\ati.ace\cli.foundation.dll] [ATI Technologies Inc., 1.2.1957.31892] [c:\program files\ati technologies\ati.ace\log.foundation.service.dll] [ATI Technologies Inc., 1.2.2006.283] [c:\program files\ati technologies\ati.ace\log.foundation.shared.dll] [ATI Technologies Inc., 1.2.1957.31919] [c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll] [Microsoft Corporation, 1.1.4322.2407] [c:\windows\assembly ativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_c9ab94cc\system.dll] [N/A, ] [c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll] [Microsoft Corporation, 1.1.4322.2032] [c:\windows\assembly ativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_ee670409\system.windows.forms.dll] [N/A, ] [c:\program files\ati technologies\ati.ace\cli.foundation.xmanifestation.dll] [ATI Technologies Inc., 1.2.2006.283] [c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll] [Microsoft Corporation, 1.1.4322.2032] [c:\windows\assembly ativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_c9a1138b\system.xml.dll] [N/A, ] [c:\windows\assembly\gac\system.runtime.remoting\1.0.5000.0__b77a5c561934e089\system.runtime.remoting.dll] [Microsoft Corporation, 1.1.4322.2032] [c:\program files\ati technologies\ati.ace\cli.component.dashboard.dll] [ATI Technologies Inc., 1.2.2006.286] [c:\program files\ati technologies\ati.ace\cli.component.dashboard.shared.dll] [ATI Technologies Inc., 1.2.1957.31893] [c:\program files\ati technologies\ati.ace\cli.component.runtime.dll] [ATI Technologies Inc., 1.2.2006.284] [c:\program files\ati technologies\ati.ace\cli.caste.graphics.shared.dll] [ATI Technologies Inc., 1.2.1962.23360] [c:\program files\ati technologies\ati.ace\dem.graphics.displaysmanager.shared.dll] [ATI Technologies Inc., 1.2.1957.31892] [c:\program files\ati technologies\ati.ace\skinfactory.dll] [ATI Technologies Inc., 1.2.2006.48] [c:\program files\ati technologies\ati.ace\aem.foundation.dll] [ATI Technologies Inc., 1.2.1957.31892] [c:\program files\ati technologies\ati.ace\cli.caste.local.dashboard.dll] [ATI Technologies Inc., 1.2.2006.290] [c:\program files\ati technologies\ati.ace\cli.caste.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.280] [c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll] [Microsoft Corporation, 1.1.4322.2032] [c:\windows\assembly ativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_c1a765cb\system.drawing.dll] [N/A, ] [c:\program files\ati technologies\ati.ace\cli.aspect.welcome.local.dashboard.dll] [ATI Technologies Inc., 1.2.2006.94] [c:\program files\ati technologies\ati.ace\cli.aspect.infocentre.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.162] [c:\program files\ati technologies\ati.ace\cli.aspect.displaysmanager.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.175] [c:\program files\ati technologies\ati.ace\cli.aspect.displaysoptions.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.167] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecrt.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.228] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\perfcounter.dll] [Microsoft Corporation, 1.1.4322.2032] [C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_perf.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)] [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll] [Microsoft Corporation, 1.1.4322.2407] [C:\Program Files\Fichiers communs\Microsoft Shared\office11\mso.dll] [Microsoft Corporation, 11.0.5606] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecrt2.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.71] [c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.209] [c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd2.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.60] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecv.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.222] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecv2.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.77] [c:\program files\ati technologies\ati.ace\cli.aspect.devicetv2.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.203] [c:\program files\ati technologies\ati.ace\cli.aspect.devicetv.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.192] [c:\program files\ati technologies\ati.ace\cli.aspect.devicedfp.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.214] [c:\program files\ati technologies\ati.ace\cli.aspect.devicedfp2.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.65] [c:\program files\ati technologies\ati.ace\cli.aspect.radeon3d.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.126] [c:\program files\ati technologies\ati.ace\cli.aspect.radeon3dlegacy.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.120] [c:\program files\ati technologies\ati.ace\cli.aspect.displayscolour2.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.55] [c:\program files\ati technologies\ati.ace\cli.aspect.displayscolour.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.182] [c:\program files\ati technologies\ati.ace\cli.aspect.mmvideo.graphics.dashboard.dll] [ , 1.2.2006.152] [c:\program files\ati technologies\ati.ace\cli.aspect.videooverlay.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.108] [c:\program files\ati technologies\ati.ace\cli.aspect.powerplay3.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.131] [c:\program files\ati technologies\ati.ace\cli.aspect.smartgart.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.114] [c:\program files\ati technologies\ati.ace\cli.aspect.vpurecover.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.102] [c:\program files\ati technologies\ati.ace\cli.aspect.workstationconfig.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.98] [c:\program files\ati technologies\ati.ace\cli.aspect.overdrive3.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.140] [c:\program files\ati technologies\ati.ace\cli.aspect.overdrive2.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.145] [c:\program files\ati technologies\ati.ace\cli.aspect.integratedumaframebuffer.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.157] [c:\program files\ati technologies\ati.ace\cli.aspect.multivpu.graphics.dashboard.dll] [ATI Technologies Inc., 1.2.2006.85] [c:\program files\ati technologies\ati.ace\cli.aspect.infocentre.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31919] [c:\program files\ati technologies\ati.ace\cli.aspect.displaysoptions.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31922] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecrt.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31921] [c:\program files\ati technologies\ati.ace\cli.aspect.deviceproperty.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31894] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecrt2.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31918] [c:\program files\ati technologies\ati.ace\cli.aspect.deviceproperty2.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31893] [c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31918] [c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd2.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31920] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecv.graphics.shared.dll] [ATI Technologies Inc., 1.2.1963.25996] [c:\program files\ati technologies\ati.ace\cli.aspect.customformats.graphics.shared.dll] [ATI Technologies Inc., 1.2.1963.25994] [c:\program files\ati technologies\ati.ace\cli.aspect.devicecv2.graphics.shared.dll] [ATI Technologies Inc., 1.2.1963.25997] [c:\program files\ati technologies\ati.ace\cli.aspect.devicetv2.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31910] [c:\program files\ati technologies\ati.ace\cli.aspect.devicetv.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31919] [c:\program files\ati technologies\ati.ace\cli.aspect.devicedfp.graphics.shared.dll] [ATI Technologies Inc., 1.2.1963.25999] [c:\program files\ati technologies\ati.ace\cli.aspect.devicedfp2.graphics.shared.dll] [ATI Technologies Inc., 1.2.1963.26001] [c:\program files\ati technologies\ati.ace\cli.aspect.radeon3d.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31894] [c:\program files\ati technologies\ati.ace\cli.aspect.radeon3dlegacy.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31915] [c:\program files\ati technologies\ati.ace\cli.aspect.displayscolour2.graphics.shared.dll] [ATI Technologies Inc., 1.2.1963.17646] [c:\program files\ati technologies\ati.ace\cli.aspect.displayscolour.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31895] [c:\program files\ati technologies\ati.ace\cli.aspect.mmvideo.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31915] [c:\program files\ati technologies\ati.ace\cli.aspect.videooverlay.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31917] [c:\program files\ati technologies\ati.ace\cli.aspect.powerplay3.graphics.shared.dll] [ATI Technologies Inc., 1.2.1975.40191] [c:\program files\ati technologies\ati.ace\cli.aspect.smartgart.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31909] [c:\program files\ati technologies\ati.ace\cli.aspect.vpurecover.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31909] [c:\program files\ati technologies\ati.ace\cli.aspect.workstationconfig.graphics.shared.dll] [ATI Technologies Inc., 1.2.1959.15702] [c:\program files\ati technologies\ati.ace\cli.aspect.overdrive3.graphics.shared.dll] [ATI Technologies Inc., 1.2.1962.20967] [c:\program files\ati technologies\ati.ace\cli.aspect.overdrive2.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31918] [c:\program files\ati technologies\ati.ace\cli.aspect.integratedumaframebuffer.graphics.shared.dll] [ATI Technologies Inc., 1.2.1957.31915] [c:\program files\ati technologies\ati.ace\cli.aspect.multivpu.graphics.shared.dll] [ATI Technologies Inc., 1.2.1971.30655] [c:\windows\assembly\gac\mscorlib.resources\1.0.5000.0_fr_b77a5c561934e089\mscorlib.resources.dll] [Microsoft Corporation, 1.1.4322.573] [c:\windows\assembly\gac\system.web\1.0.5000.0__b03f5f7f11d50a3a\system.web.dll] [Microsoft Corporation, 1.1.4322.2407] [PID: 3112 / SYSTEM][C:\Program Files\Windows Live\Messenger\usnsvc.exe] [Microsoft Corporation, 8.5.1302.1018] [C:\Program Files\Windows Live\Messenger\usnsvcps.dll] [Microsoft Corporation, 8.5.1302.1018] [PID: 3748 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1476 / Guisse][C:\Program Files\eMule\emule.exe] 0.48.0 Unicode [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\Program Files\eMule\lang\fr_FR.dll] 0.48.0 [C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [PID: 3976 / Guisse][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\WINDOWS\system32\IEFRAME.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\WINDOWS\system32\IEUI.dll] [Microsoft Corporation, 7.00.5730.13 (longhorn(wmbla).070711-1130)] [C:\WINDOWS\system32\xmllite.dll] [Microsoft Corporation, 1.00.1018.0] [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510] [C:\Program Files\Internet Explorer\ieproxy.dll] [Microsoft Corporation, 7.00.5730.13 (longhorn(wmbla).070711-1130)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200] [C:\WINDOWS\system32\BhoECart.dll] [Orbiscom Ltd. All rights reserved., 2, 2, 1, 0, 93] [C:\WINDOWS\system32\FFECart.dll] [Orbiscom Ltd. All rights reserved., 3, 0, 0, 6, 17] [C:\WINDOWS\system32\FFCore.dll] [Orbiscom Ltd. All rights reserved., 3, 0, 0, 6, 17] [C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll] [Sun Microsystems, Inc., 6.0.30.5] [C:\Program Files\Java\jre1.6.0_03\bin\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll] [Microsoft Corporation, 4.200.514.2] [C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\msidcrl40.dll] [Microsoft Corporation, 4.200.514.2] [C:\WINDOWS\system32\msfeeds.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\WINDOWS\system32\ieapfltr.dll] [Microsoft Corporation, 7.0.6000.16461] [C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx] [Adobe Systems, Inc., 9,0,47,0] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Fichiers communs\Ahead\Lib\NeroDigitalExt.dll] [Nero AG, 2, 0, 0, 8] [C:\Program Files\Fichiers communs\Ahead\Lib\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Fichiers communs\Ahead\Lib\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MFC71FRA.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 8.1.0.0] [C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA] [Adobe Systems, Inc., 8.0.0.0] [PID: 3388 / Guisse][C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe] [Microsoft Corporation, 4.200.514.2] [C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\msidcrl40.dll] [Microsoft Corporation, 4.200.514.2] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [PID: 2084 / SYSTEM][C:\WINDOWS\system32\SearchProtocolHost.exe] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\TQUERY.DLL] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\PROPSYS.dll] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\msstrc.dll] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\mssph.dll] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\MAPI32.dll] [Microsoft Corporation, 1.0.2536.0 (XPClient.010817-1148)] [C:\WINDOWS\system32\oeph.dll] [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\WINDOWS\system32\UNCPH.dll]

Le sioux · Answer

Hello Geo geo

Je regarde cela ce soir l'ami.

Tu peux me tuttoyer. ;-)

@ +

GeoGeo · Answer

Je viens de remarquer que le raport est pas entier (je pense que le forum ne supportait pas un message aussi long. Donc voilà la suite   :

[C:\WINDOWS\system32\UNCPH.dll]  [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)]
    [C:\WINDOWS\system32\mssprxy.dll]  [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)]
[PID: 2292 / SERVICE LOCAL][C:\WINDOWS\system32\SearchFilterHost.exe]  [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)]
    [C:\WINDOWS\system32\TQUERY.DLL]  [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)]
    [C:\WINDOWS\system32\PROPSYS.dll]  [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)]
    [C:\WINDOWS\system32\mssprxy.dll]  [Microsoft Corporation, 6.0.6000.16431 (vista_gdr(wmbla).070205-1422)]
[PID: 2848 / Guisse][C:\Documents and Settings\Guisse\Bureau\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)]
    [C:\Documents and Settings\Guisse\Bureau\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
File Associations
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock Provider
N/A

==================================
Autorun.Inf
[C:\]
[autorun]
open=
shell\open=Îòêðûòü
shell\open\Command=F82EC657.exe
shell\open\Default=1

==================================
HOSTS File
127.0.0.1       localhost

==================================
Process Privileges Scan
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 464, C:\WINDOWS\EXPLORER.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 816, C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI.ACE\CLI.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1436, C:\PROGRAM FILES\JAVA\JRE1.6.0_03\BIN\JUSCHED.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1604, C:\PROGRAM FILES\FICHIERS COMMUNS\LOGITECH\QCDRIVER2\LVCOMS.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1744, C:\PROGRAM FILES\WEBCAMMAX\WCMMON.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 1844, C:\WINDOWS\FIXCAMERA.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1844, C:\WINDOWS\FIXCAMERA.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1672, C:\WINDOWS\TSNP2STD.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 376, C:\WINDOWS\VSNP2STD.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1452, C:\WINDOWS\SYSTEM32\SHOVTH.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3380, C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI.ACE\CLI.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1476, C:\PROGRAM FILES\EMULE\EMULE.EXE]

==================================
API HOOK
N/A

==================================
Hidden Process
N/A

==================================


[/CODE]

Merci encore.

Le sioux · Answer

Bonsoir

Peux tu faire la manip poste 42 stp.

Mais ne copie pas .

Driver::
driver

Merci.

 @ +

GeoGeo · Answer

Bonjour, voici le rapport COmbofix : ComboFix 08-01-11.1 - Guisse 2008-01-15 12:16:30.4 - NTFSx86 Running from: C:\Documents and Settings\Guisse\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Guisse\Bureau\CFScript.txt C:\Documents and Settings\Guisse\Bureau\CFScript.txt * Created a new restore point FILE C:\autorun.inf C:\Documents and Settings\Guisse\Application Data\EasySpywareCleaner.com C:\Documents and Settings\Guisse\Application Data\InfeStop.com C:\Documents and Settings\Guisse\Application Data\spy-rid.com C:\Documents and Settings\Guisse\Guisse.exe C:\F82EC657.exe C:\Program Files\AdVantage\AdVantage.exe C:\sqmdata09.sqm C:\sqmnoopt09.sqm C:\WINDOWS\AppPatch\AppPatch.exe C:\WINDOWS\Cursors\Cursors.exe C:\WINDOWS\Help\Help.exe C:\WINDOWS\Help\Tours\htmlTour\htmlTour.exe C:\WINDOWS\Help\Tours\mmTour\mmTour.exe C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Audio.exe C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\Wav.exe C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\Cnt.exe C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Css\Css.exe C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\Btn.exe C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Img.exe C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\WMarks.exe C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Scr\Scr.exe C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Video\Video.exe C:\WINDOWS\Help\Tours\WindowsMediaPlayer\WindowsMediaPlayer.exe C:\WINDOWS\java\classes\classes.exe C:\WINDOWS\java\Packages\Data\Data.exe C:\WINDOWS\java\Packages\Packages.exe C:\WINDOWS\java\Packages\PN335Z7F.ZIP C:\WINDOWS\java\Packages\R7X3FJ1N.ZIP C:\WINDOWS\Media\Media.exe C:\WINDOWS\PCHealth\HelpCtr\Binaries\Binaries.exe C:\WINDOWS\PCHealth\HelpCtr\Config\Cache\Cache.exe C:\WINDOWS\PCHealth\HelpCtr\Config\Config.exe C:\WINDOWS\PCHealth\HelpCtr\Database\Database.exe C:\WINDOWS\PCHealth\HelpCtr\DataColl\DataColl.exe C:\WINDOWS\PCHealth\HelpCtr\Indices\Indices.exe C:\WINDOWS\PCHealth\HelpCtr\Logs\Logs.exe C:\WINDOWS\PCHealth\HelpCtr\OfflineCache\OfflineCache.exe C:\WINDOWS\PCHealth\HelpCtr\OfflineCache\Personal_32#040c\Personal_32 #040c.exe C:\WINDOWS\PCHealth\HelpCtr\PackageStore\PackageStore.exe C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\blurbs.exe C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\CompatCtr.exe C:\WINDOWS\PCHealth\HelpCtr\System\css\css.exe C:\WINDOWS\PCHealth\HelpCtr\System\dialogs\dialogs.exe C:\WINDOWS\PCHealth\HelpCtr\System\DVDUpgrd\DVDUpgrd.exe C:\WINDOWS\PCHealth\HelpCtr\System\ErrMsg\ErrMsg.exe C:\WINDOWS\PCHealth\HelpCtr\System\errors\errors.exe C:\WINDOWS\PCHealth\HelpCtr\System\images\16x16\16x16.exe C:\WINDOWS\PCHealth\HelpCtr\System\images\24x24\24x24.exe C:\WINDOWS\PCHealth\HelpCtr\System\images\32x32\32x32.exe C:\WINDOWS\PCHealth\HelpCtr\System\images\48x48\48x48.exe C:\WINDOWS\PCHealth\HelpCtr\System\images\Centers\Centers.exe C:\WINDOWS\PCHealth\HelpCtr\System\images\Expando\Expando.exe C:\WINDOWS\PCHealth\HelpCtr\System\images\images.exe C:\WINDOWS\PCHealth\HelpCtr\System\NetDiag\NetDiag.exe C:\WINDOWS\PCHealth\HelpCtr\System\panels\panels.exe C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\subpanels.exe C:\WINDOWS\PCHealth\HelpCtr\System\rc\rc.exe C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Common\Common.exe C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Css\Css.exe C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\Client.exe C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\Common.exe C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Server\Server.exe C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Remote Assistance.exe C:\WINDOWS\PCHealth\HelpCtr\System\scripts\scripts.exe C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\graphics\33x16pie\33x16pie .exe C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\graphics\47x24pie\47x24pie .exe C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\graphics\graphics.exe C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\sysinfo.exe C:\WINDOWS\PCHealth\HelpCtr\System\System.exe C:\WINDOWS\PCHealth\HelpCtr\System\UpdateCtr\UpdateCtr.exe C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US.exe C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\Common.exe C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\Css.exe C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Common.exe C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\Email.exe C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\Unsolicited.exe C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Remote Assistance.exe C:\WINDOWS\PCHealth\UploadLB\Binaries\Binaries.exe C:\WINDOWS\PCHealth\UploadLB\Config\Config.exe C:\WINDOWS\Registration\Registration.exe C:\WINDOWS\srchasst\chars\chars.exe C:\WINDOWS\srchasst\mui\[u]0[/u]40C\[u]0[/u]40C.exe C:\WINDOWS\srchasst\mui\40C\40C.exe C:\WINDOWS\srchasst\srchasst.exe C:\WINDOWS\system\system.exe C:\WINDOWS\system32\config\systemprofile\systemprofile.exe C:\WINDOWS\system32\drivers\drivers.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\Program Files\AxBx C:\Program Files\EasySpywareCleaner C:\sqmdata09.sqm C:\sqmnoopt09.sqm C:\WINDOWS\java\Packages\PN335Z7F.ZIP C:\WINDOWS\java\Packages\R7X3FJ1N.ZIP C:\WINDOWS\W0034_jpg.zip . ((((((((((((((((((((((((((((( Fichiers créés 2007-12-15 to 2008-01-15 )))))))))))))))))))))))))))))))))))) . 2008-01-15 10:18 . 2008-01-15 10:18 d-------- C:\Documents and Settings\Guisse\Application Data\ACD Systems 2008-01-14 22:18 . 2008-01-14 22:18 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2008-01-14 22:18 . 2008-01-15 08:00 d-------- C:\Documents and Settings\Guisse\Application Data\AVG7 2008-01-14 22:17 . 2008-01-15 00:31 d-------- C:\Documents and Settings\All Users\Application Data\avg7 2008-01-14 22:06 . 2008-01-14 22:06 d--h----- C:\Program Files\Fichiers communs\Carlson 2008-01-14 22:06 . 2008-01-15 06:13 45,631 --a------ C:\m9w3l6u1g1.exe 2008-01-14 22:06 . 2008-01-14 22:06 42,941 -r-hs---- C:\WINDOWS\servicestub.exe 2008-01-14 18:02 . 2008-01-14 18:02 d-------- C:\Program Files\Fichiers communs\snp2std 2008-01-14 18:02 . 2008-01-14 18:02 d-------- C:\Documents and Settings\Guisse\Application Data\InstallShield 2008-01-14 18:02 . 2007-01-26 16:48 12,028,032 --a------ C:\WINDOWS\system32\drivers\snp2sxp.sys 2008-01-14 18:02 . 2006-09-15 13:21 675,840 --a------ C:\WINDOWS\vsnp2std.exe 2008-01-14 18:02 . 2006-11-29 16:11 258,048 --a------ C:\WINDOWS\tsnp2std.exe 2008-01-14 18:02 . 2006-10-03 14:35 249,856 --a------ C:\WINDOWS\system32\vsnp2std.dll 2008-01-14 18:02 . 2007-02-05 15:25 151,552 --a------ C:\WINDOWS\system32\rsnp2std.dll 2008-01-14 18:02 . 2006-11-16 15:57 77,824 --a------ C:\WINDOWS\system32\csnp2std.dll 2008-01-14 18:02 . 2007-01-25 18:48 25,472 --a------ C:\WINDOWS\system32\drivers\sncamd.sys 2008-01-14 18:02 . 2004-12-09 17:23 15,497 --a------ C:\WINDOWS\snp2std.ini 2008-01-14 18:02 . 2004-12-09 17:23 13,022 --a------ C:\WINDOWS\snp2std.src 2008-01-10 19:11 . 2008-01-10 19:11 d-------- C:\Program Files\Philips Flat Panel Adjust 2008-01-09 19:12 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-12-29 16:44 . 2007-12-29 16:44 d-------- C:\Documents and Settings\Guisse\Application Data\Webcammax 2007-12-29 16:39 . 2007-12-29 16:39 d-------- C:\Documents and Settings\Guisse\Application Data\EasySpywareCleaner.com 2007-12-29 15:15 . 2007-12-29 15:15 d-------- C:\Documents and Settings\Guisse\Application Data\Bitdefender 2007-12-29 15:14 . 2007-12-29 05:25 d-------- C:\Program Files\BitDefender 2007-12-29 05:28 . 2008-01-13 18:34 d-------- C:\Documents and Settings\All Users\Application Data\Webcammax 2007-12-29 05:27 . 2007-12-29 16:47 d-------- C:\Program Files\WebcamMax 2007-12-29 02:55 . 2007-12-29 02:55 d-------- C:\Program Files\MSECache 2007-12-27 20:25 . 2008-01-14 22:17 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-27 20:23 . 2007-12-27 20:23 d-------- C:\Program Files\CCleaner 2007-12-27 15:07 . 2007-12-27 15:07 d-------- C:\Program Files\Wanadoo Edition 2007-12-27 11:44 . 2007-12-27 11:48 d-------- C:\Program Files\Error Repair Professional 2007-12-26 01:01 . 2007-12-26 01:01 d-------- C:\Program Files\PC Inspector File Recovery 2007-12-26 01:01 . 2002-02-18 18:40 6,200 --a------ C:\WINDOWS\system32\INT13EXT.VXD 2007-12-25 14:50 . 2007-12-25 14:50 d-------- C:\Program Files\GetData 2007-12-25 14:50 . 2007-12-25 15:23 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-12-25 12:36 . 2007-12-25 12:37 d-------- C:\WINDOWS\ERUNT 2007-12-25 08:23 . 2008-01-15 02:26 d-------- C:\Program Files\REST2514 2007-12-24 19:54 . 2007-12-25 15:58 2,836 --a------ C:\WINDOWS\system32\tmp.reg 2007-12-24 19:52 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-12-24 19:52 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-12-24 19:52 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2007-12-24 19:52 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-12-24 19:52 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-12-24 19:52 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-12-24 19:50 . 2008-01-15 02:26 d-------- C:\SmitfraudFix 2007-12-24 14:04 . 2007-12-24 14:04 d-------- C:\Program Files\splus 2007-12-24 14:04 . 2005-10-17 18:13 447,488 --a------ C:\WINDOWS\system32\splus.cpl 2007-12-24 11:30 . 2007-12-24 11:30 d-------- C:\Program Files\Trend Micro 2007-12-20 22:24 . 2007-12-20 22:41 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-19 21:33 . 2007-12-19 21:33 2,359,350 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp 2007-12-19 21:33 . 2007-12-19 21:33 65,203 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-12-19 21:23 . 2007-12-19 21:33 6,116 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2007-12-16 13:51 . 2005-06-12 18:29 77,824 --a------ C:\WINDOWS\system32\fmcodec.DLL 2007-12-16 13:29 . 2007-12-16 13:45 171 --a------ C:\WINDOWS\system32\temp_0000_65-20.aok 2007-12-16 13:27 . 2007-12-16 13:27 172 --a------ C:\WINDOWS\system32\test.aok 2007-12-16 13:25 . 2007-12-16 13:26 d-------- C:\Program Files\Allok Video to FLV Converter 2007-12-16 13:25 . 2004-01-11 08:02 258,048 --a------ C:\WINDOWS\system32\GplMpgDec.ax 2007-12-16 13:25 . 2006-10-24 14:16 242,176 --a------ C:\WINDOWS\system32\fixflash.exe 2007-12-16 13:25 . 2007-04-12 14:19 129,024 --a------ C:\WINDOWS\system32\AVERM.dll 2007-12-16 13:25 . 2006-09-26 13:57 28,672 --a------ C:\WINDOWS\system32\AVEQT.dll 2007-12-15 16:40 . 2007-12-15 16:42 d-------- C:\Program Files\AdorageI-GfxDatas 2007-12-15 16:31 . 2007-12-15 16:31 51 --a------ C:\WINDOWS\system32\blue.SITENAME 2007-12-15 16:30 . 2007-12-15 17:13 455 --a------ C:\WINDOWS\VFO.VST 2007-12-15 16:29 . 2002-09-24 11:12 2,653,888 --a------ C:\WINDOWS\system32\LTRDG13n.OCX 2007-12-15 16:29 . 2002-09-24 11:12 534,192 --a------ C:\WINDOWS\system32\LTRVW13N.OCX 2007-12-15 16:29 . 2002-09-24 11:12 466,624 --a------ C:\WINDOWS\system32\LTRPR13n.DLL 2007-12-15 16:29 . 2005-07-12 14:25 401,408 --a------ C:\WINDOWS\system32\pvmjpg30.dll 2007-12-15 16:29 . 2002-09-24 11:12 194,248 --a------ C:\WINDOWS\system32\LTRFD13n.DLL 2007-12-15 16:28 . 2006-03-28 23:50 233,472 --a------ C:\WINDOWS\system32\DiskIO.dll 2007-12-15 16:28 . 2002-09-24 11:12 185,856 --a------ C:\WINDOWS\system32\lfpng13s.dll 2007-12-15 16:28 . 2006-03-28 23:45 184,320 --a------ C:\WINDOWS\system32\RALMain.dll 2007-12-15 16:28 . 2004-01-02 13:28 126,976 --------- C:\WINDOWS\system32\AVIPrAx.dll 2007-12-15 16:28 . 2002-09-24 11:12 79,360 --a------ C:\WINDOWS\system32\lfeps13s.dll 2007-12-15 16:28 . 2002-09-24 11:12 74,752 --a------ C:\WINDOWS\system32\lfgif13s.dll 2007-12-15 16:28 . 2001-12-11 23:21 73,728 --------- C:\WINDOWS\system32\MMAviAx.dll 2007-12-15 16:28 . 2003-04-21 16:11 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll 2007-12-15 16:28 . 2005-12-12 16:57 32,768 --------- C:\WINDOWS\system32\MLPagAx.dll 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.JP 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.IT 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.FR 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.ES 2007-12-15 16:26 . 2003-11-10 17:06 26,624 --------- C:\WINDOWS\system32\PSDrvCheck.DE 2007-12-15 16:26 . 2003-11-10 17:06 16,896 --------- C:\WINDOWS\system32\PSDrvCheck.NL 2007-12-15 16:26 . 2003-10-21 10:02 16,896 --------- C:\WINDOWS\system32\PSDrvCheck.KO 2007-12-15 16:23 . 2007-12-15 16:23 d-------- C:\Program Files\Microsoft SQL Server 2007-12-15 16:23 . 2002-12-17 17:23 33,340 --a------ C:\WINDOWS\system32\dbmsqlgc.dll 2007-12-15 16:23 . 2002-10-20 15:05 24,576 --a------ C:\WINDOWS\system32\dbmsgnet.dll 2007-12-15 16:22 . 2007-12-15 16:22 d-------- C:\WINDOWS\Cache 2007-12-15 16:22 . 2003-03-19 04:04 765,952 --------- C:\WINDOWS\system32\msvcp71d.dll 2007-12-15 16:22 . 2003-03-19 04:03 544,768 --------- C:\WINDOWS\system32\msvcr71d.dll 2007-12-15 16:07 . 2007-12-15 16:07 d-------- C:\Program Files\SmartSound Software 2007-12-15 16:07 . 2007-12-15 16:08 d-------- C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc 2007-12-15 16:04 . 2007-12-29 22:16 d-------- C:\Program Files\QuickTime 2007-12-15 16:04 . 2007-12-15 16:04 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-12-15 16:03 . 2007-12-24 13:38 359 --a------ C:\WINDOWS\VFO.INI . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-06 15:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zabersoft 2008-12-06 15:40 --------- d-----w C:\Program Files\WinHTTrack 2008-12-06 10:32 --------- d-----w C:\Documents and Settings\Guisse\Application Data\spy-rid.com 2008-12-06 06:17 --------- d-----w C:\Documents and Settings\Guisse\Application Data\InfeStop.com 2008-01-15 07:51 --------- d-----w C:\Documents and Settings\Guisse\Application Data\LimeWire 2008-01-15 07:49 --------- d-----w C:\Program Files\eMule 2008-01-15 00:28 --------- d-----w C:\Program Files\Alice 2008-01-15 00:28 --------- d-----w C:\Program Files\AdobeAudition 2.0 2008-01-14 17:59 --------- d-----w C:\Documents and Settings\Guisse\Application Data\Azureus 2008-01-14 17:02 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-09 21:49 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-01-09 21:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-12-29 18:39 --------- d-----w C:\Program Files\LimeWire 2007-12-25 06:50 --------- d-----w C:\Program Files\Google 2007-12-24 15:13 --------- d-----w C:\Program Files\Azureus 2007-12-24 13:51 --------- d-----w C:\Program Files\Windows Live Toolbar 2007-12-24 13:26 --------- d-----w C:\Documents and Settings\Guisse\Application Data\proDAD 2007-12-24 13:24 --------- d-----w C:\Program Files\Moyea 2007-12-24 13:23 --------- d-----w C:\Program Files\Labtec 2007-12-24 13:15 --------- d-----w C:\Program Files\Windows Live 2007-12-24 13:06 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2007-12-24 12:59 --------- d-----w C:\Program Files\Pinnacle 2007-12-22 06:10 --------- d-----w C:\Program Files\DAEMON Tools SearchBar 2007-12-19 20:41 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-12-19 20:33 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-12-15 15:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pinnacle 2007-12-07 22:28 1,594,541 ----a-w C:\WINDOWS\WANEUninstaller.exe 2007-12-07 21:44 --------- d-----w C:\Program Files\Worms 3D 2007-12-03 20:33 --------- d-----w C:\Program Files\OpenOffice.org 2.3 2007-11-30 16:10 --------- d-----w C:\Program Files\Video cache view 2007-11-28 21:56 --------- d-----w C:\Program Files\Fichiers communs\Logitech 2007-11-28 21:55 --------- d-----w C:\Program Files\directx 2007-11-28 21:43 --------- d-----w C:\Program Files\webcamXP 2007-11-28 21:02 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll 2007-11-27 15:18 --------- d-----w C:\Program Files\CrazyPixels 2007-11-26 18:34 --------- d-----w C:\Program Files\proDAD 2007-11-26 18:19 --------- d-----w C:\Program Files\AdorageI-SAL 2007-11-25 20:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pinnacle Studio 2007-11-18 07:49 --------- d-----w C:\Documents and Settings\Guisse\Application Data\OpenOffice.org2 2007-10-29 22:43 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll 2007-10-24 05:26 17,920 ----a-w C:\Documents and Settings\Guisse\Application Data\GDIPFONTCACHEV1.DAT 2007-10-18 10:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll 2005-12-13 13:39 200,704 ----a-w C:\Program Files\ECB.exe 2005-12-13 13:38 122 ----a-w C:\Program Files\Config.ini . [color=red]Files Infected - Win32.Agent.zb[/color] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ={750fdf0e-2a26-11d1-a3ea-080036587f03} ={4E77131D-3629-431c-9818-C5679DC83E81} ={99FD978C-D287-4F50-827F-B2C658EDA8E7} ={AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} ={920E6DB1-9907-4370-B3A0-BAFC03D81399} ={16F3DD56-1AF5-4347-846D-7C10C4192619} ={2916C86E-86A6-43FE-8112-43ABE6BF8DCC} ={b32a6748-f273-4546-b60a-3c5adc239de5} ={36A21736-36C2-4C11-8ACB-D4136F2B57BD} ={EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD} ={666C7833-A9B6-4AB4-94ED-DC238C81E925} "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [ ] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 10:28 139264] "DAEMON Tools"="J:\Logiciel\Program Files\DAEMON Tools\daemon.exe" [ ] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2005-06-08 07:42 14565376 C:\WINDOWS\RTHDCPL.EXE] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2007-12-26 09:10 344064] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-06-29 00:09 32768] "CmCardRun"="C:\WINDOWS\system32\CmWatch.exe" [2003-09-16 17:50 229376] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-12-26 09:10 132496] "LVCOMS"="C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE" [2007-12-26 09:10 135214] "WebcamMaxMoniter"="C:\Program Files\WebcamMax\wcmmon.exe" [2007-08-01 01:55 450048] "FixCamera"="C:\WINDOWS\FixCamera.exe" [2007-02-12 14:50 20480] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792] "eCarteBleue-LPV-P1"="C:\Program Files\ECB.exe" [2005-12-13 14:39 200704] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-24 00:06 487424] "tsnp2std"="C:\WINDOWS\tsnp2std.exe" [2006-11-29 16:11 258048] "snp2std"="C:\WINDOWS\vsnp2std.exe" [2006-09-15 13:21 675840] "servicestub.exe"="C:\WINDOWS\servicestub.exe" [2008-01-14 22:06 42941] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-14 22:17 579072] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-29 22:16 286720] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "StartUp"="C:\WINDOWS\trayicons.exe" [ ] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-14 22:17 219136] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 14:39 294400] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Barre d'état système d'ATI CATALYST.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Barre d'état système d'ATI CATALYST.lnk backup=C:\WINDOWS\pss\Barre d'état système d'ATI CATALYST.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup R1 kbfilter;Keyboard Filter Driver;C:\WINDOWS\system32\drivers\kbfilter.sys [2002-10-15 14:48] R1 moufiltr;Mouse Filter Driver;C:\WINDOWS\system32\drivers\moufiltr.sys [2003-01-23 14:29] R2 CamthWDM;WebcamMax, WDM Video Capture;C:\WINDOWS\system32\DRIVERS\CamthWDM.sys [2007-01-11 06:39] R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2007-11-12 16:27] R3 UMSSSTOR;C-Media Storage;C:\WINDOWS\system32\DRIVERS\UMSS.SYS [2004-07-13 12:40] R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 06:58] S3 scan;BitDefender Threat Scanner;C:\WINDOWS\System32\svchost.exe [2004-08-20 00:10] S3 se44bus;Sony Ericsson Device 068 driver (WDM);C:\WINDOWS\system32\DRIVERS\se44bus.sys [2006-11-30 13:58] S3 se44mdfl;Sony Ericsson Device 068 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se44mdfl.sys [2006-11-30 13:58] S3 se44mdm;Sony Ericsson Device 068 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se44mdm.sys [2006-11-30 13:58] S3 se44mgmt;Sony Ericsson Device 068 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se44mgmt.sys [2006-11-30 13:58] S3 se44nd5;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (NDIS);C:\WINDOWS\system32\DRIVERS\se44nd5.sys [2006-11-30 13:58] S3 se44obex;Sony Ericsson Device 068 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se44obex.sys [2006-11-30 13:58] S3 se44unic;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (WDM);C:\WINDOWS\system32\DRIVERS\se44unic.sys [2006-11-30 13:58] S3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2007-01-26 16:48] S3 StMp3Rec;Pilote de périphérique de la restauration de lecteur;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2007-02-15 14:14] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 07:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] \Shell\AutoRun\command - C:\ \Shell\open\Command - C:\F82EC657.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0aeeb6cf-a50f-11dc-8b50-0013d3a45508}] \Shell\AutoRun\command - E:\ \Shell\open\Command - D88777EE.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-15 12:20:58 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-15 12:21:58 ComboFix-quarantined-files.txt 2008-01-15 11:21:55 ComboFix2.txt 2008-01-11 17:59:41 ComboFix3.txt 2008-01-10 03:37:33 . 2008-01-11 02:03:05 --- E O F --- Et un nouveau rapport HijackThis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:24, on 2008-01-15 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\WINDOWS\system32\CmWatch.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE C:\Program Files\WebcamMax\wcmmon.exe C:\WINDOWS\FixCamera.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\vsnp2std.exe C:\WINDOWS\servicestub.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\eMule\emule.exe C:\Program Files\LimeWire\LimeWire.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\wcmmon.exe" /a O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] ; "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [eCarteBleue-LPV-P1] ; "C:\Program Files\ECB.exe" /dontopenmycards O4 - HKLM\..\Run: [NeroFilterCheck] ; C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Sony Ericsson PC Suite] ; "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe O4 - HKLM\..\Run: [servicestub.exe] C:\WINDOWS\servicestub.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [AdVantage] ; "C:\Program Files\AdVantage\AdVantage.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] ; "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [DAEMON Tools] ; "J:\Logiciel\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [swg] ; C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [StartUp] C:\WINDOWS\trayicons.exe /optimize speed (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [StartUp] C:\WINDOWS\trayicons.exe /optimize speed (User 'Default user') O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/... O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29 O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys

Le sioux · Answer

Bonsoir

Je bosse ce soir et regarde ça  dès que cela me sera possible.

@ bientôt.

GeoGeo · Answer

Salut Le Sioux, tu a put regarder ?

Le sioux · Answer

Hello Geo geo

Excuse pas beaucoup dispo le sioux ces derniers jours ...

ComboFix avec CFScript : 

*  Sélectionne le texte suivant (en gras)  dans son intégralité :

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"servicestub.exe"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdVantage"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage] 
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] 
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0aeeb6 cf-a50f-11dc-8b50-0013d3a45508}] 
File::
C:\m9w3l6u1g1.exe 
C:\Documents and Settings\Guisse\Application Data\EasySpywareCleaner.com
C:\WINDOWS\servicestub.exe
C:\Program Files\AdVantage\AdVantage.exe 
C:\WINDOWS	rayicons.exe 
Folder::
C:\Program Files\AdVantage

* Copie le texte sélectionné (CTRL+C).
* Ouvre le bloc-notes (programme>Accessoires >bloc-notes).
* Colle le texte copié dans ce bloc-notes (CTRL+V).
* Sauvegarde ce fichier sous le nom de CFScript.txt

Déconnecte toi du net et désactive ton antivirus  pour que Combofix puisse s'exécuter normalement

* Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe ( sur ton bureau)

* Une fenêtre bleue va apparaître: au message qui apparaît  Type 1 to continue, or 2 to abort , tape 1 puis valide.

* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal!

Ne touche à rien tant que le scan n'est pas terminé. 

--> Une fois le scan achevé, un rapport va s'afficher : Poste son contenu et un nouveau rapport HijackThis

(Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt )

@ suivre

GeoGeo · Answer

Ok, c'est pâs grave sit t'a pas trop le temps, c'est déjà bien gentil de m'aide, prend le temps qu'il te faut. Nouveau rapport ComboFix : ComboFix 08-01-11.1 - Guisse 2008-01-18 9:48:53.5 - NTFSx86 Running from: C:\Documents and Settings\Guisse\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Guisse\Bureau\CFScript.txt C:\Documents and Settings\Guisse\Bureau\CFScript.txt * Created a new restore point FILE C:\Documents and Settings\Guisse\Application Data\EasySpywareCleaner.com C:\m9w3l6u1g1.exe C:\Program Files\AdVantage\AdVantage.exe C:\WINDOWS\servicestub.exe C:\WINDOWS\trayicons.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\servicestub.exe C:\WINDOWS\W0034_jpg.zip . ((((((((((((((((((((((((((((( Fichiers créés 2007-12-18 to 2008-01-18 )))))))))))))))))))))))))))))))))))) . 2008-01-18 08:57 . 2008-01-18 08:58 154,979 --a------ C:\i2n4r9g1.exe 2008-01-17 14:19 . 2008-01-17 14:19 d-------- C:\Program Files\Editeur 2008-01-16 23:46 . 2008-01-16 23:46 d-------- C:\Program Files\Larousse 2008-01-16 19:47 . 2008-01-17 21:18 d-------- C:\Program Files\LiveKillCleanMessenger 2008-01-16 19:47 . 2008-01-16 19:47 d-------- C:\Documents and Settings\Guisse\Application Data\Live-Prod 2008-01-16 19:30 . 2008-01-16 19:30 d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2008-01-15 10:18 . 2008-01-15 10:18 d-------- C:\Documents and Settings\Guisse\Application Data\ACD Systems 2008-01-14 22:18 . 2008-01-14 22:18 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2008-01-14 22:18 . 2008-01-18 08:00 d-------- C:\Documents and Settings\Guisse\Application Data\AVG7 2008-01-14 22:17 . 2008-01-15 00:31 d-------- C:\Documents and Settings\All Users\Application Data\avg7 2008-01-14 22:06 . 2008-01-17 23:54 d--h----- C:\Program Files\Fichiers communs\Carlson 2008-01-14 18:02 . 2008-01-14 18:02 d-------- C:\Program Files\Fichiers communs\snp2std 2008-01-14 18:02 . 2008-01-14 18:02 d-------- C:\Documents and Settings\Guisse\Application Data\InstallShield 2008-01-14 18:02 . 2007-01-26 16:48 12,028,032 --a------ C:\WINDOWS\system32\drivers\snp2sxp.sys 2008-01-14 18:02 . 2006-09-15 13:21 675,840 --a------ C:\WINDOWS\vsnp2std.exe 2008-01-14 18:02 . 2006-11-29 16:11 258,048 --a------ C:\WINDOWS\tsnp2std.exe 2008-01-14 18:02 . 2006-10-03 14:35 249,856 --a------ C:\WINDOWS\system32\vsnp2std.dll 2008-01-14 18:02 . 2007-02-05 15:25 151,552 --a------ C:\WINDOWS\system32\rsnp2std.dll 2008-01-14 18:02 . 2006-11-16 15:57 77,824 --a------ C:\WINDOWS\system32\csnp2std.dll 2008-01-14 18:02 . 2007-01-25 18:48 25,472 --a------ C:\WINDOWS\system32\drivers\sncamd.sys 2008-01-14 18:02 . 2004-12-09 17:23 15,497 --a------ C:\WINDOWS\snp2std.ini 2008-01-14 18:02 . 2004-12-09 17:23 13,022 --a------ C:\WINDOWS\snp2std.src 2008-01-10 19:11 . 2008-01-10 19:11 d-------- C:\Program Files\Philips Flat Panel Adjust 2008-01-09 19:12 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-12-29 16:44 . 2007-12-29 16:44 d-------- C:\Documents and Settings\Guisse\Application Data\Webcammax 2007-12-29 16:39 . 2007-12-29 16:39 d-------- C:\Documents and Settings\Guisse\Application Data\EasySpywareCleaner.com 2007-12-29 15:15 . 2007-12-29 15:15 d-------- C:\Documents and Settings\Guisse\Application Data\Bitdefender 2007-12-29 15:14 . 2007-12-29 05:25 d-------- C:\Program Files\BitDefender 2007-12-29 05:28 . 2008-01-13 18:34 d-------- C:\Documents and Settings\All Users\Application Data\Webcammax 2007-12-29 05:27 . 2007-12-29 16:47 d-------- C:\Program Files\WebcamMax 2007-12-29 02:55 . 2007-12-29 02:55 d-------- C:\Program Files\MSECache 2007-12-27 20:25 . 2008-01-14 22:17 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-27 20:23 . 2007-12-27 20:23 d-------- C:\Program Files\CCleaner 2007-12-27 15:07 . 2007-12-27 15:07 d-------- C:\Program Files\Wanadoo Edition 2007-12-27 11:44 . 2007-12-27 11:48 d-------- C:\Program Files\Error Repair Professional 2007-12-26 01:01 . 2007-12-26 01:01 d-------- C:\Program Files\PC Inspector File Recovery 2007-12-26 01:01 . 2002-02-18 18:40 6,200 --a------ C:\WINDOWS\system32\INT13EXT.VXD 2007-12-25 14:50 . 2007-12-25 14:50 d-------- C:\Program Files\GetData 2007-12-25 14:50 . 2007-12-25 15:23 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-12-25 12:36 . 2007-12-25 12:37 d-------- C:\WINDOWS\ERUNT 2007-12-25 08:23 . 2008-01-15 02:26 d-------- C:\Program Files\REST2514 2007-12-24 19:54 . 2007-12-25 15:58 2,836 --a------ C:\WINDOWS\system32\tmp.reg 2007-12-24 19:52 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-12-24 19:52 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-12-24 19:52 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2007-12-24 19:52 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-12-24 19:52 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-12-24 19:52 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-12-24 19:50 . 2008-01-15 02:26 d-------- C:\SmitfraudFix 2007-12-24 14:04 . 2007-12-24 14:04 d-------- C:\Program Files\splus 2007-12-24 14:04 . 2005-10-17 18:13 447,488 --a------ C:\WINDOWS\system32\splus.cpl 2007-12-24 11:30 . 2007-12-24 11:30 d-------- C:\Program Files\Trend Micro 2007-12-20 22:24 . 2007-12-20 22:41 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-19 21:33 . 2007-12-19 21:33 2,359,350 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp 2007-12-19 21:33 . 2007-12-19 21:33 65,203 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-12-19 21:23 . 2007-12-19 21:33 6,116 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-06 15:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zabersoft 2008-12-06 15:40 --------- d-----w C:\Program Files\WinHTTrack 2008-12-06 10:32 --------- d-----w C:\Documents and Settings\Guisse\Application Data\spy-rid.com 2008-12-06 06:17 --------- d-----w C:\Documents and Settings\Guisse\Application Data\InfeStop.com 2008-01-18 08:01 --------- d-----w C:\Documents and Settings\Guisse\Application Data\Azureus 2008-01-18 04:38 --------- d-----w C:\Program Files\eMule 2008-01-17 08:57 --------- d-----w C:\Documents and Settings\Guisse\Application Data\LimeWire 2008-01-16 22:46 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-16 18:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-01-16 17:03 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-01-16 16:11 --------- d-----w C:\Program Files\Windows Live 2008-01-15 00:28 --------- d-----w C:\Program Files\Alice 2008-01-15 00:28 --------- d-----w C:\Program Files\AdobeAudition 2.0 2008-01-09 21:49 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller 2007-12-29 21:16 --------- d-----w C:\Program Files\QuickTime 2007-12-29 18:39 --------- d-----w C:\Program Files\LimeWire 2007-12-25 06:50 --------- d-----w C:\Program Files\Google 2007-12-24 15:13 --------- d-----w C:\Program Files\Azureus 2007-12-24 13:51 --------- d-----w C:\Program Files\Windows Live Toolbar 2007-12-24 13:26 --------- d-----w C:\Documents and Settings\Guisse\Application Data\proDAD 2007-12-24 13:24 --------- d-----w C:\Program Files\Moyea 2007-12-24 13:23 --------- d-----w C:\Program Files\Labtec 2007-12-24 13:06 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2007-12-24 12:59 --------- d-----w C:\Program Files\Pinnacle 2007-12-22 06:10 --------- d-----w C:\Program Files\DAEMON Tools SearchBar 2007-12-19 20:33 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-12-16 12:26 --------- d-----w C:\Program Files\Allok Video to FLV Converter 2007-12-15 15:42 --------- d-----w C:\Program Files\AdorageI-GfxDatas 2007-12-15 15:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pinnacle 2007-12-15 15:23 --------- d-----w C:\Program Files\Microsoft SQL Server 2007-12-15 15:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc 2007-12-15 15:07 --------- d-----w C:\Program Files\SmartSound Software 2007-12-15 15:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-12-07 22:28 1,594,541 ----a-w C:\WINDOWS\WANEUninstaller.exe 2007-12-07 21:44 --------- d-----w C:\Program Files\Worms 3D 2007-12-03 20:33 --------- d-----w C:\Program Files\OpenOffice.org 2.3 2007-11-30 16:10 --------- d-----w C:\Program Files\Video cache view 2007-11-28 21:56 --------- d-----w C:\Program Files\Fichiers communs\Logitech 2007-11-28 21:55 --------- d-----w C:\Program Files\directx 2007-11-28 21:43 --------- d-----w C:\Program Files\webcamXP 2007-11-28 21:02 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll 2007-11-27 15:18 --------- d-----w C:\Program Files\CrazyPixels 2007-11-26 18:34 --------- d-----w C:\Program Files\proDAD 2007-11-26 18:19 --------- d-----w C:\Program Files\AdorageI-SAL 2007-11-25 20:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pinnacle Studio 2007-11-18 07:49 --------- d-----w C:\Documents and Settings\Guisse\Application Data\OpenOffice.org2 2007-10-29 22:43 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll 2007-10-24 05:26 17,920 ----a-w C:\Documents and Settings\Guisse\Application Data\GDIPFONTCACHEV1.DAT 2007-10-18 10:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll 2005-12-13 13:39 200,704 ----a-w C:\Program Files\ECB.exe 2005-12-13 13:38 122 ----a-w C:\Program Files\Config.ini . [color=red]Files Infected - Win32.Agent.zb[/color] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE . ((((((((((((((((((((((((((((( snapshot@2008-01-10_ 4.35.51.31 ))))))))))))))))))))))))))))))))))))))))) . - 2007-10-17 01:04:25 68,608 ----a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll + 2008-01-16 18:30:40 68,608 ----a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll - 2007-10-17 01:04:36 72,192 ----a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll + 2008-01-16 18:31:01 72,192 ----a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll - 2007-10-17 01:04:36 4,308,992 ----a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll + 2008-01-16 18:31:02 4,308,992 ----a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll - 2007-10-17 01:04:38 482,304 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll + 2008-01-16 18:31:05 482,304 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll - 2007-10-17 01:04:33 2,902,016 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll + 2008-01-16 18:30:52 2,902,016 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll - 2007-10-17 01:04:20 258,048 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll + 2008-01-16 18:30:30 258,048 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll - 2007-10-17 01:04:20 114,176 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll + 2008-01-16 18:30:30 114,176 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll - 2007-10-17 01:04:44 260,096 ----a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll + 2008-01-16 18:31:18 260,096 ----a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll - 2007-10-17 01:04:29 5,156,864 ----a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll + 2008-01-16 18:30:47 5,156,864 ----a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll - 2007-10-17 01:04:24 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll + 2008-01-16 18:30:38 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll - 2007-10-17 01:04:19 507,904 ----a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll + 2008-01-16 18:30:28 507,904 ----a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll - 2007-10-17 01:04:21 13,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll + 2008-01-16 18:30:32 13,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll - 2007-10-17 01:04:35 8,192 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll + 2008-01-16 18:30:56 8,192 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll - 2007-10-17 01:04:35 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll + 2008-01-16 18:30:57 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll - 2007-10-17 01:04:35 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll + 2008-01-16 18:30:59 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll - 2007-10-17 01:04:22 413,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll + 2008-01-16 18:30:34 413,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll - 2007-10-17 01:04:23 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll + 2008-01-16 18:30:35 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll - 2007-10-17 01:04:23 647,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll + 2008-01-16 18:30:36 647,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll - 2007-10-17 01:04:24 73,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll + 2008-01-16 18:30:37 73,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll - 2007-10-17 01:04:21 749,568 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll + 2008-01-16 18:30:33 749,568 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll - 2007-10-17 01:04:46 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll + 2008-01-16 18:31:21 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll - 2007-10-17 01:04:46 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll + 2008-01-16 18:31:20 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll - 2007-10-17 01:04:17 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll + 2008-01-16 18:30:25 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll - 2007-10-17 01:04:45 667,648 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll + 2008-01-16 18:31:19 667,648 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll - 2007-10-17 01:04:47 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll + 2008-01-16 18:31:22 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll - 2007-10-17 01:04:19 12,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll + 2008-01-16 18:30:28 12,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll - 2007-10-17 01:04:18 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll + 2008-01-16 18:30:26 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll - 2007-10-17 01:04:18 7,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll + 2008-01-16 18:30:27 7,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll - 2007-10-17 01:04:41 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll + 2008-01-16 18:31:12 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll - 2007-10-17 01:04:25 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll + 2008-01-16 18:30:41 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll - 2007-10-17 01:04:42 413,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll + 2008-01-16 18:31:13 413,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll - 2007-10-17 01:04:39 716,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll + 2008-01-16 18:31:06 716,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll - 2007-10-17 01:04:20 888,832 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll + 2008-01-16 18:30:31 888,832 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll - 2007-10-17 01:04:34 5,001,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll + 2008-01-16 18:30:54 5,001,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll - 2007-10-17 01:04:27 188,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll + 2008-01-16 18:30:43 188,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll - 2007-10-17 01:04:26 397,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll + 2008-01-16 18:30:41 397,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll - 2007-10-17 01:04:27 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll + 2008-01-16 18:30:44 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll - 2007-10-17 01:04:43 577,536 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll + 2008-01-16 18:31:16 577,536 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll - 2007-10-17 01:04:39 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll + 2008-01-16 18:31:08 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll - 2007-10-17 01:04:44 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll + 2008-01-16 18:31:17 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll - 2007-10-17 01:04:40 299,008 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll + 2008-01-16 18:31:10 299,008 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll - 2007-10-17 01:04:41 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll + 2008-01-16 18:31:11 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll - 2007-10-17 01:04:25 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll + 2008-01-16 18:30:39 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll - 2007-10-17 01:04:28 114,688 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll + 2008-01-16 18:30:46 114,688 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll - 2007-10-17 01:04:44 835,584 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll + 2008-01-16 18:31:18 835,584 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll - 2007-10-17 01:04:30 86,016 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll + 2008-01-16 18:30:48 86,016 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll - 2007-10-17 01:04:30 823,296 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll + 2008-01-16 18:30:49 823,296 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll - 2007-10-17 01:04:31 5,152,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll + 2008-01-16 18:30:50 5,152,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll - 2007-10-17 01:04:32 2,027,520 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll + 2008-01-16 18:30:51 2,027,520 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll - 2007-10-17 01:04:42 2,940,928 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll + 2008-01-16 18:31:15 2,940,928 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll + 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE + 2008-01-18 08:48:25 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-01-18 08:48:25 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat + 2008-01-18 08:48:25 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT + 2008-01-18 08:48:25 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat + 2008-01-18 08:48:26 6,107,136 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\ntuser.dat + 2008-01-18 08:48:26 204,800 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat + 2008-01-16 22:46:01 32,768 ----a-r C:\WINDOWS\Installer\{716E0306-8318-4364-8B8F-0CC4E9376BAC}\icon.exe - 2008-01-09 21:49:45 29,926 ----a-r C:\WINDOWS\Installer\{BADF6744-3787-48F6-B8C9-4C4995401D65}\MsblIco.Exe + 2008-01-16 16:56:46 29,926 ----a-r C:\WINDOWS\Installer\{BADF6744-3787-48F6-B8C9-4C4995401D65}\MsblIco.Exe - 2005-09-23 05:28:52 72,704 ----a-w C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe + 2005-09-23 06:28:52 72,704 ----a-w C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe - 2005-09-23 05:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_diasymreader.dll + 2005-09-23 06:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_diasymreader.dll - 2005-09-23 05:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_iehost.dll + 2005-09-23 06:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_iehost.dll - 2005-09-23 05:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_microsoft.jscript.dll + 2005-09-23 06:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_microsoft.jscript.dll - 2005-09-23 05:29:04 5,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_microsoft.vsa.vb.codedomprocessor.dll + 2005-09-23 06:29:04 5,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_microsoft.vsa.vb.codedomprocessor.dll - 2005-09-23 05:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_mscordbi.dll + 2005-09-23 06:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_mscordbi.dll - 2005-09-23 05:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_mscorrc.dll + 2005-09-23 06:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_mscorrc.dll - 2005-09-23 05:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_mscorsec.dll + 2005-09-23 06:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_mscorsec.dll - 2005-09-23 05:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_system.configuration.install.dll + 2005-09-23 06:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_system.configuration.install.dll - 2005-09-23 05:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_system.data.dll + 2005-09-23 06:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_system.data.dll - 2005-09-23 05:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_system.enterpriseservices.dll + 2005-09-23 06:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_system.enterpriseservices.dll - 2005-09-23 05:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_VsaVb7rt.dll + 2005-09-23 06:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_VsaVb7rt.dll - 2005-09-23 05:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_wminet_utils.dll + 2005-09-23 06:29:04 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbs_wminet_utils.dll - 2005-09-23 05:28:52 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp10.dll + 2005-09-23 06:28:52 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp10.dll - 2005-09-23 05:28:56 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_mscorwks.dll + 2005-09-23 06:28:56 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_mscorwks.dll - 2005-09-23 05:28:58 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_perfcounter.dll + 2005-09-23 06:28:58 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_perfcounter.dll - 2005-09-23 05:28:56 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\SharedReg12.dll + 2005-09-23 06:28:56 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\SharedReg12.dll - 2005-09-23 05:28:52 86,528 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll + 2005-09-23 06:28:52 86,528 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll - 2005-09-23 05:28:36 18,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll + 2005-09-23 06:28:36 18,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll - 2005-09-23 05:28:42 136,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll + 2005-09-23 06:28:42 136,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll - 2005-09-23 05:28:44 4,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll + 2005-09-23 06:28:44 4,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll - 2005-09-23 05:29:04 183,808 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll + 2005-09-23 06:29:04 183,808 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll - 2005-09-23 05:28:28 208,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll + 2005-09-23 06:28:28 208,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll - 2005-09-23 05:28:56 10,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll + 2005-09-23 06:28:56 10,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll - 2005-09-23 05:28:58 138,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll + 2005-09-23 06:28:58 138,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll - 2005-09-23 05:28:36 87,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\alink.dll + 2005-09-23 06:28:36 87,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\alink.dll - 2007-04-13 01:21:18 58,712 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe + 2007-04-13 02:21:18 58,712 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe - 2005-09-23 05:28:32 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe + 2005-09-23 06:28:32 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe - 2007-04-13 01:20:52 10,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll + 2007-04-13 02:20:52 10,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll - 2007-04-13 01:20:52 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll + 2007-04-13 02:20:52 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll - 2007-04-13 01:20:52 23,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll + 2007-04-13 02:20:52 23,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll - 2007-04-13 01:20:50 75,264 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll + 2007-04-13 02:20:50 75,264 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll - 2005-09-23 05:28:32 13,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe + 2005-09-23 06:28:32 13,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe - 2007-04-13 01:20:52 32,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe + 2007-04-13 02:20:52 32,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe - 2005-09-23 05:28:32 106,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe + 2005-09-23 06:28:32 106,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe - 2007-04-13 01:20:52 33,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe + 2007-04-13 02:20:52 33,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe - 2007-04-13 01:20:52 32,600 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe + 2007-04-13 02:20:52 32,600 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe - 2007-04-13 01:20:52 507,904 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll + 2007-04-13 02:20:52 507,904 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll - 2005-09-23 05:28:56 106,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe + 2005-09-23 06:28:56 106,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe - 2007-04-13 01:21:16 88,576 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll + 2007-04-13 02:21:16 88,576 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll - 2005-09-23 05:28:42 76,984 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe + 2005-09-23 06:28:42 76,984 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe - 2005-09-23 05:28:42 1,144,832 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscomp.dll + 2005-09-23 06:28:42 1,144,832 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscomp.dll - 2005-09-23 05:28:42 13,312 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll + 2005-09-23 06:28:42 13,312 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll - 2005-09-23 05:28:58 17,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll + 2005-09-23 06:28:58 17,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll - 2005-09-23 05:28:56 68,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll + 2005-09-23 06:28:56 68,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll - 2005-09-23 05:28:44 31,936 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cvtres.exe + 2005-09-23 06:28:44 31,936 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cvtres.exe - 2005-09-23 05:28:38 52,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfdll.dll + 2005-09-23 06:28:38 52,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfdll.dll - 2007-04-13 01:20:58 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe + 2007-04-13 02:20:58 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe - 2005-09-23 05:29:12 547,840 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll + 2005-09-23 06:29:12 547,840 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll - 2005-09-23 05:28:56 788,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll + 2005-09-23 06:28:56 788,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll - 2005-09-23 05:28:50 9,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fusion.dll + 2005-09-23 06:28:50 9,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fusion.dll - 2007-04-13 01:21:16 9,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe + 2007-04-13 02:21:16 9,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe - 2005-09-23 05:28:56 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll + 2005-09-23 06:28:56 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll - 2005-09-23 05:28:56 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEHost.dll + 2005-09-23 06:28:56 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEHost.dll - 2005-09-23 05:28:56 5,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll + 2005-09-23 06:28:56 5,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll - 2007-04-13 01:21:16 228,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe + 2007-04-13 02:21:16 228,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe - 2007-04-13 01:21:16 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe + 2007-04-13 02:21:16 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe - 2005-09-23 05:28:56 55,296 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll + 2005-09-23 06:28:56 55,296 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll - 2005-09-23 05:28:56 72,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll + 2005-09-23 06:28:56 72,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll - 2005-09-23 05:28:48 40,960 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe + 2005-09-23 06:28:48 40,960 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe - 2005-09-23 05:01:16 609,472 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe + 2005-09-23 06:01:16 609,472 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe - 2005-09-23 04:29:48 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1025.dll + 2005-09-23 05:29:48 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1025.dll - 2005-09-23 04:32:24 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1028.dll + 2005-09-23 05:32:24 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1028.dll - 2005-09-23 04:34:10 82,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1029.dll + 2005-09-23 05:34:10 82,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1029.dll - 2005-09-23 04:34:12 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1030.dll + 2005-09-23 05:34:12 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1030.dll - 2005-09-23 04:34:44 85,504 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1031.dll + 2005-09-23 05:34:44 85,504 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1031.dll - 2005-09-23 04:36:24 87,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1032.dll + 2005-09-23 05:36:24 87,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1032.dll - 2005-09-23 01:46:14 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1033.dll + 2005-09-23 02:46:14 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1033.dll - 2005-09-23 04:38:26 81,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1035.dll + 2005-09-23 05:38:26 81,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1035.dll - 2005-09-23 04:38:52 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1036.dll + 2005-09-23 05:38:52 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1036.dll - 2005-09-23 04:40:30 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1037.dll + 2005-09-23 05:40:30 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1037.dll - 2005-09-23 04:40:32 83,968 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1038.dll + 2005-09-23 05:40:32 83,968 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1038.dll - 2005-09-23 04:40:56 84,480 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1040.dll + 2005-09-23 05:40:56 84,480 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1040.dll - 2005-09-23 04:42:58 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1041.dll + 2005-09-23 05:42:58 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1041.dll - 2005-09-23 04:44:58 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1042.dll + 2005-09-23 05:44:58 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1042.dll - 2005-09-23 04:46:38 83,456 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1043.dll + 2005-09-23 05:46:38 83,456 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1043.dll - 2005-09-23 04:46:38 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1044.dll + 2005-09-23 05:46:38 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1044.dll - 2005-09-23 04:46:40 83,456 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1045.dll + 2005-09-23 05:46:40 83,456 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1045.dll - 2005-09-23 04:47:04 82,432 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1046.dll + 2005-09-23 05:47:04 82,432 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1046.dll - 2005-09-23 04:47:30 82,432 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1049.dll + 2005-09-23 05:47:30 82,432 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1049.dll - 2005-09-23 04:47:32 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1053.dll + 2005-09-23 05:47:32 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1053.dll - 2005-09-23 04:47:32 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1055.dll + 2005-09-23 05:47:32 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1055.dll - 2005-09-23 04:30:18 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2052.dll + 2005-09-23 05:30:18 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2052.dll - 2005-09-23 04:47:06 84,480 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2070.dll + 2005-09-23 05:47:06 84,480 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2070.dll - 2005-09-23 04:29:50 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3076.dll + 2005-09-23 05:29:50 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3076.dll - 2005-09-23 04:36:48 85,504 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3082.dll + 2005-09-23 05:36:48 85,504 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3082.dll - 2005-09-23 05:57:06 245,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\unicows.dll + 2005-09-23 06:57:06 245,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\unicows.dll - 2007-04-13 01:21:10 413,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll + 2007-04-13 02:21:10 413,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll - 2005-09-23 05:28:48 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll + 2005-09-23 06:28:48 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll - 2007-04-13 01:21:10 647,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll + 2007-04-13 02:21:10 647,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll - 2005-09-23 05:28:48 73,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll + 2005-09-23 06:28:48 73,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll - 2007-04-13 01:21:08 749,568 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll + 2007-04-13 02:21:08 749,568 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll - 2005-09-23 05:29:10 110,592 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll + 2005-09-23 06:29:10 110,592 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll - 2005-09-23 05:29:10 372,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll + 2005-09-23 06:29:10 372,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll - 2005-09-23 05:29:08 667,648 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll + 2005-09-23 06:29:08 667,648 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll - 2005-09-23 05:28:30 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll + 2005-09-23 06:28:30 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll - 2005-09-23 05:29:10 5,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll + 2005-09-23 06:29:10 5,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll - 2005-09-23 05:28:30 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll + 2005-09-23 06:28:30 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll - 2005-09-23 05:28:30 12,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll + 2005-09-23 06:28:30 12,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll - 2005-09-23 05:28:30 7,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll + 2005-09-23 06:28:30 7,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll - 2007-04-13 01:20:52 87,040 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll + 2007-04-13 02:20:52 87,040 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll - 2005-09-23 05:28:48 69,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe + 2005-09-23 06:28:48 69,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe - 2007-04-13 01:21:18 802,304 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll + 2007-04-13 02:21:18 802,304 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll - 2005-09-23 05:28:56 73,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll + 2005-09-23 06:28:56 73,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll - 2005-09-23 05:28:56 288,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll + 2005-09-23 06:28:56 288,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll - 2007-04-13 01:21:16 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll + 2007-04-13 02:21:16 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll - 2007-04-13 01:21:16 326,656 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll + 2007-04-13 02:21:16 326,656 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll - 2005-09-23 05:28:56 81,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorld.dll + 2005-09-23 06:28:56 81,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorld.dll - 2007-04-13 01:21:16 4,308,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll + 2007-04-13 02:21:16 4,308,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll - 2007-04-13 01:21:16 102,912 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll + 2007-04-13 02:21:16 102,912 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll - 2005-09-23 05:29:00 330,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll + 2005-09-23 06:29:00 330,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll - 2005-09-23 05:28:56 67,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll + 2005-09-23 06:28:56 67,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll - 2005-09-23 05:28:50 9,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll + 2005-09-23 06:28:50 9,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll - 2007-04-13 01:21:18 227,328 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll + 2007-04-13 02:21:18 227,328 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll - 2007-04-13 01:21:18 68,952 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe + 2007-04-13 02:21:18 68,952 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe - 2005-09-23 05:28:56 10,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscortim.dll + 2005-09-23 06:28:56 10,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscortim.dll - 2007-04-13 01:21:12 5,634,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll + 2007-04-13 02:21:12 5,634,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll - 2005-09-23 05:29:00 22,528 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI\[u]0[/u]409\mscorsecr.dll + 2005-09-23 06:29:00 22,528 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI\[u]0[/u]409\mscorsecr.dll - 2007-04-13 01:21:16 99,152 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe + 2007-04-13 02:21:16 99,152 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe - 2007-04-13 01:21:18 15,360 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll + 2007-04-13 02:21:18 15,360 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll - 2005-09-23 05:28:56 78,336 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll + 2005-09-23 06:28:56 78,336 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll - 2007-04-13 01:21:12 136,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll + 2007-04-13 02:21:12 136,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll - 2005-09-23 05:28:56 53,248 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe + 2005-09-23 06:28:56 53,248 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe - 2005-09-23 05:28:56 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe + 2005-09-23 06:28:56 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe - 2005-09-23 05:29:02 59,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe + 2005-09-23 06:29:02 59,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe - 2005-09-23 05:28:58 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll + 2005-09-23 06:28:58 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll - 2005-09-23 05:28:56 107,520 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\shfusion.dll + 2005-09-23 06:28:56 107,520 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\shfusion.dll - 2005-09-23 05:29:00 85,504 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll + 2005-09-23 06:29:00 85,504 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll - 2007-04-13 01:21:18 382,464 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll + 2007-04-13 02:21:18 382,464 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll - 2007-04-13 01:21:18 110,592 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll + 2007-04-13 02:21:18 110,592 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll - 2007-04-13 01:21:18 413,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll + 2007-04-13 02:21:18 413,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll - 2005-09-23 05:28:56 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll + 2005-09-23 06:28:56 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll - 2007-04-13 01:21:16 2,902,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll + 2007-04-13 02:21:16 2,902,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll - 2007-04-13 01:21:18 482,304 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll + 2007-04-13 02:21:18 482,304 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll - 2007-04-13 01:21:18 716,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll + 2007-04-13 02:21:18 716,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll - 2007-04-13 01:20:58 888,832 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll + 2007-04-13 02:20:58 888,832 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll - 2007-04-13 01:21:16 5,001,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll + 2007-04-13 02:21:16 5,001,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll - 2005-09-23 05:28:56 397,312 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll + 2005-09-23 06:28:56 397,312 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll - 2007-04-13 01:21:18 188,416 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll + 2007-04-13 02:21:18 188,416 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll - 2007-04-13 01:21:16 2,940,928 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll + 2007-04-13 02:21:16 2,940,928 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll - 2005-09-23 05:28:56 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll + 2005-09-23 06:28:56 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll - 2007-04-13 01:21:16 577,536 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll + 2007-04-13 02:21:16 577,536 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll - 2007-04-13 01:21:16 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll + 2007-04-13 02:21:16 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll - 2007-04-13 01:21:18 47,616 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll + 2007-04-13 02:21:18 47,616 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll - 2007-04-13 01:21:18 114,176 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll + 2007-04-13 02:21:18 114,176 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll - 2007-04-13 01:21:16 372,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll + 2007-04-13 02:21:16 372,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll - 2005-09-23 05:28:56 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll + 2005-09-23 06:28:56 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll - 2007-04-13 01:21:16 299,008 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll + 2007-04-13 02:21:16 299,008 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll - 2005-09-23 05:28:56 131,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll + 2005-09-23 06:28:56 131,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll - 2005-09-23 05:28:56 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Security.dll + 2005-09-23 06:28:56 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Security.dll - 2005-09-23 05:28:56 114,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll + 2005-09-23 06:28:56 114,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll - 2007-04-13 01:21:18 260,096 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll + 2007-04-13 02:21:18 260,096 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll - 2007-04-13 01:21:16 5,156,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll + 2007-04-13 02:21:16 5,156,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll - 2005-09-23 05:28:56 835,584 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll + 2005-09-23 06:28:56 835,584 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll - 2005-09-23 05:28:56 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll + 2005-09-23 06:28:56 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll - 2005-09-23 05:28:56 823,296 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll + 2005-09-23 06:28:56 823,296 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll - 2007-04-13 01:21:16 5,152,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll + 2007-04-13 02:21:16 5,152,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll - 2007-04-13 01:21:16 2,027,520 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll + 2007-04-13 02:21:16 2,027,520 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll - 2005-09-23 05:28:56 71,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL + 2005-09-23 06:28:56 71,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL - 2007-04-13 01:21:28 1,166,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe + 2007-04-13 02:21:28 1,166,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe - 2007-04-13 01:20:50 1,330,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll + 2007-04-13 02:20:50 1,330,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll - 2007-04-13 01:20:52 406,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll + 2007-04-13 02:20:52 406,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll - 2005-09-23 05:28:56 28,160 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll + 2005-09-23 06:28:56 28,160 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll - 2007-12-29 04:31:30 9,728 ----a-w C:\WINDOWS\system32\BASSMOD.dll + 2008-01-13 17:38:26 9,728 ----a-w C:\WINDOWS\system32\BASSMOD.dll - 2003-05-30 14:27:46 32,768 ----a-w C:\WINDOWS\system32\CmCardRm.dll + 2003-05-30 15:27:46 32,768 ----a-w C:\WINDOWS\system32\CmCardRm.dll - 2003-07-03 12:44:24 212,992 ----a-w C:\WINDOWS\system32\CmCardRm.exe + 2003-07-03 13:44:24 212,992 ----a-w C:\WINDOWS\system32\CmCardRm.exe - 2007-12-26 08:10:24 229,376 ----a-w C:\WINDOWS\system32\cmwatch.exe + 2003-09-16 16:50:58 229,376 ----a-w C:\WINDOWS\system32\CmWatch.exe - 2005-09-23 05:28:38 83,456 ----a-w C:\WINDOWS\system32\dfshim.dll + 2005-09-23 06:28:38 83,456 ----a-w C:\WINDOWS\system32\dfshim.dll + 2008-01-14 21:17:51 821,856 ----a-w C:\WINDOWS\system32\drivers\avg7core.sys + 2008-01-14 21:18:00 4,224 ----a-w C:\WINDOWS\system32\drivers\avg7rsw.sys + 2008-01-14 21:18:01 27,776 ----a-w C:\WINDOWS\system32\drivers\avg7rsxp.sys + 2008-01-14 21:18:07 10,760 ----a-w C:\WINDOWS\system32\drivers\avgclean.sys + 2008-01-14 21:18:07 26,952 ----a-w C:\WINDOWS\system32\drivers\avgmfx86.sys - 2004-07-13 10:40:22 48,512 ----a-w C:\WINDOWS\system32\drivers\Umss.SYS + 2004-07-13 11:40:22 48,512 ----a-w C:\WINDOWS\system32\drivers\Umss.SYS - 2007-12-29 15:31:06 290,088 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2008-01-17 09:56:22 294,072 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT - 2007-12-02 23:00:05 18,684,536 ----a-w C:\WINDOWS\system32\MRT.exe + 2008-01-02 18:21:36 17,642,616 ----a-w C:\WINDOWS\system32\MRT.exe - 2007-04-13 01:21:14 271,360 ----a-w C:\WINDOWS\system32\mscoree.dll + 2007-04-13 02:21:14 271,360 ----a-w C:\WINDOWS\system32\mscoree.dll - 2005-09-23 05:28:52 150,016 ----a-w C:\WINDOWS\system32\mscorier.dll + 2005-09-23 06:28:52 150,016 ----a-w C:\WINDOWS\system32\mscorier.dll - 2005-09-23 05:28:52 74,240 ----a-w C:\WINDOWS\system32\mscories.dll + 2005-09-23 06:28:52 74,240 ----a-w C:\WINDOWS\system32\mscories.dll - 2003-04-21 15:11:38 82,432 ----a-w C:\WINDOWS\system32\msxml4r.dll + 2003-04-18 15:29:24 96,256 ----a-w C:\WINDOWS\system32\msxml4r.dll - 2005-09-23 05:28:56 32,768 ----a-w C:\WINDOWS\system32\netfxperf.dll + 2005-09-23 06:28:56 32,768 ----a-w C:\WINDOWS\system32\netfxperf.dll - 2007-12-24 12:40:10 70,018 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-01-16 18:31:33 70,018 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-12-24 12:40:10 92,342 ----a-w C:\WINDOWS\system32\perfc00C.dat + 2008-01-16 18:31:33 92,342 ----a-w C:\WINDOWS\system32\perfc00C.dat - 2007-12-24 12:40:10 418,762 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-01-

Le sioux · Answer

Bonjour Geo geo

Je vois que tu as installé LiveKillCleanMessenger  il y a peu. Je vois cela aussi : C:\Program Files\Fichiers communs\Carlson 

Why ?  Tu as reçu un zip de photos  via msn ?

@ suivre

GeoGeo · Answer

Oui, un virus ! J'arrive pas à l'enlever justement et on ma dit qu'avec LiveCleanMessenger ça irai mieux. Si je supprime C:\Program Files\Fichiers communs\Carlson ça va l'enlever ?

Le sioux · Answer

Re Pourquoi ne m'en as tu pas parlé ... MSNFix.zip de !aur3n7 Télécharge MSNFix.zip (de !aur3n7) sur votre bureau: http://sosvirus.changelog.fr/MSNFix.zip Décompresse-le (clic droit >> Extraire ici) et double clique sur le fichier MSNFix.bat. - Exécute l'option R. -- Si l'infection est détectée, exécutez l'option N. --- Sauvegarde ce rapport puis faites un copier/coller de ce rapport sur le forum, ainsi qu'un nouveau scan HijackThis. Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.txt Note : Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal Sauvegarder et fermer le rapport pour que Windows termine de se lancer normalement.: @ suivre.

GeoGeo · Answer

En fait j'ai reçu ce virus, il me fermait msn quand je parlait et l'ami qui ma passé le virus sans faire exprès ma donné la solution de LiveKill Clean Messenger, après j'avais plus de problème, et là le virus ne m'embettait plus. Donc j'ai pas pensé à t'en parler.
Sinon, en ce moment mon ordi s'amuse à s'étindre tout seul d'un coup, c'est toujours liés au même problème ?

Voici donc le rapport de MSNFix :

MSNFix 1.634  
 
C:\Documents and Settings\Guisse\Bureau\MSNFix 
Fix exécuté le 2008-01-18 - 13:26:07.48 By Guisse 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\DOCUME~1\ALLUSE~1\MENUDM~1\carlton 

************************  MSNCHK ***** /!\ beta test /!\


 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\DOCUME~1\ALLUSE~1\MENUDM~1\carlton  
 
 
 
************************ Nettoyage du registre 
 
 
 
************************ Fichiers suspects 
 
/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention 
 
[C:\i2n4r9g1.exe] 701BF2AA800BDBAEBACF7DB7BD5AB870 
[C:\Program Files\ECB.exe] 82890D031025F792CBB740FE1C5CA82F 

[color=#FF0000][b]==>[/b][/color] SVP merci d'envoyer le fichier  [b] C:\DOCUME~1\Guisse\Bureau\Upload_Me.zip [/b] sur http://upload.changelog.fr

 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 2008-01-18_132805.51.zip
 
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   --------------------------------------------- 
 



Et celui de HijackThis :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:29, on 2008-01-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\CmWatch.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\WebcamMax\wcmmon.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS	snp2std.exe
C:\WINDOWS\vsnp2std.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\wcmmon.exe" /a
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] ; "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [eCarteBleue-LPV-P1] ; "C:\Program Files\ECB.exe"  /dontopenmycards
O4 - HKLM\..\Run: [NeroFilterCheck] ; C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] ; "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS	snp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] ; "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] ; "J:\Logiciel\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [swg] ; C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [StartUp] C:\WINDOWS	rayicons.exe /optimize speed (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [StartUp] C:\WINDOWS	rayicons.exe /optimize speed (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys

Le sioux · Answer

Re

Peux tu faire cela stp :

 SVP merci d'envoyer le fichier [b] C:\DOCUME~1\Guisse\Bureau\Upload_Me.zip [/b] sur http://upload.changelog.fr 

Merci.

Puis :

Je te conseille d'enregistrer la page en format HTLM afin d’appliquer la procédure comme il faut, pour cela : 
Avec Internet Explorer 7, presse la touche Alt pour faire apparaître le menu puis :
- clique sur le menu Fichier (en haut à gauche), puis choisis Enregistrer sous...
- dans la boîte de dialogue Enregistrer sous, pour le champ "Enregistrer dans" (en haut), clique sur la flèche de la "liste déroulante" et choisis Bureau; pour le champ "Type", laisse Page Web complète; pour le champ "Nom du fichier", saisis Discussion en cours; termine en cliquant sur Enregistrer
Pour afficher la page (après redémarrage), double-clique sur "Discussion en cours.htm" situé sur le Bureau.
(Note: tu n'auras pas accès à Internet à partir du moment ou te redémarreras en mode sans échec)

Il faut exécuter toutes les étapes, sans interruption, dans l'ordre exact indiqué ci-dessous.
Si un élément te paraît obscur, demande des explications avant de commencer la désinfection

1) Télécharge

  OTMoveIt (de Old_Timer) sur ton Bureau.
 http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe
N'y touche pas pour le moment.

2) Redémarre en mode sans échec

Regarde ici si besoin avant ici  : http://pageperso.aol.fr/loraline60/mode_sans_echec.htm
Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement, appuie sur la touche [F8]  (ou [F5]  sur certains pc) jusqu'à l'affichage du menu des options avancées de Windows.
Sélectionner "Mode sans échec" et appuie sur  [Entrée] 
Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre. 

Ouvre le fichier HTLM sauvegardé sur le Bureau afin de suivre les instructions comme il faut.

3) Lance HijackThis.

Je te conseille d'enregistrer  toutes les lignes a fixer puis de copier cette sélection dans un fichier texte sur ton PC pour pouvoir appliquer la procédure correctement.

Lance Hijackthis en double cliquant sur son raccourci sur le Bureau.
Clique sur Scan Only et coche les lignes suivantes :

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] ; "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] ; C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-18\..\Run: [StartUp] C:\WINDOWS	rayicons.exe /optimize speed (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [StartUp] C:\WINDOWS	rayicons.exe /optimize speed (User 'Default user')
 O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab 

Ferme toutes les autres fenêtres, tous les autres programmes. Pas de connections Internet.
Clique sur Fix Checked puis clique sur OK
Puis ferme hijackthis.

Si certaines lignes sont absentes, signale les en fin de procédure

4)  OTMoveIt (de Old_Timer)

Double clique sur OTMoveIt.exe pour le lancer.
Copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :
Paste List of Files/Folders to be moved.

C:\WINDOWS	rayicons.exe
C:\i2n4r9g1.exe 
C:\Documents and Settings\Guisse\Application Data\spy-rid.com
C:\Documents and Settings\Guisse\Application Data\InfeStop.com 

Clique sur MoveIt! pour lancer la suppression.
Le résultat apparaîtra dans le cadre Results.
Clique sur Exit pour fermer.

Il te sera peut-être demander de redémarrer le PC pour achever la suppression.
si c'est le cas accepte par Yes.

5) Rapports

Fais redémarrer ton PC en mode normal puis poste en réponse  :

*  Le rapport d’OTMoveIt  situé dans C:\_OTMoveIt\MovedFiles (contenu du fichier C:\_OTMoveIt\MovedFiles\********_******.log - les *** sont des chiffres représentant la date et l'heure)
* Un nouveau rapport HijackThis.

@ suivre

Utilisateur anonyme · Answer

Coucou vous deux,
Je poste juste pour dire que suis impressionné par ce topic....et pour vous souhaiter la bonne journée...

Géogéo : Merci d'avoir un pc vérolé...
Le Sioux : Merci de désinfecter les véroles...

Voilou,
Désolou de mon intrusion...
Merci,
A+

Le sioux · Answer

Hello DIID

On galère un peu tout de même ...  ;-)

Bonne journée.

GeoGeo · Answer

Bonjour, c'est quoi un pc vérolé ?
Pour HijackThis il manquanis le fichier  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL') 

Voici les rapports :

OtMoveIt :

File/Folder C:\WINDOWS	rayicons.exe not found.
C:\i2n4r9g1.exe moved successfully.
C:\Documents and Settings\Guisse\Application Data\spy-rid.com\SpyRid\BrowserObjects moved successfully.
C:\Documents and Settings\Guisse\Application Data\spy-rid.com\SpyRid\Autorun\StartMenuCurrentUser moved successfully.
C:\Documents and Settings\Guisse\Application Data\spy-rid.com\SpyRid\Autorun\StartMenuAllUsers moved successfully.
C:\Documents and Settings\Guisse\Application Data\spy-rid.com\SpyRid\Autorun\HKLMRun\RunOnceEx moved successfully.
C:\Documents and Settings\Guisse\Application Data\spy-rid.com\SpyRid\Autorun\HKLMRun\RunOnce moved successfully.
C:\Documents and Settings\Guisse\Application Data\spy-rid.com\SpyRid\Autorun\HKLMRun moved successfully.
C:\Documents and Settings\Guisse\Application Data\spy-rid.com\SpyRid\Autorun\HKCURun\RunOnceEx moved successfully.
C:\Documents and Settings\Guisse\Application Data\spy-rid.com\SpyRid\Autorun\HKCURun\RunOnce moved successfully.
C:\Documents and Settings\Guisse\Application Data\spy-rid.com\SpyRid\Autorun\HKCURun moved successfully.
C:\Documents and Settings\Guisse\Application Data\spy-rid.com\SpyRid\Autorun moved successfully.
C:\Documents and Settings\Guisse\Application Data\spy-rid.com\SpyRid moved successfully.
C:\Documents and Settings\Guisse\Application Data\spy-rid.com moved successfully.
C:\Documents and Settings\Guisse\Application Data\InfeStop.com\InfeStop\BrowserObjects moved successfully.
C:\Documents and Settings\Guisse\Application Data\InfeStop.com\InfeStop\Autorun\StartMenuCurrentUser moved successfully.
C:\Documents and Settings\Guisse\Application Data\InfeStop.com\InfeStop\Autorun\StartMenuAllUsers moved successfully.
C:\Documents and Settings\Guisse\Application Data\InfeStop.com\InfeStop\Autorun\HKLMRun\RunOnceEx moved successfully.
C:\Documents and Settings\Guisse\Application Data\InfeStop.com\InfeStop\Autorun\HKLMRun\RunOnce moved successfully.
C:\Documents and Settings\Guisse\Application Data\InfeStop.com\InfeStop\Autorun\HKLMRun moved successfully.
C:\Documents and Settings\Guisse\Application Data\InfeStop.com\InfeStop\Autorun\HKCURun\RunOnceEx moved successfully.
C:\Documents and Settings\Guisse\Application Data\InfeStop.com\InfeStop\Autorun\HKCURun\RunOnce moved successfully.
C:\Documents and Settings\Guisse\Application Data\InfeStop.com\InfeStop\Autorun\HKCURun moved successfully.
C:\Documents and Settings\Guisse\Application Data\InfeStop.com\InfeStop\Autorun moved successfully.
C:\Documents and Settings\Guisse\Application Data\InfeStop.com\InfeStop moved successfully.
C:\Documents and Settings\Guisse\Application Data\InfeStop.com moved successfully.
 
Created on 01-20-2008 13:50:40


Et HijackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:25, on 2008-01-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\CmWatch.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\WebcamMax\wcmmon.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS	snp2std.exe
C:\WINDOWS\vsnp2std.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\wcmmon.exe" /a
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [eCarteBleue-LPV-P1] ; "C:\Program Files\ECB.exe"  /dontopenmycards
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] ; "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS	snp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] ; "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] ; "J:\Logiciel\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [swg] ; C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys

Le sioux · Answer

Bonsoir geo geo

Peux tu faire cela stp :

 SVP merci d'envoyer le fichier  C:\DOCUME~1\Guisse\Bureau\Upload_Me.zip  sur http://upload.changelog.fr 

Sinon, comment se porte ton PC a présent ?

@ suivre.

GeoGeo · Answer

Voilà c'est envoyé !
Là mon pc ne me fait plus de messages d'erreur, apparement il a l'aire d'être guéri !
Tu pense que cette fois c'est bon ?
En tout cas je tiend vraiment vraiment à te remercier parceque tu ma consacrer beaucoup de temps et c'est vraiment gentil de ta part !

Le sioux · Answer

Re

Oups, j ai oublié plusieurs choses ... désolé ...

# Supprime C:\WINDOWS\murka.dat  fais le avec OTMoveIt avant de lancer clean up  ;)

# Peux tu aussi tester sur Virus Total :

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE

sités par combofix comme :

[color=red]Files Infected - Win32.Agent.zb[/color]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE 

( Win32.Agent.zb  -->   le 10 Jan 2008 01:05 chez Malekal_Morte  http://forum.malekal.com/ftopic4035.php  )

* Va sur VIRUS TOTAL https://www.virustotal.com/gui/

* Clique sur "parcourir" :

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

* Recherche le fichier à analyser, puis clique ensuite sur "send".

Il faut patienter car tu es sur une file d'attente.
Le rapport ne sera complet que lorsque tu verras la mention "FINISHED"sur la droite.

Dépose le dans ta prochaine réponse.

Tuto : http://pageperso.aol.fr/loraline60/virus_total.htm

Note : Il est possible que tu es besoin d'avoir accès aux dossiers et fichiers cachés, pour cela "Affiche les dossiers cachés" Aide toi de B ) Afficher les dossiers cachés ici https://forum.pcastuces.com/sujet.asp?f=25&s=3902 si besoin.

Fais de meme pour :
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe  et 
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE 

@ suivre

GeoGeo · Answer

Ouaou !!!! J'avais completement oublié qu'il me restait ça à faire !!! Je suis revenus sur le topic pour remercier Le Sioux et j'ai vu que j'avais pas fini !
Je fait tout ça tout a l'heure. Désolé.

Le sioux · Answer

Hello Géo geo

Ouaips, tu m'avais laché ...

@ bientôt.

Message "warning potential spyware operation&

65 réponses

Votre réponse

Discussions similaires

Newsletters