Infecter par virusheat , SOS !!!

jojo51 -  
Bonjour,
j'aurais besoin d'aide pour supprimer "virus heat"
car depuis un bon bout de temps je n'allume plus beaucoup mon ordi à cause des probleme et si mon pere le decouvre je vais encore me faire "&!(,-°]" et j'ai que 12 ans donc je ne connais pratiquement rien a l'informatique.
donc si quelqu'un peut m'aider
se serait sympa !!

merci d'avance !
Configuration: Windows XP
Internet Explorer 6.0

43 réponses

Résumé de la discussion

La problématique porte sur la suppression du malware appelé 'virus heat' sur un ordinateur fonctionnant sous Windows XP et Internet Explorer 6, l'utilisateur étant mineur et recherchant une aide fiable. Plusieurs réponses évoquent l'utilisation de HijackThis pour identifier et corriger des entrées de démarrage, de toolbar et de modules complémentaires, afin d'éliminer les éléments indésirables et sécuriser le système. Des tutoriels recommandent ensuite un outil anti-malware comme Malwarebytes Anti-Malware, avec des précautions telles que la désactivation d'Internet Explorer pendant la suppression et la sauvegarde du rapport pour vérification. En cas de résultats partiels, les conseils recommandent de répéter le scan et de nettoyer les éléments détectés, tout en restant vigilant face à d'éventuels redéploiements malveillants.

Bobot (l’IA à votre service)
  1. g!rly Contributeur
    salut,

    Télécharge HijackThis ici :

    -> http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

    Tutoriel d´instalation : (Merci a Balltrap34 pour cette réalisation)

    -> http://pageperso.aol.fr/balltrap34/Hijenr.gif

    Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

    -> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

    Post le rapport généré ici stp...

    @+
    0
    1. jojo51
      voila mon rapport

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 10:55:41, on 24/03/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\drivers\CDAC11BA.EXE
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\SOUNDMAN.EXE
      C:\WINDOWS\system32\VTTimer.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\WINDOWS\osd.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\WINDOWS\system32\Rundll32.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
      O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: {0ddd38e9-7de1-bd39-e554-d63dfca13005} - {50031acf-d36d-455e-93db-1ed79e83ddd0} - C:\WINDOWS\system32\dwmsfcwq.dll
      O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O2 - BHO: (no name) - {71D126D0-C787-40DD-8AEA-CC0AAA0DB357} - (no file)
      O2 - BHO: (no name) - {8E1DB2B5-D02A-4082-A650-345857F03206} - C:\WINDOWS\system32\byxyabb.dll (file missing)
      O2 - BHO: (no name) - {8F10DE2B-E923-4548-B524-4D9C5FA80777} - (no file)
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
      O2 - BHO: (no name) - {DC2884B2-40CA-44CC-A38A-963AE5B35C7A} - (no file)
      O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
      O3 - Toolbar: (no name) - {98828DED-A591-462F-83BA-D2F62A68B8B8} - (no file)
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
      O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
      O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [OSD] C:\WINDOWS\osd.exe
      O4 - HKLM\..\Run: [Glass2k] C:\WINDOWS\Resources\Themes\VistaXP\glass\Glass2k.exe
      O4 - HKLM\..\Run: [VisualTooltip] C:\WINDOWS\Resources\Themes\VistaXP\vt\VisualToolTip.exe
      O4 - HKLM\..\Run: [48813152] rundll32.exe "C:\WINDOWS\system32\ywfnqvab.dll",b
      O4 - HKLM\..\Run: [BM4bb202ce] Rundll32.exe "C:\WINDOWS\system32\mmbculfo.dll",s
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2454111 14
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
      O4 - HKCU\..\Run: [Yahoo! Pager] ~c:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
      O4 - HKCU\..\Run: [Yodm3D] C:\WINDOWS\Resources\Themes\VistaXP\y3d\Yodm3D.exe
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O14 - IERESET.INF: START_PAGE_URL=https://www.google.com/?gws_rd=ssl
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
      O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
      O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
      O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      0
      1. g!rly Contributeur
        Salut jojo51,

        Tu as de jolies infections ;-(

        Il va faloir utiliser un logiciel puissant pour en venir a bout; alors lie bien les instructions que je vais te donner avant de te lancer :

        Je te dis cela car tu dis avoir douze ans; mais si tu suis a la lettre les instructions il ne devrais pas avoir de soucis >

        regarde egalement le tutoriel sur le lien en bas de page ;-)

        Voici le logiciel que l´on va utiliser : Combofix.

        Télécharge combofix.exe (par sUBs) sur ton Bureau.

        -> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

        -> Double clique combofix.exe.
        -> Tape sur la touche 1 (Yes) pour démarrer le scan.
        -> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

        NOTE : Le rapport se trouve également ici : C:\Combofix.txt

        Avant d'utiliser ComboFix :

        -> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

        -> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

        Une fois fait, sur ton bureau double-clic sur Combofix.exe.

        - Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

        /!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

        - En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

        - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

        -> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

        -> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message ainsi qu´un nouveau rapport hijack this.

        -> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

        Ps : Si tu ne comprends pas quelque chose, demande moi avant de debuter ;-)

        @+
        0
        1. jojo51
          j'ai bien suivit lezs instructions et voila ce que ça a donner

          ComboFix 08-03-22.3 - maison 2008-03-24 20:11:01.4 - NTFSx86
          Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.269 [GMT 1:00]
          Endroit: C:\Documents and Settings\maison\Bureau\ComboFix.exe

          [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
          .
          TimedOut: progfile.dat
          -- Other TimeOuts --
          Findstr -MIF:/ "\\TTC\.pdb InsertAdvertisement"
          GREP -i "C:\\Program Files\\[^\\]*\\[^\\]*$"
          VFind -tf -s282624 "C:\Program Files\????????*[0-9].dll"
          CF15802.exe /c " VFind.exe -ltf -s-1000000 -d+2007-12-24 "C:\Program Files\*" >progfile.dat"
          VFind.exe -ltf -s-1000000 -d+2007-12-24 "C:\Program Files\*"
          CF15802.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot"

          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          ---- Previous Run -------
          .
          C:\Program Files\Helper
          C:\WINDOWS\BM4bb202ce.xml
          C:\WINDOWS\cookies.ini
          C:\WINDOWS\pskt.ini
          C:\WINDOWS\system32\abadd.ini
          C:\WINDOWS\system32\abadd.ini2
          C:\WINDOWS\system32\aoxhkpyc.dll
          C:\WINDOWS\system32\bavqnfwy.ini
          C:\WINDOWS\system32\dfqhjwcv.ini
          C:\WINDOWS\system32\dwmsfcwq.dll
          C:\WINDOWS\system32\ernhwcbl.dll
          C:\WINDOWS\system32\gaqaljhs.ini
          C:\WINDOWS\system32\heevhpop.dll
          C:\WINDOWS\system32\ifqhwrav.dll
          C:\WINDOWS\system32\mmbculfo.dll
          C:\WINDOWS\system32\ncasdfsj.dll
          C:\WINDOWS\system32\opqss.ini
          C:\WINDOWS\system32\opqss.ini2
          C:\WINDOWS\system32\rkkwgsvm.dll
          C:\WINDOWS\system32\shjlaqag.dll
          C:\WINDOWS\system32\vcwjhqfd.dll
          C:\WINDOWS\system32\yosututn.dll
          C:\WINDOWS\system32\ywfnqvab.dll

          .
          ((((((((((((((((((((((((((((( Fichiers créés 2008-02-24 to 2008-03-24 ))))))))))))))))))))))))))))))))))))
          .

          2008-03-24 11:39 . 2008-03-24 11:40 <REP> d-------- C:\Program Files\Babylon
          2008-03-24 11:39 . 2008-03-24 11:41 <REP> d-------- C:\Documents and Settings\maison\Application Data\Babylon
          2008-03-24 11:39 . 2008-03-24 11:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Babylon
          2008-03-24 10:52 . 2008-03-24 10:52 <REP> d-------- C:\Program Files\Trend Micro
          2008-03-23 21:24 . 2008-03-23 21:24 <REP> d-------- C:\Program Files\Enigma Software Group
          2008-03-22 19:31 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
          2008-03-22 19:31 . 2008-03-22 19:31 3,120 --a------ C:\WINDOWS\system32\118290.54
          2008-03-22 19:31 . 2008-03-22 19:31 3,120 --a------ C:\WINDOWS\118294.78
          2008-03-22 19:31 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
          2008-03-20 15:22 . 2008-03-20 15:22 <REP> d-------- C:\Program Files\Fichiers communs\iS3
          2008-03-20 15:22 . 2008-03-23 21:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
          2008-03-20 15:22 . 2008-03-22 13:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SITEguard
          2008-03-09 21:47 . 2008-03-09 21:47 <REP> d-------- C:\Documents and Settings\maison\Application Data\dBpoweramp
          2008-03-09 21:39 . 2008-03-09 21:39 <REP> d-------- C:\Program Files\Illustrate
          2008-03-09 21:39 . 2008-03-09 21:43 <REP> d-------- C:\Documents and Settings\maison\Application Data\AccurateRip
          2008-03-09 21:39 . 2008-03-09 21:38 4,230,520 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
          2008-03-09 21:39 . 2008-03-09 21:39 33,846 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Music Converter.bmp
          2008-03-09 21:39 . 2008-03-09 21:39 12,896 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Music Converter.dat
          2008-03-07 18:03 . 2008-03-07 18:03 2,496 --a------ C:\WINDOWS\system32\tmp.reg
          2008-03-07 18:02 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
          2008-03-07 18:02 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
          2008-03-07 18:02 . 2008-03-01 23:12 86,016 --a------ C:\WINDOWS\system32\VACFix.exe
          2008-03-07 18:02 . 2008-03-05 22:29 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
          2008-03-07 18:02 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
          2008-03-07 18:02 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
          2008-03-07 18:02 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
          2008-03-05 20:13 . 2008-03-05 20:13 <REP> d-------- C:\Program Files\Audacity
          2008-03-05 16:51 . 2008-03-05 20:08 <REP> d-------- C:\Program Files\Any Audio Converter
          2008-03-03 19:01 . 2008-03-03 19:03 <REP> d-------- C:\ComboFix[1]
          2008-03-02 12:02 . 2008-03-02 12:03 <REP> d-------- C:\Documents and Settings\All Users\Application Data\YoYoGames
          2008-03-02 11:34 . 2008-03-02 11:34 <REP> d-------- C:\Documents and Settings\maison\Application Data\Yahoo! Messenger
          2008-02-28 16:15 . 2008-02-28 16:15 <REP> d-------- C:\Program Files\Sotfone
          2008-02-28 16:15 . 2008-03-09 17:53 54,156 --ah----- C:\WINDOWS\QTFont.qfn
          2008-02-28 16:15 . 2008-02-28 16:15 1,409 --a------ C:\WINDOWS\QTFont.for
          2008-02-27 17:36 . 2008-02-27 19:46 <REP> d-------- C:\Program Files\BitComet

          .
          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2008-03-22 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
          2008-02-13 10:48 --------- d-----w C:\Program Files\CamStudio
          2008-02-13 10:32 --------- d-----w C:\Program Files\t@b
          2008-02-13 10:29 --------- d-----w C:\Program Files\BoontyGames
          2008-02-13 09:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
          2008-02-13 08:47 --------- d-----w C:\Program Files\Spybot - Search & Destroy
          2008-02-12 22:09 691,545 ----a-w C:\WINDOWS\unins000.exe
          2008-02-11 21:05 --------- d-----w C:\Program Files\Magic Karaoke Maker
          2008-02-11 10:08 --------- d-----w C:\Program Files\PhotoFiltre
          2008-02-09 20:47 --------- d-----w C:\Program Files\IdolMusicStar
          2008-02-09 20:43 --------- d-----w C:\Program Files\GStudio6
          2008-02-09 20:42 407,047 ----a-w C:\WINDOWS\system32\mioengine.exe
          2008-02-09 20:42 --------- d-----w C:\Program Files\Mioplanet
          2008-02-09 20:27 --------- d-----w C:\Documents and Settings\maison\Application Data\gtk-2.0
          2008-02-06 14:22 20,344 ----a-w C:\Documents and Settings\maison\Application Data\GDIPFONTCACHEV1.DAT
          2008-02-03 18:29 --------- d-----w C:\Program Files\Disney Imagineering
          2008-02-02 19:26 --------- d-----w C:\Program Files\Team MediaPortal
          2008-01-31 15:31 --------- d-----w C:\Program Files\Compil Games
          2007-05-02 11:34 92,064 -c--a-w C:\Documents and Settings\maison\mqdmmdm.sys
          2007-05-02 11:34 9,232 -c--a-w C:\Documents and Settings\maison\mqdmmdfl.sys
          2007-05-02 11:34 79,328 -c--a-w C:\Documents and Settings\maison\mqdmserd.sys
          2007-05-02 11:34 66,656 -c--a-w C:\Documents and Settings\maison\mqdmbus.sys
          2007-05-02 11:34 6,208 -c--a-w C:\Documents and Settings\maison\mqdmcmnt.sys
          2007-05-02 11:34 5,936 -c--a-w C:\Documents and Settings\maison\mqdmwhnt.sys
          2007-05-02 11:34 4,048 -c--a-w C:\Documents and Settings\maison\mqdmcr.sys
          2007-05-02 11:34 25,600 -c--a-w C:\Documents and Settings\maison\usbsermptxp.sys
          2007-05-02 11:34 22,768 -c--a-w C:\Documents and Settings\maison\usbsermpt.sys
          .

          ((((((((((((((((((((((((((((( snapshot@2008-03-04_20.09.47.17 )))))))))))))))))))))))))))))))))))))))))
          .
          + 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
          - 2008-02-13 23:33:10 167,936 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\accicons.exe
          + 2008-03-23 20:13:55 167,936 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\accicons.exe
          - 2008-02-13 23:33:10 34,304 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\misc.exe
          + 2008-03-23 20:13:54 34,304 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\misc.exe
          - 2008-02-13 23:33:10 8,192 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\mspicons.exe
          + 2008-03-23 20:13:55 8,192 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\mspicons.exe
          - 2008-02-13 23:33:10 3,584 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\opwicon.exe
          + 2008-03-23 20:13:55 3,584 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\opwicon.exe
          - 2008-02-13 23:33:10 114,688 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\outicon.exe
          + 2008-03-23 20:13:55 114,688 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\outicon.exe
          - 2008-02-13 23:33:10 16,384 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\PEicons.exe
          + 2008-03-23 20:13:55 16,384 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\PEicons.exe
          - 2008-02-13 23:33:10 30,720 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\pptico.exe
          + 2008-03-23 20:13:55 30,720 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\pptico.exe
          - 2008-02-13 23:33:10 22,528 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\unbndico.exe
          + 2008-03-23 20:13:55 22,528 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\unbndico.exe
          - 2008-02-13 23:33:10 45,056 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\wordicon.exe
          + 2008-03-23 20:13:54 45,056 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\wordicon.exe
          - 2008-02-13 23:33:10 90,112 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\xlicons.exe
          + 2008-03-23 20:13:54 90,112 ----a-r C:\WINDOWS\Installer\{9011040C-6000-11D3-8CFE-0050048383C9}\xlicons.exe
          - 2007-01-10 21:07:24 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
          + 2008-03-22 12:57:18 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
          - 2007-01-10 21:07:24 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
          + 2008-03-22 12:57:18 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
          - 2007-01-10 21:07:24 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
          + 2008-03-22 12:57:18 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
          + 2007-06-13 13:10:53 84,480 ----a-w C:\WINDOWS\system32\kdjgq.exe
          - 2007-03-15 16:19:28 1,476,992 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll
          + 2007-10-11 13:12:48 1,468,968 ----a-w C:\WINDOWS\system32\LegitCheckControl.DLL
          - 2008-02-04 23:09:46 18,214,008 ----a-w C:\WINDOWS\system32\MRT.exe
          + 2008-03-05 16:30:54 19,148,408 ----a-w C:\WINDOWS\system32\MRT.exe
          + 2004-08-03 23:54:38 134,656 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\PS5UI.DLL
          + 2004-08-03 23:54:38 464,384 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\PSCRIPT5.DLL
          + 2008-03-05 12:38:02 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_580.dat
          .
          -- Snapshot reset to current date --
          .
          ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          REGEDIT4
          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
          "fsc-reminder.exe"="C:\WINDOWS\reminder\fsc-reminder.exe" [2005-01-19 17:10 28672]
          "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
          "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-20 19:45 68856]
          "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 15:53 73840]
          "Yahoo! Pager"="~c:\Program Files\Yahoo!\Messenger\ypager.exe" [ ]
          "Yodm3D"="C:\WINDOWS\Resources\Themes\VistaXP\y3d\Yodm3D.exe" [2007-06-26 19:26 2058752]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "SoundMan"="SOUNDMAN.EXE" [2006-08-03 04:12 577536 C:\WINDOWS\SOUNDMAN.EXE]
          "VTTimer"="VTTimer.exe" [2005-03-08 02:33 53248 C:\WINDOWS\system32\VTTimer.exe]
          "VTTrayp"="VTtrayp.exe" [2006-05-09 08:21 176128 C:\WINDOWS\system32\VTTrayp.exe]
          "Muscbrigade"="c:\Musicbrigade\Musicbrigade.exe" [2005-12-22 09:26 40960]
          "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
          "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-01-27 00:07 5529600]
          "nwiz"="nwiz.exe" [2005-01-27 00:07 1490944 C:\WINDOWS\system32\nwiz.exe]
          "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-01-27 00:07 86016]
          "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-03-22 15:58 98304]
          "OSD"="C:\WINDOWS\osd.exe" [2007-01-21 20:50 86016]
          "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 15:53 73840]
          "Glass2k"="C:\WINDOWS\Resources\Themes\VistaXP\glass\Glass2k.exe" [2007-07-14 05:31 56325]
          "VisualTooltip"="C:\WINDOWS\Resources\Themes\VistaXP\vt\VisualToolTip.exe" [2007-04-25 09:45 956928]

          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
          "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
          "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-20 19:45 68856]

          C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
          Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
          Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04 83360]

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
          "%windir%\\system32\\sessmgr.exe"=
          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
          "C:\\Program Files\\i-voyager46\\Scol.exe"=
          "C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
          "C:\\Program Files\\Messenger\\msmsgs.exe"=
          "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
          "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
          "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
          "C:\\Program Files\\Fichiers communs\\PocketSoft\\RTPatch\\AutoRTP\\artpschd.exe"=
          "C:\\Program Files\\GIMP-2.0\\lib\\gimp\\2.0\\plug-ins\\script-fu.exe"=
          "C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
          "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
          "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
          "23006:TCP"= 23006:TCP:BitComet 23006 TCP
          "23006:UDP"= 23006:UDP:BitComet 23006 UDP

          R3 ovt530;Webcam Deluxe;C:\WINDOWS\system32\Drivers\ov530vid.sys [2005-03-15 17:04]
          S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-01-27 19:15]
          S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

          .
          **************************************************************************

          catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-03-24 20:14:23
          Windows 5.1.2600 Service Pack 2 NTFS

          Balayage processus cachés ...

          Balayage caché autostart entries ...

          Balayage des fichiers cachés ...

          Scan terminé avec succès
          Les fichiers cachés: 0

          **************************************************************************
          .
          --------------------- DLLs a chargé sous des processus courants ---------------------

          PROCESS: C:\WINDOWS\explorer.exe
          -> C:\Program Files\Hercules\WebCam Station\PhotoImpression\share\pihook.dll
          .
          Temps d'accomplissement: 2008-03-24 20:15:45
          ComboFix-quarantined-files.txt 2008-03-24 19:15:43
          ComboFix2.txt 2008-03-04 19:10:11
          .
          2008-03-23 20:13:58 --- E O F ---

          merci encore g!rly
          mais maintenant je ne serait pas connecter avant demain
          0
          2. g!rly Contributeur
            bonsoir jojo51,

            ok pour combofix ;-)

            dis moi ce que tu pensse de ca :

            A propos de Boonty games

            Utilises tu des jeux de boonty games depuis longtemps ?

            Voici une petite information sur Boonty games

            Leur politique :

            "Il se peut que nous partageons aussi des informations payantes avec des tiers
            qui fournissent des services payants et partage des données regroupées montrant le type
            et le nombre de jeux vidéos que vous téléchargez, votre age, votre sexe, vos occupations,
            niveau d'éducation, localité géographique, données sur l'équipement de votre ordinateur,
            internet et intérêts pour les jeux vidéos, activités et entraînement des jeux édités.
            De plus, nous partageons les adresses email avec des tiers fournisseurs de compte mails
            qui nous assistent en envoyant nos mails a de nombreux clients en même temps..."

            Si tu es d'accord avec eux, pas de problèmes sinon...

            post un nouveau rapport hijack this stp

            @+
            0
            1. jojo51
              je connais ce site mais c'est mon cousin qui est allé dessus
              bref... sinon oui je suis d'accord avec eux
              0
              1. g!rly Contributeur
                salut jojo51,

                ok donc tu veux le garder et leur divulguer tes infos ?

                post un nouveau rapport hijack this stp

                @+
                0
                1. jojo51
                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 17:49, on 2008-03-25
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                  Boot mode: Normal

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                  C:\WINDOWS\system32\nvsvc32.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  C:\Program Files\Windows Live\Messenger\usnsvc.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\WINDOWS\SOUNDMAN.EXE
                  C:\WINDOWS\system32\VTTimer.exe
                  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  C:\Program Files\QuickTime\qttask.exe
                  C:\WINDOWS\osd.exe
                  C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
                  C:\WINDOWS\Resources\Themes\VistaXP\glass\Glass2k.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
                  O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
                  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
                  O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                  O3 - Toolbar: (no name) - {98828DED-A591-462F-83BA-D2F62A68B8B8} - (no file)
                  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                  O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
                  O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
                  O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
                  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [OSD] C:\WINDOWS\osd.exe
                  O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
                  O4 - HKLM\..\Run: [Glass2k] C:\WINDOWS\Resources\Themes\VistaXP\glass\Glass2k.exe
                  O4 - HKLM\..\Run: [VisualTooltip] C:\WINDOWS\Resources\Themes\VistaXP\vt\VisualToolTip.exe
                  O4 - HKLM\..\Run: [48813152] rundll32.exe "C:\WINDOWS\system32\ywfnqvab.dll",b
                  O4 - HKLM\..\Run: [BM4bb202ce] Rundll32.exe "C:\WINDOWS\system32\mmbculfo.dll",s
                  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2454111 14
                  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
                  O4 - HKCU\..\Run: [Yahoo! Pager] ~c:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
                  O4 - HKCU\..\Run: [Yodm3D] C:\WINDOWS\Resources\Themes\VistaXP\y3d\Yodm3D.exe
                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                  O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                  0
                  1. g!rly Contributeur
                    ok jojo51,

                    la suite :

                    Copie le texte ci-dessous :

                    File::
                    C:\WINDOWS\system32\kdjgq.exe
                    C:\WINDOWS\system32\mmbculfo.dll
                    C:\WINDOWS\system32\ywfnqvab.dll
                    C:\WINDOWS\system32\118290.54
                    C:\WINDOWS\118294.78

                    Folder::
                    C:\Program Files\Macrogaming

                    Registry::
                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "SweetIM"=-
                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "48813152"=-
                    "BM4bb202ce"=-

                    Ouvre le Bloc-Notes puis colle le texte copié.
                    (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
                    Sauvegarde ce fichier sous le nom de CFScript.txt.

                    Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

                    http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

                    Cela va relancer Combofix,

                    Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                    Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                    Ne touche à rien tant que le scan n'est pas terminé.

                    Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

                    S'il n'y a pas de rédémarrage, poste quand même les rapports.

                    @+
                    0
                    1. jojo51
                      ComboFix 08-03-22.3 - maison 2008-03-25 19:25:01.7 - NTFSx86
                      Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.227 [GMT 1:00]
                      Endroit: C:\Documents and Settings\maison\Bureau\ComboFix.exe

                      [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                      .

                      ((((((((((((((((((((((((((((( Fichiers créés 2008-02-25 to 2008-03-25 ))))))))))))))))))))))))))))))))))))
                      .

                      2008-03-25 17:47 . 2008-03-25 17:47 <REP> d-------- C:\Program Files\Usenet.to
                      2008-03-25 17:47 . 2008-03-25 17:48 <REP> d-------- C:\Documents and Settings\maison\Application Data\UseNeXT
                      2008-03-25 17:31 . 2008-03-25 17:31 54,156 --ah----- C:\WINDOWS\QTFont.qfn
                      2008-03-25 17:31 . 2008-03-25 17:31 1,409 --a------ C:\WINDOWS\QTFont.for
                      2008-03-24 11:39 . 2008-03-24 11:40 <REP> d-------- C:\Program Files\Babylon
                      2008-03-24 11:39 . 2008-03-24 11:41 <REP> d-------- C:\Documents and Settings\maison\Application Data\Babylon
                      2008-03-24 11:39 . 2008-03-24 11:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Babylon
                      2008-03-24 10:52 . 2008-03-24 10:52 <REP> d-------- C:\Program Files\Trend Micro
                      2008-03-23 21:24 . 2008-03-23 21:24 <REP> d-------- C:\Program Files\Enigma Software Group
                      2008-03-22 19:31 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
                      2008-03-22 19:31 . 2008-03-22 19:31 3,120 --a------ C:\WINDOWS\system32\118290.54
                      2008-03-22 19:31 . 2008-03-22 19:31 3,120 --a------ C:\WINDOWS\118294.78
                      2008-03-22 19:31 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
                      2008-03-20 15:22 . 2008-03-20 15:22 <REP> d-------- C:\Program Files\Fichiers communs\iS3
                      2008-03-20 15:22 . 2008-03-23 21:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
                      2008-03-20 15:22 . 2008-03-22 13:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SITEguard
                      2008-03-09 21:47 . 2008-03-09 21:47 <REP> d-------- C:\Documents and Settings\maison\Application Data\dBpoweramp
                      2008-03-09 21:39 . 2008-03-09 21:39 <REP> d-------- C:\Program Files\Illustrate
                      2008-03-09 21:39 . 2008-03-09 21:43 <REP> d-------- C:\Documents and Settings\maison\Application Data\AccurateRip
                      2008-03-09 21:39 . 2008-03-09 21:38 4,230,520 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
                      2008-03-07 18:03 . 2008-03-07 18:03 2,496 --a------ C:\WINDOWS\system32\tmp.reg
                      2008-03-07 18:02 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
                      2008-03-07 18:02 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
                      2008-03-07 18:02 . 2008-03-01 23:12 86,016 --a------ C:\WINDOWS\system32\VACFix.exe
                      2008-03-07 18:02 . 2008-03-05 22:29 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
                      2008-03-07 18:02 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
                      2008-03-07 18:02 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
                      2008-03-07 18:02 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
                      2008-03-05 20:13 . 2008-03-05 20:13 <REP> d-------- C:\Program Files\Audacity
                      2008-03-05 16:51 . 2008-03-05 20:08 <REP> d-------- C:\Program Files\Any Audio Converter
                      2008-03-03 19:01 . 2008-03-03 19:03 <REP> d-------- C:\ComboFix[1]
                      2008-03-02 12:02 . 2008-03-02 12:03 <REP> d-------- C:\Documents and Settings\All Users\Application Data\YoYoGames
                      2008-03-02 11:34 . 2008-03-02 11:34 <REP> d-------- C:\Documents and Settings\maison\Application Data\Yahoo! Messenger
                      2008-02-28 16:15 . 2008-02-28 16:15 <REP> d-------- C:\Program Files\Sotfone
                      2008-02-27 17:36 . 2008-02-27 19:46 <REP> d-------- C:\Program Files\BitComet

                      .
                      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      2008-03-22 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
                      2008-02-13 10:48 --------- d-----w C:\Program Files\CamStudio
                      2008-02-13 10:32 --------- d-----w C:\Program Files\t@b
                      2008-02-13 10:29 --------- d-----w C:\Program Files\BoontyGames
                      2008-02-13 09:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                      2008-02-13 08:47 --------- d-----w C:\Program Files\Spybot - Search & Destroy
                      2008-02-12 22:09 691,545 ----a-w C:\WINDOWS\unins000.exe
                      2008-02-11 21:05 --------- d-----w C:\Program Files\Magic Karaoke Maker
                      2008-02-11 10:08 --------- d-----w C:\Program Files\PhotoFiltre
                      2008-02-09 20:47 --------- d-----w C:\Program Files\IdolMusicStar
                      2008-02-09 20:43 --------- d-----w C:\Program Files\GStudio6
                      2008-02-09 20:42 407,047 ----a-w C:\WINDOWS\system32\mioengine.exe
                      2008-02-09 20:42 --------- d-----w C:\Program Files\Mioplanet
                      2008-02-09 20:27 --------- d-----w C:\Documents and Settings\maison\Application Data\gtk-2.0
                      2008-02-06 14:22 20,344 ----a-w C:\Documents and Settings\maison\Application Data\GDIPFONTCACHEV1.DAT
                      2008-02-03 18:29 --------- d-----w C:\Program Files\Disney Imagineering
                      2008-02-02 19:26 --------- d-----w C:\Program Files\Team MediaPortal
                      2008-01-31 15:31 --------- d-----w C:\Program Files\Compil Games
                      2007-05-02 11:34 92,064 -c--a-w C:\Documents and Settings\maison\mqdmmdm.sys
                      2007-05-02 11:34 9,232 -c--a-w C:\Documents and Settings\maison\mqdmmdfl.sys
                      2007-05-02 11:34 79,328 -c--a-w C:\Documents and Settings\maison\mqdmserd.sys
                      2007-05-02 11:34 66,656 -c--a-w C:\Documents and Settings\maison\mqdmbus.sys
                      2007-05-02 11:34 6,208 -c--a-w C:\Documents and Settings\maison\mqdmcmnt.sys
                      2007-05-02 11:34 5,936 -c--a-w C:\Documents and Settings\maison\mqdmwhnt.sys
                      2007-05-02 11:34 4,048 -c--a-w C:\Documents and Settings\maison\mqdmcr.sys
                      2007-05-02 11:34 25,600 -c--a-w C:\Documents and Settings\maison\usbsermptxp.sys
                      2007-05-02 11:34 22,768 -c--a-w C:\Documents and Settings\maison\usbsermpt.sys
                      .

                      ((((((((((((((((((((((((((((( snapshot_2008-03-24_20.15.35.70 )))))))))))))))))))))))))))))))))))))))))
                      .
                      + 2008-03-25 15:48:49 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_564.dat
                      .
                      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      .
                      REGEDIT4
                      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
                      "fsc-reminder.exe"="C:\WINDOWS\reminder\fsc-reminder.exe" [2005-01-19 17:10 28672]
                      "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
                      "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-20 19:45 68856]
                      "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 15:53 73840]
                      "Yahoo! Pager"="~c:\Program Files\Yahoo!\Messenger\ypager.exe" [ ]
                      "Yodm3D"="C:\WINDOWS\Resources\Themes\VistaXP\y3d\Yodm3D.exe" [2007-06-26 19:26 2058752]

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "SoundMan"="SOUNDMAN.EXE" [2006-08-03 04:12 577536 C:\WINDOWS\SOUNDMAN.EXE]
                      "VTTimer"="VTTimer.exe" [2005-03-08 02:33 53248 C:\WINDOWS\system32\VTTimer.exe]
                      "VTTrayp"="VTtrayp.exe" [2006-05-09 08:21 176128 C:\WINDOWS\system32\VTTrayp.exe]
                      "Muscbrigade"="c:\Musicbrigade\Musicbrigade.exe" [2005-12-22 09:26 40960]
                      "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
                      "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-01-27 00:07 5529600]
                      "nwiz"="nwiz.exe" [2005-01-27 00:07 1490944 C:\WINDOWS\system32\nwiz.exe]
                      "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-01-27 00:07 86016]
                      "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-03-22 15:58 98304]
                      "OSD"="C:\WINDOWS\osd.exe" [2007-01-21 20:50 86016]
                      "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 15:53 73840]
                      "Glass2k"="C:\WINDOWS\Resources\Themes\VistaXP\glass\Glass2k.exe" [2007-07-14 05:31 56325]
                      "VisualTooltip"="C:\WINDOWS\Resources\Themes\VistaXP\vt\VisualToolTip.exe" [2007-04-25 09:45 956928]
                      "48813152"="C:\WINDOWS\system32\ywfnqvab.dll" [ ]
                      "BM4bb202ce"="C:\WINDOWS\system32\mmbculfo.dll" [ ]

                      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                      "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
                      "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-20 19:45 68856]

                      C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                      Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
                      Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04 83360]

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                      "%windir%\\system32\\sessmgr.exe"=
                      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                      "C:\\Program Files\\i-voyager46\\Scol.exe"=
                      "C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
                      "C:\\Program Files\\Messenger\\msmsgs.exe"=
                      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                      "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
                      "C:\\Program Files\\Fichiers communs\\PocketSoft\\RTPatch\\AutoRTP\\artpschd.exe"=
                      "C:\\Program Files\\GIMP-2.0\\lib\\gimp\\2.0\\plug-ins\\script-fu.exe"=
                      "C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
                      "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
                      "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                      "23006:TCP"= 23006:TCP:BitComet 23006 TCP
                      "23006:UDP"= 23006:UDP:BitComet 23006 UDP

                      R3 ovt530;Webcam Deluxe;C:\WINDOWS\system32\Drivers\ov530vid.sys [2005-03-15 17:04]
                      S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-01-27 19:15]
                      S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

                      .
                      **************************************************************************

                      catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                      Rootkit scan 2008-03-25 19:26:51
                      Windows 5.1.2600 Service Pack 2 NTFS

                      Balayage processus cachés ...

                      Balayage caché autostart entries ...

                      Balayage des fichiers cachés ...

                      Scan terminé avec succès
                      Les fichiers cachés: 0

                      **************************************************************************
                      .
                      --------------------- DLLs a chargé sous des processus courants ---------------------

                      PROCESS: C:\WINDOWS\explorer.exe
                      -> C:\Program Files\Hercules\WebCam Station\PhotoImpression\share\pihook.dll
                      .
                      Temps d'accomplissement: 2008-03-25 19:27:32
                      ComboFix-quarantined-files.txt 2008-03-25 18:27:24
                      ComboFix2.txt 2008-03-25 18:22:53
                      ComboFix3.txt 2008-03-24 19:15:46
                      ComboFix4.txt 2008-03-04 19:10:11
                      .
                      2008-03-23 20:13:58 --- E O F ---

                      merci pour tout mais je ne serait pas la avant samedi car je pars en angleterre
                      0
                      1. jojo51
                        ComboFix 08-03-22.3 - maison 2008-03-25 19:25:01.7 - NTFSx86
                        Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.227 [GMT 1:00]
                        Endroit: C:\Documents and Settings\maison\Bureau\ComboFix.exe

                        [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                        .

                        ((((((((((((((((((((((((((((( Fichiers créés 2008-02-25 to 2008-03-25 ))))))))))))))))))))))))))))))))))))
                        .

                        2008-03-25 17:47 . 2008-03-25 17:47 <REP> d-------- C:\Program Files\Usenet.to
                        2008-03-25 17:47 . 2008-03-25 17:48 <REP> d-------- C:\Documents and Settings\maison\Application Data\UseNeXT
                        2008-03-25 17:31 . 2008-03-25 17:31 54,156 --ah----- C:\WINDOWS\QTFont.qfn
                        2008-03-25 17:31 . 2008-03-25 17:31 1,409 --a------ C:\WINDOWS\QTFont.for
                        2008-03-24 11:39 . 2008-03-24 11:40 <REP> d-------- C:\Program Files\Babylon
                        2008-03-24 11:39 . 2008-03-24 11:41 <REP> d-------- C:\Documents and Settings\maison\Application Data\Babylon
                        2008-03-24 11:39 . 2008-03-24 11:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Babylon
                        2008-03-24 10:52 . 2008-03-24 10:52 <REP> d-------- C:\Program Files\Trend Micro
                        2008-03-23 21:24 . 2008-03-23 21:24 <REP> d-------- C:\Program Files\Enigma Software Group
                        2008-03-22 19:31 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
                        2008-03-22 19:31 . 2008-03-22 19:31 3,120 --a------ C:\WINDOWS\system32\118290.54
                        2008-03-22 19:31 . 2008-03-22 19:31 3,120 --a------ C:\WINDOWS\118294.78
                        2008-03-22 19:31 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
                        2008-03-20 15:22 . 2008-03-20 15:22 <REP> d-------- C:\Program Files\Fichiers communs\iS3
                        2008-03-20 15:22 . 2008-03-23 21:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
                        2008-03-20 15:22 . 2008-03-22 13:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SITEguard
                        2008-03-09 21:47 . 2008-03-09 21:47 <REP> d-------- C:\Documents and Settings\maison\Application Data\dBpoweramp
                        2008-03-09 21:39 . 2008-03-09 21:39 <REP> d-------- C:\Program Files\Illustrate
                        2008-03-09 21:39 . 2008-03-09 21:43 <REP> d-------- C:\Documents and Settings\maison\Application Data\AccurateRip
                        2008-03-09 21:39 . 2008-03-09 21:38 4,230,520 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
                        2008-03-07 18:03 . 2008-03-07 18:03 2,496 --a------ C:\WINDOWS\system32\tmp.reg
                        2008-03-07 18:02 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
                        2008-03-07 18:02 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
                        2008-03-07 18:02 . 2008-03-01 23:12 86,016 --a------ C:\WINDOWS\system32\VACFix.exe
                        2008-03-07 18:02 . 2008-03-05 22:29 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
                        2008-03-07 18:02 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
                        2008-03-07 18:02 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
                        2008-03-07 18:02 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
                        2008-03-05 20:13 . 2008-03-05 20:13 <REP> d-------- C:\Program Files\Audacity
                        2008-03-05 16:51 . 2008-03-05 20:08 <REP> d-------- C:\Program Files\Any Audio Converter
                        2008-03-03 19:01 . 2008-03-03 19:03 <REP> d-------- C:\ComboFix[1]
                        2008-03-02 12:02 . 2008-03-02 12:03 <REP> d-------- C:\Documents and Settings\All Users\Application Data\YoYoGames
                        2008-03-02 11:34 . 2008-03-02 11:34 <REP> d-------- C:\Documents and Settings\maison\Application Data\Yahoo! Messenger
                        2008-02-28 16:15 . 2008-02-28 16:15 <REP> d-------- C:\Program Files\Sotfone
                        2008-02-27 17:36 . 2008-02-27 19:46 <REP> d-------- C:\Program Files\BitComet

                        .
                        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        2008-03-22 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
                        2008-02-13 10:48 --------- d-----w C:\Program Files\CamStudio
                        2008-02-13 10:32 --------- d-----w C:\Program Files\t@b
                        2008-02-13 10:29 --------- d-----w C:\Program Files\BoontyGames
                        2008-02-13 09:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                        2008-02-13 08:47 --------- d-----w C:\Program Files\Spybot - Search & Destroy
                        2008-02-12 22:09 691,545 ----a-w C:\WINDOWS\unins000.exe
                        2008-02-11 21:05 --------- d-----w C:\Program Files\Magic Karaoke Maker
                        2008-02-11 10:08 --------- d-----w C:\Program Files\PhotoFiltre
                        2008-02-09 20:47 --------- d-----w C:\Program Files\IdolMusicStar
                        2008-02-09 20:43 --------- d-----w C:\Program Files\GStudio6
                        2008-02-09 20:42 407,047 ----a-w C:\WINDOWS\system32\mioengine.exe
                        2008-02-09 20:42 --------- d-----w C:\Program Files\Mioplanet
                        2008-02-09 20:27 --------- d-----w C:\Documents and Settings\maison\Application Data\gtk-2.0
                        2008-02-06 14:22 20,344 ----a-w C:\Documents and Settings\maison\Application Data\GDIPFONTCACHEV1.DAT
                        2008-02-03 18:29 --------- d-----w C:\Program Files\Disney Imagineering
                        2008-02-02 19:26 --------- d-----w C:\Program Files\Team MediaPortal
                        2008-01-31 15:31 --------- d-----w C:\Program Files\Compil Games
                        2007-05-02 11:34 92,064 -c--a-w C:\Documents and Settings\maison\mqdmmdm.sys
                        2007-05-02 11:34 9,232 -c--a-w C:\Documents and Settings\maison\mqdmmdfl.sys
                        2007-05-02 11:34 79,328 -c--a-w C:\Documents and Settings\maison\mqdmserd.sys
                        2007-05-02 11:34 66,656 -c--a-w C:\Documents and Settings\maison\mqdmbus.sys
                        2007-05-02 11:34 6,208 -c--a-w C:\Documents and Settings\maison\mqdmcmnt.sys
                        2007-05-02 11:34 5,936 -c--a-w C:\Documents and Settings\maison\mqdmwhnt.sys
                        2007-05-02 11:34 4,048 -c--a-w C:\Documents and Settings\maison\mqdmcr.sys
                        2007-05-02 11:34 25,600 -c--a-w C:\Documents and Settings\maison\usbsermptxp.sys
                        2007-05-02 11:34 22,768 -c--a-w C:\Documents and Settings\maison\usbsermpt.sys
                        .

                        ((((((((((((((((((((((((((((( snapshot_2008-03-24_20.15.35.70 )))))))))))))))))))))))))))))))))))))))))
                        .
                        + 2008-03-25 15:48:49 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_564.dat
                        .
                        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        .
                        REGEDIT4
                        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
                        "fsc-reminder.exe"="C:\WINDOWS\reminder\fsc-reminder.exe" [2005-01-19 17:10 28672]
                        "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
                        "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-20 19:45 68856]
                        "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 15:53 73840]
                        "Yahoo! Pager"="~c:\Program Files\Yahoo!\Messenger\ypager.exe" [ ]
                        "Yodm3D"="C:\WINDOWS\Resources\Themes\VistaXP\y3d\Yodm3D.exe" [2007-06-26 19:26 2058752]

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "SoundMan"="SOUNDMAN.EXE" [2006-08-03 04:12 577536 C:\WINDOWS\SOUNDMAN.EXE]
                        "VTTimer"="VTTimer.exe" [2005-03-08 02:33 53248 C:\WINDOWS\system32\VTTimer.exe]
                        "VTTrayp"="VTtrayp.exe" [2006-05-09 08:21 176128 C:\WINDOWS\system32\VTTrayp.exe]
                        "Muscbrigade"="c:\Musicbrigade\Musicbrigade.exe" [2005-12-22 09:26 40960]
                        "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
                        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-01-27 00:07 5529600]
                        "nwiz"="nwiz.exe" [2005-01-27 00:07 1490944 C:\WINDOWS\system32\nwiz.exe]
                        "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-01-27 00:07 86016]
                        "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-03-22 15:58 98304]
                        "OSD"="C:\WINDOWS\osd.exe" [2007-01-21 20:50 86016]
                        "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 15:53 73840]
                        "Glass2k"="C:\WINDOWS\Resources\Themes\VistaXP\glass\Glass2k.exe" [2007-07-14 05:31 56325]
                        "VisualTooltip"="C:\WINDOWS\Resources\Themes\VistaXP\vt\VisualToolTip.exe" [2007-04-25 09:45 956928]
                        "48813152"="C:\WINDOWS\system32\ywfnqvab.dll" [ ]
                        "BM4bb202ce"="C:\WINDOWS\system32\mmbculfo.dll" [ ]

                        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                        "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
                        "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-20 19:45 68856]

                        C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                        Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
                        Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04 83360]

                        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                        "%windir%\\system32\\sessmgr.exe"=
                        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                        "C:\\Program Files\\i-voyager46\\Scol.exe"=
                        "C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
                        "C:\\Program Files\\Messenger\\msmsgs.exe"=
                        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                        "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
                        "C:\\Program Files\\Fichiers communs\\PocketSoft\\RTPatch\\AutoRTP\\artpschd.exe"=
                        "C:\\Program Files\\GIMP-2.0\\lib\\gimp\\2.0\\plug-ins\\script-fu.exe"=
                        "C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
                        "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
                        "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=

                        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                        "23006:TCP"= 23006:TCP:BitComet 23006 TCP
                        "23006:UDP"= 23006:UDP:BitComet 23006 UDP

                        R3 ovt530;Webcam Deluxe;C:\WINDOWS\system32\Drivers\ov530vid.sys [2005-03-15 17:04]
                        S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-01-27 19:15]
                        S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

                        .
                        **************************************************************************

                        catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                        Rootkit scan 2008-03-25 19:26:51
                        Windows 5.1.2600 Service Pack 2 NTFS

                        Balayage processus cachés ...

                        Balayage caché autostart entries ...

                        Balayage des fichiers cachés ...

                        Scan terminé avec succès
                        Les fichiers cachés: 0

                        **************************************************************************
                        .
                        --------------------- DLLs a chargé sous des processus courants ---------------------

                        PROCESS: C:\WINDOWS\explorer.exe
                        -> C:\Program Files\Hercules\WebCam Station\PhotoImpression\share\pihook.dll
                        .
                        Temps d'accomplissement: 2008-03-25 19:27:32
                        ComboFix-quarantined-files.txt 2008-03-25 18:27:24
                        ComboFix2.txt 2008-03-25 18:22:53
                        ComboFix3.txt 2008-03-24 19:15:46
                        ComboFix4.txt 2008-03-04 19:10:11
                        .
                        2008-03-23 20:13:58 --- E O F ---

                        merci pour tout mais je ne serait pas la avant samedi car je pars en angleterre
                        0
                        1. jojo51
                          ComboFix 08-03-22.3 - maison 2008-03-25 19:25:01.7 - NTFSx86
                          Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.227 [GMT 1:00]
                          Endroit: C:\Documents and Settings\maison\Bureau\ComboFix.exe

                          [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                          .

                          ((((((((((((((((((((((((((((( Fichiers créés 2008-02-25 to 2008-03-25 ))))))))))))))))))))))))))))))))))))
                          .

                          2008-03-25 17:47 . 2008-03-25 17:47 <REP> d-------- C:\Program Files\Usenet.to
                          2008-03-25 17:47 . 2008-03-25 17:48 <REP> d-------- C:\Documents and Settings\maison\Application Data\UseNeXT
                          2008-03-25 17:31 . 2008-03-25 17:31 54,156 --ah----- C:\WINDOWS\QTFont.qfn
                          2008-03-25 17:31 . 2008-03-25 17:31 1,409 --a------ C:\WINDOWS\QTFont.for
                          2008-03-24 11:39 . 2008-03-24 11:40 <REP> d-------- C:\Program Files\Babylon
                          2008-03-24 11:39 . 2008-03-24 11:41 <REP> d-------- C:\Documents and Settings\maison\Application Data\Babylon
                          2008-03-24 11:39 . 2008-03-24 11:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Babylon
                          2008-03-24 10:52 . 2008-03-24 10:52 <REP> d-------- C:\Program Files\Trend Micro
                          2008-03-23 21:24 . 2008-03-23 21:24 <REP> d-------- C:\Program Files\Enigma Software Group
                          2008-03-22 19:31 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
                          2008-03-22 19:31 . 2008-03-22 19:31 3,120 --a------ C:\WINDOWS\system32\118290.54
                          2008-03-22 19:31 . 2008-03-22 19:31 3,120 --a------ C:\WINDOWS\118294.78
                          2008-03-22 19:31 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
                          2008-03-20 15:22 . 2008-03-20 15:22 <REP> d-------- C:\Program Files\Fichiers communs\iS3
                          2008-03-20 15:22 . 2008-03-23 21:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
                          2008-03-20 15:22 . 2008-03-22 13:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SITEguard
                          2008-03-09 21:47 . 2008-03-09 21:47 <REP> d-------- C:\Documents and Settings\maison\Application Data\dBpoweramp
                          2008-03-09 21:39 . 2008-03-09 21:39 <REP> d-------- C:\Program Files\Illustrate
                          2008-03-09 21:39 . 2008-03-09 21:43 <REP> d-------- C:\Documents and Settings\maison\Application Data\AccurateRip
                          2008-03-09 21:39 . 2008-03-09 21:38 4,230,520 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
                          2008-03-07 18:03 . 2008-03-07 18:03 2,496 --a------ C:\WINDOWS\system32\tmp.reg
                          2008-03-07 18:02 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
                          2008-03-07 18:02 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
                          2008-03-07 18:02 . 2008-03-01 23:12 86,016 --a------ C:\WINDOWS\system32\VACFix.exe
                          2008-03-07 18:02 . 2008-03-05 22:29 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
                          2008-03-07 18:02 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
                          2008-03-07 18:02 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
                          2008-03-07 18:02 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
                          2008-03-05 20:13 . 2008-03-05 20:13 <REP> d-------- C:\Program Files\Audacity
                          2008-03-05 16:51 . 2008-03-05 20:08 <REP> d-------- C:\Program Files\Any Audio Converter
                          2008-03-03 19:01 . 2008-03-03 19:03 <REP> d-------- C:\ComboFix[1]
                          2008-03-02 12:02 . 2008-03-02 12:03 <REP> d-------- C:\Documents and Settings\All Users\Application Data\YoYoGames
                          2008-03-02 11:34 . 2008-03-02 11:34 <REP> d-------- C:\Documents and Settings\maison\Application Data\Yahoo! Messenger
                          2008-02-28 16:15 . 2008-02-28 16:15 <REP> d-------- C:\Program Files\Sotfone
                          2008-02-27 17:36 . 2008-02-27 19:46 <REP> d-------- C:\Program Files\BitComet

                          .
                          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          2008-03-22 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
                          2008-02-13 10:48 --------- d-----w C:\Program Files\CamStudio
                          2008-02-13 10:32 --------- d-----w C:\Program Files\t@b
                          2008-02-13 10:29 --------- d-----w C:\Program Files\BoontyGames
                          2008-02-13 09:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                          2008-02-13 08:47 --------- d-----w C:\Program Files\Spybot - Search & Destroy
                          2008-02-12 22:09 691,545 ----a-w C:\WINDOWS\unins000.exe
                          2008-02-11 21:05 --------- d-----w C:\Program Files\Magic Karaoke Maker
                          2008-02-11 10:08 --------- d-----w C:\Program Files\PhotoFiltre
                          2008-02-09 20:47 --------- d-----w C:\Program Files\IdolMusicStar
                          2008-02-09 20:43 --------- d-----w C:\Program Files\GStudio6
                          2008-02-09 20:42 407,047 ----a-w C:\WINDOWS\system32\mioengine.exe
                          2008-02-09 20:42 --------- d-----w C:\Program Files\Mioplanet
                          2008-02-09 20:27 --------- d-----w C:\Documents and Settings\maison\Application Data\gtk-2.0
                          2008-02-06 14:22 20,344 ----a-w C:\Documents and Settings\maison\Application Data\GDIPFONTCACHEV1.DAT
                          2008-02-03 18:29 --------- d-----w C:\Program Files\Disney Imagineering
                          2008-02-02 19:26 --------- d-----w C:\Program Files\Team MediaPortal
                          2008-01-31 15:31 --------- d-----w C:\Program Files\Compil Games
                          2007-05-02 11:34 92,064 -c--a-w C:\Documents and Settings\maison\mqdmmdm.sys
                          2007-05-02 11:34 9,232 -c--a-w C:\Documents and Settings\maison\mqdmmdfl.sys
                          2007-05-02 11:34 79,328 -c--a-w C:\Documents and Settings\maison\mqdmserd.sys
                          2007-05-02 11:34 66,656 -c--a-w C:\Documents and Settings\maison\mqdmbus.sys
                          2007-05-02 11:34 6,208 -c--a-w C:\Documents and Settings\maison\mqdmcmnt.sys
                          2007-05-02 11:34 5,936 -c--a-w C:\Documents and Settings\maison\mqdmwhnt.sys
                          2007-05-02 11:34 4,048 -c--a-w C:\Documents and Settings\maison\mqdmcr.sys
                          2007-05-02 11:34 25,600 -c--a-w C:\Documents and Settings\maison\usbsermptxp.sys
                          2007-05-02 11:34 22,768 -c--a-w C:\Documents and Settings\maison\usbsermpt.sys
                          .

                          ((((((((((((((((((((((((((((( snapshot_2008-03-24_20.15.35.70 )))))))))))))))))))))))))))))))))))))))))
                          .
                          + 2008-03-25 15:48:49 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_564.dat
                          .
                          ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          .
                          REGEDIT4
                          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
                          "fsc-reminder.exe"="C:\WINDOWS\reminder\fsc-reminder.exe" [2005-01-19 17:10 28672]
                          "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
                          "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-20 19:45 68856]
                          "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 15:53 73840]
                          "Yahoo! Pager"="~c:\Program Files\Yahoo!\Messenger\ypager.exe" [ ]
                          "Yodm3D"="C:\WINDOWS\Resources\Themes\VistaXP\y3d\Yodm3D.exe" [2007-06-26 19:26 2058752]

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "SoundMan"="SOUNDMAN.EXE" [2006-08-03 04:12 577536 C:\WINDOWS\SOUNDMAN.EXE]
                          "VTTimer"="VTTimer.exe" [2005-03-08 02:33 53248 C:\WINDOWS\system32\VTTimer.exe]
                          "VTTrayp"="VTtrayp.exe" [2006-05-09 08:21 176128 C:\WINDOWS\system32\VTTrayp.exe]
                          "Muscbrigade"="c:\Musicbrigade\Musicbrigade.exe" [2005-12-22 09:26 40960]
                          "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
                          "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-01-27 00:07 5529600]
                          "nwiz"="nwiz.exe" [2005-01-27 00:07 1490944 C:\WINDOWS\system32\nwiz.exe]
                          "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-01-27 00:07 86016]
                          "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-03-22 15:58 98304]
                          "OSD"="C:\WINDOWS\osd.exe" [2007-01-21 20:50 86016]
                          "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 15:53 73840]
                          "Glass2k"="C:\WINDOWS\Resources\Themes\VistaXP\glass\Glass2k.exe" [2007-07-14 05:31 56325]
                          "VisualTooltip"="C:\WINDOWS\Resources\Themes\VistaXP\vt\VisualToolTip.exe" [2007-04-25 09:45 956928]
                          "48813152"="C:\WINDOWS\system32\ywfnqvab.dll" [ ]
                          "BM4bb202ce"="C:\WINDOWS\system32\mmbculfo.dll" [ ]

                          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                          "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
                          "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-20 19:45 68856]

                          C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                          Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
                          Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04 83360]

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                          "%windir%\\system32\\sessmgr.exe"=
                          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                          "C:\\Program Files\\i-voyager46\\Scol.exe"=
                          "C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
                          "C:\\Program Files\\Messenger\\msmsgs.exe"=
                          "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                          "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                          "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
                          "C:\\Program Files\\Fichiers communs\\PocketSoft\\RTPatch\\AutoRTP\\artpschd.exe"=
                          "C:\\Program Files\\GIMP-2.0\\lib\\gimp\\2.0\\plug-ins\\script-fu.exe"=
                          "C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
                          "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
                          "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                          "23006:TCP"= 23006:TCP:BitComet 23006 TCP
                          "23006:UDP"= 23006:UDP:BitComet 23006 UDP

                          R3 ovt530;Webcam Deluxe;C:\WINDOWS\system32\Drivers\ov530vid.sys [2005-03-15 17:04]
                          S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-01-27 19:15]
                          S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

                          .
                          **************************************************************************

                          catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                          Rootkit scan 2008-03-25 19:26:51
                          Windows 5.1.2600 Service Pack 2 NTFS

                          Balayage processus cachés ...

                          Balayage caché autostart entries ...

                          Balayage des fichiers cachés ...

                          Scan terminé avec succès
                          Les fichiers cachés: 0

                          **************************************************************************
                          .
                          --------------------- DLLs a chargé sous des processus courants ---------------------

                          PROCESS: C:\WINDOWS\explorer.exe
                          -> C:\Program Files\Hercules\WebCam Station\PhotoImpression\share\pihook.dll
                          .
                          Temps d'accomplissement: 2008-03-25 19:27:32
                          ComboFix-quarantined-files.txt 2008-03-25 18:27:24
                          ComboFix2.txt 2008-03-25 18:22:53
                          ComboFix3.txt 2008-03-24 19:15:46
                          ComboFix4.txt 2008-03-04 19:10:11
                          .
                          2008-03-23 20:13:58 --- E O F ---

                          merci pour tout mais je ne serait pas la avant samedi car je pars en angleterre
                          0
                          1. g!rly Contributeur
                            jojo51,

                            ca n´a pas marché,

                            il faut bien que tu copie la liste ci dessous et que tu l´enrregistre en un fichier .txt que tu glisse sur l´icone de combofix...

                            comme ceci :

                            http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

                            Copie le texte ci-dessous :

                            File::
                            C:\WINDOWS\system32\kdjgq.exe
                            C:\WINDOWS\system32\mmbculfo.dll
                            C:\WINDOWS\system32\ywfnqvab.dll
                            C:\WINDOWS\system32\118290.54
                            C:\WINDOWS\118294.78

                            Folder::
                            C:\Program Files\Macrogaming

                            Registry::
                            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                            "SweetIM"=-
                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                            "48813152"=-
                            "BM4bb202ce"=-

                            Ouvre le Bloc-Notes puis colle le texte copié.
                            (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
                            Sauvegarde ce fichier sous le nom de CFScript.txt.

                            Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

                            http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

                            Cela va relancer Combofix,

                            Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                            Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                            Ne touche à rien tant que le scan n'est pas terminé.

                            Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

                            S'il n'y a pas de rédémarrage, poste quand même les rapports.

                            reessaie

                            @+
                            0
                            1. jojo51
                              re bonjour
                              merci de ta patience g!rly pendant c'est 3 jours
                              donc voila le rapport

                              ComboFix 08-03-27.3 - maison 2008-03-29 12:00:02.8 - NTFSx86
                              Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.232 [GMT 1:00]
                              Endroit: C:\Documents and Settings\maison\Bureau\ComboFix.exe
                              Command switches used :: C:\Documents and Settings\maison\Bureau\CFScript.txt
                              * Création d'un nouveau point de restauration

                              [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                              FILE ::
                              C:\WINDOWS\118294.78
                              C:\WINDOWS\system32\118290.54
                              C:\WINDOWS\system32\kdjgq.exe
                              C:\WINDOWS\system32\mmbculfo.dll
                              C:\WINDOWS\system32\ywfnqvab.dll
                              .

                              (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                              .

                              C:\Program Files\Macrogaming
                              C:\Program Files\Macrogaming\SweetIM\conf\adapter.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\autoupdate.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\logger.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\messages.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\sweetim.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\sweetimapp.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\asophiea@free.fr\emoticons_shortcut.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\asophiea@free.fr\user_config.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\la-missdu51@hotmail.fr\emoticons_shortcut.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\la-missdu51@hotmail.fr\user_config.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\main_user_config.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\matheo51@free.fr\emoticons_shortcut.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\matheo51@free.fr\lastuse_Audibles.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\matheo51@free.fr\lastuse_Emoticons.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\matheo51@free.fr\lastuse_SoundFX.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\matheo51@free.fr\lastuse_SpecialFX.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\matheo51@free.fr\lastuse_Winks.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\matheo51@free.fr\user_config.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\petit.lynx51@hotmail.fr\emoticons_shortcut.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\petit.lynx51@hotmail.fr\user_config.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\shenzy51@hotmail.com\emoticons_shortcut.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\shenzy51@hotmail.com\user_config.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\super-mega.nono@hotmail.fr\emoticons_shortcut.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\super-mega.nono@hotmail.fr\lastuse_SoundFX.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\super-mega.nono@hotmail.fr\lastuse_Winks.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\super-mega.nono@hotmail.fr\user_config.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\thomas1101@hotmail.fr\emoticons_shortcut.xml
                              C:\Program Files\Macrogaming\SweetIM\conf\users\thomas1101@hotmail.fr\user_config.xml
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100AC.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100BB.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100C5.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100C6.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100CC.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100D1.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100D3.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100D9.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100DA.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100E8.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100FA.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100FD.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100FE.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00100FF.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010100.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010104.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001010F.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001011D.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010124.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010814.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010818.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001081A.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001081C.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001084A.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010852.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010853.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010857.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010859.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001085D.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001085E.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010862.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001086B.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010883.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010889.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001088C.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001088D.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010890.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010891.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010892.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010893.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010894.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010896.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0010897.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001089A.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001089B.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]001089D.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00108A0.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00108A1.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00108A5.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00108A9.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00108AF.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00108B1.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00108B3.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00108B6.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00108BA.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]002005C.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020066.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020069.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]002006A.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]002006D.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]002006E.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020071.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020072.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020075.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020077.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020079.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]002007D.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020096.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]002009D.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]002011B.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]002012B.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020132.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]002013F.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020148.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020149.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]002015C.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020171.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020177.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020180.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020185.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0020186.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00201AE.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0030001.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0030003.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0030005.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0030007.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]003000F.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0030011.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0030013.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0030019.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]003001D.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0030023.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0030025.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]003004B.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]003004E.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0030050.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0030052.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]003005D.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]003005F.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0030061.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0030063.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040015.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004001E.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004001F.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040021.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040022.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040024.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040026.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040027.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004002B.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004002C.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040039.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004003B.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004003C.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004004A.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004004D.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040050.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004005A.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004005C.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040061.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040062.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040063.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040065.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040067.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004006A.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004006E.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0040072.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]004007C.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00400A2.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00400A3.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00400AA.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]00400C4.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0050001.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0050002.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0050004.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0050005.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0050007.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]0060075.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]006007C.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]10108A7.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]1030047.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]1050001.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\[u]0[/u]1050002.dat
                              C:\Program Files\Macrogaming\SweetIM\data\contentdb\cache_indx.dat
                              C:\Program Files\Macrogaming\SweetIM\default.xml
                              C:\Program Files\Macrogaming\SweetIM\mgAdaptersProxy.dll
                              C:\Program Files\Macrogaming\SweetIM\mgArchive.dll
                              C:\Program Files\Macrogaming\SweetIM\mgcommon.dll
                              C:\Program Files\Macrogaming\SweetIM\mgcommunication.dll
                              C:\Program Files\Macrogaming\SweetIM\mgconfig.dll
                              C:\Program Files\Macrogaming\SweetIM\mgFlashPlayer.dll
                              C:\Program Files\Macrogaming\SweetIM\mghooking.dll
                              C:\Program Files\Macrogaming\SweetIM\mgIEPlayer.dll
                              C:\Program Files\Macrogaming\SweetIM\mglogger.dll
                              C:\Program Files\Macrogaming\SweetIM\mgMediaPlayer.dll
                              C:\Program Files\Macrogaming\SweetIM\mgMsnAuto.dll
                              C:\Program Files\Macrogaming\SweetIM\mgMsnMessengerAdapter.dll
                              C:\Program Files\Macrogaming\SweetIM\mgSweetIM.dll
                              C:\Program Files\Macrogaming\SweetIM\mgUpdateSupport.dll
                              C:\Program Files\Macrogaming\SweetIM\mgxml_wrapper.dll
                              C:\Program Files\Macrogaming\SweetIM\mgYahooAuto.dll
                              C:\Program Files\Macrogaming\SweetIM\mgYahooMessengerAdapter.dll
                              C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
                              C:\Program Files\Macrogaming\SweetIMBarForIE\affid.dat
                              C:\Program Files\Macrogaming\SweetIMBarForIE\basis.xml
                              C:\Program Files\Macrogaming\SweetIMBarForIE\Bookmarks_23x18.bmp
                              C:\Program Files\Macrogaming\SweetIMBarForIE\Cache\cd2005c66fba47ff715ecc444d3bc1fb.xml
                              C:\Program Files\Macrogaming\SweetIMBarForIE\Email_23x18.bmp
                              C:\Program Files\Macrogaming\SweetIMBarForIE\Games_23x18.bmp
                              C:\Program Files\Macrogaming\SweetIMBarForIE\Greetingcards_23x18.bmp
                              C:\Program Files\Macrogaming\SweetIMBarForIE\Mobile_23x18.bmp
                              C:\Program Files\Macrogaming\SweetIMBarForIE\Music_23x18.bmp
                              C:\Program Files\Macrogaming\SweetIMBarForIE\News_23x18.bmp
                              C:\Program Files\Macrogaming\SweetIMBarForIE\Shoping_23x18.bmp
                              C:\Program Files\Macrogaming\SweetIMBarForIE\SmileySmile.bmp
                              C:\Program Files\Macrogaming\SweetIMBarForIE\SmileyWink.bmp
                              C:\Program Files\Macrogaming\SweetIMBarForIE\sweetimicons.bmp
                              C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.crc
                              C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.xml
                              C:\Program Files\Macrogaming\SweetIMBarForIE\version.txt
                              C:\WINDOWS\118294.78
                              C:\WINDOWS\system32\118290.54
                              C:\WINDOWS\system32\kdjgq.exe

                              .
                              ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                              .

                              -------\Service_npf

                              ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-28 to 2008-03-29 ))))))))))))))))))))))))))))))))))))
                              .

                              2008-03-26 04:26 . 2008-03-26 04:26 <REP> d-------- C:\Program Files\NCH Swift Sound
                              2008-03-26 04:26 . 2008-03-26 04:26 <REP> d-------- C:\Documents and Settings\maison\Application Data\NCH Swift Sound
                              2008-03-26 04:26 . 2008-03-26 04:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
                              2008-03-25 20:26 . 2008-03-25 20:26 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
                              2008-03-25 20:25 . 2008-03-25 20:25 <REP> d-------- C:\Program Files\LitexMedia
                              2008-03-25 17:47 . 2008-03-25 17:47 <REP> d-------- C:\Program Files\Usenet.to
                              2008-03-25 17:47 . 2008-03-25 17:48 <REP> d-------- C:\Documents and Settings\maison\Application Data\UseNeXT
                              2008-03-25 17:31 . 2008-03-25 19:32 54,156 --ah----- C:\WINDOWS\QTFont.qfn
                              2008-03-25 17:31 . 2008-03-25 17:31 1,409 --a------ C:\WINDOWS\QTFont.for
                              2008-03-24 11:39 . 2008-03-24 11:40 <REP> d-------- C:\Program Files\Babylon
                              2008-03-24 11:39 . 2008-03-24 11:41 <REP> d-------- C:\Documents and Settings\maison\Application Data\Babylon
                              2008-03-24 11:39 . 2008-03-24 11:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Babylon
                              2008-03-24 10:52 . 2008-03-24 10:52 <REP> d-------- C:\Program Files\Trend Micro
                              2008-03-23 21:24 . 2008-03-23 21:24 <REP> d-------- C:\Program Files\Enigma Software Group
                              2008-03-22 19:31 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
                              2008-03-22 19:31 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
                              2008-03-20 15:22 . 2008-03-20 15:22 <REP> d-------- C:\Program Files\Fichiers communs\iS3
                              2008-03-20 15:22 . 2008-03-23 21:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
                              2008-03-20 15:22 . 2008-03-22 13:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SITEguard
                              2008-03-09 21:47 . 2008-03-09 21:47 <REP> d-------- C:\Documents and Settings\maison\Application Data\dBpoweramp
                              2008-03-09 21:39 . 2008-03-09 21:39 <REP> d-------- C:\Program Files\Illustrate
                              2008-03-09 21:39 . 2008-03-09 21:43 <REP> d-------- C:\Documents and Settings\maison\Application Data\AccurateRip
                              2008-03-09 21:39 . 2008-03-25 20:33 4,230,520 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
                              2008-03-07 18:03 . 2008-03-07 18:03 2,496 --a------ C:\WINDOWS\system32\tmp.reg
                              2008-03-07 18:02 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
                              2008-03-07 18:02 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
                              2008-03-07 18:02 . 2008-03-01 23:12 86,016 --a------ C:\WINDOWS\system32\VACFix.exe
                              2008-03-07 18:02 . 2008-03-05 22:29 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
                              2008-03-07 18:02 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
                              2008-03-07 18:02 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
                              2008-03-07 18:02 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
                              2008-03-05 20:13 . 2008-03-05 20:13 <REP> d-------- C:\Program Files\Audacity
                              2008-03-05 16:51 . 2008-03-05 20:08 <REP> d-------- C:\Program Files\Any Audio Converter
                              2008-03-03 19:01 . 2008-03-03 19:03 <REP> d-------- C:\ComboFix[1]
                              2008-03-02 12:02 . 2008-03-02 12:03 <REP> d-------- C:\Documents and Settings\All Users\Application Data\YoYoGames
                              2008-03-02 11:34 . 2008-03-02 11:34 <REP> d-------- C:\Documents and Settings\maison\Application Data\Yahoo! Messenger

                              .
                              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              2008-03-22 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
                              2008-02-28 15:15 --------- d-----w C:\Program Files\Sotfone
                              2008-02-27 18:46 --------- d-----w C:\Program Files\BitComet
                              2008-02-13 10:48 --------- d-----w C:\Program Files\CamStudio
                              2008-02-13 10:32 --------- d-----w C:\Program Files\t@b
                              2008-02-13 10:29 --------- d-----w C:\Program Files\BoontyGames
                              2008-02-13 09:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                              2008-02-13 08:47 --------- d-----w C:\Program Files\Spybot - Search & Destroy
                              2008-02-12 22:09 691,545 ----a-w C:\WINDOWS\unins000.exe
                              2008-02-11 21:05 --------- d-----w C:\Program Files\Magic Karaoke Maker
                              2008-02-11 10:08 --------- d-----w C:\Program Files\PhotoFiltre
                              2008-02-09 20:47 --------- d-----w C:\Program Files\IdolMusicStar
                              2008-02-09 20:43 --------- d-----w C:\Program Files\GStudio6
                              2008-02-09 20:42 --------- d-----w C:\Program Files\Mioplanet
                              2008-02-09 20:27 --------- d-----w C:\Documents and Settings\maison\Application Data\gtk-2.0
                              2008-02-06 14:22 20,344 ----a-w C:\Documents and Settings\maison\Application Data\GDIPFONTCACHEV1.DAT
                              2008-02-03 18:29 --------- d-----w C:\Program Files\Disney Imagineering
                              2008-02-02 19:26 --------- d-----w C:\Program Files\Team MediaPortal
                              2008-01-31 15:31 --------- d-----w C:\Program Files\Compil Games
                              2007-05-02 11:34 92,064 -c--a-w C:\Documents and Settings\maison\mqdmmdm.sys
                              2007-05-02 11:34 9,232 -c--a-w C:\Documents and Settings\maison\mqdmmdfl.sys
                              2007-05-02 11:34 79,328 -c--a-w C:\Documents and Settings\maison\mqdmserd.sys
                              2007-05-02 11:34 66,656 -c--a-w C:\Documents and Settings\maison\mqdmbus.sys
                              2007-05-02 11:34 6,208 -c--a-w C:\Documents and Settings\maison\mqdmcmnt.sys
                              2007-05-02 11:34 5,936 -c--a-w C:\Documents and Settings\maison\mqdmwhnt.sys
                              2007-05-02 11:34 4,048 -c--a-w C:\Documents and Settings\maison\mqdmcr.sys
                              2007-05-02 11:34 25,600 -c--a-w C:\Documents and Settings\maison\usbsermptxp.sys
                              2007-05-02 11:34 22,768 -c--a-w C:\Documents and Settings\maison\usbsermpt.sys
                              .

                              ((((((((((((((((((((((((((((( snapshot_2008-03-24_20.15.35.70 )))))))))))))))))))))))))))))))))))))))))
                              .
                              + 2008-03-29 11:04:51 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_588.dat
                              .
                              ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              .
                              REGEDIT4
                              *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

                              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
                              "fsc-reminder.exe"="C:\WINDOWS\reminder\fsc-reminder.exe" [2005-01-19 17:10 28672]
                              "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
                              "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-20 19:45 68856]
                              "Yahoo! Pager"="~c:\Program Files\Yahoo!\Messenger\ypager.exe" [ ]
                              "Yodm3D"="C:\WINDOWS\Resources\Themes\VistaXP\y3d\Yodm3D.exe" [2007-06-26 19:26 2058752]
                              "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [ ]

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "SoundMan"="SOUNDMAN.EXE" [2006-08-03 04:12 577536 C:\WINDOWS\SOUNDMAN.EXE]
                              "VTTimer"="VTTimer.exe" [2005-03-08 02:33 53248 C:\WINDOWS\system32\VTTimer.exe]
                              "VTTrayp"="VTtrayp.exe" [2006-05-09 08:21 176128 C:\WINDOWS\system32\VTTrayp.exe]
                              "Muscbrigade"="c:\Musicbrigade\Musicbrigade.exe" [2005-12-22 09:26 40960]
                              "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
                              "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-01-27 00:07 5529600]
                              "nwiz"="nwiz.exe" [2005-01-27 00:07 1490944 C:\WINDOWS\system32\nwiz.exe]
                              "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-01-27 00:07 86016]
                              "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-03-22 15:58 98304]
                              "OSD"="C:\WINDOWS\osd.exe" [2007-01-21 20:50 86016]
                              "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [ ]
                              "Glass2k"="C:\WINDOWS\Resources\Themes\VistaXP\glass\Glass2k.exe" [2007-07-14 05:31 56325]
                              "VisualTooltip"="C:\WINDOWS\Resources\Themes\VistaXP\vt\VisualToolTip.exe" [2007-04-25 09:45 956928]
                              "48813152"="C:\WINDOWS\system32\ywfnqvab.dll" [ ]
                              "BM4bb202ce"="C:\WINDOWS\system32\mmbculfo.dll" [ ]

                              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                              "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
                              "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-20 19:45 68856]

                              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                              "%windir%\\system32\\sessmgr.exe"=
                              "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                              "C:\\Program Files\\i-voyager46\\Scol.exe"=
                              "C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
                              "C:\\Program Files\\Messenger\\msmsgs.exe"=
                              "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                              "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                              "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
                              "C:\\Program Files\\Fichiers communs\\PocketSoft\\RTPatch\\AutoRTP\\artpschd.exe"=
                              "C:\\Program Files\\GIMP-2.0\\lib\\gimp\\2.0\\plug-ins\\script-fu.exe"=
                              "C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
                              "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
                              "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=

                              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                              "23006:TCP"= 23006:TCP:BitComet 23006 TCP
                              "23006:UDP"= 23006:UDP:BitComet 23006 UDP

                              R3 ovt530;Webcam Deluxe;C:\WINDOWS\system32\Drivers\ov530vid.sys [2005-03-15 17:04]
                              S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-01-27 19:15]
                              S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

                              .
                              **************************************************************************

                              catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                              Rootkit scan 2008-03-29 12:13:02
                              Windows 5.1.2600 Service Pack 2 NTFS

                              Balayage processus cach‚s ...

                              Balayage cach‚ autostart entries ...

                              Balayage des fichiers cach‚s ...

                              Scan termin‚ avec succŠs
                              Les fichiers cach‚s: 0

                              **************************************************************************
                              .
                              --------------------- DLLs a charg‚ sous des processus courants ---------------------

                              PROCESS: C:\WINDOWS\explorer.exe
                              -> C:\Program Files\Hercules\WebCam Station\PhotoImpression\share\pihook.dll
                              .
                              ------------------------ Other Running Processes ------------------------
                              .
                              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                              C:\Program Files\Alwil Software\Avast4\ashServ.exe
                              C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                              C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                              C:\WINDOWS\system32\nvsvc32.exe
                              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                              C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                              .
                              **************************************************************************
                              .
                              Temps d'accomplissement: 2008-03-29 12:16:17 - machine was rebooted [maison]
                              ComboFix-quarantined-files.txt 2008-03-29 11:16:13
                              ComboFix2.txt 2008-03-25 18:27:33
                              ComboFix3.txt 2008-03-25 18:22:53
                              ComboFix4.txt 2008-03-24 19:15:46
                              ComboFix5.txt 2008-03-04 19:10:11
                              Pre-Run: 227,696,087,040 octets libres
                              Post-Run: 227,691,753,472 octets libres
                              .
                              2008-03-23 20:13:58 --- E O F ---

                              merci encore
                              0
                              1. g!rly Contributeur
                                Salut jojo51,

                                post un nouveau hijack this stp

                                @+
                                0
                                1. jojo51
                                  Logfile of Trend Micro HijackThis v2.0.2
                                  Scan saved at 19:11:21, on 30/03/2008
                                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                                  Boot mode: Normal

                                  Running processes:
                                  C:\WINDOWS\System32\smss.exe
                                  C:\WINDOWS\system32\winlogon.exe
                                  C:\WINDOWS\system32\services.exe
                                  C:\WINDOWS\system32\lsass.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                  C:\WINDOWS\system32\spoolsv.exe
                                  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                  C:\WINDOWS\system32\nvsvc32.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                  C:\WINDOWS\Explorer.EXE
                                  C:\WINDOWS\SOUNDMAN.EXE
                                  C:\WINDOWS\system32\VTTimer.exe
                                  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                  C:\Program Files\QuickTime\qttask.exe
                                  C:\WINDOWS\osd.exe
                                  C:\WINDOWS\Resources\Themes\VistaXP\glass\Glass2k.exe
                                  C:\WINDOWS\system32\ctfmon.exe
                                  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                  C:\Program Files\Windows Media Player\wmplayer.exe
                                  C:\Program Files\internet explorer\iexplore.exe
                                  C:\Program Files\Outlook Express\msimn.exe
                                  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                  R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
                                  O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
                                  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                                  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                                  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
                                  O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
                                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                                  O3 - Toolbar: (no name) - {98828DED-A591-462F-83BA-D2F62A68B8B8} - (no file)
                                  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                                  O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
                                  O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
                                  O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
                                  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                                  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                                  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                  O4 - HKLM\..\Run: [OSD] C:\WINDOWS\osd.exe
                                  O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
                                  O4 - HKLM\..\Run: [Glass2k] C:\WINDOWS\Resources\Themes\VistaXP\glass\Glass2k.exe
                                  O4 - HKLM\..\Run: [VisualTooltip] C:\WINDOWS\Resources\Themes\VistaXP\vt\VisualToolTip.exe
                                  O4 - HKLM\..\Run: [48813152] rundll32.exe "C:\WINDOWS\system32\ywfnqvab.dll",b
                                  O4 - HKLM\..\Run: [BM4bb202ce] Rundll32.exe "C:\WINDOWS\system32\mmbculfo.dll",s
                                  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                                  O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2454111 14
                                  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                  O4 - HKCU\..\Run: [Yahoo! Pager] ~c:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
                                  O4 - HKCU\..\Run: [Yodm3D] C:\WINDOWS\Resources\Themes\VistaXP\y3d\Yodm3D.exe
                                  O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
                                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                                  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                                  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                  O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                                  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                                  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                                  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                  O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                                  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                                  0
                                  1. g!rly Contributeur
                                    re,

                                    instale ce par feu :

                                    Online armor :

                                    http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall

                                    tuto : https://www.malekal.com/tutorial-online-armor-free/

                                    puis

                                    Copie le texte ci-dessous :

                                    File::
                                    C:\WINDOWS\system32\ywfnqvab.dll
                                    C:\WINDOWS\system32\mmbculfo.dll

                                    Folder::
                                    C:\Program Files\Macrogaming

                                    Registry::
                                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                    "SweetIM"=-
                                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                    "48813152"=-
                                    "BM4bb202ce"=-

                                    Ouvre le Bloc-Notes puis colle le texte copié.
                                    (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
                                    Sauvegarde ce fichier sous le nom de CFScript.txt.

                                    Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

                                    http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

                                    Cela va relancer Combofix,

                                    Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                                    Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                                    Ne touche à rien tant que le scan n'est pas terminé.

                                    Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

                                    S'il n'y a pas de rédémarrage, poste quand même les rapports.

                                    @+
                                    0
                                    1. jojo51
                                      ComboFix 08-03-27.3 - maison 2008-03-31 20:27:21.9 - NTFSx86
                                      Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.238 [GMT 2:00]
                                      Endroit: C:\Documents and Settings\maison\Bureau\ComboFix.exe
                                      Command switches used :: C:\Documents and Settings\maison\Bureau\CFScript.txt
                                      * Création d'un nouveau point de restauration

                                      [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                                      FILE ::
                                      C:\WINDOWS\system32\mmbculfo.dll
                                      C:\WINDOWS\system32\ywfnqvab.dll
                                      .
                                      TimedOut: progfile.dat
                                      -- Script messages for sUBs --
                                      Findstr -MIF:/ "\\TTC\.pdb InsertAdvertisement"
                                      GREP -Eisf temp00
                                      VFind -tf -s282624 "C:\Program Files\????????*[0-9].dll"

                                      ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-28 to 2008-03-31 ))))))))))))))))))))))))))))))))))))
                                      .

                                      2008-03-31 19:54 . 2008-03-31 19:54 <REP> d-------- C:\Program Files\Tall Emu
                                      2008-03-30 18:48 . 2008-03-30 18:49 796,672 --a------ C:\WINDOWS\GPInstall.exe
                                      2008-03-30 15:19 . 2008-03-30 15:19 <REP> d-------- C:\Program Files\Fichiers communs\PocketSoft
                                      2008-03-30 15:19 . 2002-02-27 17:50 197,120 --a------ C:\WINDOWS\patchw32.dll
                                      2008-03-30 00:00 . 2008-03-30 00:00 <REP> d-------- C:\WinDev Mobile 10 Express - Installation
                                      2008-03-29 23:59 . 2008-03-29 23:59 <REP> d-------- C:\Program Files\Microsoft Synchronization Services
                                      2008-03-29 23:59 . 2008-03-29 23:59 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
                                      2008-03-29 23:48 . 2008-03-29 23:48 <REP> d-------- C:\Program Files\Microsoft.NET
                                      2008-03-29 23:48 . 2008-03-30 00:02 <REP> d-------- C:\Program Files\Microsoft Visual Studio 9.0
                                      2008-03-29 23:48 . 2008-03-30 00:09 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
                                      2008-03-29 23:47 . 2008-03-29 23:47 <REP> d-------- C:\Program Files\Microsoft SDKs
                                      2008-03-29 23:43 . 2008-03-29 23:43 <REP> d-------- C:\Program Files\MSBuild
                                      2008-03-29 23:42 . 2008-03-29 23:45 <REP> d-------- C:\WINDOWS\system32\XPSViewer
                                      2008-03-29 23:42 . 2008-03-29 23:42 <REP> d-------- C:\Program Files\Reference Assemblies
                                      2008-03-29 23:41 . 2006-06-29 14:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
                                      2008-03-29 14:29 . 2008-03-29 14:29 <REP> d-------- C:\Program Files\Ma‹do Production
                                      2008-03-29 13:16 . <REP> C:\Documents and Settings\InvitÚ\Local Settings
                                      2008-03-29 13:16 . <REP> C:\Documents and Settings\InvitÚ\Local Settings
                                      2008-03-26 05:26 . 2008-03-26 05:26 <REP> d-------- C:\Program Files\NCH Swift Sound
                                      2008-03-26 05:26 . 2008-03-26 05:26 <REP> d-------- C:\Documents and Settings\maison\Application Data\NCH Swift Sound
                                      2008-03-26 05:26 . 2008-03-26 05:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
                                      2008-03-25 21:26 . 2008-03-25 21:26 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
                                      2008-03-25 21:25 . 2008-03-25 21:25 <REP> d-------- C:\Program Files\LitexMedia
                                      2008-03-25 18:47 . 2008-03-25 18:47 <REP> d-------- C:\Program Files\Usenet.to
                                      2008-03-25 18:47 . 2008-03-25 18:48 <REP> d-------- C:\Documents and Settings\maison\Application Data\UseNeXT
                                      2008-03-25 18:31 . 2008-03-30 18:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn
                                      2008-03-25 18:31 . 2008-03-25 18:31 1,409 --a------ C:\WINDOWS\QTFont.for
                                      2008-03-24 12:39 . 2008-03-24 12:40 <REP> d-------- C:\Program Files\Babylon
                                      2008-03-24 12:39 . 2008-03-24 12:41 <REP> d-------- C:\Documents and Settings\maison\Application Data\Babylon
                                      2008-03-24 12:39 . 2008-03-24 12:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Babylon
                                      2008-03-24 11:52 . 2008-03-24 11:52 <REP> d-------- C:\Program Files\Trend Micro
                                      2008-03-23 22:24 . 2008-03-23 22:24 <REP> d-------- C:\Program Files\Enigma Software Group
                                      2008-03-22 20:31 . 2005-09-25 17:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
                                      2008-03-22 20:31 . 2003-08-13 01:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
                                      2008-03-20 16:22 . 2008-03-20 16:22 <REP> d-------- C:\Program Files\Fichiers communs\iS3
                                      2008-03-20 16:22 . 2008-03-23 22:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
                                      2008-03-20 16:22 . 2008-03-22 14:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SITEguard
                                      2008-03-09 22:47 . 2008-03-09 22:47 <REP> d-------- C:\Documents and Settings\maison\Application Data\dBpoweramp
                                      2008-03-09 22:39 . 2008-03-09 22:39 <REP> d-------- C:\Program Files\Illustrate
                                      2008-03-09 22:39 . 2008-03-09 22:43 <REP> d-------- C:\Documents and Settings\maison\Application Data\AccurateRip
                                      2008-03-09 22:39 . 2008-03-25 21:33 4,230,520 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
                                      2008-03-07 19:03 . 2008-03-07 19:03 2,496 --a------ C:\WINDOWS\system32\tmp.reg
                                      2008-03-07 19:02 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
                                      2008-03-07 19:02 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
                                      2008-03-07 19:02 . 2008-03-02 00:12 86,016 --a------ C:\WINDOWS\system32\VACFix.exe
                                      2008-03-07 19:02 . 2008-03-05 23:29 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
                                      2008-03-07 19:02 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
                                      2008-03-07 19:02 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
                                      2008-03-07 19:02 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
                                      2008-03-05 21:13 . 2008-03-05 21:13 <REP> d-------- C:\Program Files\Audacity
                                      2008-03-05 17:51 . 2008-03-05 21:08 <REP> d-------- C:\Program Files\Any Audio Converter
                                      2008-03-03 20:01 . 2008-03-03 20:03 <REP> d-------- C:\ComboFix[1]
                                      2008-03-02 13:02 . 2008-03-02 13:03 <REP> d-------- C:\Documents and Settings\All Users\Application Data\YoYoGames
                                      2008-03-02 12:34 . 2008-03-02 12:34 <REP> d-------- C:\Documents and Settings\maison\Application Data\Yahoo! Messenger
                                      2008-02-28 17:15 . 2008-02-28 17:15 <REP> d-------- C:\Program Files\Sotfone
                                      2008-02-27 18:36 . 2008-02-27 20:46 <REP> d-------- C:\Program Files\BitComet
                                      2008-02-13 12:36 . 2008-02-13 12:36 <REP> d-------- C:\digitalvideoconverter
                                      2008-02-13 12:32 . 2008-02-13 12:32 <REP> d-------- C:\Program Files\t@b
                                      2008-02-13 12:29 . 2008-02-13 12:48 <REP> d-------- C:\Program Files\CamStudio
                                      2008-02-13 00:10 . 2008-02-13 00:09 691,545 --a------ C:\WINDOWS\unins000.exe
                                      2008-02-13 00:10 . 2008-02-13 00:10 3,447 --a------ C:\WINDOWS\unins000.dat
                                      2008-02-11 23:05 . 2008-02-11 23:05 <REP> d-------- C:\Program Files\Magic Karaoke Maker
                                      2008-02-11 12:07 . 2008-02-11 12:08 <REP> d-------- C:\Program Files\PhotoFiltre
                                      2008-02-09 23:08 . 1998-02-06 22:37 299,520 --a------ C:\WINDOWS\uninst.exe
                                      2008-02-09 22:46 . 2008-02-09 22:47 <REP> d-------- C:\Program Files\IdolMusicStar
                                      2008-02-09 22:42 . 2008-02-09 22:42 <REP> d-------- C:\Program Files\Mioplanet
                                      2008-02-09 22:42 . 2008-02-09 22:42 407,047 --a------ C:\WINDOWS\system32\mioengine.exe
                                      2008-02-06 16:22 . 2008-02-06 16:22 20,344 --a------ C:\Documents and Settings\maison\Application Data\GDIPFONTCACHEV1.DAT
                                      2008-02-03 20:29 . 2008-02-03 20:29 <REP> d-------- C:\Program Files\Disney Imagineering
                                      2008-02-03 20:28 . 2008-02-03 20:30 1,143 --a------ C:\WINDOWS\disney.ini
                                      2008-02-03 20:28 . 2008-02-03 20:28 190 --a------ C:\WINDOWS\disneysy.ini
                                      2008-02-02 21:26 . 2008-02-02 21:26 <REP> d-------- C:\Program Files\Team MediaPortal
                                      2008-02-01 22:18 . 2008-02-01 22:18 146 --a------ C:\WINDOWS\W2W.ini
                                      2008-02-01 22:17 . 2008-02-09 22:43 0 --a------ C:\WINDOWS\system32\WIN.INI
                                      2008-02-01 22:17 . 2008-02-09 22:43 0 --a------ C:\WINDOWS\system32\SYSTEM.INI
                                      2008-02-01 22:16 . 2008-02-01 22:16 <REP> d-------- C:\WINDOWS\Downloaded Installations
                                      2008-02-01 22:16 . 2008-02-09 22:43 <REP> d-------- C:\Program Files\GStudio6

                                      .
                                      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                                      .
                                      2008-03-30 13:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
                                      2008-03-29 12:29 --------- d-----w C:\Program Files\Maïdo Production
                                      2008-02-13 10:29 --------- d-----w C:\Program Files\BoontyGames
                                      2008-02-13 09:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                                      2008-02-13 08:47 --------- d-----w C:\Program Files\Spybot - Search & Destroy
                                      2008-02-09 20:27 --------- d-----w C:\Documents and Settings\maison\Application Data\gtk-2.0
                                      2008-01-31 15:31 --------- d-----w C:\Program Files\Compil Games
                                      2007-05-02 11:34 92,064 -c--a-w C:\Documents and Settings\maison\mqdmmdm.sys
                                      2007-05-02 11:34 9,232 -c--a-w C:\Documents and Settings\maison\mqdmmdfl.sys
                                      2007-05-02 11:34 79,328 -c--a-w C:\Documents and Settings\maison\mqdmserd.sys
                                      2007-05-02 11:34 66,656 -c--a-w C:\Documents and Settings\maison\mqdmbus.sys
                                      2007-05-02 11:34 6,208 -c--a-w C:\Documents and Settings\maison\mqdmcmnt.sys
                                      2007-05-02 11:34 5,936 -c--a-w C:\Documents and Settings\maison\mqdmwhnt.sys
                                      2007-05-02 11:34 4,048 -c--a-w C:\Documents and Settings\maison\mqdmcr.sys
                                      2007-05-02 11:34 25,600 -c--a-w C:\Documents and Settings\maison\usbsermptxp.sys
                                      2007-05-02 11:34 22,768 -c--a-w C:\Documents and Settings\maison\usbsermpt.sys
                                      .

                                      ((((((((((((((((((((((((((((( snapshot_2008-03-24_20.15.35.70 )))))))))))))))))))))))))))))))))))))))))
                                      .
                                      + 2008-03-29 21:48:32 110,592 ----a-w C:\WINDOWS\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll
                                      + 2008-03-29 21:48:39 245,760 ----a-w C:\WINDOWS\assembly\GAC\EnvDTE\8.0.0.0__b03f5f7f11d50a3a\envdte.dll
                                      + 2008-03-29 21:49:48 135,168 ----a-w C:\WINDOWS\assembly\GAC\EnvDTE80\8.0.0.0__b03f5f7f11d50a3a\envdte80.dll
                                      + 2008-03-29 21:49:48 18,944 ----a-w C:\WINDOWS\assembly\GAC\EnvDTE90\9.0.0.0__b03f5f7f11d50a3a\envdte90.dll
                                      + 2008-03-29 21:50:25 6,656 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Internal.VisualStudio.Shell.Interop.9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.Internal.VisualStudio.Shell.Interop.9.0.dll
                                      + 2008-03-29 21:51:31 22,552 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll
                                      + 2008-03-29 21:50:02 69,632 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualStudio.CommandBars\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.CommandBars.dll
                                      + 2008-03-29 21:50:05 176,128 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualStudio.Debugger.Interop\8.0.1.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Debugger.Interop.dll
                                      + 2008-03-29 21:50:05 126,976 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualStudio.Debugger.InteropA\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Debugger.InteropA.dll
                                      + 2008-03-29 21:51:30 8,704 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualStudio.Designer.Interfaces\1.0.5000.0__b03f5f7f11d50a3a\microsoft.visualstudio.designer.interfaces.dll
                                      + 2008-03-29 21:50:12 118,784 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll
                                      + 2008-03-29 21:50:16 172,032 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualStudio.Shell.Interop.8.0\8.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.shell.interop.8.0.dll
                                      + 2008-03-29 21:50:16 40,960 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualStudio.Shell.Interop.9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.Interop.9.0.dll
                                      + 2008-03-29 21:50:16 249,856 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualStudio.Shell.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.Interop.dll
                                      + 2008-03-29 21:50:18 57,344 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualStudio.TextManager.Interop.8.0\8.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.textmanager.interop.8.0.dll
                                      + 2008-03-29 21:51:35 7,680 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualStudio.TextManager.Interop.9.0\9.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.textmanager.interop.9.0.dll
                                      + 2008-03-29 21:50:18 114,688 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualStudio.TextManager.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.TextManager.Interop.dll
                                      + 2008-03-29 21:50:20 11,264 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualStudio.VSHelp\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.VSHelp.dll
                                      + 2008-03-29 21:50:20 8,704 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualStudio.VSHelp80\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.VSHelp80.dll
                                      + 2008-03-29 21:51:31 13,312 ----a-w C:\WINDOWS\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll
                                      + 2008-03-29 21:51:39 16,384 ----a-w C:\WINDOWS\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll
                                      + 2008-03-29 21:51:06 53,248 ----a-w C:\WINDOWS\assembly\GAC\VSLangProj\7.0.3300.0__b03f5f7f11d50a3a\VSLangProj.dll
                                      + 2008-03-29 21:51:08 19,968 ----a-w C:\WINDOWS\assembly\GAC\VSLangProj2\7.0.5000.0__b03f5f7f11d50a3a\VSLangProj2.dll
                                      + 2008-03-29 21:51:11 73,728 ----a-w C:\WINDOWS\assembly\GAC\VSLangProj80\8.0.0.0__b03f5f7f11d50a3a\VSLangProj80.dll
                                      + 2008-03-29 21:51:11 5,120 ----a-w C:\WINDOWS\assembly\GAC\VslangProj90\9.0.0.0__b03f5f7f11d50a3a\VSLangProj90.dll
                                      + 2008-03-29 21:51:20 49,152 ----a-w C:\WINDOWS\assembly\GAC\VsWebSite.Interop\8.0.0.0__b03f5f7f11d50a3a\VsWebSite.Interop.dll
                                      + 2008-03-29 21:51:26 12,288 ----a-w C:\WINDOWS\assembly\GAC\VsWebSite.Interop90\9.0.0.0__b03f5f7f11d50a3a\VsWebSite.Interop90.dll
                                      - 2007-07-17 20:32:36 68,608 -c--a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
                                      + 2008-03-29 21:39:50 69,120 ----a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
                                      - 2007-07-17 20:32:46 72,192 -c--a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
                                      + 2008-03-29 21:40:00 72,192 ----a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
                                      + 2008-03-29 21:42:51 151,552 ----a-w C:\WINDOWS\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
                                      + 2008-03-29 21:48:36 573,440 ----a-w C:\WINDOWS\assembly\GAC_32\Microsoft.VisualStudio.Modeling.Sdk.Diagrams.GraphObject\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Modeling.Sdk.Diagrams.GraphObject.dll
                                      + 2008-03-29 21:50:25 1,712,128 ----a-w C:\WINDOWS\assembly\GAC_32\mscorcfg\3.5.0.0__b03f5f7f11d50a3a\mscorcfg.dll
                                      - 2007-07-17 20:32:47 4,308,992 -c--a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
                                      + 2008-03-29 21:39:25 4,444,160 ----a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
                                      + 2008-03-29 21:43:00 4,174,336 ----a-w C:\WINDOWS\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
                                      - 2007-07-17 20:32:48 482,304 -c--a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
                                      + 2008-03-29 21:40:03 483,840 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
                                      - 2007-07-17 20:32:43 2,902,016 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
                                      + 2008-03-29 21:39:38 3,036,160 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
                                      - 2007-07-17 20:32:29 258,048 -c--a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
                                      + 2008-03-29 21:40:08 258,048 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
                                      - 2007-07-17 20:32:29 114,176 -c--a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
                                      + 2008-03-29 21:40:08 113,664 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
                                      + 2008-03-29 21:42:58 346,624 ----a-w C:\WINDOWS\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
                                      - 2007-07-17 20:32:54 260,096 -c--a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
                                      + 2008-03-29 21:40:01 261,120 ----a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
                                      - 2007-07-17 20:32:39 5,156,864 -c--a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
                                      + 2008-03-29 21:39:34 5,431,296 ----a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
                                      - 2007-07-17 20:32:35 10,752 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
                                      + 2008-03-29 21:39:47 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
                                      - 2007-01-11 23:29:16 315,392 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt.resources\2.0.0.0_fr_b03f5f7f11d50a3a\aspnetmmcext.resources.dll
                                      + 2008-03-29 21:46:44 315,392 ----a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt.resources\2.0.0.0_fr_b03f5f7f11d50a3a\aspnetmmcext.resources.dll
                                      - 2007-07-17 20:32:29 507,904 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
                                      + 2008-03-29 21:39:35 507,904 ----a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
                                      - 2007-07-17 20:32:31 13,312 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
                                      + 2008-03-29 21:39:49 13,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
                                      - 2007-07-17 20:32:45 8,192 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
                                      + 2008-03-29 21:39:55 8,192 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
                                      - 2007-07-17 20:32:45 36,864 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
                                      + 2008-03-29 21:39:56 77,824 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
                                      - 2007-07-17 20:32:46 5,632 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
                                      + 2008-03-29 21:39:57 6,656 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
                                      + 2008-03-29 21:45:46 12,288 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Conversion.v3.5.resources.dll
                                      + 2008-03-29 21:44:02 106,496 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v3.5.dll
                                      - 2007-01-11 23:29:18 53,248 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Engine.resources.dll
                                      + 2008-03-29 21:46:52 53,248 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Engine.resources.dll
                                      + 2008-03-29 21:45:46 69,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Engine.resources.dll
                                      - 2007-07-17 20:32:32 413,696 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
                                      + 2008-03-29 21:40:09 348,160 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
                                      + 2008-03-29 21:44:03 737,280 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
                                      - 2007-07-17 20:32:33 36,864 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
                                      + 2008-03-29 21:40:09 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
                                      + 2008-03-29 21:44:03 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
                                      - 2007-01-11 23:29:19 139,264 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Tasks.resources.dll
                                      + 2008-03-29 21:46:52 139,264 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Tasks.resources.dll
                                      + 2008-03-29 21:45:46 155,648 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Tasks.v3.5.resources.dll
                                      + 2008-03-29 21:44:04 794,624 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v3.5.dll
                                      - 2007-07-17 20:32:34 647,168 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
                                      + 2008-03-29 21:40:11 655,360 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
                                      - 2007-01-11 23:29:19 10,240 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Utilities.Resources.dll
                                      + 2008-03-29 21:46:53 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Utilities.Resources.dll
                                      + 2008-03-29 21:45:46 11,776 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Utilities.v3.5.resources.dll
                                      + 2008-03-29 21:44:04 94,208 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v3.5.dll
                                      - 2007-07-17 20:32:34 73,728 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
                                      + 2008-03-29 21:40:12 77,824 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
                                      - 2007-01-11 23:29:17 45,056 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.JScript.Resources.dll
                                      + 2008-03-29 21:46:45 45,056 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.JScript.Resources.dll
                                      - 2007-07-17 20:32:32 749,568 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
                                      + 2008-03-29 21:39:58 749,568 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
                                      + 2008-03-29 21:50:00 69,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.MSXML\8.0.0.0__b03f5f7f11d50a3a\microsoft.msxml.dll
                                      + 2008-03-29 21:59:46 38,256 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Synchronization.Data.resources\1.0.0.0_fr_89845dcd8080cc91\Microsoft.Synchronization.Data.resources.dll
                                      + 2008-03-29 21:59:46 99,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Synchronization.Data.Server\1.0.0.0__89845dcd8080cc91\Microsoft.Synchronization.Data.Server.dll
                                      + 2008-03-29 21:59:46 91,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\Microsoft.Synchronization.Data.SqlServerCe.dll
                                      + 2008-03-29 21:59:46 111,984 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\Microsoft.Synchronization.Data.dll
                                      + 2008-03-29 21:45:35 5,120 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.resources\3.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.Resources.dll
                                      + 2008-03-29 21:45:35 19,456 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.resources\3.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Resources.dll
                                      + 2008-03-29 21:42:52 397,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll
                                      - 2007-01-11 23:29:21 9,216 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\microsoft.visualbasic.compatibility.data.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.resources.dll
                                      + 2008-03-29 21:46:59 9,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\microsoft.visualbasic.compatibility.data.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.resources.dll
                                      - 2007-07-17 20:33:00 110,592 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
                                      + 2008-03-29 21:39:56 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
                                      - 2007-01-11 23:29:20 9,728 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\microsoft.visualbasic.compatibility.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.resources.dll
                                      + 2008-03-29 21:46:59 9,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\microsoft.visualbasic.compatibility.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.resources.dll
                                      - 2007-07-17 20:33:00 372,736 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
                                      + 2008-03-29 21:39:54 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
                                      + 2008-03-29 21:50:42 6,144 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.PowerPacks.Vs.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.PowerPacks.Vs.resources.dll
                                      + 2008-03-29 21:50:42 73,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.PowerPacks.Vs\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.PowerPacks.Vs.dll
                                      + 2008-03-29 21:50:44 4,096 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.PowerPacks.VsPackage.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.PowerPacks.VsPackage.resources.dll
                                      + 2008-03-29 21:50:43 8,704 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.PowerPacks.VsPackage\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.PowerPacks.VsPackage.dll
                                      - 2007-01-11 23:29:20 61,440 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.resources.dll
                                      + 2008-03-29 21:46:59 61,440 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.resources.dll
                                      - 2007-07-17 20:32:26 28,672 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
                                      + 2008-03-29 21:40:03 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
                                      - 2007-07-17 20:32:59 667,648 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
                                      + 2008-03-29 21:39:53 671,744 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
                                      + 2008-03-29 21:44:03 41,984 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll
                                      - 2007-07-17 20:33:01 5,632 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
                                      + 2008-03-29 21:39:29 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
                                      + 2008-03-29 21:50:03 61,440 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.CommonIDE.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.CommonIDE.resources.dll
                                      + 2008-03-29 21:50:03 671,744 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.CommonIDE\9.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.commonide.dll
                                      + 2008-03-29 21:50:03 8,192 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Configuration.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Configuration.Resources.dll
                                      + 2008-03-29 21:50:03 106,496 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Configuration\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Configuration.dll
                                      + 2008-03-29 21:51:39 4,096 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Data.Core.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Data.Core.Resources.dll
                                      + 2008-03-29 21:51:39 13,824 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Data.Core\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Data.Core.dll
                                      + 2008-03-29 21:51:39 11,776 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Data.Framework.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Data.Framework.Resources.dll
                                      + 2008-03-29 21:51:39 172,032 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Data.Framework\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Data.Framework.dll
                                      + 2008-03-29 21:51:40 94,208 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Data.Services.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Data.Services.Resources.dll
                                      + 2008-03-29 21:51:40 200,704 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Data.Services\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Data.Services.dll
                                      + 2008-03-29 21:49:32 7,680 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Debugger.Runtime\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Debugger.Runtime.dll
                                      + 2008-03-29 21:50:05 49,152 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.DebuggerVisualizers\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.DebuggerVisualizers.dll
                                      + 2008-03-29 21:50:07 15,360 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Design.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Design.Resources.dll
                                      + 2008-03-29 21:50:06 557,056 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Design\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Design.dll
                                      + 2008-03-29 21:50:09 1,028,096 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Editors.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Editors.Resources.dll
                                      + 2008-03-29 21:50:08 2,711,552 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Editors\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Editors.dll
                                      + 2008-03-29 21:50:11 17,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.HostingProcess.Utilities.Sync\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll
                                      + 2008-03-29 21:50:12 57,344 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.HostingProcess.Utilities\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.HostingProcess.Utilities.dll
                                      + 2008-03-29 21:50:12 19,456 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.ManagedInterfaces.9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.ManagedInterfaces.9.0.dll
                                      + 2008-03-29 21:50:12 15,872 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.ManagedInterfaces.WCF\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.ManagedInterfaces.WCF.dll
                                      + 2008-03-29 21:50:12 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.ManagedInterfaces\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.ManagedInterfaces.dll
                                      + 2008-03-29 21:48:37 69,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Modeling.Sdk.Diagrams.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Modeling.Sdk.Diagrams.Resources.dll
                                      + 2008-03-29 21:48:35 827,392 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Modeling.Sdk.Diagrams\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Modeling.Sdk.Diagrams.dll
                                      + 2008-03-29 21:48:37 77,824 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Modeling.Sdk.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Modeling.Sdk.Resources.dll
                                      + 2008-03-29 21:48:38 73,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Modeling.Sdk.Shell.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Modeling.Sdk.Shell.Resources.dll
                                      + 2008-03-29 21:48:37 307,200 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Modeling.Sdk.Shell\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Modeling.Sdk.Shell.dll
                                      + 2008-03-29 21:48:34 430,080 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Modeling.Sdk\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Modeling.Sdk.dll
                                      + 2008-03-29 21:50:13 5,120 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Package.LanguageService.9.0.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Package.LanguageService.9.0.resources.dll
                                      + 2008-03-29 21:50:13 348,160 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Package.LanguageService.9.0\3.5.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Package.LanguageService.9.0.dll
                                      + 2008-03-29 21:50:12 5,120 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Package.LanguageService.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Package.LanguageService.resources.dll
                                      + 2008-03-29 21:50:13 344,064 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Package.LanguageService\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Package.LanguageService.dll
                                      + 2008-03-29 21:50:13 4,096 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.ProjectAggregator\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.ProjectAggregator.dll
                                      + 2008-03-29 21:50:14 405,504 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Publish.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Publish.Resources.dll
                                      + 2008-03-29 21:50:14 790,528 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Publish\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Publish.dll
                                      + 2008-03-29 21:50:15 8,192 ----a-w C:\WINDOWS\assembly\GAC_MSIL\microsoft.visualstudio.resources\9.0.0.0_fr_b03f5f7f11d50a3a\microsoft.visualstudio.Resources.dll
                                      + 2008-03-29 21:50:15 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Shell.9.0.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.9.0.resources.dll
                                      + 2008-03-29 21:50:15 356,352 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Shell.9.0\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.9.0.dll
                                      + 2008-03-29 21:50:16 24,576 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Shell.Design.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.Design.Resources.dll
                                      + 2008-03-29 21:50:15 184,320 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Shell.Design\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.Design.dll
                                      + 2008-03-29 21:50:16 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Shell.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.Resources.dll
                                      + 2008-03-29 21:50:16 368,640 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Shell\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.dll
                                      + 2008-03-29 21:50:18 15,872 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.TemplateWizardInterface\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.TemplateWizardInterface.dll
                                      + 2008-03-29 21:48:38 13,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.TextTemplating.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.TextTemplating.Resources.dll
                                      + 2008-03-29 21:48:39 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.TextTemplating.VSHost.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.TextTemplating.VSHost.Resources.dll
                                      + 2008-03-29 21:48:38 98,304 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.TextTemplating.VSHost\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.TextTemplating.VSHost.dll
                                      + 2008-03-29 21:48:38 86,016 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.TextTemplating\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.TextTemplating.dll
                                      + 2008-03-29 21:50:19 16,384 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.VSContentInstaller\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.VSContentInstaller.dll
                                      + 2008-03-29 21:50:20 16,384 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.WCFReference.Interop\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.WCFReference.Interop.dll
                                      + 2008-03-29 21:50:21 86,016 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Windows.Forms.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Windows.Forms.Resources.dll
                                      + 2008-03-29 21:50:20 552,960 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Windows.Forms\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Windows.Forms.dll
                                      + 2008-03-29 21:51:26 19,456 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.WizardFramework.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.WizardFramework.Resources.Dll
                                      + 2008-03-29 21:51:43 73,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.WizardFramework\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.WizardFramework.Dll
                                      + 2008-03-29 21:51:44 69,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Xaml.LanguageService.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Xaml.LanguageService.resources.dll
                                      + 2008-03-29 21:51:44 188,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Xaml.LanguageService\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Xaml.LanguageService.dll
                                      + 2008-03-29 21:51:44 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Xaml.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Xaml.resources.dll
                                      + 2008-03-29 21:51:44 1,191,936 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Xaml\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Xaml.dll
                                      + 2008-03-29 21:50:24 12,288 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.XmlEditor\3.5.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.XmlEditor.dll
                                      + 2008-03-29 21:50:21 15,360 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Zip.9.0.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Zip.9.0.resources.dll
                                      + 2008-03-29 21:50:21 65,536 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Zip.9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Zip.9.0.dll
                                      + 2008-03-29 21:50:22 15,360 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Zip.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualStudio.Zip.resources.dll
                                      + 2008-03-29 21:50:22 61,440 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Zip\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Zip.dll
                                      + 2008-03-29 21:50:07 274,432 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio\9.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.dll
                                      - 2007-07-17 20:32:28 12,800 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
                                      + 2008-03-29 21:40:06 12,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
                                      - 2007-07-17 20:32:28 32,768 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
                                      + 2008-03-29 21:39:52 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
                                      + 2008-03-29 21:51:30 1,056,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VSDesigner.resources\9.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VSDesigner.Resources.DLL
                                      + 2008-03-29 21:50:23 4,386,816 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VSDesigner\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VSDesigner.dll
                                      + 2008-03-29 21:51:44 184,320 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Windows.Design.Developer.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Windows.Design.Developer.resources.dll
                                      + 2008-03-29 21:51:44 962,560 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Windows.Design.Developer\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Windows.Design.Developer.dll
                                      + 2008-03-29 21:51:44 6,144 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Windows.Design.Extensibility.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Windows.Design.Extensibility.resources.dll
                                      + 2008-03-29 21:51:44 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Windows.Design.Extensibility\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Windows.Design.Extensibility.dll
                                      + 2008-03-29 21:51:47 3,584 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Windows.Design.Host.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Windows.Design.Host.resources.dll
                                      + 2008-03-29 21:51:47 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Windows.Design.Host\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Windows.Design.Host.dll
                                      + 2008-03-29 21:51:47 11,776 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Windows.Design.Interaction.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Windows.Design.Interaction.resources.dll
                                      + 2008-03-29 21:51:47 159,744 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Windows.Design.Interaction\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Windows.Design.Interaction.dll
                                      + 2008-03-29 21:51:51 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Windows.Design.Markup.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Windows.Design.Markup.resources.dll
                                      + 2008-03-29 21:51:51 737,280 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Windows.Design.Markup\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Windows.Design.Markup.dll
                                      + 2008-03-29 21:51:44 7,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Windows.Design.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Windows.Design.resources.dll
                                      + 2008-03-29 21:51:44 106,496 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Windows.Design\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Windows.Design.dll
                                      - 2007-07-17 20:32:28 7,168 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
                                      + 2008-03-29 21:39:52 7,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
                                      + 2008-03-29 21:50:26 786,432 ----a-w C:\WINDOWS\assembly\GAC_MSIL\mscorcfg.resources\3.5.0.0_fr_b03f5f7f11d50a3a\mscorcfg.resources.dll
                                      - 2007-01-11 23:29:19 311,296 ----a-w C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_fr_b77a5c561934e089\mscorlib.Resources.dll
                                      + 2008-03-29 21:46:53 311,296 ----a-w C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_fr_b77a5c561934e089\mscorlib.Resources.dll
                                      + 2008-03-29 21:50:29 40,960 ----a-w C:\WINDOWS\assembly\GAC_MSIL\msddslmp\8.0.0.0__b03f5f7f11d50a3a\msddslmp.dll
                                      + 2008-03-29 21:50:28 139,264 ----a-w C:\WINDOWS\assembly\GAC_MSIL\msddsp\9.0.0.0__b03f5f7f11d50a3a\msddsp.dll
                                      + 2008-03-29 21:45:39 57,344 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationBuildTasks.resources\3.0.0.0_fr_31bf3856ad364e35\PresentationBuildTasks.resources.dll
                                      + 2008-03-29 21:42:48 602,112 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\PresentationBuildTasks.dll
                                      + 2008-03-29 21:43:00 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\PresentationCFFRasterizer.dll
                                      + 2008-03-29 21:45:38 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_fr_31bf3856ad364e35\PresentationCore.resources.dll
                                      + 2008-03-29 21:42:56 184,320 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll
                                      + 2008-03-29 21:42:55 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll
                                      + 2008-03-29 21:42:55 376,832 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll
                                      + 2008-03-29 21:45:39 253,952 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_fr_31bf3856ad364e35\PresentationFramework.resources.dll
                                      + 2008-03-29 21:42:55 151,552 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll
                                      + 2008-03-29 21:42:55 5,210,112 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll
                                      + 2008-03-29 21:45:38 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationUI.resources\3.0.0.0_fr_31bf3856ad364e35\PresentationUI.resources.dll
                                      + 2008-03-29 21:42:54 897,024 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\PresentationUI.dll
                                      + 2008-03-29 21:45:38 40,960 ----a-w C:\WINDOWS\assembly\GAC_MSIL\ReachFramework.resources\3.0.0.0_fr_31bf3856ad364e35\ReachFramework.resources.dll
                                      + 2008-03-29 21:42:59 528,384 ----a-w C:\WINDOWS\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\ReachFramework.dll
                                      + 2008-03-29 21:45:35 5,120 ----a-w C:\WINDOWS\assembly\GAC_MSIL\SMDiagnostics.resources\3.0.0.0_fr_b77a5c561934e089\SMDiagnostics.resources.dll
                                      + 2008-03-29 21:42:52 102,400 ----a-w C:\WINDOWS\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll
                                      - 2007-01-11 23:29:20 10,752 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl.resources\2.0.0.0_fr_b03f5f7f11d50a3a\sysglobl.resources.dll
                                      + 2008-03-29 21:46:57 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl.resources\2.0.0.0_fr_b03f5f7f11d50a3a\sysglobl.resources.dll
                                      - 2007-07-17 20:32:51 110,592 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
                                      + 2008-03-29 21:39:58 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
                                      + 2008-03-29 21:44:06 40,960 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll
                                      + 2008-03-29 21:44:06 159,744 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\System.AddIn.dll
                                      - 2007-01-11 23:29:19 28,672 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Configuration.Install.Resources.dll
                                      + 2008-03-29 21:46:54 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Configuration.Install.Resources.dll
                                      - 2007-07-17 20:32:36 81,920 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
                                      + 2008-03-29 21:39:59 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
                                      - 2007-01-11 23:29:20 49,152 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\system.configuration.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Configuration.resources.dll
                                      + 2008-03-29 21:46:58 49,152 ----a-w C:\WINDOWS\assembly\GAC_MSIL\system.configuration.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Configuration.resources.dll
                                      - 2007-07-17 20:32:52 413,696 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
                                      + 2008-03-29 21:39:36 425,984 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
                                      + 2008-03-29 21:45:47 61,440 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Core.resources\3.5.0.0_fr_b77a5c561934e089\System.Core.Resources.dll
                                      + 2008-03-29 21:44:07 663,552 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.dll
                                      + 2008-03-29 21:45:47 5,120 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.DataSetExtensions.resources\3.5.0.0_fr_b77a5c561934e089\System.Data.DataSetExtensions.Resources.dll
                                      + 2008-03-29 21:44:07 53,248 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll
                                      + 2008-03-29 21:45:46 57,344 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.Linq.resources\3.5.0.0_fr_b77a5c561934e089\System.Data.Linq.Resources.dll
                                      + 2008-03-29 21:44:01 667,648 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089\System.Data.Linq.dll
                                      - 2007-01-11 23:29:19 110,592 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.OracleClient.resources\2.0.0.0_fr_b77a5c561934e089\System.Data.OracleClient.resources.dll
                                      + 2008-03-29 21:46:54 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.OracleClient.resources\2.0.0.0_fr_b77a5c561934e089\System.Data.OracleClient.resources.dll
                                      - 2007-01-11 23:29:18 335,872 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.resources\2.0.0.0_fr_b77a5c561934e089\System.Data.Resources.dll
                                      + 2008-03-29 21:46:49 344,064 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.resources\2.0.0.0_fr_b77a5c561934e089\System.Data.Resources.dll
                                      + 2008-03-29 21:59:46 42,064 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlServerCe.resources\3.5.0.0_fr_89845dcd8080cc91\System.Data.SqlServerCe.resources.dll
                                      + 2008-03-29 21:59:46 263,248 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\System.Data.SqlServerCe.dll
                                      - 2007-01-11 23:29:19 36,864 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml.resources\2.0.0.0_fr_b77a5c561934e089\system.data.sqlxml.resources.dll
                                      + 2008-03-29 21:46:55 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml.resources\2.0.0.0_fr_b77a5c561934e089\system.data.sqlxml.resources.dll
                                      - 2007-07-17 20:32:49 716,800 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
                                      + 2008-03-29 21:39:40 741,376 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
                                      - 2007-01-11 23:29:17 385,024 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Deployment.resources.dll
                                      + 2008-03-29 21:46:44 389,120 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Deployment.resources.dll
                                      - 2007-07-17 20:32:30 888,832 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
                                      + 2008-03-29 21:39:41 933,888 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
                                      - 2007-01-11 23:29:18 544,768 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Design.Resources.dll
                                      + 2008-03-29 21:46:50 544,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Design.Resources.dll
                                      - 2007-07-17 20:32:44 5,001,216 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
                                      + 2008-03-29 21:40:13 5,070,848 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
                                      + 2008-03-29 21:45:45 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement.resources\3.5.0.0_fr_b77a5c561934e089\System.DirectoryServices.AccountManagement.resources.dll
                                      + 2008-03-29 21:44:01 282,624 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll
                                      - 2007-01-11 23:29:17 28,672 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.DirectoryServices.Protocols.resources.dll
                                      + 2008-03-29 21:46:46 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.DirectoryServices.Protocols.resources.dll
                                      - 2007-07-17 20:32:37 188,416 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
                                      + 2008-03-29 21:40:10 188,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
                                      - 2007-01-11 23:29:17 40,960 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.DirectoryServices.Resources.dll
                                      + 2008-03-29 21:46:46 40,960 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.DirectoryServices.Resources.dll
                                      - 2007-07-17 20:32:37 397,312 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
                                      + 2008-03-29 21:39:47 401,408 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
                                      - 2007-01-11 23:29:19 6,144 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Drawing.Design.Resources.dll
                                      + 2008-03-29 21:46:55 6,144 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Drawing.Design.Resources.dll
                                      - 2007-07-17 20:32:38 81,920 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
                                      + 2008-03-29 21:40:05 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
                                      - 2007-01-11 23:29:18 15,360 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Drawing.Resources.dll
                                      + 2008-03-29 21:46:50 15,360 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Drawing.Resources.dll
                                      - 2007-07-17 20:32:53 577,536 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
                                      + 2008-03-29 21:39:30 630,784 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
                                      - 2007-01-11 23:29:17 32,768 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.EnterpriseServices.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.EnterpriseServices.Resources.dll
                                      + 2008-03-29 21:46:45 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.EnterpriseServices.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.EnterpriseServices.Resources.dll
                                      + 2008-03-29 21:45:35 65,536 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.IdentityModel.resources\3.0.0.0_fr_b77a5c561934e089\System.IdentityModel.Resources.dll
                                      + 2008-03-29 21:45:35 57,344 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.IdentityModel.Selectors.resources\3.0.0.0_fr_b77a5c561934e089\System.IdentityModel.Selectors.Resources.dll
                                      + 2008-03-29 21:43:02 126,976 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.IdentityModel.Selectors\3.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll
                                      + 2008-03-29 21:43:02 430,080 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll
                                      + 2008-03-29 21:45:35 12,288 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.IO.Log.resources\3.0.0.0_fr_b03f5f7f11d50a3a\System.IO.Log.Resources.dll
                                      + 2008-03-29 21:42:51 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.IO.Log\3.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll
                                      + 2008-03-29 21:45:47 11,264 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management.Instrumentation.resources\3.5.0.0_fr_b77a5c561934e089\System.Management.Instrumentation.Resources.dll
                                      + 2008-03-29 21:44:07 139,264 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management.Instrumentation\3.5.0.0__b77a5c561934e089\System.Management.Instrumentation.dll
                                      - 2007-01-11 23:29:20 13,312 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Management.Resources.dll
                                      + 2008-03-29 21:46:56 13,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Management.Resources.dll
                                      - 2007-07-17 20:32:50 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
                                      + 2008-03-29 21:40:07 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
                                      - 2007-01-11 23:29:18 61,440 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Messaging.Resources.dll
                                      + 2008-03-29 21:46:51 61,440 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Messaging.Resources.dll
                                      - 2007-07-17 20:32:54 258,048 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
                                      + 2008-03-29 21:40:04 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
                                      + 2008-03-29 21:45:49 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Net.resources\3.5.0.0_fr_b03f5f7f11d50a3a\System.Net.Resources.dll
                                      + 2008-03-29 21:44:10 233,472 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Net\3.5.0.0__b03f5f7f11d50a3a\System.Net.dll
                                      + 2008-03-29 21:45:38 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Printing.resources\3.0.0.0_fr_31bf3856ad364e35\System.Printing.resources.dll
                                      - 2007-01-11 23:29:18 212,992 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.resources\2.0.0.0_fr_b77a5c561934e089\system.Resources.dll
                                      + 2008-03-29 21:46:51 212,992 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.resources\2.0.0.0_fr_b77a5c561934e089\system.Resources.dll
                                      - 2007-01-11 23:29:20 32,768 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_fr_b77a5c561934e089\System.Runtime.Remoting.Resources.dll
                                      + 2008-03-29 21:46:56 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_fr_b77a5c561934e089\System.Runtime.Remoting.Resources.dll
                                      - 2007-07-17 20:32:50 299,008 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
                                      + 2008-03-29 21:40:02 299,008 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
                                      - 2007-01-11 23:29:20 11,776 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.Resources.dll
                                      + 2008-03-29 21:46:57 11,776 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.Resources.dll
                                      - 2007-07-17 20:32:51 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
                                      + 2008-03-29 21:40:01 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
                                      + 2008-03-29 21:45:35 98,304 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.resources\3.0.0.0_fr_b77a5c561934e089\System.RunTime.Serialization.Resources.dll
                                      + 2008-03-29 21:42:51 929,792 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll
                                      - 2007-01-11 23:29:17 28,672 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Security.Resources.dll
                                      + 2008-03-29 21:46:45 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Security.Resources.dll
                                      - 2007-07-17 20:32:35 258,048 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
                                      + 2008-03-29 21:39:32 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
                                      + 2008-03-29 21:45:35 40,960 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceModel.Install.resources\3.0.0.0_fr_b77a5c561934e089\System.ServiceModel.Install.Resources.dll
                                      + 2008-03-29 21:42:49 159,744 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\System.ServiceModel.Install.dll
                                      + 2008-03-29 21:45:35 499,712 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceModel.resources\3.0.0.0_fr_b77a5c561934e089\System.ServiceModel.Resources.dll
                                      + 2008-03-29 21:42:49 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
                                      + 2008-03-29 21:45:45 70,712 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceModel.Web.resources\3.5.0.0_fr_31bf3856ad364e35\System.ServiceModel.Web.resources.dll
                                      + 2008-03-29 21:44:00 496,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll
                                      + 2008-03-29 21:42:50 5,971,968 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
                                      - 2007-01-11 23:29:17 40,960 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.ServiceProcess.Resources.dll
                                      + 2008-03-29 21:46:47 40,960 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.ServiceProcess.Resources.dll
                                      - 2007-07-17 20:32:38 114,688 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
                                      + 2008-03-29 21:39:32 114,688 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
                                      + 2008-03-29 21:45:37 65,536 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Speech.resources\3.0.0.0_fr_31bf3856ad364e35\System.Speech.resources.dll
                                      + 2008-03-29 21:42:48 688,128 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Speech\3.0.0.0__31bf3856ad364e35\System.Speech.dll
                                      - 2007-01-11 23:29:20 16,896 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Transactions.resources\2.0.0.0_fr_b77a5c561934e089\System.Transactions.resources.dll
                                      + 2008-03-29 21:46:57 16,896 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Transactions.resources\2.0.0.0_fr_b77a5c561934e089\System.Transactions.resources.dll
                                      + 2008-03-29 21:45:47 49,152 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Extensions.Design.resources\3.5.0.0_fr_31bf3856ad364e35\System.Web.Extensions.Design.Resources.dll
                                      + 2008-03-29 21:44:11 327,680 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Extensions.Design\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.Design.dll
                                      + 2008-03-29 21:45:47 651,264 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Extensions.resources\3.5.0.0_fr_31bf3856ad364e35\System.Web.Extensions.Resources.dll
                                      + 2008-03-29 21:44:12 1,253,376 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
                                      - 2007-01-11 23:29:20 81,920 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Web.Mobile.resources.dll
                                      + 2008-03-29 21:46:58 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Web.Mobile.resources.dll
                                      - 2007-07-17 20:32:55 835,584 -c--a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
                                      + 2008-03-29 21:39:45 884,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
                                      - 2007-07-17
                                      0
                                      1. g!rly Contributeur
                                        jojo51,

                                        post un nouveau rapport hijack this stp

                                        @+
                                        0
                                        1. jojo51
                                          Logfile of Trend Micro HijackThis v2.0.2
                                          Scan saved at 12:45:13, on 02/04/2008
                                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                                          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                                          Boot mode: Normal

                                          Running processes:
                                          C:\WINDOWS\System32\smss.exe
                                          C:\WINDOWS\system32\winlogon.exe
                                          C:\WINDOWS\system32\services.exe
                                          C:\WINDOWS\system32\lsass.exe
                                          C:\WINDOWS\system32\svchost.exe
                                          C:\WINDOWS\System32\svchost.exe
                                          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                          C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                          C:\WINDOWS\system32\spoolsv.exe
                                          C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                          C:\WINDOWS\system32\nvsvc32.exe
                                          C:\WINDOWS\system32\svchost.exe
                                          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                          C:\WINDOWS\SOUNDMAN.EXE
                                          C:\WINDOWS\system32\VTTimer.exe
                                          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                          C:\Program Files\QuickTime\qttask.exe
                                          C:\WINDOWS\osd.exe
                                          C:\WINDOWS\Resources\Themes\VistaXP\glass\Glass2k.exe
                                          C:\WINDOWS\Resources\Themes\VistaXP\vt\VisualToolTip.exe
                                          C:\WINDOWS\system32\ctfmon.exe
                                          C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                          C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                          C:\WINDOWS\Resources\Themes\VistaXP\y3d\Yodm3D.exe
                                          C:\WINDOWS\explorer.exe
                                          C:\WINDOWS\system32\wuauclt.exe
                                          C:\Program Files\Outlook Express\msimn.exe
                                          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
                                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
                                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                          R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
                                          O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
                                          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                                          O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                                          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
                                          O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
                                          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                                          O3 - Toolbar: (no name) - {98828DED-A591-462F-83BA-D2F62A68B8B8} - (no file)
                                          O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                                          O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
                                          O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
                                          O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
                                          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                                          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                                          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                          O4 - HKLM\..\Run: [OSD] C:\WINDOWS\osd.exe
                                          O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
                                          O4 - HKLM\..\Run: [Glass2k] C:\WINDOWS\Resources\Themes\VistaXP\glass\Glass2k.exe
                                          O4 - HKLM\..\Run: [VisualTooltip] C:\WINDOWS\Resources\Themes\VistaXP\vt\VisualToolTip.exe
                                          O4 - HKLM\..\Run: [OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
                                          O4 - HKLM\..\Run: [BM4bb202ce] Rundll32.exe "C:\WINDOWS\system32\mmbculfo.dll",s
                                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                                          O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2454111 14
                                          O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                          O4 - HKCU\..\Run: [Yahoo! Pager] ~c:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
                                          O4 - HKCU\..\Run: [Yodm3D] C:\WINDOWS\Resources\Themes\VistaXP\y3d\Yodm3D.exe
                                          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                          O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                                          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                                          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                                          O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                          O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                                          O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                                          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                                          O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                                          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                          O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                          O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                          O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                                          O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                                          0
                                          • 1
                                          • 2
                                          • 3

                                          Discussions similaires

                                          Infecte par un virus
                                          sapard

                                          3 réponses
                                          Mon ordinateur a été infecté par un virus ou
                                          henry4002

                                          6 réponses
                                          Infecter par Trojan:Win32/Skeeyah.A!rfn
                                          yukiwii-

                                          6 réponses
                                          sos infecte par keylogger, spoofing
                                          juni11590

                                          22 réponses
                                          Je dois être infecter par un virus ! PUP.Optional.StartPage
                                          zentone

                                          15 réponses