lenteur voire plantage apres trojan vundo

Question

Bonjour,
apres avoir semble il éliminé un trojan vundo grace à vundofix puis cclean mon pc est ultra lent voire bloqué.
voici le rapport hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:11:05, on 25/12/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\ECB-CLEO.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pabw.net/pabw/index.php?sid=4812d48f6a3600b4aa2f170f2f318676
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\ECB-CLEO.exe"  /dontopenmycards
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NetScreen-Remote.lnk = C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/02e1dfbbcd5e38189e05/netzip/RdxIE601_fr.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

Kokliko · Answer

Bonsoir,

Essaie de nettoyer ton disque dur (propriétés, options, nettoyage de disque)
Essaie de faire une défragmentation pour voir si les performances peuvent êtres améliorées.

A+

^^Marie^^ · Answer

Bonsoir

Platform: Windows XP (WinNT 5.01.2600)
Faudrait peut-être mettre ton XP à jour
A moins que tu aies une version non officielle

Fais un clic droit sur hijackthis,

 choisis "renommer"

 marque : PROUT.exe 


Puis remet un rapport stp

dearmrman · Answer

j'ai bien une version officielle de xp mais j'ai jamais voulu mettre le sp2.
voici le nouveau rapport:(je pense que c'est le meme)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:56:03, on 25/12/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\ECB-CLEO.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Trend Micro\hervehtch\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pabw.net/pabw/index.php?sid=4812d48f6a3600b4aa2f170f2f318676
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\ECB-CLEO.exe"  /dontopenmycards
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NetScreen-Remote.lnk = C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/02e1dfbbcd5e38189e05/netzip/RdxIE601_fr.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

dearmrman · Answer

petite precision: quelques fois tout marche bien et puis soudainement quand j'ouvre un nouveau logiciel ou document le pc met 10 minutes pour lancer l'application. en ce moment ça a l'air de marcher.

^^Marie^^ · Answer

Ok

Répond à mes questions

Et je pense que tu es encore infecté par Vundo

Comme je ne sais pas ce que tu as fait, donc .....

dearmrman · Answer

le nouveau rapport a été fait en renommant hijackthis.
au debut de l'attaque vundo ce n'etait pas génant, norton le reperait et le supprimait mais il réaparraissait 30 min apres.
puis au bout de 2 jours le pc est devenu lent.
alors pour enlever trojan vundo j'ai utilisé vundofix puis j'ai fait un nettoyage avec cclean.
et depuis des fois ça marche mais au bout d'un moment ça devient lent.

dearmrman · Answer

je communique avec un 2eme pc.(il risque quelque chose lui?)
le pc a replanté.
j'ai réussi a faire le rapport renommé je l'ai mis sur mon usb pour vous l'envoyer et apres j'ai voulu ouvrir excel et ça a planté.

^^Marie^^ · Answer

j'ai bien une version officielle de xp mais j'ai jamais voulu mettre le sp2. 
Tu n'as mm pas le SP1 !!!!!!


Fais un scan avec Vundo

Télécharge VundoFix.exe (par Atribune) sur ton Bureau. 
http://www.atribune.org/ccount/click.php?id=4 

* Double-clique VundoFix.exe afin de le lancer. 
* Lorsque l'outil se lance à nouveau, clique sur le bouton Scan for Vundo 
* Clique sur le bouton Scan for Vundo. 
* Lorsque le scan est complété, clique sur le bouton Remove Vundo 
* Une invite te demandera si tu veux supprimer les fichiers, clique YES 
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers. 
* Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown"); clique OK 
* Démarre ton PC à nouveau. 
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt 



Télécharge VirtumundoBegone sur le bureau: 
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe 

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions. 
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse

dearmrman · Answer

vundofix n'a rien trouvé de plus. voici le rapport:


VundoFix V6.7.7

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 17:54:32 24/12/2007

Listing files found while scanning....

C:\WINDOWS\System32	uvsppm.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\System32	uvsppm.dll
C:\WINDOWS\System32	uvsppm.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\System32	uvsppm.dll
C:\WINDOWS\System32	uvsppm.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

VundoFix V6.7.7

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 02:27:56 25/12/2007

Listing files found while scanning....

C:\WINDOWS\system32	uvsppm.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32	uvsppm.dll
C:\WINDOWS\system32	uvsppm.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32	uvsppm.dll
C:\WINDOWS\system32	uvsppm.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

VundoFix V6.7.7

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 09:36:23 25/12/2007

Listing files found while scanning....

No infected files were found.


VundoFix V6.7.7

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 18:37:30 25/12/2007

Listing files found while scanning....


VundoFix V6.7.7

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 22:26:38 25/12/2007

Listing files found while scanning....

No infected files were found.



et voici le rapport  virtumundobegone :


[12/25/2007, 22:52:15] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\hervé\Bureau\VirtumundoBeGone.exe" )
[12/25/2007, 22:52:21] - Detected System Information:
[12/25/2007, 22:52:21] -  Windows Version: 5.1.2600, 
[12/25/2007, 22:52:21] -  Current Username: hervé (Admin)
[12/25/2007, 22:52:21] -  Windows is in NORMAL mode.
[12/25/2007, 22:52:21] - Searching for Browser Helper Objects:
[12/25/2007, 22:52:21] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[12/25/2007, 22:52:21] -  BHO 2: {2E03C0FD-4C48-43A7-9A54-00240C70FF16} (ECarteBleueBrowserHelper Class)
[12/25/2007, 22:52:21] -  BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[12/25/2007, 22:52:21] -  BHO 4: {9ECB9560-04F9-4bbc-943D-298DDF1699E1} (CNisExtBho Class)
[12/25/2007, 22:52:21] -  BHO 5: {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} (CNavExtBho Class)
[12/25/2007, 22:52:21] -  BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[12/25/2007, 22:52:21] -  BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[12/25/2007, 22:52:21] -  BHO 8: {D55D0FB9-3549-47BF-9260-3C15A25A25E5} ()
[12/25/2007, 22:52:21] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/25/2007, 22:52:21] -  Checking for HKLM\...\Winlogon\Notify\jkhfd
[12/25/2007, 22:52:21] -  Key not found: HKLM\...\Winlogon\Notify\jkhfd, continuing.
[12/25/2007, 22:52:21] - Finished Searching Browser Helper Objects
[12/25/2007, 22:52:21] - Finishing up...
[12/25/2007, 22:52:21] - Nothing found! Exiting...

dearmrman · Answer

cette nuit j'ai fait une defragmentation.
j'ai une petite nouveauté: j'ai lancé outlook qui a bien marché et quand j'ai réduit la fenetre mon bureau est vide rien n'est affiché meme le clic droit ne marche pas.il faut que je reboote et ça remarche

^^Marie^^ · Answer

Bonjour

télécharge combofix (par sUBs)ici : 
Combofix est un programme qui supprime des trojans/backdoor connues et rootkits
http://download.bleepingcomputer.com/sUBs/ComboFix.exe 


et enregistre le sur le bureau. 

2 double-clique sur combofix.exe et suis les instructions 

3 à la fin, il va produire un rapport C:\ComboFix.txt 

4 copie/colle ce rapport dans ta prochaine réponse. 

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi. 

Poste aussi un nouveau rapport Hijackthis.



stp

dearmrman · Answer

voici les 2 rapports:

ComboFix 07-12-21.4 - hervé 2007-12-26 8:59:28.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.0.1252.1.1036.18.633 [GMT 1:00]
Running from: C:\Documents and Settings\hervé\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\MabryObj.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-26 to 2007-12-26 ))))))))))))))))))))))))))))))))))))
.

2007-12-25 19:17 . 2007-12-25 19:17 <REP> d-------- C:\Program Files\CCleaner
2007-12-25 09:34 . 2007-12-25 21:56 <REP> d-------- C:\Program Files\Trend Micro
2007-12-24 17:54 . 2007-12-25 09:24 <REP> d-------- C:\VundoFix Backups
2007-12-24 16:34 . 2007-12-24 16:34 314,784 --a------ C:\WINDOWS\system32\jkhfd.dll
2007-12-24 16:34 . 2007-12-26 09:04 4,520 --ahs---- C:\WINDOWS\system32\dfhkj.ini
2007-12-24 16:34 . 2007-12-26 09:03 4,418 --ahs---- C:\WINDOWS\system32\dfhkj.ini2
2007-12-23 09:42 . 2007-12-23 09:42 306,380 --a------ C:\WINDOWS\system32\ddccy.dll
2007-12-23 00:10 . 2007-12-23 00:10 24,304 --------- C:\WINDOWS\system32\tuvsppm.dll
2007-12-16 11:02 . 2007-12-16 11:02 <REP> d-------- C:\lenny
2007-12-16 10:59 . 2007-12-16 10:59 <REP> d-------- C:\tug of war demos
2007-12-13 00:56 . 2007-12-13 00:57 <REP> d-------- C:\mccartney presstoplay alt
2007-12-13 00:39 . 2007-12-13 01:25 <REP> d-------- C:\mccartney olympia
2007-12-13 00:34 . 2007-12-13 00:58 <REP> d-------- C:\mccartney off the ground alt
2007-12-10 09:55 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-26 08:46 . 2007-12-22 15:29 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-11-26 08:46 . 2007-11-26 08:46 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-26 07:58 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2007-12-26 07:26 --------- d-----w C:\Program Files\Auction Sentry
2007-12-23 08:01 --------- d-----w C:\Program Files\Norton Internet Security
2007-12-23 07:57 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-12-23 07:57 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-12-23 07:57 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-12-23 07:57 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-12-23 07:57 --------- d-----w C:\Program Files\Symantec
2007-12-11 10:16 --------- d-----w C:\Program Files\Commercial AMADA SA
2007-12-10 08:55 --------- d-----w C:\Program Files\Java
2007-10-30 05:53 --------- d-----w C:\Program Files\K-Lite Codec Pack
2007-10-30 05:49 --------- d-----w C:\Program Files\DivX
2007-10-01 13:49 542,088 ----a-w C:\WINDOWS\system32\SymNeti.dll
2007-10-01 13:49 161,160 ----a-w C:\WINDOWS\system32\SymRedir.dll
2007-01-27 10:14 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2006-02-19 01:28 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
2006-02-07 08:07 200,704 ----a-w C:\Program Files\ECB-CLEO.exe
2006-02-07 08:06 121 ----a-w C:\Program Files\Config.ini
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60590526-DA07-4A7E-A336-1F204A612430}]
2007-12-24 16:34 314784 --a------ C:\WINDOWS\System32\jkhfd.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="RUNDLL32.exe" [2001-08-28 13:00 C:\WINDOWS\system32\rundll32.exe]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-04-20 08:57]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2001-08-02 06:14]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-05 06:51]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2001-08-28 13:00 C:\WINDOWS\system32\rundll32.exe]
"DataLayer"="C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 08:30]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 08:11]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 08:39]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-05 10:33]
"Cloneur Expert Monitor"="C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" [2006-07-01 12:12]
"Acronis Scheduler2 Service"="C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" [2006-07-01 12:12]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-02-22 12:08]
"SSC_UserPrompt"="C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-10 12:57]
"eCarteBleue-CLEO"="C:\Program Files\ECB-CLEO.exe" [2006-02-07 09:07]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41]
"Symantec PIF AlertEng"="C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 09:22]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 13:00]
"NvMediaCenter"="RUNDLL32.exe" [2001-08-28 13:00 C:\WINDOWS\system32\rundll32.exe]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\System32\jkhfd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^hervé^Menu Démarrer^Programmes^Démarrage^PowerReg Scheduler.exe]
path=C:\Documents and Settings\hervé\Menu Démarrer\Programmes\Démarrage\PowerReg Scheduler.exe
backup=C:\WINDOWS\pss\PowerReg Scheduler.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioAudioCentral]
2003-02-26 15:50 253952 --a------ C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2003-02-27 03:36 757760 --a------ C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioEngineUtility]
2003-02-27 04:31 69632 --a------ C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe

R0 snapman;Acronis Snapshots Manager;C:\WINDOWS\System32\DRIVERS\snapman.sys [2006-07-01 12:12]
R0 timounter;Acronis TrueImage Backup Archive Explorer;C:\WINDOWS\System32\DRIVERS\timntr.sys [2006-07-01 12:12]
R2 Crypto;Crypto;C:\WINDOWS\System32\drivers\Crypto.sys [2004-07-30 12:20]
R2 IPSECDRV;SafeNet IPSec Plugin;C:\WINDOWS\System32\Drivers\IPSECDRV.sys [2004-08-11 11:01]
R2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2006-08-03 16:29]
R2 tifsfilter;Acronis TrueImage FS Filter;C:\WINDOWS\System32\DRIVERS\tifsfilt.sys [2006-07-01 12:12]
R3 DniVap;SafeNet WAN Miniport (VA);C:\WINDOWS\System32\DRIVERS\vap.sys [2001-12-14 15:26]
R3 ham50;Creatix V.90 HAM Data Fax Modem;C:\WINDOWS\System32\DRIVERS\CTXH51.sys [2001-08-04 06:50]
S3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;C:\WINDOWS\System32\DRIVERS\WlanUIG.sys [2004-09-02 22:18]

*Newly Created Service* - ALG
*Newly Created Service* - COMHOST
*Newly Created Service* - IPNAT
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-12-21 22:18:59 C:\WINDOWS\Tasks\Norton AntiVirus - Effectuer une analyse complète du système - hervé.job"
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-26 09:03:55
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.0000]
-> C:\WINDOWS\System32\jkhfd.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2600.0000]
-> C:\WINDOWS\System32\jkhfd.dll
.
Completion time: 2007-12-26 9:06:41 - machine was rebooted
.
2007-12-13 02:02:14 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:09:08, on 26/12/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\ECB-CLEO.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pabw.net/pabw/index.php?sid=4812d48f6a3600b4aa2f170f2f318676
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\ECB-CLEO.exe" /dontopenmycards
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NetScreen-Remote.lnk = C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/02e1dfbbcd5e38189e05/netzip/RdxIE601_fr.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

^^Marie^^ · Answer

Re

Ce qui m'ennuie c'est que ton XP n'est pas à jour, donc il manque certaines protections

Platform: Windows XP (WinNT 5.01.2600) 

Fais la mise à jour 

Démarrer
Tous les programmes
Windows Update

dearmrman · Answer

je fais les mises à jour et je te poste un rapport hijackthis.
je dois partir en rdv professionnel.je te recontacte cet am.
merci encore de t'occuper de mon probleme.

^^Marie^^ · Answer

ok

dearmrman · Answer

j'ai fait les mises à jour dont le sp2 et j'ai eu un bureau vide sans icone des le lancement.
par contre j'ai pu acceder à mes dossiers en faisant cont alt sup puis une nouvelle tache dans le gestionnaire des taches.
j'ai lancé un logiciel et une fenetre s'est ouverte en disant que windows paramettre mon logiciel, mes icones sont apparues.
j'ai rebouté pour voir si ça n'allait pas disparaitre et tout a l'air bon.
je vais voir si c'est stable.

y a t il une procedure pour valider tout ça?

merci

dearmrman · Answer

bon c'est pas génial.
c'est tres lent mais utilisable.
ça plante de temps en temps.
que puis je faire?

^^Marie^^ · Answer

Refais moi un log Hijackthis
stp

dearmrman · Answer

en fait c'est au bout  d'un certain temps d'inactivité sur le pc que ça bloque.
ça a marché de 18 h à 19h30, j'ai été diner et à mon retour ça ne marchait plus.
il faut que je reboote 5 ou 6 fois avant que ça reparte

j'ai fait 2 rapports le 1er normal et le 2 en changeant le nom

voici le 1 er rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:07:10, on 26/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\ECB-CLEO.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Trend Micro\HijahervéckThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pabw.net/pabw/index.php?sid=4812d48f6a3600b4aa2f170f2f318676
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: (no name) - {44690C40-F21E-410A-94C1-A6997B4C7314} - C:\WINDOWS\System32\jkhfd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\ECB-CLEO.exe"  /dontopenmycards
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NetScreen-Remote.lnk = C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/02e1dfbbcd5e38189e05/netzip/RdxIE601_fr.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

docjol · Answer

J'ai ommis le rapport de Vundofix que voici:
VundoFix V6.7.7

Checking Java version...

Scan started at 02:56:36 27/12/2007

Listing files found while scanning....

C:\WINDOWS\system32\mljgdaw.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\mljgdaw.dll
C:\WINDOWS\system32\mljgdaw.dll Could not be deleted.

Performing Repairs to the registry.
Done!

docjol · Answer

Pour terminer, voici le rapport avec combofix: ComboFix 07-12-21.4 - Joly 2007-12-27 4:13:11.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.474 [GMT 1:00] Running from: C:\Documents and Settings\Joly\Local Settings\Temporary Internet Files\Content.IE5\WVSXCD4J\ComboFix[1].exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Bureau\webmediaplayer.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes.\WebMediaPlayer C:\Documents and Settings\All Users\Menu Démarrer\Programmes.\WebMediaPlayer\Conditions générales.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes.\WebMediaPlayer\Confidentialité.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes.\WebMediaPlayer\WebMediaPlayer.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes.\WebMediaPlayer\Website.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Conditions générales.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Confidentialité.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\WebMediaPlayer.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Website.lnk c:\Documents and Settings\Joly\Local Settings\Application Data fmbvwew.dat C:\Documents and Settings\Joly\Local Settings\Application Data fmbvwew.exe c:\Documents and Settings\Joly\Local Settings\Application Data fmbvwew_nav.dat c:\Documents and Settings\Joly\Local Settings\Application Data fmbvwew_navps.dat C:\Program Files\webmediaplayer C:\Program Files\webmediaplayer\Conditions générales.url C:\Program Files\webmediaplayer\Confidentialité.url C:\Program Files\webmediaplayer esources\languages_v2.xml C:\Program Files\webmediaplayer esources\webmedias C:\Program Files\webmediaplayer\skins\classic.skn C:\Program Files\webmediaplayer\sqlite3.dll C:\Program Files\webmediaplayer\uninst.exe C:\Program Files\webmediaplayer\WebMediaPlayer.exe C:\Program Files\webmediaplayer\Website.url C:\WINDOWS\system32 vs2.inf . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-27 to 2007-12-27 )))))))))))))))))))))))))))))))))))) . 2007-12-27 02:56 . 2007-12-27 02:56 d-------- C:\VundoFix Backups 2007-12-27 02:37 . 2007-12-27 02:37 d-------- C:\Program Files\Spyware-Secure 2007-12-26 15:57 . 2007-12-26 15:57 d-------- C:\Documents and Settings\Joly\Application Data\Apple Computer 2007-12-25 00:53 . 2007-12-25 00:53 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-24 23:58 . 2007-12-24 23:58 d-------- C:\WINDOWS eport 2007-12-24 23:57 . 2007-12-24 23:44 40,242,225 --a------ C:\WINDOWS\LPT$VPN.905 2007-12-24 23:44 . 2007-12-24 23:44 d-------- C:\WINDOWS\AU_Backup 2007-12-24 23:44 . 2007-12-24 23:44 40,242,225 --a------ C:\WINDOWS\VPTNFILE.905 2007-12-24 23:44 . 2007-12-24 23:44 1,906,226 --a------ C:\WINDOWS sc.ptn 2007-12-24 23:44 . 2007-12-24 23:44 1,163,344 --a------ C:\WINDOWS\vsapi32.dll 2007-12-24 23:44 . 2007-12-24 23:44 267,845 --a------ C:\WINDOWS sc.exe 2007-12-24 23:44 . 2007-12-24 23:44 86,094 --a------ C:\WINDOWS\BPMNT.dll 2007-12-24 23:44 . 2007-12-24 23:44 71,749 --a------ C:\WINDOWS\hcextoutput.dll 2007-12-24 23:44 . 2007-12-24 23:59 823 --a------ C:\WINDOWS sc.ini 2007-12-24 23:40 . 2007-12-24 23:44 d-------- C:\WINDOWS\AU_Temp 2007-12-24 23:40 . 2007-12-24 23:40 d-------- C:\WINDOWS\AU_Log 2007-12-24 23:40 . 2007-12-24 23:40 170 --a------ C:\WINDOWS\GetServer.ini 2007-12-24 23:39 . 2007-12-24 23:39 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL 2007-12-24 23:39 . 2007-12-24 23:39 286,720 --a------ C:\WINDOWS\PATCH.EXE 2007-12-24 23:39 . 2007-12-24 23:39 69,689 --a------ C:\WINDOWS\UNZIP.DLL 2007-12-24 08:42 . 2007-12-24 08:42 15 --a------ C:\WINDOWS\system32\90c6198b 2007-12-23 11:39 . 2007-12-26 13:00 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-12-23 11:39 . 2007-12-23 11:39 1,409 --a------ C:\WINDOWS\QTFont.for 2007-12-20 20:39 . 2007-12-27 04:21 9,486 --ahs---- C:\WINDOWS\system32\vwwvw.ini 2007-12-20 20:39 . 2007-12-27 04:19 9,384 --ahs---- C:\WINDOWS\system32\vwwvw.ini2 2007-12-20 20:04 . 2007-12-23 01:26 314,624 --------- C:\WINDOWS\system32\wvwwv.dll 2007-12-20 19:58 . 2007-12-20 19:58 24,304 --a------ C:\WINDOWS\system32\mljgdaw.dll.vir 2007-12-20 19:56 . 2007-12-20 19:56 d-------- C:\WINDOWS\Sun . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-27 01:22 --------- d-----w C:\Program Files\Mindscape 2007-12-27 01:21 --------- d-----w C:\Program Files\eMule 2007-12-27 01:21 --------- d-----w C:\Program Files\Azureus 2007-12-26 19:05 --------- d-----w C:\Documents and Settings\Joly\Application Data\Azureus 2007-12-25 02:10 --------- d-----w C:\Program Files\Everest Poker 2007-12-24 22:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-19 07:22 --------- d-----w C:\Program Files\Google 2007-12-17 19:30 --------- d-----w C:\Program Files\Java 2007-11-25 23:38 --------- d-----w C:\Documents and Settings\Joly\Application Data\Nokia Multimedia Player 2007-11-25 20:55 --------- d-----w C:\Documents and Settings\Joly\Application Data\PC Suite 2007-11-25 20:52 --------- d-----w C:\Documents and Settings\Joly\Application Data\Nokia 2007-11-25 20:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Suite 2007-11-25 20:41 --------- d-----w C:\Program Files\Fichiers communs\Nokia 2007-11-25 20:40 --------- d-----w C:\Program Files\Nokia 2007-11-25 20:40 --------- d-----w C:\Program Files\Fichiers communs\PCSuite 2007-11-25 20:39 --------- d-----w C:\Program Files\DIFX 2007-11-25 20:36 --------- d-----w C:\Program Files\PC Connectivity Solution 2007-11-25 20:36 --------- d-----w C:\Program Files\7-Zip 2007-11-25 20:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations 2007-11-25 14:03 --------- d-----w C:\Program Files\Panda Security 2007-11-25 13:11 --------- d-----w C:\Documents and Settings\Joly\Application Data\DivX 2007-11-25 13:07 --------- d-----w C:\Program Files\DivX 2007-11-25 10:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus 2007-11-17 15:24 --------- d-----w C:\Program Files\QuickTime 2007-11-17 15:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-11-11 13:02 283,648 ----a-w C:\WINDOWS\uninst.exe 2007-11-11 10:48 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-11-08 16:12 --------- d-----w C:\Program Files\IncrediMail 2007-11-04 10:05 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll 2007-11-03 18:25 --------- d-----w C:\Program Files\Microsoft ActiveSync 2007-11-03 17:54 --------- d-----w C:\Program Files\Fichiers communs\ODBC 2007-10-20 00:56 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe 2007-10-20 00:56 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-10-20 00:56 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-10-20 00:56 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2007-10-20 00:56 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe 2007-10-20 00:56 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2007-10-20 00:56 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2007-10-20 00:54 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll 2007-10-20 00:54 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll 2007-10-20 00:54 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-10-20 00:54 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll 2007-10-20 00:54 739,840 ----a-w C:\WINDOWS\system32\DivX.dll 2007-10-20 00:54 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2007-10-18 09:06 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-10-18 09:03 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2007-10-18 09:03 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2007-10-18 09:03 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2007-10-18 09:03 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2007-10-18 09:03 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2007-10-18 09:03 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2007-10-18 09:02 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{09ADA475-622F-45F7-A4DA-22D688460D19}] 2007-12-23 01:26 314624 --------- C:\WINDOWS\system32\wvwwv.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24] "CanalPlayer"="C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe" [] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2005-08-05 14:01] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-20 23:38] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32 undll32.exe] "CanalPlayer"="C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe" [] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-10-11 14:53] "SetIcon"="\Program Files\SMSC\Seticon.exe" [2004-04-28 13:02] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" [] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-19 01:18] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2007-08-12 19:06] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\wvwwv.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Docteur Club Internet.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Docteur Club Internet.lnk backup=C:\WINDOWS\pss\Docteur Club Internet.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 09:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg wiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2004-11-02 19:24 32768 --a------ C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Workflow] D:\install\Workflow.exe R2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys [2005-04-01 09:42] R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2005-04-21 12:33] R3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 07:57] S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2005-01-27 21:24] S3 W8335XP;IEEE 802.11g Wireless Cardbus/PCI Adapter HW51;C:\WINDOWS\system32\DRIVERS\Mrv8000c.sys [2004-12-24 07:43] . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-27 04:20:55 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\WINDOWS\system32\wvwwv.dll PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2180] -> C:\WINDOWS\system32\wvwwv.dll . Completion time: 2007-12-27 4:22:28 - machine was rebooted

dearmrman · Answer

une solution apres le post de mes 2 rapports?

^^Marie^^ · Answer

Reposte un log hijackthis
stp

dearmrman · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:38:36, on 27/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\ECB-CLEO.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Trend Micro\HervéjackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pabw.net/pabw/index.php?sid=4812d48f6a3600b4aa2f170f2f318676
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\ECB-CLEO.exe"  /dontopenmycards
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NetScreen-Remote.lnk = C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/02e1dfbbcd5e38189e05/netzip/RdxIE601_fr.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

^^Marie^^ · Answer

Refais moi le point de tes symptômes
stp
C'est un peu la foire sur ton topik ;;))

dearmrman · Answer

pour le moment tout a l'air de fonctionner normalement.
j'ai refait combofix mais en mode sans echec ensuite vundofix et virtumundobegone .
apres j'ai nettoyé avec ccleaner et fait toutes les mises a jour windows et norton.
j'ai tout reparametré et maintenant ça a l'air de marcher.
ça fait 3 heures que le pc est en route et il n'y a eu aucun symptome.ça fait 4 jours que ça n'etait pas arrivé !!!!

dearmrman · Answer

tout marche parfaitemant depuis presque 2 jours.

voici le rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:10:36, on 29/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\ECB-CLEO.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Auction Sentry\AuctionSentry.exe
C:\Program Files\Auction Sentry\AuctionSentry.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\Herveis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pabw.net/pabw/index.php?sid=4812d48f6a3600b4aa2f170f2f318676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\ECB-CLEO.exe"  /dontopenmycards
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NetScreen-Remote.lnk = C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/02e1dfbbcd5e38189e05/netzip/RdxIE601_fr.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

^^Marie^^ · Answer

Tu l'as renommé ??

Lorsque tu le renommes


Fais un clic droit sur hijackthis,
choisis "renommer" 
marque : tu écris &#9658;  PROUT.exe
Puis remet un rapport stp

dearmrman · Answer

oui je l'ai renommé. je ne l'ai pas appellé prout mais il est renommé.

^^Marie^^ · Answer

Refais un log comboFix
Stp

dearmrman · Answer

ComboFix 07-12-21.4 - hervé 2007-12-29 14:21:35.3 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.638 [GMT 1:00] Running from: C:\Documents and Settings\hervé\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\MabryObj.dll . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-28 to 2007-12-29 )))))))))))))))))))))))))))))))))))) . 2007-12-29 14:01 . 2007-12-29 14:01 32,768 --a------ C:\WINDOWS\upuninst.exe 2007-12-27 20:38 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll 2007-12-27 19:44 . 2006-08-21 10:14 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys 2007-12-27 19:44 . 2006-08-21 10:14 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe 2007-12-27 19:44 . 2006-08-21 13:26 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll 2007-12-27 19:37 . 2007-12-27 20:44 1,393 --a------ C:\WINDOWS\imsins.BAK 2007-12-27 19:24 . 2007-07-09 14:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2007-12-27 15:39 . 2007-02-28 17:02 2,182,400 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2007-12-27 15:39 . 2007-02-28 17:02 2,138,112 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2007-12-27 15:39 . 2007-02-28 17:02 2,059,648 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2007-12-27 15:39 . 2007-02-28 17:02 2,017,792 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2007-12-27 15:39 . 2006-12-26 14:09 536,576 -----c--- C:\WINDOWS\system32\dllcache\msado15.dll 2007-12-27 15:39 . 2006-12-26 14:09 200,704 -----c--- C:\WINDOWS\system32\dllcache\msadox.dll 2007-12-27 15:39 . 2006-12-26 14:09 180,224 -----c--- C:\WINDOWS\system32\dllcache\msadomd.dll 2007-12-27 15:39 . 2006-12-26 14:09 102,400 -----c--- C:\WINDOWS\system32\dllcache\msjro.dll 2007-12-27 15:38 . 2007-10-11 07:13 1,495,040 -----c--- C:\WINDOWS\system32\dllcache\shdocvw.dll 2007-12-27 15:37 . 2007-07-13 00:30 765,952 --a--c--- C:\WINDOWS\system32\dllcache\vgx.dll 2007-12-27 15:37 . 2006-10-20 02:38 716,800 -----c--- C:\WINDOWS\system32\dllcache\sxs.dll 2007-12-27 15:37 . 2006-04-20 12:51 359,808 -----c--- C:\WINDOWS\system32\dllcache\tcpip.sys 2007-12-27 15:37 . 2007-06-19 14:32 282,112 -----c--- C:\WINDOWS\system32\dllcache\gdi32.dll 2007-12-26 13:52 . 2007-12-26 13:52 d-------- C:\Documents and Settings\LocalService\Menu D‚marrer 2007-12-26 10:08 . 2004-08-20 00:09 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-12-26 09:58 . 2007-12-26 09:58 d-------- C:\WINDOWS\provisioning 2007-12-26 09:58 . 2007-12-26 09:58 d-------- C:\WINDOWS\peernet 2007-12-26 09:56 . 2007-12-26 09:56 d-------- C:\WINDOWS\ServicePackFiles 2007-12-26 09:51 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-12-26 09:46 . 2007-12-26 09:46 d-------- C:\WINDOWS\EHome 2007-12-25 19:17 . 2007-12-25 19:17 d-------- C:\Program Files\CCleaner 2007-12-25 09:34 . 2007-12-29 10:10 d-------- C:\Program Files\Trend Micro 2007-12-24 17:54 . 2007-12-25 09:24 d-------- C:\VundoFix Backups 2007-12-24 16:34 . 2007-12-24 16:34 314,784 --a------ C:\WINDOWS\system32\jkhfd.dll 2007-12-24 16:34 . 2007-12-29 14:29 7,226 --ahs---- C:\WINDOWS\system32\dfhkj.ini2 2007-12-24 16:34 . 2007-12-29 14:32 7,226 --ahs---- C:\WINDOWS\system32\dfhkj.ini 2007-12-23 09:42 . 2007-12-23 09:42 306,380 --a------ C:\WINDOWS\system32\ddccy.dll 2007-12-23 00:10 . 2007-12-23 00:10 24,304 --------- C:\WINDOWS\system32\tuvsppm.dll 2007-12-16 11:02 . 2007-12-29 12:27 d-------- C:\lenny 2007-12-16 10:59 . 2007-12-16 10:59 d-------- C:\tug of war demos 2007-12-13 00:56 . 2007-12-29 12:36 d-------- C:\mccartney presstoplay alt 2007-12-13 00:39 . 2007-12-13 01:25 d-------- C:\mccartney olympia 2007-12-13 00:34 . 2007-12-29 12:58 d-------- C:\mccartney off the ground alt 2007-12-10 09:55 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-29 13:01 61,440 ----a-w C:\WINDOWS\system32\cdrtc.dll 2007-12-29 13:01 45,056 ----a-w C:\WINDOWS\system32\cdral.dll 2007-12-29 13:01 --------- d-----w C:\Program Files\Fichiers communs\Roxio Shared 2007-12-29 12:56 --------- d-----w C:\Program Files\Auction Sentry 2007-12-28 14:06 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared 2007-12-27 00:03 --------- d-----w C:\Program Files\Norton Internet Security 2007-12-23 07:57 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2007-12-23 07:57 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2007-12-23 07:57 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-12-23 07:57 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2007-12-23 07:57 --------- d-----w C:\Program Files\Symantec 2007-12-11 10:16 --------- d-----w C:\Program Files\Commercial AMADA SA 2007-12-10 08:55 --------- d-----w C:\Program Files\Java 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-10-30 05:53 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-10-30 05:49 --------- d-----w C:\Program Files\DivX 2007-10-29 22:43 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-20 05:01 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll 2007-10-01 13:49 542,088 ----a-w C:\WINDOWS\system32\SymNeti.dll 2007-10-01 13:49 161,160 ----a-w C:\WINDOWS\system32\SymRedir.dll 2007-01-27 10:14 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe 2006-02-19 01:28 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll 2006-02-07 08:07 200,704 ----a-w C:\Program Files\ECB-CLEO.exe 2006-02-07 08:06 121 ----a-w C:\Program Files\Config.ini . ((((((((((((((((((((((((((((( snapshot_2007-12-27_15.22.41.76 ))))))))))))))))))))))))))))))))))))))))) . - 2006-06-02 21:36:23 7,168 ----a-w C:\WINDOWS\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll + 2007-12-27 15:23:30 8,192 ----a-w C:\WINDOWS\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll - 2006-06-02 21:36:21 32,768 ----a-w C:\WINDOWS\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll + 2007-12-27 15:23:33 32,768 ----a-w C:\WINDOWS\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll - 2006-06-02 21:36:17 716,800 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll + 2007-12-27 15:23:49 720,896 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll - 2006-06-02 21:36:17 299,008 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll + 2007-12-27 15:23:35 299,008 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll - 2006-06-02 21:36:23 32,768 ----a-w C:\WINDOWS\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll + 2007-12-27 15:23:45 32,768 ----a-w C:\WINDOWS\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll - 2006-06-02 21:36:24 299,008 ----a-w C:\WINDOWS\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll + 2007-12-27 15:23:41 303,104 ----a-w C:\WINDOWS\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll - 2006-06-02 21:36:22 1,290,240 ----a-w C:\WINDOWS\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll + 2007-12-27 15:23:46 1,294,336 ----a-w C:\WINDOWS\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll - 2006-06-02 21:36:22 1,699,840 ----a-w C:\WINDOWS\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll + 2007-12-27 15:23:31 1,703,936 ----a-w C:\WINDOWS\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll - 2006-06-02 21:36:22 86,016 ----a-w C:\WINDOWS\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll + 2007-12-27 15:23:48 90,112 ----a-w C:\WINDOWS\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll - 2006-06-02 21:36:22 466,944 ----a-w C:\WINDOWS\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll + 2007-12-27 15:23:40 466,944 ----a-w C:\WINDOWS\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll - 2006-06-02 21:36:22 241,664 ----a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll + 2007-12-27 15:23:37 241,664 ----a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll - 2006-06-02 21:36:22 64,000 ----a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll + 2007-12-27 15:23:37 66,560 ----a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll - 2006-06-02 21:36:22 368,640 ----a-w C:\WINDOWS\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll + 2007-12-27 15:23:44 372,736 ----a-w C:\WINDOWS\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll - 2006-06-02 21:36:22 241,664 ----a-w C:\WINDOWS\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll + 2007-12-27 15:23:50 241,664 ----a-w C:\WINDOWS\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll - 2006-06-02 21:36:22 323,584 ----a-w C:\WINDOWS\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll + 2007-12-27 15:23:42 323,584 ----a-w C:\WINDOWS\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll - 2006-06-02 21:36:22 131,072 ----a-w C:\WINDOWS\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll + 2007-12-27 15:23:37 131,072 ----a-w C:\WINDOWS\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll - 2006-06-02 21:36:22 77,824 ----a-w C:\WINDOWS\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll + 2007-12-27 15:23:39 77,824 ----a-w C:\WINDOWS\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll - 2006-06-02 21:36:22 126,976 ----a-w C:\WINDOWS\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll + 2007-12-27 15:23:47 126,976 ----a-w C:\WINDOWS\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll - 2006-06-02 21:36:23 819,200 ----a-w C:\WINDOWS\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll + 2007-12-27 15:23:29 819,200 ----a-w C:\WINDOWS\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll - 2006-06-02 21:36:22 57,344 ----a-w C:\WINDOWS\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll + 2007-12-27 15:23:36 57,344 ----a-w C:\WINDOWS\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll - 2006-06-02 21:36:22 569,344 ----a-w C:\WINDOWS\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll + 2007-12-27 15:23:32 573,440 ----a-w C:\WINDOWS\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll - 2006-06-02 21:36:22 1,245,184 ----a-w C:\WINDOWS\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll + 2007-12-28 02:02:08 1,265,664 ----a-w C:\WINDOWS\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll - 2006-06-02 21:36:23 2,039,808 ----a-w C:\WINDOWS\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll + 2007-12-27 15:23:38 2,052,096 ----a-w C:\WINDOWS\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll - 2006-06-02 21:36:23 1,335,296 ----a-w C:\WINDOWS\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.Xml.dll + 2007-12-27 15:23:43 1,339,392 ----a-w C:\WINDOWS\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.XML.dll - 2006-06-02 21:36:22 1,216,512 ----a-w C:\WINDOWS\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll + 2007-12-28 02:02:09 1,232,896 ----a-w C:\WINDOWS\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll + 2007-12-28 02:02:28 61,440 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_9b9dbc6a\CustomMarshalers.dll + 2007-12-28 02:02:57 3,391,488 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_499b8923\mscorlib.dll + 2007-12-28 02:02:50 1,466,368 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_85f20ed8\System.Design.dll + 2007-12-28 02:02:30 90,112 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_19989f94\System.Drawing.Design.dll + 2007-12-28 02:02:53 835,584 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_89ce871a\System.Drawing.dll + 2007-12-28 02:02:38 3,018,752 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_2d5e7d9b\System.Windows.Forms.dll + 2007-12-28 02:02:45 2,088,960 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_d4bfb588\System.Xml.dll + 2007-12-28 02:02:26 1,966,080 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_e8988e60\System.dll + 2007-12-27 15:25:34 3,379,200 ------w C:\WINDOWS\assembly\temp\9EKQV17CIO\mscorlib.dll + 2007-12-27 15:23:51 1,224,704 ------w C:\WINDOWS\assembly\temp\BHMSX37BFK\System.dll + 2007-12-27 15:25:28 835,584 ------w C:\WINDOWS\assembly\temp\KPV04AFLPT\System.Drawing.dll + 2007-12-27 15:24:10 1,953,792 ------w C:\WINDOWS\assembly\temp\KQV159EIMQ\System.dll + 2007-12-27 15:24:39 3,014,656 ------w C:\WINDOWS\assembly\temp\OTZ5AGLRX2\System.Windows.Forms.dll + 2007-12-27 15:25:03 2,088,960 ------w C:\WINDOWS\assembly\temp\Z5AGMRX28C\System.Xml.dll + 2006-02-15 00:22:26 142,464 ------w C:\WINDOWS\Driver Cache\i386\aec.sys + 2006-03-17 00:33:10 262,784 ------w C:\WINDOWS\Driver Cache\i386\http.sys + 2006-06-14 08:47:45 172,416 ------w C:\WINDOWS\Driver Cache\i386\kmixer.sys + 2006-05-05 09:41:45 453,120 ------w C:\WINDOWS\Driver Cache\i386\mrxsmb.sys + 2007-02-28 16:02:21 2,138,112 ------w C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe + 2007-02-28 16:02:36 2,059,648 ------w C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe + 2007-02-28 16:02:21 2,017,792 ------w C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe + 2007-02-28 16:02:36 2,182,400 ------w C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe + 2006-06-14 08:47:46 6,400 ------w C:\WINDOWS\Driver Cache\i386\splitter.sys + 2006-06-14 09:00:45 82,944 ------w C:\WINDOWS\Driver Cache\i386\wdmaud.sys - 2004-08-19 23:09:53 1,036,288 ----a-w C:\WINDOWS\explorer.exe + 2007-06-13 13:22:28 1,037,312 ----a-w C:\WINDOWS\explorer.exe - 2004-08-19 23:09:54 10,752 ----a-w C:\WINDOWS\hh.exe + 2005-05-26 23:22:01 10,752 ----a-w C:\WINDOWS\hh.exe + 2004-08-19 23:09:19 61,440 -c----w C:\WINDOWS\ie7\admparse.dll + 2004-08-19 23:09:19 101,888 -c----w C:\WINDOWS\ie7\advpack.dll + 2004-08-19 23:09:21 35,328 -c----w C:\WINDOWS\ie7\corpol.dll + 2006-06-02 19:32:20 33,792 -c----w C:\WINDOWS\ie7\custsat.dll + 2007-10-11 06:13:39 357,888 -c----w C:\WINDOWS\ie7\dxtmsft.dll + 2007-10-11 06:13:39 205,312 -c----w C:\WINDOWS\ie7\dxtrans.dll + 2007-10-11 06:13:39 55,808 -c----w C:\WINDOWS\ie7\extmgr.dll + 2004-08-19 23:09:27 38,912 -c----w C:\WINDOWS\ie7\hmmapi.dll + 2004-08-19 23:09:54 34,304 -c----w C:\WINDOWS\ie7\ie4uinit.exe + 2004-08-19 23:09:27 139,264 -c----w C:\WINDOWS\ie7\ieakeng.dll + 2004-08-19 23:09:27 221,696 -c----w C:\WINDOWS\ie7\ieaksie.dll + 2001-08-28 12:00:00 245,760 -c----w C:\WINDOWS\ie7\ieakui.dll + 2004-08-19 23:09:27 323,584 -c----w C:\WINDOWS\ie7\iedkcs32.dll + 2007-10-10 11:16:27 18,432 -c----w C:\WINDOWS\ie7\iedw.exe + 2004-08-19 23:09:27 81,920 -c----w C:\WINDOWS\ie7\ieencode.dll + 2007-10-11 06:13:39 251,392 -c----w C:\WINDOWS\ie7\iepeers.dll + 2004-08-19 23:09:27 49,152 -c----w C:\WINDOWS\ie7\iernonce.dll + 2004-08-19 23:09:27 63,488 -c----w C:\WINDOWS\ie7\iesetup.dll + 2004-08-19 23:09:54 93,184 -c----w C:\WINDOWS\ie7\iexplore.exe + 2004-08-19 23:09:28 35,840 -c----w C:\WINDOWS\ie7\imgutil.dll + 2007-10-11 06:13:39 96,768 -c----w C:\WINDOWS\ie7\inseng.dll + 2007-11-14 07:28:02 450,560 -c----w C:\WINDOWS\ie7\jscript.dll + 2007-10-11 06:13:39 16,384 -c----w C:\WINDOWS\ie7\jsproxy.dll + 2004-08-19 23:09:30 22,528 -c----w C:\WINDOWS\ie7\licmgr10.dll + 2004-08-19 23:09:58 29,184 -c----w C:\WINDOWS\ie7\mshta.exe + 2007-10-30 10:18:16 3,079,680 -c----w C:\WINDOWS\ie7\mshtml.dll + 2007-10-11 06:13:40 449,024 -c----w C:\WINDOWS\ie7\mshtmled.dll + 2004-08-19 23:08:26 57,344 -c----w C:\WINDOWS\ie7\mshtmler.dll + 2001-08-28 12:00:00 146,432 -c----w C:\WINDOWS\ie7\msls31.dll + 2007-10-11 06:13:40 146,432 -c----w C:\WINDOWS\ie7\msrating.dll + 2007-10-11 06:13:40 532,480 -c----w C:\WINDOWS\ie7\mstime.dll + 2004-08-19 23:09:36 97,280 -c----w C:\WINDOWS\ie7\occache.dll + 2007-10-11 06:13:40 39,424 -c----w C:\WINDOWS\ie7\pngfilt.dll + 2007-09-26 17:34:42 33,472 -c----w C:\WINDOWS\ie7\spuninst\iecustom.dll + 2007-09-26 17:32:30 66,048 -c--a-w C:\WINDOWS\ie7\spuninst\ieResetIcons.exe + 2006-09-06 16:43:28 216,800 -c----w C:\WINDOWS\ie7\spuninst\spuninst.exe + 2006-09-06 16:43:30 394,976 -c----w C:\WINDOWS\ie7\spuninst\updspapi.dll + 2004-08-19 23:09:46 37,888 -c----w C:\WINDOWS\ie7\url.dll + 2007-10-11 06:13:41 617,472 -c----w C:\WINDOWS\ie7\urlmon.dll + 2004-08-19 23:09:46 417,792 -c----w C:\WINDOWS\ie7\vbscript.dll + 2007-06-26 13:56:54 851,968 -c----w C:\WINDOWS\ie7\vgx.dll + 2004-08-19 23:09:47 281,600 -c----w C:\WINDOWS\ie7\webcheck.dll + 2007-10-11 06:13:41 663,552 -c----w C:\WINDOWS\ie7\wininet.dll + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\updspapi.dll + 2007-08-13 17:54:10 765,952 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\vgx.dll + 2007-08-13 17:39:00 123,904 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\advpack.dll + 2007-08-13 17:39:00 123,904 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\advpack.dll.000 + 2007-08-13 17:35:38 214,528 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\dxtrans.dll + 2007-08-13 17:54:10 131,584 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\extmgr.dll + 2007-08-13 17:36:26 61,952 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\icardie.dll + 2007-08-13 17:39:06 54,784 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ie4uinit.exe + 2007-08-13 17:39:06 54,784 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ie4uinit.exe.000 + 2007-08-13 17:39:26 152,064 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieakeng.dll + 2007-08-13 17:39:26 152,064 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieakeng.dll.000 + 2007-08-13 17:39:54 229,376 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieaksie.dll + 2007-08-13 17:39:54 229,376 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieaksie.dll.000 + 2007-08-13 16:56:54 161,792 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieakui.dll + 2007-02-12 15:10:12 2,451,312 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieapfltr.dat + 2007-07-11 11:27:48 383,488 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieapfltr.dll + 2007-08-13 17:39:50 382,976 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iedkcs32.dll + 2007-08-13 17:39:50 382,976 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iedkcs32.dll.000 + 2007-08-13 17:54:10 6,049,280 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieframe.dll + 2007-08-13 17:39:10 43,008 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iernonce.dll + 2007-08-13 17:39:10 43,008 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iernonce.dll.000 + 2007-08-13 17:34:04 266,752 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iertutil.dll + 2007-08-13 17:39:10 13,312 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieudinit.exe + 2007-08-13 17:43:56 622,080 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iexplore.exe + 2007-08-13 17:43:56 622,080 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iexplore.exe.000 + 2007-08-13 17:54:10 27,136 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\jsproxy.dll + 2007-08-13 17:54:10 458,752 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msfeeds.dll + 2007-08-13 17:54:10 50,688 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msfeedsbs.dll + 2007-08-13 17:54:12 3,578,368 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mshtml.dll + 2007-08-13 17:54:10 475,648 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mshtmled.dll + 2007-08-13 17:44:26 192,000 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msrating.dll + 2007-08-13 17:54:10 670,720 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mstime.dll + 2007-08-13 17:44:06 101,376 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\occache.dll + 2007-08-13 17:44:06 101,376 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\occache.dll.000 + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe + 2007-06-30 20:24:42 394,976 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\updspapi.dll + 2007-08-13 17:44:30 105,984 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\url.dll + 2007-08-13 17:44:30 105,984 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\url.dll.000 + 2007-08-13 17:54:10 1,162,240 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\urlmon.dll + 2007-08-13 17:54:10 231,424 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\webcheck.dll + 2007-08-13 17:54:10 231,424 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\webcheck.dll.000 + 2007-08-13 17:54:10 818,688 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll + 2007-12-27 18:40:22 32,768 ----a-r C:\WINDOWS\Installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF}\icon.exe - 2003-02-20 17:19:32 253,952 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll + 2007-04-13 20:30:52 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll - 2003-02-20 17:19:34 20,480 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe + 2004-07-15 00:49:18 20,480 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe - 2003-02-20 17:19:38 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe + 2004-07-15 00:49:26 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe - 2003-02-20 17:19:36 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe + 2007-04-13 20:30:52 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe - 2003-02-20 17:09:08 77,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll + 2007-04-13 19:57:52 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll - 2003-02-21 08:20:44 49,152 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.exe + 2004-07-15 10:23:28 49,152 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.exe - 2003-02-21 08:21:00 626,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cscomp.dll + 2004-07-15 10:23:44 626,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cscomp.dll - 2003-02-20 17:06:20 282,624 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll + 2004-07-14 23:24:30 282,624 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll + 2003-10-08 13:30:14 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\gacutil.exe - 2003-02-21 05:24:38 7,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll + 2004-07-15 13:31:00 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll - 2003-02-21 05:24:40 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEHost.dll + 2004-07-15 13:31:04 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEHost.dll - 2003-02-20 17:09:40 196,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ilasm.exe + 2004-07-14 23:35:30 196,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ilasm.exe - 2003-02-21 05:26:36 716,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll + 2004-07-15 13:28:58 720,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll - 2003-02-21 05:26:38 299,008 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll + 2004-07-15 13:28:56 299,008 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll - 2003-02-21 05:25:04 49,152 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPol.exe + 2004-07-15 13:28:50 49,152 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPol.exe - 2003-02-21 05:25:04 49,152 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe + 2004-07-15 13:28:50 49,152 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe - 2003-02-20 17:09:12 77,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbc.dll + 2004-07-14 23:32:44 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbc.dll - 2003-02-20 17:09:12 233,472 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbi.dll + 2004-07-14 23:32:46 233,472 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbi.dll - 2003-02-20 17:09:14 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorie.dll + 2007-04-13 19:57:58 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorie.dll - 2003-02-20 17:06:32 311,296 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll + 2007-04-13 19:56:30 315,392 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll - 2003-02-20 17:09:16 98,304 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorld.dll + 2007-04-13 19:58:00 102,400 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorld.dll - 2003-02-21 05:26:34 2,088,960 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll + 2007-04-13 19:50:46 2,142,208 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll - 2003-02-20 17:09:18 143,360 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorrc.dll + 2004-07-14 23:33:22 143,360 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorrc.dll - 2003-02-20 17:09:18 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll + 2004-07-14 23:33:24 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll - 2003-02-20 17:09:18 77,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll + 2007-04-13 19:58:02 77,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll - 2003-02-20 17:07:34 2,494,464 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll + 2007-04-13 19:57:00 2,523,136 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll - 2003-02-20 17:08:32 2,482,176 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll + 2007-04-13 19:57:28 2,514,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll + 2007-01-15 15:11:26 73,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe - 2003-02-20 17:09:30 90,112 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\PerfCounter.dll + 2004-07-14 23:34:50 94,208 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\PerfCounter.dll - 2003-02-21 05:26:46 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegCode.dll + 2004-07-15 13:28:48 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegCode.dll + 2004-07-15 00:49:16 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3196\_aspnet_isapi.dll + 2004-07-14 23:32:22 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3196\_CORPerfMonExt.dll + 2004-07-14 23:24:30 282,624 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3196\_fusion.dll + 2004-07-14 23:25:06 315,392 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3196\_mscorjit.dll + 2004-07-15 13:29:02 2,138,112 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3196\_mscorlib.dll + 2003-02-20 17:09:18 77,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3196\_mscorsn.dll + 2004-07-14 23:26:52 2,510,848 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3196\_mscorsvr.dll + 2004-07-14 23:28:34 2,502,656 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3196\_mscorwks.dll + 2003-02-21 02:42:22 348,160 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3196\_msvcr71.dll + 2004-07-14 23:34:50 94,208 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW3196\_PerfCounter.dll - 2003-02-20 17:09:34 319,488 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SOS.dll + 2004-07-14 23:35:04 319,488 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SOS.dll - 2003-02-21 05:26:38 1,290,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.dll + 2004-07-15 13:32:00 1,294,336 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.dll - 2003-02-21 05:25:42 299,008 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll + 2004-07-15 13:31:14 303,104 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll - 2003-02-21 05:26:42 1,699,840 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Design.dll + 2004-07-15 13:29:02 1,703,936 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Design.dll - 2003-02-21 05:26:44 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll + 2004-07-15 13:28:54 90,112 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll - 2003-02-21 05:26:46 1,216,512 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.dll + 2007-04-13 20:35:38 1,232,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.dll - 2003-02-21 05:26:50 466,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll + 2004-07-15 13:28:58 466,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll - 2003-02-21 05:26:50 241,664 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll + 2004-07-15 13:28:56 241,664 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll - 2003-02-20 17:09:36 64,000 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.Thunk.dll + 2004-07-14 23:35:12 66,560 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.Thunk.dll - 2003-02-21 05:26:52 368,640 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Management.dll + 2004-07-15 13:31:58 372,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Management.dll - 2003-02-21 05:26:54 241,664 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll + 2004-07-15 13:31:12 241,664 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll - 2003-02-21 05:26:56 323,584 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll + 2004-07-15 13:28:58 323,584 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll - 2003-02-21 05:26:56 131,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll + 2004-07-15 13:31:54 131,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll - 2003-02-21 05:26:58 77,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Security.dll + 2004-07-15 13:28:52 77,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Security.dll - 2003-02-21 05:27:00 126,976 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll + 2004-07-15 13:28:54 126,976 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll - 2003-02-21 05:27:02 1,245,184 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.dll + 2007-04-13 20:35:46 1,265,664 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.dll - 2003-02-21 05:27:06 819,200 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll + 2004-07-15 13:28:58 819,200 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll - 2003-02-21 05:24:18 57,344 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll + 2004-07-15 13:28:52 57,344 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll - 2003-02-21 05:27:06 569,344 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll + 2004-07-15 13:31:16 573,440 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll - 2003-02-21 05:27:08 2,039,808 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll + 2004-07-15 13:32:02 2,052,096 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll - 2003-02-21 05:27:10 1,335,296 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.XML.dll + 2004-07-15 13:29:00 1,339,392 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.XML.dll + 2004-06-22 12:51:38 53,248 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe - 2003-02-21 08:20:38 737,280 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\vbc.exe + 2004-07-15 10:23:20 737,280 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\vbc.exe - 2003-02-21 03:04:18 1,032,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll + 2004-07-15 07:15:14 1,032,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll - 2003-02-20 18:10:40 31,744 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll + 2004-07-15 01:11:56 31,744 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll - 2004-08-19 23:09:19 41,984 ----a-w C:\WINDOWS\msagent\agentdp2.dll + 2006-10-12 14:04:13 42,496 ----a-w C:\WINDOWS\msagent\agentdp2.dll - 2004-08-19 23:09:19 58,880 ----a-w C:\WINDOWS\msagent\agentdpv.dll + 2007-03-09 13:48:06 57,344 ----a-w C:\WINDOWS\msagent\agentdpv.dll - 2004-08-19 23:09:50 256,512 ----a-w C:\WINDOWS\msagent\agentsvr.exe + 2006-10-12 11:09:53 256,512 ----a-w C:\WINDOWS\msagent\agentsvr.exe + 2006-06-02 19:32:20 33,792 ------w C:\WINDOWS\network diagnostic\custsat.dll + 2006-10-10 12:44:50 557,568 ------w C:\WINDOWS\network diagnostic\xpnetdiag.exe - 2004-08-19 23:09:19 100,352 ----a-w C:\WINDOWS\system32\6to4svc.dll + 2006-08-16 11:59:27 100,352 ----a-w C:\WINDOWS\system32\6to4svc.dll - 2004-08-19 23:09:19 61,440 ----a-w C:\WINDOWS\system32\admparse.dll + 2007-08-13 17:39:20 71,680 ----a-w C:\WINDOWS\system32\admparse.dll - 2004-08-19 23:09:19 101,888 ----a-w C:\WINDOWS\system32\advpack.dll + 2007-10-10 23:49:42 124,928 ----a-w C:\WINDOWS\system32\advpack.dll - 2004-08-19 23:09:20 56,832 ----a-w C:\WINDOWS\system32\authz.dll + 2005-03-02 18:10:36 56,832 ----a-w C:\WINDOWS\system32\authz.dll - 2004-08-19 23:09:20 1,017,344 ----a-w C:\WINDOWS\system32\browseui.dll + 2007-10-11 06:13:38 1,024,000 ----a-w C:\WINDOWS\system32\browseui.dll - 2004-08-19 23:09:20 229,888 ----a-w C:\WINDOWS\system32\catsrv.dll + 2005-07-26 04:39:54 225,792 ----a-w C:\WINDOWS\system32\catsrv.dll - 2004-08-19 23:09:20 628,224 ----a-w C:\WINDOWS\system32\catsrvut.dll + 2005-07-26 04:39:54 625,152 ----a-w C:\WINDOWS\system32\catsrvut.dll - 2004-08-19 23:09:20 151,552 ----a-w C:\WINDOWS\system32\cdfview.dll + 2007-10-11 06:13:38 152,064 ----a-w C:\WINDOWS\system32\cdfview.dll - 2004-08-19 23:09:20 2,067,968 ----a-w C:\WINDOWS\system32\cdosys.dll + 2005-09-10 01:55:14 2,067,968 ----a-w C:\WINDOWS\system32\cdosys.dll - 2004-08-19 23:09:20 69,120 ----a-w C:\WINDOWS\system32\ciodm.dll + 2006-06-22 05:13:45 69,120 ----a-w C:\WINDOWS\system32\ciodm.dll - 2004-08-19 23:09:20 110,080 ----a-w C:\WINDOWS\system32\clbcatex.dll + 2005-07-26 04:39:55 110,080 ----a-w C:\WINDOWS\system32\clbcatex.dll - 2004-08-19 23:09:20 501,248 ----a-w C:\WINDOWS\system32\clbcatq.dll + 2005-07-26 04:39:55 498,688 ----a-w C:\WINDOWS\system32\clbcatq.dll - 2004-08-19 23:09:20 62,464 ----a-w C:\WINDOWS\system32\colbact.dll + 2005-07-26 04:39:55 60,416 ----a-w C:\WINDOWS\system32\colbact.dll - 2004-08-19 23:09:20 195,584 ----a-w C:\WINDOWS\system32\Com\comadmin.dll + 2005-07-26 04:39:56 195,072 ----a-w C:\WINDOWS\system32\Com\comadmin.dll - 2004-08-19 23:09:20 611,328 ----a-w C:\WINDOWS\system32\comctl32.dll + 2006-08-25 15:51:14 617,472 ----a-w C:\WINDOWS\system32\comctl32.dll - 2001-08-28 12:00:00 82,432 ----a-w C:\WINDOWS\system32\comrepl.dll + 2005-07-26 04:39:56 97,792 ----a-w C:\WINDOWS\system32\comrepl.dll - 2004-08-19 23:09:21 1,251,840 ----a-w C:\WINDOWS\system32\comsvcs.dll + 2005-07-26 04:39:57 1,267,200 ----a-w C:\WINDOWS\system32\comsvcs.dll - 2004-08-19 23:09:21 540,160 ----a-w C:\WINDOWS\system32\comuid.dll + 2005-07-26 04:39:57 540,160 ----a-w C:\WINDOWS\system32\comuid.dll - 2004-08-19 23:09:22 1,056,256 ----a-w C:\WINDOWS\system32\danim.dll + 2007-10-11 06:13:38 1,056,768 ----a-w C:\WINDOWS\system32\danim.dll - 2004-08-19 23:09:22 111,616 ----a-w C:\WINDOWS\system32\dhcpcsvc.dll + 2006-05-19 13:23:35 112,128 ----a-w C:\WINDOWS\system32\dhcpcsvc.dll + 2006-08-16 11:59:27 100,352 -c----w C:\WINDOWS\system32\dllcache\6to4svc.dll + 2007-08-13 17:39:20 71,680 -c----w C:\WINDOWS\system32\dllcache\admparse.dll + 2007-10-10 23:49:42 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll + 2006-10-12 14:04:13 42,496 -c----w C:\WINDOWS\system32\dllcache\agentdp2.dll + 2007-03-09 13:48:06 57,344 -c--a-w C:\WINDOWS\system32\dllcache\agentdpv.dll + 2006-10-12 11:09:53 256,512 -c----w C:\WINDOWS\system32\dllcache\agentsvr.exe + 2007-10-11 06:13:38 1,024,000 -c----w C:\WINDOWS\system32\dllcache\browseui.dll + 2007-10-11 06:13:38 152,064 -c----w C:\WINDOWS\system32\dllcache\cdfview.dll + 2006-06-22 05:13:45 69,120 -c----w C:\WINDOWS\system32\dllcache\ciodm.dll + 2006-08-25 15:51:14 617,472 -c----w C:\WINDOWS\system32\dllcache\comctl32.dll - 2001-08-28 12:00:00 82,432 -c--a-w C:\WINDOWS\system32\dllcache\comrepl.dll + 2005-07-26 04:39:56 97,792 -c--a-w C:\WINDOWS\system32\dllcache\comrepl.dll + 2007-08-13 17:42:54 17,408 -c----w C:\WINDOWS\system32\dllcache\corpol.dll + 2007-10-11 06:13:38 1,056,768 -c----w C:\WINDOWS\system32\dllcache\danim.dll + 2006-05-19 13:23:35 112,128 -c----w C:\WINDOWS\system32\dllcache\dhcpcsvc.dll + 2007-05-16 15:13:53 86,528 -c----w C:\WINDOWS\system32\dllcache\directdb.dll + 2006-06-26 17:41:32 148,480 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll + 2006-08-24 12:17:20 500,278 -c----w C:\WINDOWS\system32\dllcache\dxmasf.dll + 2007-08-13 17:35:46 346,624 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll + 2007-10-10 23:49:42 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll + 2007-06-13 13:22:28 1,037,312 -c----w C:\WINDOWS\system32\dllcache\explorer.exe + 2007-10-10 23:49:42 132,608 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll - 2001-08-28 12:00:00 79,360 -c--a-w C:\WINDOWS\system32\dllcache\fontsub.dll + 2005-10-17 21:21:08 80,896 -c--a-w C:\WINDOWS\system32\dllcache\fontsub.dll - 2001-08-28 12:00:00 77,850 -c--a-w C:\WINDOWS\system32\dllcache\hlink.dll + 2006-07-21 08:27:28 72,704 -c--a-w C:\WINDOWS\system32\dllcache\hlink.dll + 2007-08-13 17:18:02 60,416 -c----w C:\WINDOWS\system32\dllcache\hmmapi.dll + 2007-10-10 23:49:42 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll + 2007-10-10 11:00:41 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe + 2007-10-10 23:49:42 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll + 2007-10-10 23:49:42 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll - 2001-08-28 12:00:00 245,760 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll + 2007-10-10 05:46:55 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll + 2007-07-01 03:31:33 2,455,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dat + 2007-10-10 23:49:42 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll + 2007-10-10 23:49:42 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll + 2007-08-13 17:44:02 69,120 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe + 2007-08-13 17:45:18 78,336 -c----w C:\WINDOWS\system32\dllcache\ieencode.dll + 2007-10-10 23:49:43 6,065,664 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll + 2007-08-13 17:54:10 191,488 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll + 2007-10-10 23:49:43 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll + 2007-10-10 23:49:43 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll + 2007-08-13 17:39:12 55,296 -c----w C:\WINDOWS\system32\dllcache\iesetup.dll + 2007-10-10 10:59:40 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe + 2007-10-10 11:00:59 625,152 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe + 2007-08-13 17:36:06 36,352 -c----w C:\WINDOWS\system32\dllcache\imgutil.dll + 2007-08-21 06:17:23 683,520 -c----w C:\WINDOWS\system32\dllcache\inetcomm.dll + 2007-08-13 17:39:02 92,672 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll + 2006-05-19 13:23:35 95,744 -c----w C:\WINDOWS\system32\dllcache\iphlpapi.dll - 2001-08-28 12:00:00 144,896 -c--a-w C:\WINDOWS\system32\dllcache\jgdw400.dll + 2006-06-01 18:48:44 163,840 -c--a-w C:\WINDOWS\system32\dllcache\jgdw400.dll - 2001-08-28 12:00:00 42,496 -c--a-w C:\WINDOWS\system32\dllcache\jgpl400.dll + 2006-06-01 18:48:44 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jgpl400.dll + 2007-08-13 17:38:04 491,520 -c--a-w C:\WINDOWS\system32\dllcache\jscript.dll + 2007-10-10 23:49:44 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2007-04-16 15:53:11 1,049,600 -c----w C:\WINDOWS\system32\dllcache\kernel32.dll + 2006-06-14 08:47:45 172,416 -c----w C:\WINDOWS\system32\dllcache\kmixer.sys + 2007-08-13 17:44:18 40,960 -c----w C:\WINDOWS\system32\dllcache\licmgr10.dll + 2006-08-17 12:29:49 728,576 -c----w C:\WINDOWS\system32\dllcache\lsasrv.dll + 2007-03-08 15:37:50 40,960 -c----w C:\WINDOWS\system32\dllcache\mf3216.dll - 2001-08-28 12:00:00 924,432 -c--a-w C:\WINDOWS\system32\dllcache\mfc40u.dll + 2006-11-01 19:18:42 927,504 -c--a-w C:\WINDOWS\system32\dllcache\mfc40u.dll + 2006-10-14 08:13:25 981,760 -c----w C:\WINDOWS\system32\dllcache\mfc42u.dll + 2006-05-05 09:41:45 453,120 -c----w C:\WINDOWS\system32\dllcache\mrxsmb.sys + 2007-10-10 23:49:44 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll + 2007-10-10 23:49:44 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll + 2006-11-27 14:55:30 539,136 -c----w C:\WINDOWS\system32\dllcache\msftedit.dll + 2007-08-13 17:32:30 45,568 -c----w C:\WINDOWS\system32\dllcache\mshta.exe + 2007-10-31 03:53:50 3,590,656 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll + 2007-10-10 23:49:44 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll + 2007-08-13 17:01:12 48,128 -c----w C:\WINDOWS\system32\dllcache\mshtmler.dll - 2005-05-03 11:58:36 2,890,240 -c--a-w C:\WINDOWS\system32\dllcache\msi.dll + 2007-04-18 16:14:18 2,854,400 -c--a-w C:\WINDOWS\system32\dllcache\msi.dll - 2001-08-28 12:00:00 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msls31.dll + 2007-08-13 17:54:10 156,160 -c--a-w C:\WINDOWS\system32\dllcache\msls31.dll + 2007-05-16 15:13:54 1,314,816 -c----w C:\WINDOWS\system32\dllcache\msoe.dll + 2007-10-10 23:49:44 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll + 2007-10-10 23:49:45 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll + 2007-06-26 06:09:14 1,104,896 -c----w C:\WINDOWS\system32\dllcache\msxml3.dll + 2006-08-17 12:29:49 332,288 -c----w C:\WINDOWS\system32\dllcache\netapi32.dll + 2007-02-09 11:10:35 574,464 -c----w C:\WINDOWS\system32\dllcache\ntfs.sys + 2006-10-13 12:36:55 145,920 -c----w C:\WINDOWS\system32\dllcache\nwprovau.dll + 2007-10-10 23:49:45 102,400 -c----w C:\WINDOWS\system32\dllcache\occache.dll + 2007-05-17 11:29:50 549,376 -c----w C:\WINDOWS\system32\dllcache\oleaut32.dll - 2001-08-28 12:00:00 69,120 -c--a-w C:\WINDOWS\system32\dllcache\olecli32.dll + 2005-07-26 04:40:00 75,264 -c--a-w C:\WINDOWS\system32\dllcache\olecli32.dll - 2001-08-28 12:00:00 34,304 -c--a-w C:\WINDOWS\system32\dllcache\olecnv32.dll + 2005-07-26 04:40:00 37,888 -c--a-w C:\WINDOWS\system32\dllcache\olecnv32.dll - 2001-08-28 12:00:00 119,808 -c--a-w C:\WINDOWS\system32\dllcache\oledlg.dll + 2006-10-16 16:16:00 124,928 -c--a-w C:\WINDOWS\system32\dllcache\oledlg.dll + 2007-08-13 17:36:12 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll + 2007-10-29 22:43:32 1,293,824 -c----w C:\WINDOWS\system32\dllcache\quartz.dll + 2006-06-22 05:13:46 1,440,768 -c----w C:\WINDOWS\system32\dllcache\query.dll + 2006-06-26 17:41:32 8,192 -c----w C:\WINDOWS\system32\dllcache\rasadhlp.dll + 2006-06-22 10:48:06 181,248 -c----w C:\WINDOWS\system32\dllcache\rasmans.dll + 2006-05-05 09:47:57 174,592 -c----w C:\WINDOWS\system32\dllcache\rdbss.sys + 2006-11-27 14:55:31 433,152 -c----w C:\WINDOWS\system32\dllcache\riched20.dll - 2001-08-28 12:00:00 200,064 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys + 2006-07-13 08:48:58 202,240 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys + 2007-04-25 14:22:35 144,896 -c----w C:\WINDOWS\system32\dllcache\schannel.dll + 2007-10-25 16:43:25 8,516,608 -c--a-w C:\WINDOWS\system32\dllcache\shell32.dll + 2007-10-11 06:13:41 474,624 -c----w C:\WINDOWS\system32\dllcache\shlwapi.dll + 2006-12-19 21:49:47 135,168 -c----w C:\WINDOWS\system32\dllcache\shsvcs.dll + 2006-06-14 08:47:46 6,400 -c----w C:\WINDOWS\system32\dllcache\splitter.sys + 2006-08-14 10:34:41 332,928 -c----w C:\WINDOWS\system32\dllcache\srv.sys + 2006-08-24 12:19:40 246,814 -c----w C:\WINDOWS\system32\dllcache\strmdll.dll + 2006-08-16 09:37:30 225,664 -c----w C:\WINDOWS\system32\dllcache\tcpip6.sys + 2007-02-05 20:19:06 185,344 -c----w C:\WINDOWS\system32\dllcache\upnphost.dll + 2007-10-10 23:49:45 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll + 2007-10-10 23:49:45 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll + 2007-03-08 15:37:50 578,560 -c----w C:\WINDOWS\system32\dllcache\user32.dll + 2007-08-13 17:54:10 413,696 -c----w C:\WINDOWS\system32\dllcache\vbscript.dll + 2007-05-16 15:13:55 510,976 -c----w C:\WINDOWS\system32\dllcache\wab32.dll + 2007-05-16 15:13:55 85,504 -c----w C:\WINDOWS\system32\dllcache\wabimp.dll + 2006-06-14 09:00:45 82,944 -c----w C:\WINDOWS\system32\dllcache\wdmaud.sys + 2007-10-10 23:49:45 232,960 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll + 2006-12-19 18:17:50 334,336 -c----w C:\WINDOWS\system32\dllcache\wiaservc.dll + 2007-03-08 15:33:58 1,843,712 -c----w C:\WINDOWS\system32\dllcache\win32k.sys + 2007-10-10 23:49:45 824,832 -c----w C:\WINDOWS\system32\dllcache\wininet.dll + 2007-03-17 13:44:47 293,376 -c----w C:\WINDOWS\system32\dllcache\winsrv.dll + 2006-08-17 12:29:49 132,096 -c----w C:\WINDOWS\system32\dllcache\wkssvc.dll - 2004-10-11 09:20:30 224,256 -c--a-w C:\WINDOWS\system32\dllcache\wmasf.dll + 2007-10-20 05:01:32 227,328 -c--a-w C:\WINDOWS\system32\dllcache\wmasf.dll - 2004-10-11 09:20:36 2,362,104 -c--a-w C:\WINDOWS\system32\dllcache\wmvcore.dll + 2006-12-07 06:40:49 2,362,184 -c--a-w C:\WINDOWS\system32\dllcache\wmvcore.dll - 2004-08-19 23:09:22 148,480 ----a-w C:\WINDOWS\system32\dnsapi.dll + 2006-06-26 17:41:32 148,480 ----a-w C:\WINDOWS\system32\dnsapi.dll - 2004-08-04 05:39:36 142,464 ----a-w C:\WINDOWS\system32\drivers\aec.sys + 2006-02-15 00:22:26 142,464 ----a-w C:\WINDOWS\system32\drivers\aec.sys - 2004-08-04 06:01:19 124,800 ------w C:\WINDOWS\system32\drivers\fltmgr.sys + 2006-08-21 09:14:58 128,896 ------w C:\WINDOWS\system32\drivers\fltmgr.sys - 2004-08-04 06:00:13 263,040 ------w C:\WINDOWS\system32\drivers\http.sys + 2006-03-17 00:33:10 262,784 ------w C:\WINDOWS\system32\drivers\http.sys - 2004-08-04 06:04:50 134,912 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys + 2004-09-29 22:28:37 134,912 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys - 2004-08-04 06:07:48 171,776 ----a-w C:\WINDOWS\system32\drivers\kmixer.sys + 2006-06-14 08:47:45 172,416 ----a-w C:\WINDOWS\system32\drivers\kmixer.sys - 2004-08-04 06:15:16 451,456 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys + 2006-05-05 09:41:45 453,120 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys - 2004-08-04 06:15:09 574,592 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys + 2007-02-09 11:10:35 574,464 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys - 2004-08-04 06:20:06 176,512 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys + 2006-05-05 09:47:57 174,592 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys - 2004-08-19 23:10:18 139,400 ----a-w C:\WINDOWS\system32\drivers\rdpwd.sys + 2005-06-10 04:11:22 139,528 ----a-w C:\WINDOWS\system32\drivers\rdpwd.sys - 2001-08-28 12:00:00 200,064 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys + 2006-07-13 08:48:58 202,240 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys - 2004-08-04 06:07:47 6,400 ----a-w C:\WINDOWS\system32\drivers\splitter.sys + 2006-06-14 08:47:46 6,400 ----a-w C:\WINDOWS\system32\drivers\splitter.sys - 2004-08-04 06:14:45 336,256 ----a-w C:\WINDOWS\system32\drivers\srv.sys + 2006-08-14 10:34:41 332,928 ----a-w C:\WINDOWS\system32\drivers\srv.sys - 2004-08-04 06:14:40 359,040 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys + 2006-04-20 11:51:50 359,808 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys - 2004-08-04 06:07:45 223,616 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys + 2006-08-16 09:37:30 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys - 2004-08-04 06:15:04 82,944 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys + 2006-06-14 09:00:45 82,944 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys - 2004-08-19 23:09:23 499,741 ----a-w C:\WINDOWS\system32\dxmasf.dll + 2006-08-24 12:17:20 500,278 ----a-w C:\WINDOWS\system32\dxmasf.dll - 2004-08-19 23:09:23 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll + 2007-08-13 17:35:46 346,624 ----a-w C:\WINDOWS\system32\dxtmsft.dll - 2004-08-19 23:09:23 201,728 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2007-10-10 23:49:42 214,528 ------w C:\WINDOWS\system32\dxtrans.dll - 2004-08-19 23:09:25 243,200 ----a-w C:\WINDOWS\system32\es.dll + 2005-07-26 04:39:57 243,200 ----a-w C:\WINDOWS\system32\es.dll - 2004-08-19 23:09:25 1,097,728 ----a-w C:\WINDOWS\system32\esent.dll + 2005-10-20 22:25:53 1,097,728 ----a-w C:\WINDOWS\system32\esent.dll - 2004-08-19 23:09:25 55,808 ------w C:\WINDOWS\system32\extmgr.dll + 2007-10-10 23:49:42 132,608 ------w C:\WINDOWS\system32\extmgr.dll - 2004-08-19 23:09:25 16,896 ------w C:\WINDOWS\system32\fltlib.dll + 2006-08-21 12:26:15 16,896 ----a-w C:\WINDOWS\system32\fltlib.dll - 2004-08-19 23:09:54 22,528 ------w C:\WINDOWS\system32\fltmc.exe + 2006-08-21 09:14:58 23,040 ----a-w C:\WINDOWS\system32\fltmc.exe - 2007-12-26 12:49:41 134,872 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2007-12-27 18:56:56 134,872 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT - 2001-08-28 12:00:00 79,360 ----a-w C:\WINDOWS\system32\fontsub.dll + 2005-10-17 21:21:08 80,896 ----a-w C:\WINDOWS\system32\fontsub.dll - 2004-08-19 23:09:27 278,016 ----a-w C:\WINDOWS\system32\gdi32.dll + 2007-06-19 13:32:25 282,112 ----a-w C:\WINDOWS\system32\gdi32.dll - 2004-08-19 23:09:27 38,912 ----a-w C:\WINDOWS\system32\hhsetup.dll + 2005-05-27 02:08:06 41,472 ----a-w C:\WINDOWS\system32\hhsetup.dll - 2001-08-28 12:00:00 77,850 ----a-w C:\WINDOWS\system32\hlink.dll + 2006-07-21 08:27:28 72,704 ----a-w C:\WINDOWS\system32\hlink.dll - 2004-08-19 23:09:27 352,256 ----a-w C:\WINDOWS\system32\hypertrm.dll + 2004-11-17 17:42:33 354,304 ----a-w C:\WINDOWS\system32\hypertrm.dll + 2007-10-10 23:49:42 63,488 ----a-w C:\WINDOWS\system32\icardie.dll - 2004-08-19 23:09:27 253,952 ----a-w C:\WINDOWS\system32\icm32.dll + 2005-06-29 01:49:41 254,976 ----a-w C:\WINDOWS\system32\icm32.dll + 2006-06-29 07:05:44 26,112 ------w C:\WINDOWS\system32\idndl.dll - 2004-08-19 23:09:54 34,304 ----a-w C:\WINDOWS\system32\ie4uinit.exe + 2007-10-10 11:00:41 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe - 2004-08-19 23:09:27 139,264 ----a-w C:\WINDOWS\system32\ieakeng.dll + 2007-10-10 23:49:42 153,088 ------w C:\WINDOWS\system32\ieakeng.dll - 2004-08-19 23:09:27 221,696 ----a-w C:\WINDOWS\system32\ieaksie.dll + 2007-10-10 23:49:42 230,400 ------w C:\WINDOWS\system32\ieaksie.dll - 2001-08-28 12:00:00 245,760 ----a-w C:\WINDOWS\system32\ieakui.dll + 2007-10-10 05:46:55 161,792 ------w C:\WINDOWS\system32\ieakui.dll + 2007-07-01 03:31:33 2,455,488 ----a-w C:\WINDOWS\system32\ieapfltr.dat + 2007-10-10 23:49:42 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll - 2004-08-19 23:09:27 323,584 ----a-w C:\WINDOWS\system32\iedkcs32.dll + 2007-10-10 23:49:42 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll - 2004-08-19 23:09:27 81,920 ------w C:\WINDOWS\system32\ieencode.dll + 2007-08-13 17:45:18 78,336 ----a-w C:\WINDOWS\system32\ieencode.dll + 2007-10-10 23:49:43 6,065,664 ----a-w C:\WINDOWS\system32\ieframe.dll - 2004-08-19 23:09:27 249,344 ----a-w C:\WINDOWS\system32\iepeers.dll + 2007-08-13 17:54:10 191,488 ----a-w C:\WINDOWS\system32\iepeers.dll - 2004-08-19 23:09:27 49,152 ----a-w C:\WINDOWS\system32\iernonce.dll + 2007-10-10 23:49:43 44,544 ------w C:\WINDOWS\system32\iernonce.dll + 2007-10-10 23:49:43 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll - 2004-08-19 23:09:27 63,488 ----a-w C:\WINDOWS\system32\iesetup.dll + 2007-08-13 17:39:12 55,296 ----a-w C:\WINDOWS\system32\iesetup.dll + 2007-10-10 10:59:40 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe + 2007-08-13 17:54:10 180,736 ------w C:\WINDOWS\system32\ieui.dll - 2004-08-19 23:09:28 35,840 ----a-w C:\WINDOWS\system32\imgutil.dll + 2007-08-13 17:36:06 36,352 ----a-w C:\WINDOWS\system32\imgutil.dll - 2004-08-19 23:09:28 678,400 ----a-w C:\WINDOWS\system32\inetcomm.dll + 2007-08-21 06:17:23 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll - 2004-08-19 23:09:29 96,768 ----a-w C:\WINDOWS\system32\inseng.dll + 2007-08-13 17:39:02 92,672 ----a-w C:\WINDOWS\system32\inseng.dll - 2004-08-19 23:09:30 95,744 ----a-w C:\WINDOWS\system32\iphlpapi.dll + 2006-05-19 13:23:35 95,744 ----a-w C:\WINDOWS\system32\iphlpapi.dll - 2004-08-19 23:09:30 143,872 ----a-w C:\WINDOWS\system32\itircl.dll + 2005-05-27 02:08:06 155,136 ----a-w C:\WINDOWS\system32\itircl.dll - 2004-08-19 23:09:30 134,144 ----a-w C:\WINDOWS\system32\itss.dll + 2005-05-27 02:08:06 137,216 ----a-w C:\WINDOWS\system32\itss.dll - 2001-08-28 12:00:00 144,896 ----a-w C:\WINDOWS\system32\jgdw400.dll + 2006-06-01 18:48:44 163,840 ----a-w C:\WINDOWS\system32\jgdw400.dll - 2001-08-28 12:00:00 42,496 ----a-w C:\WINDOWS\system32\jgpl400.dll + 2006-06-01 18:48:44 27,648 ----a-w C:\WINDOWS\system32\jgpl400.dll - 2004-08-19 23:09:30 450,560 ----a-w C:\WINDOWS\system32\jscript.dll + 2007-08-13 17:38:04 491,520 ----a-w C:\WINDOWS\system32\jscript.dll - 2004-08-19 23:09:30 15,872 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2007-10-10 23:49:44 27,648 ------w C:\WINDOWS\system32\jsproxy.dll - 2004-08-19 23:09:30 294,400 ----a-w C:\WINDOWS\system32\kerberos.dll + 2005-06-15 17:50:31 295,936 ----a-w C:\WINDOWS\system32\kerberos.dll - 2004-08-19 23:09:30 1,048,576 ----a-w C:\WINDOWS\system32\kernel32.dll + 2007-04-16 15:53:11 1,049,600 ----a-w C:\WINDOWS\system32\kernel32.dll - 2004-08-19 23:09:30 22,528 ----a-w C:\WINDOWS\system32\licmgr10.dll + 2007-08-13 17:44:18 40,960 ----a-w C:\WINDOWS\system32\licmgr10.dll - 2004-08-19 23:09:30 18,944 ----a-w C:\WINDOWS\system32\linkinfo.dll + 2005-09-01 01:43:37 19,968 ----a-w C:\WINDOWS\system32\linkinfo.dll - 2004-08-19 23:09:30 728,576 ----a-w C:\WINDOWS\system32\lsasrv.dll + 2006-08-17 12:29:49 728,576 ----a-w C:\WINDOWS\system32\lsasrv.dll - 2004-08-19 23:09:30 39,936 ----a-w C:\WINDOWS\system32\mf3216.dll + 2007-03-08 15:37:50 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll - 2001-08-28 12:00:00 924,432 ----a-w C:\WINDOWS\system32\mfc40u.dll + 2006-11-01 19:18:42 927,504 ----a-w C:\WINDOWS\system32\mfc40u.dll - 2004-08-19 23:09:30 1,024,000 ----a-w C:\WINDOWS\system32\mfc42u.dll + 2006-10-14 08:13:25 981,760 ----a-w C:\WINDOWS\system32\mfc42u.dll - 2004-08-19 23:09:33 73,728 ----a-w C:\WINDOWS\system32\mscms.dll + 2005-06-29 01:49:41 74,240 ----a-w C:\WINDOWS\system32\mscms.dll - 2003-02-20 17:06:24 155,648 ----a-w C:\WINDOWS\system32\mscoree.dll + 2006-12-22 11:28:14 271,360 ----a-w C:\WINDOWS\system32\mscoree.dll - 2003-02-20 16:43:38 16,896 ----a-w C:\WINDOWS\system32\mscorier.dll + 2004-07-14 22:34:06 16,896 ----a-w C:\WINDOWS\system32\mscorier.dll - 2004-08-19 23:09:33 425,472 ----a-w C:\WINDOWS\system32\msdtcprx.dll + 2006-03-01 19:43:50 426,496 ----a-w C:\WINDOWS\system32\msdtcprx.dll - 2004-08-19 23:09:33 949,248 ----a-w C:\WINDOWS\system32\msdtctm.dll + 2006-03-01 19:43:50 956,416 ----a-w C:\WINDOWS\system32\msdtctm.dll - 2004-08-19 23:09:33 161,280 ----a-w C:\WINDOWS\system32\msdtcuiu.dll + 2006-03-01 19:43:51 161,280 ----a-w C:\WINDOWS\system32\msdtcuiu.dll + 2007-10-10 23:49:44 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll + 2007-10-10 23:49:44 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll + 2007-08-13 17:36:40 12,288 ------w C:\WINDOWS\system32\msfeedssync.exe - 2004-08-19 23:09:33 537,088 ------w C:\WINDOWS\system32\msftedit.dll + 2006-11-27 14:55:30 539,136 ------w C:\WINDOWS\system32\msftedit.dll - 2004-08-19 23:09:58 29,184 ----a-w C:\WINDOWS\system32\mshta.exe + 2007-08-13 17:32:30 45,568 ----a-w C:\WINDOWS\system32\mshta.exe - 2004-08-19 23:09:33 3,003,392 ----a-w C:\WINDOWS\system32\mshtml.dll + 2007-10-31 03:53:50 3,590,656 ----a-w C:\WINDOWS\system32\mshtml.dll - 2004-08-19 23:09:33 448,512 ----a-w C:\WINDOWS\system32\mshtmled.dll + 2007-10-10 23:49:44 478,208 ------w C:\WINDOWS\system32\mshtmled.dll - 2004-08-19 23:08:26 57,344 ----a-w C:\WINDOWS\system32\mshtmler.dll + 2007-08-13 17:01:12 48,128 ----a-w C:\WINDOWS\system32\mshtmler.dll - 2005-05-03 11:58:36 2,890,240 ----a-w C:\WINDOWS\system32\msi.dll + 2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll - 2001-08-28 12:00:00 146,432 ----a-w C:\WINDOWS\system32\msls31.dll + 2007-08-13 17:54:10 156,160 ----a-w C:\WINDOWS\system32\msls31.dll - 2004-08-19 23:09:33 146,432 ----a-w C:\WINDOWS\system32\msrating.dll + 2007-10-10 23:49:44 193,024 ------w C:\WINDOWS\system32\msrating.dll - 2004-08-19 23:09:34 530,432 ----a-w C:\WINDOWS\system32\mstime.dll + 2007-10-10 23:49:45 671,232 ------w C:\WINDOWS\system32\mstime.dll - 2004-08-19 23:09:35 1,236,480 ----a-w C:\WINDOWS\system32\msxml3.dll + 2007-06-26 06:09:14 1,104,896 ----a-w C:\WINDOWS\system32\msxml3.dll - 2003-04-18 14:46:22 1,233,920 ----a-w C:\WINDOWS\system32\msxml4.dll + 2007-05-08 14:03:04 1,275,392 ----a-w C:\WINDOWS\system32\msxml4.dll - 2004-08-19 23:09:35 66,560 ----a-w C:\WINDOWS\system32\mtxclu.dll + 2006-03-01 19:43:51 66,560 ----a-w C:\WINDOWS\system32\mtxclu.dll - 2004-08-19 23:09:35 90,112 ----a-w C:\WINDOWS\system32\mtxoci.dll + 2006-03-01 19:43:51 91,136 ----a-w C:\WINDOWS\system32\mtxoci.dll + 2006-12-22 12:02:36 6,144 ----a-w C:\WINDOWS\system32\mui\[u]0[/u]409\mscorees.dll - 2004-08-19 23:09:35 332,288 ----a-w C:\WINDOWS\system32\netapi32.dll + 2006-08-17 12:29:49 332,288 ----a-w C:\WINDOWS\system32\netapi32.dll - 2004-08-19 23:09:36 198,144 ----a-w C:\WINDOWS\system32\netman.dll + 2005-08-22 18:35:10 197,632 ----a-w C:\WINDOWS\system32\netman.dll + 2006-06-28 16:59:26 24,576 ------w C:\WINDOWS\system32\nlsdl.dll + 2006-06-29 07:05:44 23,552 ------w C:\WINDOWS\system32\normaliz.dll - 2004-08-19 23:04:18 2,058,880 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe + 2007-02-28 16:02:36 2,059,648 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe - 2004-08-19 23:04:35 2,183,040 ----a-w C:\WINDOWS\system32\ntoskrnl.exe + 2007-02-28 16:02:36 2,182,400 ----a-w C:\WINDOWS\system32\ntoskrnl.exe - 2004-08-19 23:09:36 147,968 ----a-w C:\WINDOWS\system32\nwprovau.dll + 2006-10-13 12:36:55 145,920 ----a-w C:\WINDOWS\system32\nwprovau.dll - 2004-08-19 23:09:36 97,280 ----a-w C:\WINDOWS\system32\occache.dll + 2007-10-10 23:49:45 102,400 ------w C:\WINDOWS\system32\occache.dll - 2004-08-19 23:09:36 1,281,024 ----a-w C:\WINDOWS\system32\ole32.dll + 2005-07-26 04:40:00 1,284,608 ----a-w C:\WINDOWS\system32\ole32.dll - 2004-08-19 23:09:36 553,472 ----a-w C:\WINDOWS\system32\oleaut32.dll + 2007-05-17 11:29:50 549,376 ----a-w C:\WINDOWS\system32\oleaut32.dll - 2001-08-28 12:00:00 69,120 ----a-w C:\WINDOWS\system32\olecli32.dll + 2005-07-26 04:40:00 75,264 ----a-w C:\WINDOWS\system32\olecli32.dll - 2001-08-28 12:00:00 34,304 ----a-w C:\WINDOWS\system32\olecnv32.dll + 2005-07-26 04:40:00 37,888 ----a-w C:\WINDOWS\system32\olecnv32.dll - 2001-08-28 12:00:00 119,808 ----a-w C:\WINDOWS\system32\oledlg.dll + 2006-10-16 16:16:00 124,928 ----a-w C:\WINDOWS\system32\oledlg.dll - 2007-12-26 12:55:31 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-12-27 19:01:50 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-12-26 12:55:31 63,614 ----a-w C:\WINDOWS\system32\perfc00C.dat + 2007-12-27 19:01:50 63,614 ----a-w C:\WINDOWS\system32\perfc00C.dat - 2007-12-26 12:55:31 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-12-27 19:01:50 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-12-26 12:55:31 445,016 ----a-w C:\WINDOWS\system32\perfh00C.dat + 2007-12-27 19:01:50 445,016 ----a-w C:\WINDOWS\system32\perfh00C.dat - 2004-08-19 23:09:37 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2007-08-13 17:36:12 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll - 2004-08-19 23:09:39 1,440,768 ----a-w C:\WINDOWS\system32\query.dll + 2006-06-22 05:13:46 1,440,768 ----a-w C:\WINDOWS\system32\query.dll - 2004-08-19 23:09:39 8,192 ----a-w C:\WINDOWS\system32\rasadhlp.dll + 2006-06-26 17:41:32 8,192 ----a-w C:\WINDOWS\system32\rasadhlp.dll - 2004-08-19 23:09:39 174,080 ----a-w C:\WINDOWS\system32\rasmans.dll + 2006-06-22 10:48:06 181,248 ----a-w C:\WINDOWS\system32\rasmans.dll - 2004-08-19 23:09:39 431,616 ----a-w C:\WINDOWS\system32\riched20.dll + 2006-11-27 14:55:31

dearmrman · Answer

la suite :



+ 2006-11-27 14:55:31	433,152	----a-w	C:\WINDOWS\system32iched20.dll
- 2004-08-19 23:09:39	581,120	----a-w	C:\WINDOWS\system32pcrt4.dll
+ 2007-07-09 13:11:46	584,192	----a-w	C:\WINDOWS\system32pcrt4.dll
- 2004-08-19 23:09:39	395,776	----a-w	C:\WINDOWS\system32pcss.dll
+ 2005-07-26 04:40:00	397,824	----a-w	C:\WINDOWS\system32pcss.dll
- 2004-08-19 23:09:39	144,896	----a-w	C:\WINDOWS\system32\schannel.dll
+ 2007-04-25 14:22:35	144,896	----a-w	C:\WINDOWS\system32\schannel.dll
- 2004-08-19 23:09:40	1,483,776	----a-w	C:\WINDOWS\system32\shdocvw.dll
+ 2007-10-11 06:13:40	1,495,040	----a-w	C:\WINDOWS\system32\shdocvw.dll
- 2004-08-19 23:09:40	8,440,320	----a-w	C:\WINDOWS\system32\shell32.dll
+ 2007-10-25 16:43:25	8,516,608	----a-w	C:\WINDOWS\system32\shell32.dll
- 2004-08-19 23:09:40	474,112	----a-w	C:\WINDOWS\system32\shlwapi.dll
+ 2007-10-11 06:13:41	474,624	----a-w	C:\WINDOWS\system32\shlwapi.dll
- 2004-08-19 23:09:40	135,168	----a-w	C:\WINDOWS\system32\shsvcs.dll
+ 2006-12-19 21:49:47	135,168	----a-w	C:\WINDOWS\system32\shsvcs.dll
- 2004-08-19 23:10:03	57,856	----a-w	C:\WINDOWS\system32\spoolsv.exe
+ 2005-06-10 23:53:32	57,856	----a-w	C:\WINDOWS\system32\spoolsv.exe
- 2004-08-19 23:09:44	96,768	----a-w	C:\WINDOWS\system32\srvsvc.dll
+ 2004-12-07 19:34:00	96,768	----a-w	C:\WINDOWS\system32\srvsvc.dll
- 2004-08-19 23:09:45	246,302	----a-w	C:\WINDOWS\system32\strmdll.dll
+ 2006-08-24 12:19:40	246,814	----a-w	C:\WINDOWS\system32\strmdll.dll
- 2004-08-19 23:09:45	716,800	----a-w	C:\WINDOWS\system32\sxs.dll
+ 2006-10-20 01:38:44	716,800	----a-w	C:\WINDOWS\system32\sxs.dll
- 2004-08-19 23:09:45	210,432	----a-w	C:\WINDOWS\system32	2embed.dll
+ 2005-10-17 21:21:08	118,272	----a-w	C:\WINDOWS\system32	2embed.dll
- 2004-08-19 23:09:46	246,272	----a-w	C:\WINDOWS\system32	apisrv.dll
+ 2005-07-08 16:28:58	249,344	----a-w	C:\WINDOWS\system32	apisrv.dll
- 2004-08-19 23:10:03	77,824	----a-w	C:\WINDOWS\system32	elnet.exe
+ 2005-05-11 02:30:03	78,336	----a-w	C:\WINDOWS\system32	elnet.exe
- 2004-08-19 23:09:46	101,376	----a-w	C:\WINDOWS\system32	xflog.dll
+ 2005-07-26 04:40:00	101,376	----a-w	C:\WINDOWS\system32	xflog.dll
+ 2007-11-13 11:31:11	60,416	------w	C:\WINDOWS\system32	zchange.exe
- 2004-08-19 23:09:46	119,808	----a-w	C:\WINDOWS\system32\umpnpmgr.dll
+ 2005-08-23 03:39:36	124,928	----a-w	C:\WINDOWS\system32\umpnpmgr.dll
- 2004-08-19 23:09:46	185,344	----a-w	C:\WINDOWS\system32\upnphost.dll
+ 2007-02-05 20:19:06	185,344	----a-w	C:\WINDOWS\system32\upnphost.dll
- 2004-08-19 23:09:46	37,888	----a-w	C:\WINDOWS\system32\url.dll
+ 2007-10-10 23:49:45	105,984	----a-w	C:\WINDOWS\system32\url.dll
- 2004-08-19 23:09:46	603,136	----a-w	C:\WINDOWS\system32\urlmon.dll
+ 2007-10-10 23:49:45	1,159,680	----a-w	C:\WINDOWS\system32\urlmon.dll
- 2004-08-19 23:09:46	578,048	----a-w	C:\WINDOWS\system32\user32.dll
+ 2007-03-08 15:37:50	578,560	----a-w	C:\WINDOWS\system32\user32.dll
- 2004-08-19 23:09:46	417,792	----a-w	C:\WINDOWS\system32\vbscript.dll
+ 2007-08-13 17:54:10	413,696	----a-w	C:\WINDOWS\system32\vbscript.dll
+ 2006-03-17 00:38:01	28,672	------w	C:\WINDOWS\system32\verclsid.exe
- 2004-08-19 23:09:47	49,152	----a-w	C:\WINDOWS\system32\wdigest.dll
+ 2006-03-24 04:37:52	49,152	----a-w	C:\WINDOWS\system32\wdigest.dll
- 2004-08-19 23:09:47	281,600	----a-w	C:\WINDOWS\system32\webcheck.dll
+ 2007-10-10 23:49:45	232,960	----a-w	C:\WINDOWS\system32\webcheck.dll
- 2004-08-19 23:09:47	67,584	----a-w	C:\WINDOWS\system32\webclnt.dll
+ 2006-01-04 03:35:11	68,096	----a-w	C:\WINDOWS\system32\webclnt.dll
- 2004-08-19 23:09:47	333,824	----a-w	C:\WINDOWS\system32\wiaservc.dll
+ 2006-12-19 18:17:50	334,336	----a-w	C:\WINDOWS\system32\wiaservc.dll
- 2004-08-19 23:00:55	1,836,032	----a-w	C:\WINDOWS\system32\win32k.sys
+ 2007-03-08 15:33:58	1,843,712	----a-w	C:\WINDOWS\system32\win32k.sys
+ 2007-08-13 17:45:16	206,336	------w	C:\WINDOWS\system32\WinFXDocObj.exe
- 2004-08-19 23:09:47	660,480	----a-w	C:\WINDOWS\system32\wininet.dll
+ 2007-10-10 23:49:45	824,832	----a-w	C:\WINDOWS\system32\wininet.dll
- 2004-08-19 23:09:47	291,328	----a-w	C:\WINDOWS\system32\winsrv.dll
+ 2007-03-17 13:44:47	293,376	----a-w	C:\WINDOWS\system32\winsrv.dll
- 2004-08-19 23:09:47	132,096	----a-w	C:\WINDOWS\system32\wkssvc.dll
+ 2006-08-17 12:29:49	132,096	----a-w	C:\WINDOWS\system32\wkssvc.dll
- 2004-08-10 22:41:20	5,550,080	----a-w	C:\WINDOWS\system32\wmp.dll
+ 2007-04-30 07:20:24	5,537,792	----a-w	C:\WINDOWS\system32\wmp.dll
- 2004-10-11 09:20:36	2,362,104	----a-w	C:\WINDOWS\system32\wmvcore.dll
+ 2006-12-07 06:40:49	2,362,184	----a-w	C:\WINDOWS\system32\wmvcore.dll
+ 2006-07-14 15:51:51	121,856	------w	C:\WINDOWS\system32\xmllite.dll
- 2004-08-19 23:09:49	11,776	----a-w	C:\WINDOWS\system32\xolehlp.dll
+ 2006-03-01 19:43:51	11,776	----a-w	C:\WINDOWS\system32\xolehlp.dll
+ 2007-10-29 15:07:16	369,152	----a-w	C:\WINDOWS\system32\xpsp3res.dll
+ 2007-05-08 14:06:44	1,275,392	----a-w	C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9a\msxml4.dll
+ 2007-01-19 12:51:03	74,802	----a-w	C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\atl.dll
+ 2007-01-19 12:51:04	995,383	----a-w	C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\mfc42.dll
+ 2007-01-19 12:51:04	1,011,774	----a-w	C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\mfc42u.dll
+ 2007-01-19 12:51:04	401,462	----a-w	C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\msvcp60.dll
+ 2006-08-25 15:51:12	1,054,208	----a-w	C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{851013FE-ECC2-472B-9D3E-5ED106DBEB66}]
2007-12-24 16:34	314784	--a------	C:\WINDOWS\System32\jkhfd.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-04-20 08:57]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-05 06:51]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-20 00:10 C:\WINDOWS\system32undll32.exe]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-02-22 12:08]
"eCarteBleue-CLEO"="C:\Program Files\ECB-CLEO.exe" [2006-02-07 09:07]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41]
"Symantec PIF AlertEng"="C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 09:22]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-20 00:10 C:\WINDOWS\system32undll32.exe]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages	REG_MULTI_SZ   	msv1_0 C:\WINDOWS\System32\jkhfd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk
backup=C:\WINDOWS\pss\Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^hervé^Menu Démarrer^Programmes^Démarrage^PowerReg Scheduler.exe]
path=C:\Documents and Settings\hervé\Menu Démarrer\Programmes\Démarrage\PowerReg Scheduler.exe
backup=C:\WINDOWS\pss\PowerReg Scheduler.exeStartup
			
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2006-07-01 12:12	61440	--a------	C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
			
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cloneur Expert Monitor]
2006-07-01 12:12	437675	--a------	C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe
			
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer]
2005-03-31 08:30	1106944	--a------	C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe
			
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
			C:\Program Files\Messenger\msmsgs.exe /background
			
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg
wiz]
			nwiz.exe /install
			
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
			C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
			
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
			C:\Program Files\QuickTime\qttask.exe -atboottime
			
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioAudioCentral]
2003-02-26 15:50	253952	--a------	C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
			
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2003-02-27 03:36	757760	--a------	C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
			
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioEngineUtility]
2007-12-29 14:01	65536	--a------	C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe
			
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2001-07-03 08:11	57344	--a------	C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
			
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-09-25 01:11	132496	--a------	C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
			
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-06-05 06:51	68856	--a------	C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

R0 snapman;Acronis Snapshots Manager;C:\WINDOWS\system32\DRIVERS\snapman.sys [2006-07-01 12:12]
R0 timounter;Acronis TrueImage Backup Archive Explorer;C:\WINDOWS\system32\DRIVERS	imntr.sys [2006-07-01 12:12]
R2 Crypto;Crypto;C:\WINDOWS\system32\drivers\Crypto.sys [2004-07-30 12:20]
R2 IPSECDRV;SafeNet IPSec Plugin;C:\WINDOWS\System32\Drivers\IPSECDRV.sys [2004-08-11 11:01]
R2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2006-08-03 16:29]
R2 tifsfilter;Acronis TrueImage FS Filter;C:\WINDOWS\system32\DRIVERS	ifsfilt.sys [2006-07-01 12:12]
R3 DniVap;SafeNet WAN Miniport (VA);C:\WINDOWS\system32\DRIVERS\vap.sys [2001-12-14 15:26]
R3 ham50;Creatix V.90 HAM Data Fax Modem;C:\WINDOWS\system32\DRIVERS\CTXH51.sys [2001-08-04 06:50]
S3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;C:\WINDOWS\system32\DRIVERS\WlanUIG.sys [2004-09-02 22:18]

*Newly Created Service* - COMHOST 
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-12-28 21:26:34 C:\WINDOWS\Tasks\Norton AntiVirus - Effectuer une analyse complète du système - hervé.job"
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-29 14:30:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully 
hidden files: 0 

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes --------------------- 

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\WINDOWS\System32\jkhfd.dll
.
Completion time: 2007-12-29 14:35:07 - machine was rebooted
.
2007-12-28 02:02:19	--- E O F ---

Lenteur voire plantage apres trojan vundo

32 réponses

Votre réponse

Discussions similaires

Newsletters