Virus trojan

julian26 -

Bonjour,
probleme de virus.voici mon log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:17:12, on 31/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\Explorer.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Capucine\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Capucine\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0B015876-A08C-9D2E-EE9D-9172C7F7FCAD} - C:\WINDOWS\system32\fzzomq.dll (file missing)
O2 - BHO: (no name) - {4B18DD50-C996-44fc-AC52-0FECFF82ED58} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {D262C9E6-55DC-414F-8410-AEBF9814262A} - C:\WINDOWS\System32\dlahh.dll (file missing)
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exe
O4 - HKLM\..\Run: [cisaiitj] C:\WINDOWS\system32\gmwbepdd.exe
O4 - HKLM\..\Run: [webrebates] "C:\Program Files\WebRebates4\webrebates.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Nfiom] C:\WINDOWS\system32\w?aclt.exe
O4 - HKCU\..\Run: [Sra] "C:\PROGRA~1\YSTEM~1\userinit.exe" -vt mt
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [Sra] "C:\DOCUME~1\Capucine\MESDOC~1\CROSOF~1.NET\mmc.exe" -vt ndrv (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Lvospk] C:\WINDOWS\?icrosoft\w?auboot.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Sra] "C:\DOCUME~1\Capucine\MESDOC~1\CROSOF~1.NET\mmc.exe" -vt ndrv (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://c:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Web Rebates. - file://C:\Program Files\WebRebates4\websrebates\webtrebates\toprC0.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: ShopperReports - Compare travel rates - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted IP range: 213.159.117.133
O15 - Trusted IP range: 213.159.117.133 (HKLM)
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=714b9e99bb1ec51fadc828f5983e23109b906c2b320d9f1b39ed54699be7e97f4caf42694383070009646062296ff92e68cfba8c:eb8a1fb09d00c5943edceabcca450006
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Filter: text/plain - {380B9B69-6FB2-447C-8856-DD9851C7E886} - C:\WINDOWS\System32\dlahh.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 11287 bytes

Configuration: Windows XP
Internet Explorer 7.0

Afficher la suite

6 réponses

Réponse 1 / 6
jlpjlp Contributeur sécurité
Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O2 - BHO: (no name) - {0B015876-A08C-9D2E-EE9D-9172C7F7FCAD} - C:\WINDOWS\system32\fzzomq.dll (file missing)
O2 - BHO: (no name) - {4B18DD50-C996-44fc-AC52-0FECFF82ED58} - (no file)
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [cisaiitj] C:\WINDOWS\system32\gmwbepdd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [Nfiom] C:\WINDOWS\system32\w?aclt.exe
O4 - HKCU\..\Run: [Sra] "C:\PROGRA~1\YSTEM~1\userinit.exe" -vt mt
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [Sra] "C:\DOCUME~1\Capucine\MESDOC~1\CROSOF~1.NET\mmc.exe" -vt ndrv (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Lvospk] C:\WINDOWS\?icrosoft\w?auboot.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Sra] "C:\DOCUME~1\Capucine\MESDOC~1\CROSOF~1.NET\mmc.exe" -vt ndrv (User 'Default user')
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted IP range: 213.159.117.133
O15 - Trusted IP range: 213.159.117.133 (HKLM)
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/...

__________________

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum
_______________________

télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :
C:\WINDOWS\system32\gmwbepdd.exe
C:\WINDOWS\system32\w?aclt.exe
C:\PROGRA~1\YSTEM~1\userinit.exe
C:\WINDOWS\?icrosoft\w?auboot.exe
C:\DOCUME~1\Capucine\MESDOC~1\CROSOF~1.NET\mmc.exe

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
__________

Mettre a jour java:
https://www.malekal.com/maintenir-java-adobe-reader-et-le-player-flash-a-jour/

_____________

colle le rapport d'un scan en ligne
avec un des suivants:

bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
_______________
recolle un rapport hijackthis

1

Réagir
Réponse 2 / 6
jlpjlp Contributeur sécurité
slt,

lance cwshredder (faire fix)
https://www.trendmicro.com/en_us/forHome.html
https://www.01net.com/actualites/
_______

Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
______________

recolle un hijackhtis et explique cette fois correctzmznt tes soucis

0

Réagir
1. julian26 Auteur
  
  voia le rapport.en fait c'est lorsque je quitte internet que plusieurs virus apparaissent.Trojan.downloader.injecter.E
  ComboFix 08-03-30.3 - Capucine 2008-03-31 18:34:53.2 - NTFSx86
  Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.554 [GMT 2:00]
  Endroit: C:\Documents and Settings\Capucine\Local Settings\Temporary Internet Files\Content.IE5\95UUQCYE\ComboFix[1].exe
  * Création d'un nouveau point de restauration
  * Resident AV is active
  
  .
  
  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\Program Files\MyWay
  C:\Program Files\MyWay\myBar\1.bin\PARTNER.BMP
  C:\Program Files\MyWay\myBar\1.bin\PARTNER.DAT
  C:\Program Files\MyWay\myBar\1.bin\PARTNER2.DAT
  C:\Program Files\MyWay\myBar\1.bin\PARTNER3.DAT
  C:\Program Files\MyWay\myBar\1.bin\PARTNER4.DAT
  C:\Program Files\MyWay\myBar\1.bin\PARTNER5.DAT
  C:\Program Files\MyWay\myBar\1.bin\PARTNER6.DAT
  C:\Program Files\MyWay\myBar\Cache\[u]0/u0014244
  C:\Program Files\MyWay\myBar\Cache\[u]0/u0059B0F.bin
  C:\Program Files\MyWay\myBar\Cache\[u]0/u005A4A4.bin
  C:\Program Files\MyWay\myBar\Cache\[u]0/u005A705.bin
  C:\Program Files\MyWay\myBar\Cache\[u]0/u005E68F.bmp
  C:\Program Files\MyWay\myBar\Cache\[u]0/u00BBF62
  C:\Program Files\MyWay\myBar\Cache\[u]0/u0AFB11C
  C:\Program Files\MyWay\myBar\Cache\[u]0/u1B46875
  C:\Program Files\MyWay\myBar\Cache\[u]0/u4F5889C
  C:\Program Files\MyWay\myBar\Cache\files.ini
  C:\Program Files\MyWay\myBar\History\search
  C:\Program Files\MyWay\myBar\Settings\prevcfg.htm
  C:\Program Files\MyWay\myBar\Settings\settings.dat
  C:\Program Files\MyWay\myBar\Settings\settings.htm
  C:\WINDOWS\smdat32a.sys
  C:\WINDOWS\smdat32m.sys
  C:\WINDOWS\Web\default.htt
  
  .
  ((((((((((((((((((((((((((((( Fichiers créés 2008-02-28 to 2008-03-31 ))))))))))))))))))))))))))))))))))))
  .
  
  2008-02-24 02:40 . 2008-02-24 02:40 <REP> d-------- C:\Program Files\iPod
  2008-02-15 22:06 . 2008-03-31 18:15 <REP> d-------- C:\Program Files\Shareaza Applications
  2008-02-15 22:06 . 2006-11-12 12:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx
  2008-02-01 12:17 . 2008-02-01 12:17 587,264 --a------ C:\WINDOWS\WLXPGSS.SCR
  2008-02-01 00:13 . 2008-02-01 00:13 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
  2008-02-01 00:13 . 2008-02-01 00:13 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
  
  .
  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-03-31 16:35 81,984 ----a-w C:\WINDOWS\system32\bdod.bin
  2008-02-28 07:52 --------- d-----w C:\Program Files\Windows Live
  2008-02-25 22:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
  2008-02-24 00:41 --------- d-----w C:\Program Files\iTunes
  2008-02-24 00:38 --------- d-----w C:\Program Files\QuickTime
  2008-02-15 19:56 --------- d-----w C:\Program Files\eMule
  2008-01-11 05:36 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
  2007-12-19 22:53 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
  2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys
  2007-12-08 05:08 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
  2007-12-06 11:03 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
  2007-12-06 11:02 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
  2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
  2007-12-06 04:59 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
  2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
  2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll
  2007-10-25 18:45 52,401 -c--a-w C:\Documents and Settings\Capucine\Mes documents.zip
  2007-04-14 14:42 775,840 -c--a-w C:\Documents and Settings\Capucine\Application Data\GDIPFONTCACHEV1.DAT
  2007-02-08 15:49 31 -c--a-w C:\Documents and Settings\Capucine\getfile.dat
  2006-01-11 20:04 28,431 -c--a-w C:\WINDOWS\Fonts\high_fiber.zip
  2005-11-14 15:55 266 ---h--w C:\Program Files\desktop.ini
  2005-11-14 15:55 11,079 -c-h--w C:\Program Files\folder.htt
  .
  
  ((((((((((((((((((((((((((((( snapshot@2007-12-08_16.25.43.35 )))))))))))))))))))))))))))))))))))))))))
  .
  + 2007-07-12 23:28:38 765,952 ----a-w C:\WINDOWS\$hf_mig$\KB938127-IE7\SP2QFE\vgx.dll
  + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB938127-IE7\spmsg.dll
  + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB938127-IE7\spuninst.exe
  + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB938127-IE7\update\spcustom.dll
  + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB938127-IE7\update\update.exe
  + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB938127-IE7\update\updspapi.dll
  + 2007-10-29 22:36:31 1,293,824 ----a-w C:\WINDOWS\$hf_mig$\KB941568\SP2QFE\quartz.dll
  + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB941568\spmsg.dll
  + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB941568\spuninst.exe
  + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB941568\update\spcustom.dll
  + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB941568\update\update.exe
  + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB941568\update\updspapi.dll
  + 2007-10-30 16:53:32 360,832 ----a-w C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
  + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB941644\spmsg.dll
  + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB941644\spuninst.exe
  + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB941644\update\spcustom.dll
  + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB941644\update\update.exe
  + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB941644\update\updspapi.dll
  + 2007-10-10 23:22:14 124,928 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\advpack.dll
  + 2007-10-10 23:22:14 214,528 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\dxtrans.dll
  + 2007-10-10 23:22:14 132,608 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\extmgr.dll
  + 2007-10-10 23:22:14 63,488 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\icardie.dll
  + 2007-10-10 08:16:47 70,656 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\ie4uinit.exe
  + 2007-10-10 23:22:14 153,088 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\ieakeng.dll
  + 2007-10-10 23:22:14 230,400 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\ieaksie.dll
  + 2007-10-10 05:47:20 161,792 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\ieakui.dll
  + 2007-07-01 03:31:33 2,455,488 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\ieapfltr.dat
  + 2007-10-10 23:22:14 383,488 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\ieapfltr.dll
  + 2007-10-10 23:22:15 388,096 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\iedkcs32.dll
  + 2007-10-10 23:22:16 6,067,200 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\ieframe.dll
  + 2007-10-10 23:22:16 44,544 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\iernonce.dll
  + 2007-10-10 23:22:16 267,776 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\iertutil.dll
  + 2007-10-10 08:16:47 13,824 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\ieudinit.exe
  + 2007-10-10 08:16:56 625,664 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\iexplore.exe
  + 2007-10-10 23:22:16 27,648 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\jsproxy.dll
  + 2007-10-10 23:22:16 459,264 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\msfeeds.dll
  + 2007-10-10 23:22:16 52,224 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\msfeedsbs.dll
  + 2007-10-30 23:40:57 3,593,216 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\mshtml.dll
  + 2007-10-10 23:22:18 478,208 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\mshtmled.dll
  + 2007-10-10 23:22:18 193,024 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\msrating.dll
  + 2007-10-10 23:22:18 671,232 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\mstime.dll
  + 2007-10-10 23:22:18 102,912 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\occache.dll
  + 2007-10-10 23:22:18 105,984 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\url.dll
  + 2007-10-10 23:22:19 1,162,240 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\urlmon.dll
  + 2007-10-10 23:22:19 233,472 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\webcheck.dll
  + 2007-10-10 23:22:19 825,344 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
  + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\spmsg.dll
  + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\spuninst.exe
  + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\update\spcustom.dll
  + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\update\update.exe
  + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB942615-IE7\update\updspapi.dll
  + 2007-11-13 11:02:46 60,416 ----a-w C:\WINDOWS\$hf_mig$\KB942763\SP2QFE\tzchange.exe
  + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB942763\spmsg.dll
  + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB942763\spuninst.exe
  + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB942763\update\spcustom.dll
  + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB942763\update\update.exe
  + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB942763\update\updspapi.dll
  + 2007-12-04 18:30:15 551,936 ----a-w C:\WINDOWS\$hf_mig$\KB943055\SP2QFE\oleaut32.dll
  + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB943055\spmsg.dll
  + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB943055\spuninst.exe
  + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB943055\update\spcustom.dll
  + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB943055\update\update.exe
  + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB943055\update\updspapi.dll
  + 2007-11-07 09:50:06 733,696 ----a-w C:\WINDOWS\$hf_mig$\KB943485\SP2QFE\lsasrv.dll
  + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB943485\spmsg.dll
  + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB943485\spuninst.exe
  + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB943485\update\spcustom.dll
  + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB943485\update\update.exe
  + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB943485\update\updspapi.dll
  + 2007-12-07 01:42:15 124,928 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\advpack.dll
  + 2007-12-19 22:20:28 347,136 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\dxtmsft.dll
  + 2007-12-07 01:42:15 214,528 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\dxtrans.dll
  + 2007-12-07 01:42:15 133,120 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\extmgr.dll
  + 2007-12-07 01:42:15 63,488 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\icardie.dll
  + 2007-12-06 08:34:28 70,656 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\ie4uinit.exe
  + 2007-12-07 01:42:15 153,088 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\ieakeng.dll
  + 2007-12-07 01:42:16 230,400 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\ieaksie.dll
  + 2007-12-06 05:00:02 161,792 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\ieakui.dll
  + 2007-04-17 09:32:38 2,455,488 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\ieapfltr.dat
  + 2007-12-07 01:42:16 383,488 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\ieapfltr.dll
  + 2007-12-07 01:42:16 388,096 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\iedkcs32.dll
  + 2007-12-07 01:42:19 6,067,200 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\ieframe.dll
  + 2007-12-07 01:42:19 44,544 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\iernonce.dll
  + 2007-12-07 01:42:19 267,776 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\iertutil.dll
  + 2007-12-06 08:34:29 13,824 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\ieudinit.exe
  + 2007-12-06 08:34:45 625,664 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\iexplore.exe
  + 2007-12-07 01:42:20 27,648 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\jsproxy.dll
  + 2007-12-07 01:42:20 459,264 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\msfeeds.dll
  + 2007-12-07 01:42:20 52,224 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\msfeedsbs.dll
  + 2007-12-07 01:42:21 3,593,216 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\mshtml.dll
  + 2007-12-07 01:42:21 478,208 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\mshtmled.dll
  + 2007-12-07 01:42:21 193,024 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\msrating.dll
  + 2007-12-07 01:42:21 671,232 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\mstime.dll
  + 2007-12-07 01:42:21 102,912 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\occache.dll
  + 2008-01-11 05:54:27 44,544 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\pngfilt.dll
  + 2007-12-07 01:42:21 105,984 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\url.dll
  + 2007-12-07 01:42:22 1,162,752 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\urlmon.dll
  + 2007-12-07 01:42:22 233,472 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\webcheck.dll
  + 2007-12-07 01:42:22 825,344 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
  + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\spmsg.dll
  + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\spuninst.exe
  + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\update\spcustom.dll
  + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\update\update.exe
  + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB944533-IE7\update\updspapi.dll
  + 2007-11-13 08:47:45 20,480 ----a-w C:\WINDOWS\$hf_mig$\KB944653\SP2QFE\secdrv.sys
  + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB944653\spmsg.dll
  + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB944653\spuninst.exe
  + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB944653\update\spcustom.dll
  + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB944653\update\update.exe
  + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB944653\update\updspapi.dll
  + 2007-12-18 09:38:59 179,712 ----a-w C:\WINDOWS\$hf_mig$\KB946026\SP2QFE\mrxdav.sys
  + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB946026\spmsg.dll
  + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB946026\spuninst.exe
  + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB946026\update\spcustom.dll
  + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB946026\update\update.exe
  + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB946026\update\updspapi.dll
  + 2002-08-30 11:00:00 184,320 -c----w C:\WINDOWS\$NtServicePackUninstall$\msh261.drv
  + 2002-08-30 11:00:00 286,720 -c----w C:\WINDOWS\$NtServicePackUninstall$\msh263.drv
  + 2002-08-30 11:00:00 22,016 -c----w C:\WINDOWS\$NtServicePackUninstall$\wdmaud.drv
  + 2002-08-30 11:00:00 132,608 -c----w C:\WINDOWS\$NtServicePackUninstall$\winspool.drv
  + 2005-08-30 03:55:43 1,293,312 -c----w C:\WINDOWS\$NtUninstallKB941568$\quartz.dll
  + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe
  + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB941568$\spuninst\updspapi.dll
  + 2005-06-28 09:23:40 216,800 -c----w C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe
  + 2005-06-28 09:23:54 371,424 -c----w C:\WINDOWS\$NtUninstallKB941569$\spuninst\updspapi.dll
  + 2004-08-10 23:41:00 229,376 -c----w C:\WINDOWS\$NtUninstallKB941569$\wmasf.dll
  + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe
  + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB941644$\spuninst\updspapi.dll
  + 2006-04-20 11:51:50 359,808 -c----w C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
  + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe
  + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB942763$\spuninst\updspapi.dll
  + 2007-07-18 12:42:22 60,416 -c----w C:\WINDOWS\$NtUninstallKB942763$\tzchange.exe
  + 2006-08-17 12:29:49 728,576 -c----w C:\WINDOWS\$NtUninstallKB943485$\lsasrv.dll
  + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe
  + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB943485$\spuninst\updspapi.dll
  + 2002-08-30 11:00:00 27,440 -c----w C:\WINDOWS\$NtUninstallKB944653$\secdrv.sys
  + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe
  + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB944653$\spuninst\updspapi.dll
  + 2006-10-16 15:10:58 221,488 -c----w C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe
  + 2006-10-16 15:10:58 379,184 -c----w C:\WINDOWS\$NtUninstallWIC$\spuninst\updspapi.dll
  + 2007-12-08 17:51:54 45,056 ----a-w C:\WINDOWS\BDOSCAN8\avxdisk.dll
  + 2007-12-08 17:51:54 10,240 ----a-w C:\WINDOWS\BDOSCAN8\avxs.dll
  + 2007-12-08 17:51:54 27,136 ----a-w C:\WINDOWS\BDOSCAN8\avxt.dll
  + 2007-12-08 17:51:56 181,760 ----a-w C:\WINDOWS\BDOSCAN8\bdcore.dll
  + 2007-10-25 09:26:48 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll
  + 2007-10-25 09:26:48 53,248 ----a-w C:\WINDOWS\BDOSCAN8\ipsupd.dll
  + 2007-12-08 17:51:56 142,848 ----a-w C:\WINDOWS\BDOSCAN8\libfn.dll
  + 2007-12-08 17:51:54 86,016 ----a-w C:\WINDOWS\BDOSCAN8\librtvr.dll
  + 2007-10-25 09:26:48 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
  + 2007-10-25 09:26:48 118,784 ----a-w C:\WINDOWS\Downloaded Program Files\bdupd.dll
  + 2007-10-25 09:26:48 53,248 ----a-w C:\WINDOWS\Downloaded Program Files\ipsupd.dll
  + 2000-08-31 06:00:00 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
  + 2004-08-19 23:09:19 61,440 -c----w C:\WINDOWS\ie7\admparse.dll
  + 2004-08-19 23:09:19 101,888 -c----w C:\WINDOWS\ie7\advpack.dll
  + 2004-08-19 23:09:21 35,328 -c----w C:\WINDOWS\ie7\corpol.dll
  + 2006-06-02 19:32:20 33,792 -c----w C:\WINDOWS\ie7\custsat.dll
  + 2007-08-22 13:13:05 357,888 -c----w C:\WINDOWS\ie7\dxtmsft.dll
  + 2007-08-22 13:13:05 205,312 -c----w C:\WINDOWS\ie7\dxtrans.dll
  + 2007-08-22 13:13:05 55,808 -c----w C:\WINDOWS\ie7\extmgr.dll
  + 2004-08-19 23:09:27 38,912 -c----w C:\WINDOWS\ie7\hmmapi.dll
  + 2004-08-19 23:09:54 34,304 -c----w C:\WINDOWS\ie7\ie4uinit.exe
  + 2004-08-19 23:09:27 139,264 -c----w C:\WINDOWS\ie7\ieakeng.dll
  + 2004-08-19 23:09:27 221,696 -c----w C:\WINDOWS\ie7\ieaksie.dll
  + 2002-08-30 11:00:00 245,760 -c----w C:\WINDOWS\ie7\ieakui.dll
  + 2004-08-19 23:09:27 323,584 -c----w C:\WINDOWS\ie7\iedkcs32.dll
  + 2007-08-21 10:30:45 18,432 -c----w C:\WINDOWS\ie7\iedw.exe
  + 2004-08-19 23:09:27 81,920 -c----w C:\WINDOWS\ie7\ieencode.dll
  + 2007-08-22 13:13:05 251,392 -c----w C:\WINDOWS\ie7\iepeers.dll
  + 2004-08-19 23:09:27 49,152 -c----w C:\WINDOWS\ie7\iernonce.dll
  + 2004-08-19 23:09:27 63,488 -c----w C:\WINDOWS\ie7\iesetup.dll
  + 2004-08-19 23:09:54 93,184 -c----w C:\WINDOWS\ie7\iexplore.exe
  + 2004-08-19 23:09:28 35,840 -c----w C:\WINDOWS\ie7\imgutil.dll
  + 2007-08-22 13:13:06 96,768 -c----w C:\WINDOWS\ie7\inseng.dll
  + 2006-05-18 05:31:21 450,560 -c----w C:\WINDOWS\ie7\jscript.dll
  + 2007-08-22 13:13:06 16,384 -c----w C:\WINDOWS\ie7\jsproxy.dll
  + 2004-08-19 23:09:30 22,528 -c----w C:\WINDOWS\ie7\licmgr10.dll
  + 2004-08-19 23:09:58 29,184 -c----w C:\WINDOWS\ie7\mshta.exe
  + 2007-08-22 13:13:07 3,079,168 -c----w C:\WINDOWS\ie7\mshtml.dll
  + 2007-08-22 13:13:07 449,024 -c----w C:\WINDOWS\ie7\mshtmled.dll
  + 2004-08-19 23:08:26 57,344 -c----w C:\WINDOWS\ie7\mshtmler.dll
  + 2002-08-30 11:00:00 146,432 -c----w C:\WINDOWS\ie7\msls31.dll
  + 2007-08-22 13:13:07 146,432 -c----w C:\WINDOWS\ie7\msrating.dll
  + 2007-08-22 13:13:07 532,480 -c----w C:\WINDOWS\ie7\mstime.dll
  + 2004-08-19 23:09:36 97,280 -c----w C:\WINDOWS\ie7\occache.dll
  + 2007-08-22 13:13:07 39,424 -c----w C:\WINDOWS\ie7\pngfilt.dll
  + 2007-09-26 17:34:42 33,472 -c----w C:\WINDOWS\ie7\spuninst\iecustom.dll
  + 2007-09-26 17:32:30 66,048 -c--a-w C:\WINDOWS\ie7\spuninst\ieResetIcons.exe
  + 2006-09-06 16:43:28 216,800 -c----w C:\WINDOWS\ie7\spuninst\spuninst.exe
  + 2006-09-06 16:43:30 394,976 -c----w C:\WINDOWS\ie7\spuninst\updspapi.dll
  + 2004-08-19 23:09:46 37,888 -c----w C:\WINDOWS\ie7\url.dll
  + 2007-08-22 13:13:08 617,472 -c----w C:\WINDOWS\ie7\urlmon.dll
  + 2004-08-19 23:09:46 417,792 -c----w C:\WINDOWS\ie7\vbscript.dll
  + 2007-06-26 13:56:54 851,968 -c----w C:\WINDOWS\ie7\vgx.dll
  + 2004-08-19 23:09:47 281,600 -c----w C:\WINDOWS\ie7\webcheck.dll
  + 2007-08-22 13:13:08 663,040 -c----w C:\WINDOWS\ie7\wininet.dll
  + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe
  + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\updspapi.dll
  + 2007-08-13 17:54:10 765,952 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\vgx.dll
  + 2007-08-13 17:39:00 123,904 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\advpack.dll
  + 2007-08-13 17:35:38 214,528 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\dxtrans.dll
  + 2007-08-13 17:54:10 131,584 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\extmgr.dll
  + 2007-08-13 17:36:26 61,952 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\icardie.dll
  + 2007-08-13 17:39:06 54,784 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ie4uinit.exe
  + 2007-08-13 17:39:26 152,064 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieakeng.dll
  + 2007-08-13 17:39:54 229,376 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieaksie.dll
  + 2007-08-13 16:56:54 161,792 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieakui.dll
  + 2007-02-12 15:10:12 2,451,312 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieapfltr.dat
  + 2007-07-11 11:27:48 383,488 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieapfltr.dll
  + 2007-08-13 17:39:50 382,976 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iedkcs32.dll
  + 2007-08-13 17:54:10 6,049,280 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieframe.dll
  + 2007-08-13 17:39:10 43,008 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iernonce.dll
  + 2007-08-13 17:34:04 266,752 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iertutil.dll
  + 2007-08-13 17:39:10 13,312 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieudinit.exe
  + 2007-08-13 17:43:56 622,080 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iexplore.exe
  + 2007-08-13 17:54:10 27,136 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\jsproxy.dll
  + 2007-08-13 17:54:10 458,752 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msfeeds.dll
  + 2007-08-13 17:54:10 50,688 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msfeedsbs.dll
  + 2007-08-13 17:54:12 3,578,368 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mshtml.dll
  + 2007-08-13 17:54:10 475,648 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mshtmled.dll
  + 2007-08-13 17:44:26 192,000 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msrating.dll
  + 2007-08-13 17:54:10 670,720 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mstime.dll
  + 2007-08-13 17:44:06 101,376 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\occache.dll
  + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe
  + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\updspapi.dll
  + 2007-08-13 17:44:30 105,984 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\url.dll
  + 2007-08-13 17:54:10 1,162,240 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\urlmon.dll
  + 2007-08-13 17:54:10 231,424 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\webcheck.dll
  + 2007-08-13 17:54:10 818,688 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll
  + 2007-10-10 23:49:42 124,928 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\advpack.dll
  + 2007-08-13 17:35:46 346,624 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\dxtmsft.dll
  + 2007-10-10 23:49:42 214,528 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\dxtrans.dll
  + 2007-10-10 23:49:42 132,608 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\extmgr.dll
  + 2007-10-10 23:49:42 63,488 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\icardie.dll
  + 2007-10-10 11:00:41 70,656 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ie4uinit.exe
  + 2007-10-10 23:49:42 153,088 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieakeng.dll
  + 2007-10-10 23:49:42 230,400 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieaksie.dll
  + 2007-10-10 05:46:55 161,792 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieakui.dll
  + 2007-10-10 23:49:42 383,488 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieapfltr.dll
  + 2007-10-10 23:49:42 384,512 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\iedkcs32.dll
  + 2007-10-10 23:49:43 6,065,664 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieframe.dll
  + 2007-10-10 23:49:43 44,544 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\iernonce.dll
  + 2007-10-10 23:49:43 267,776 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\iertutil.dll
  + 2007-10-10 10:59:40 13,824 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieudinit.exe
  + 2007-10-10 11:00:59 625,152 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\iexplore.exe
  + 2007-10-10 23:49:44 27,648 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\jsproxy.dll
  + 2007-10-10 23:49:44 459,264 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\msfeeds.dll
  + 2007-10-10 23:49:44 52,224 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\msfeedsbs.dll
  + 2007-10-30 23:23:48 3,590,656 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\mshtml.dll
  + 2007-10-10 23:49:44 478,208 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\mshtmled.dll
  + 2007-10-10 23:49:44 193,024 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\msrating.dll
  + 2007-10-10 23:49:45 671,232 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\mstime.dll
  + 2007-10-10 23:49:45 102,400 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\occache.dll
  + 2007-08-13 17:36:12 44,544 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\pngfilt.dll
  + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe
  + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\updspapi.dll
  + 2007-10-10 23:49:45 105,984 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\url.dll
  + 2007-10-10 23:49:45 1,159,680 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\urlmon.dll
  + 2007-10-10 23:49:45 232,960 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\webcheck.dll
  + 2007-10-10 23:49:45 824,832 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\wininet.dll
  + 2004-11-17 14:34:04 12,227,264 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040480900063D11C8EF10054038389C\11.0.6412\MSO.DLL
  + 2004-11-17 14:13:54 5,112,000 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040480900063D11C8EF10054038389C\11.0.6412\XLVIEW.EXE
  + 2008-02-24 00:42:10 102,400 ----a-r C:\WINDOWS\Installer\{80FD852F-5AAC-4129-B931-06AAFFA43138}\iTunesIco.exe
  - 2005-11-14 20:38:24 135,168 -c--a-r C:\WINDOWS\Installer\{90840409-6000-11D3-8CFE-0150048383C9}\misc.exe
  + 2008-03-12 07:53:43 135,168 ----a-r C:\WINDOWS\Installer\{90840409-6000-11D3-8CFE-0150048383C9}\misc.exe
  - 2005-11-14 20:38:24 40,960 -c--a-r C:\WINDOWS\Installer\{90840409-6000-11D3-8CFE-0150048383C9}\xlvicon.exe
  + 2008-03-12 07:53:43 40,960 ----a-r C:\WINDOWS\Installer\{90840409-6000-11D3-8CFE-0150048383C9}\xlvicon.exe
  - 2003-08-27 11:19:58 34,304 -c--a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\misc.exe
  + 2008-03-12 07:52:25 34,304 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\misc.exe
  - 2003-08-27 11:19:58 8,192 -c--a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\mspicons.exe
  + 2008-03-12 07:52:25 8,192 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\mspicons.exe
  - 2003-08-27 11:19:58 3,584 -c--a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\opwicon.exe
  + 2008-03-12 07:52:25 3,584 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\opwicon.exe
  - 2003-08-27 11:19:58 16,384 -c--a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\PEicons.exe
  + 2008-03-12 07:52:25 16,384 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\PEicons.exe
  - 2003-08-27 11:19:58 22,528 -c--a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\unbndico.exe
  + 2008-03-12 07:52:25 22,528 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\unbndico.exe
  - 2003-08-27 11:19:58 45,056 -c--a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\wordicon.exe
  + 2008-03-12 07:52:25 45,056 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\wordicon.exe
  + 2008-02-28 07:52:27 123,008 ----a-r C:\WINDOWS\Installer\{A70FA218-6598-4AC9-813D-63597C5DD068}\WLXPhotoGalleryIcon.exe
  - 2007-05-06 09:29:12 23,558 -c--a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A00000000001}\ARPPRODUCTICON.exe
  + 2008-01-27 19:12:25 23,558 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A00000000001}\ARPPRODUCTICON.exe
  + 2007-12-25 17:56:08 27,136 ----a-r C:\WINDOWS\Installer\{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}\AppleSoftwareUpdateIco.exe
  + 2008-02-25 22:38:48 29,926 ----a-r C:\WINDOWS\Installer\{BADF6744-3787-48F6-B8C9-4C4995401D65}\MsblIco.Exe
  - 2007-06-16 23:11:58 51,200 ----a-w C:\WINDOWS\NirCmd.exe
  + 2000-08-31 06:00:00 28,160 ----a-w C:\WINDOWS\NirCmd.exe
  + 2004-08-19 23:10:08 188,416 -c----w C:\WINDOWS\ServicePackFiles\i386\msh261.drv
  + 2004-08-19 23:10:08 294,912 -c----w C:\WINDOWS\ServicePackFiles\i386\msh263.drv
  + 2004-08-19 23:10:08 23,552 -c----w C:\WINDOWS\ServicePackFiles\i386\wdmaud.drv
  + 2004-08-19 23:10:08 146,944 -c----w C:\WINDOWS\ServicePackFiles\i386\winspool.drv
  + 2002-08-30 11:00:00 73,680 -c--a-w C:\WINDOWS\system\MCIAVI.DRV
  + 2002-08-30 11:00:00 25,280 -c--a-w C:\WINDOWS\system\MCISEQ.DRV
  + 2002-08-30 11:00:00 28,160 -c--a-w C:\WINDOWS\system\MCIWAVE.DRV
  + 2002-08-30 11:00:00 3,360 -c--a-w C:\WINDOWS\system\SYSTEM.DRV
  + 2002-08-30 11:00:00 4,096 -c--a-w C:\WINDOWS\system\TIMER.DRV
  + 2002-08-30 11:00:00 13,600 -c--a-w C:\WINDOWS\system\WFWNET.DRV
  + 2004-08-19 23:10:08 146,944 -c--a-w C:\WINDOWS\system\winspool.drv
  - 2004-08-19 23:09:19 61,440 ----a-w C:\WINDOWS\system32\admparse.dll
  + 2007-08-13 17:39:20 71,680 ----a-w C:\WINDOWS\system32\admparse.dll
  - 2004-08-19 23:09:19 101,888 ----a-w C:\WINDOWS\system32\advpack.dll
  + 2007-12-07 02:08:32 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
  - 2001-01-22 01:25:24 32,768 -c--a-w C:\WINDOWS\system32\ATHPRXY.DLL
  + 2004-01-29 14:08:23 32,768 ----a-w C:\WINDOWS\system32\ATHPRXY.DLL
  + 2002-08-30 11:00:00 10,544 -c--a-w C:\WINDOWS\system32\comm.drv
  - 2004-08-19 23:09:21 35,328 ----a-w C:\WINDOWS\system32\corpol.dll
  + 2007-08-13 17:42:54 17,408 ----a-w C:\WINDOWS\system32\corpol.dll
  + 2006-11-29 12:06:18 3,426,072 ----a-w C:\WINDOWS\system32\d3dx9_32.dll
  - 2004-08-19 23:09:19 61,440 ----a-w C:\WINDOWS\system32\dllcache\admparse.dll
  + 2007-08-13 17:39:20 71,680 ----a-w C:\WINDOWS\system32\dllcache\admparse.dll
  + 2007-12-07 02:08:32 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
  - 2004-08-19 23:09:21 35,328 ----a-w C:\WINDOWS\system32\dllcache\corpol.dll
  + 2007-08-13 17:42:54 17,408 ----a-w C:\WINDOWS\system32\dllcache\corpol.dll
  - 2006-06-02 19:32:20 33,792 ----a-w C:\WINDOWS\system32\dllcache\custsat.dll
  + 2007-08-13 17:54:10 33,792 ----a-w C:\WINDOWS\system32\dllcache\custsat.dll
  - 2007-08-22 13:13:05 205,312 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
  + 2007-12-07 02:08:32 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
  - 2007-08-22 13:13:05 55,808 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
  + 2007-12-07 02:08:32 133,120 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
  - 2004-08-19 23:09:27 38,912 ----a-w C:\WINDOWS\system32\dllcache\hmmapi.dll
  + 2007-08-13 17:18:02 60,416 ----a-w C:\WINDOWS\system32\dllcache\hmmapi.dll
  - 2007-08-20 09:59:29 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
  + 2007-12-07 02:08:32 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
  - 2004-08-19 23:09:27 139,264 ----a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
  + 2007-12-07 02:08:32 153,088 ----a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
  - 2004-08-19 23:09:27 221,696 ----a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
  + 2007-12-07 02:08:32 230,400 ----a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
  - 2007-08-20 09:59:29 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
  + 2007-12-07 02:08:32 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
  - 2004-08-19 23:09:27 323,584 ----a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
  + 2007-12-07 02:08:32 384,512 ----a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
  - 2007-08-21 10:30:45 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
  + 2007-08-13 17:44:02 69,120 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
  - 2004-08-19 23:09:27 81,920 ----a-w C:\WINDOWS\system32\dllcache\ieencode.dll
  + 2007-08-13 17:45:18 78,336 ----a-w C:\WINDOWS\system32\dllcache\ieencode.dll
  - 2007-08-20 09:59:29 6,058,496 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
  + 2007-12-07 02:08:33 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
  - 2007-08-22 13:13:05 251,392 ----a-w C:\WINDOWS\system32\dllcache\iepeers.dll
  + 2007-08-13 17:54:10 191,488 ----a-w C:\WINDOWS\system32\dllcache\iepeers.dll
  - 2004-08-19 23:09:27 49,152 ----a-w C:\WINDOWS\system32\dllcache\iernonce.dll
  + 2007-12-07 02:08:33 44,544 ----a-w C:\WINDOWS\system32\dllcache\iernonce.dll
  - 2007-08-20 09:59:30 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
  + 2007-12-07 02:08:33 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
  - 2004-08-19 23:09:27 63,488 ----a-w C:\WINDOWS\system32\dllcache\iesetup.dll
  + 2007-08-13 17:39:12 55,296 ----a-w C:\WINDOWS\system32\dllcache\iesetup.dll
  - 2004-08-19 23:09:28 35,840 ----a-w C:\WINDOWS\system32\dllcache\imgutil.dll
  + 2007-08-13 17:36:06 36,352 ----a-w C:\WINDOWS\system32\dllcache\imgutil.dll
  - 2007-08-22 13:13:06 96,768 ----a-w C:\WINDOWS\system32\dllcache\inseng.dll
  + 2007-08-13 17:39:02 92,672 ----a-w C:\WINDOWS\system32\dllcache\inseng.dll
  - 2006-05-18 05:31:21 450,560 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll
  + 2007-08-13 17:38:04 491,520 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll
  - 2007-08-22 13:13:06 16,384 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
  + 2007-12-07 02:08:33 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
  - 2004-08-19 23:09:30 22,528 ----a-w C:\WINDOWS\system32\dllcache\licmgr10.dll
  + 2007-08-13 17:44:18 40,960 ----a-w C:\WINDOWS\system32\dllcache\licmgr10.dll
  - 2006-08-17 12:29:49 728,576 -c----w C:\WINDOWS\system32\dllcache\lsasrv.dll
  + 2007-11-07 09:28:31 728,576 ------w C:\WINDOWS\system32\dllcache\lsasrv.dll
  + 2002-08-30 11:00:00 73,680 -c--a-w C:\WINDOWS\system32\dllcache\mciavi.drv
  + 2002-08-30 11:00:00 25,280 -c--a-w C:\WINDOWS\system32\dllcache\mciseq.drv
  + 2002-08-30 11:00:00 28,160 -c--a-w C:\WINDOWS\system32\dllcache\mciwave.drv
  - 2007-08-20 09:59:30 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
  + 2007-12-07 02:08:33 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
  - 2007-08-20 09:59:30 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
  + 2007-12-07 02:08:33 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
  - 2004-08-19 23:09:58 29,184 ----a-w C:\WINDOWS\system32\dllcache\mshta.exe
  + 2007-08-13 17:32:30 45,568 ----a-w C:\WINDOWS\system32\dllcache\mshta.exe
  - 2007-08-22 13:13:07 449,024 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
  + 2007-12-07 02:08:34 478,208 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
  - 2004-08-19 23:08:26 57,344 ----a-w C:\WINDOWS\system32\dllcache\mshtmler.dll
  + 2007-08-13 17:01:12 48,128 ----a-w C:\WINDOWS\system32\dllcache\mshtmler.dll
  + 2007-08-13 17:54:10 156,160 ------w C:\WINDOWS\system32\dllcache\msls31.dll
  - 2007-08-22 13:13:07 146,432 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
  + 2007-12-07 02:08:34 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
  - 2007-08-22 13:13:07 532,480 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
  + 2007-12-07 02:08:34 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
  + 2007-12-07 02:08:34 102,912 ------w C:\WINDOWS\system32\dllcache\occache.dll
  + 2007-10-29 22:43:32 1,293,824 ------w C:\WINDOWS\system32\dllcache\quartz.dll
  + 2002-08-30 11:00:00 3,360 -c--a-w C:\WINDOWS\system32\dllcache\system.drv
  - 2006-04-20 11:51:50 359,808 -c----w C:\WINDOWS\system32\dllcache\tcpip.sys
  + 2007-10-30 17:20:55 360,064 ------w C:\WINDOWS\system32\dllcache\tcpip.sys
  + 2002-08-30 11:00:00 4,096 -c--a-w C:\WINDOWS\system32\dllcache\timer.drv
  + 2007-12-07 02:08:34 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
  - 2007-08-22 13:13:08 617,472 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
  + 2007-12-07 02:08:34 1,159,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
  - 2004-08-19 23:09:46 417,792 ----a-w C:\WINDOWS\system32\dllcache\vbscript.dll
  + 2007-08-13 17:54:10 413,696 ----a-w C:\WINDOWS\system32\dllcache\vbscript.dll
  - 2007-06-26 13:56:54 851,968 ----a-w C:\WINDOWS\system32\dllcache\vgx.dll
  + 2007-07-12 23:30:52 765,952 ----a-w C:\WINDOWS\system32\dllcache\vgx.dll
  + 2007-12-07 02:08:34 233,472 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
  + 2002-08-30 11:00:00 13,600 -c--a-w C:\WINDOWS\system32\dllcache\wfwnet.drv
  - 2007-08-22 13:13:08 663,040 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
  + 2007-12-07 02:08:34 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
  + 2004-08-19 23:10:08 146,944 -c--a-w C:\WINDOWS\system32\dllcache\winspool.drv
  - 2004-08-10 23:41:00 229,376 -c--a-w C:\WINDOWS\system32\dllcache\wmasf.dll
  + 2007-10-20 05:01:32 227,328 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
  + 2006-09-19 13:44:04 15,664 ----a-w C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
  - 2004-08-04 06:00:56 181,248 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
  + 2007-12-18 09:51:35 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
  - 2002-08-30 11:00:00 27,440 -c--a-w C:\WINDOWS\system32\drivers\secdrv.sys
  + 2007-11-13 10:25:54 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
  - 2006-04-20 11:51:50 359,808 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
  + 2007-10-30 17:20:55 360,064 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
  + 2007-10-31 13:09:14 30,464 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
  + 2007-10-31 13:09:14 30,464 -c--a-w C:\WINDOWS\system32\DRVSTORE\usbaapl_4351B7DAFF62FD33510D77DFAE3CF8CC82517571\usbaapl.sys
  - 2007-08-22 13:13:05 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
  + 2007-12-19 22:53:23 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
  - 2007-08-22 13:13:05 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll
  + 2007-12-07 02:08:32 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
  - 2007-08-22 13:13:05 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll
  + 2007-12-07 02:08:32 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
  + 2000-08-31 06:00:00 73,728 ----a-w C:\WINDOWS\system32\fdsv.exe
  - 1999-10-18 01:01:42 1,129,232 -c--a-w C:\WINDOWS\system32\FM20.DLL
  + 2003-09-25 11:07:00 1,139,472 ----a-w C:\WINDOWS\system32\FM20.DLL
  - 2001-02-21 09:02:06 29,456 -c--a-w C:\WINDOWS\system32\FM20FRA.DLL
  + 2003-10-29 13:05:10 28,672 ----a-w C:\WINDOWS\system32\FM20FRA.DLL
  - 2007-11-25 18:50:10 3,163,912 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
  + 2007-12-11 14:34:33 3,163,176 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
  + 2006-10-03 18:47:52 109,360 ----a-w C:\WINDOWS\system32\GEARAspi.dll
  + 2000-08-31 06:00:00 80,412 ----a-w C:\WINDOWS\system32\grep.exe
  + 2007-12-07 02:08:32 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
  - 2004-08-19 23:09:54 34,304 ----a-w C:\WINDOWS\system32\ie4uinit.exe
  + 2007-12-06 11:02:31 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe
  - 2004-08-19 23:09:27 139,264 ----a-w C:\WINDOWS\system32\ieakeng.dll
  + 2007-12-07 02:08:32 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
  - 2004-08-19 23:09:27 221,696 ----a-w C:\WINDOWS\system32\ieaksie.dll
  + 2007-12-07 02:08:32 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
  - 2002-08-30 11:00:00 245,760 ----a-w C:\WINDOWS\system32\ieakui.dll
  + 2007-12-06 04:59:51 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
  + 2007-04-17 09:32:38 2,455,488 ----a-w C:\WINDOWS\system32\ieapfltr.dat
  + 2007-12-07 02:08:32 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
  - 2004-08-19 23:09:27 323,584 ----a-w C:\WINDOWS\system32\iedkcs32.dll
  + 2007-12-07 02:08:32 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
  - 2004-08-19 23:09:27 81,920 ----a-w C:\WINDOWS\system32\ieencode.dll
  + 2007-08-13 17:45:18 78,336 ----a-w C:\WINDOWS\system32\ieencode.dll
  + 2007-12-07 02:08:33 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
  - 2007-08-22 13:13:05 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll
  + 2007-08-13 17:54:10 191,488 ----a-w C:\WINDOWS\system32\iepeers.dll
  - 2004-08-19 23:09:27 49,152 ----a-w C:\WINDOWS\system32\iernonce.dll
  + 2007-12-07 02:08:33 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
  + 2007-12-07 02:08:33 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
  - 2004-08-19 23:09:27 63,488 ----a-w C:\WINDOWS\system32\iesetup.dll
  + 2007-08-13 17:39:12 55,296 ----a-w C:\WINDOWS\system32\iesetup.dll
  - 2007-08-17 10:20:54 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
  + 2007-12-06 11:00:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
  + 2007-08-13 17:54:10 180,736 ------w C:\WINDOWS\system32\ieui.dll
  - 2004-08-19 23:09:28 35,840 ----a-w C:\WINDOWS\system32\imgutil.dll
  + 2007-08-13 17:36:06 36,352 ----a-w C:\WINDOWS\system32\imgutil.dll
  - 2007-08-22 13:13:06 96,768 ----a-w C:\WINDOWS\system32\inseng.dll
  + 2007-08-13 17:39:02 92,672 ----a-w C:\WINDOWS\system32\inseng.dll
  - 2006-05-18 05:31:21 450,560 ----a-w C:\WINDOWS\system32\jscript.dll
  + 2007-08-13 17:38:04 491,520 ----a-w C:\WINDOWS\system32\jscript.dll
  - 2007-08-22 13:13:06 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll
  + 2007-12-07 02:08:33 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
  + 2002-08-30 11:00:00 224,448 -c--a-w C:\WINDOWS\system32\lanman.drv
  - 2004-08-19 23:09:30 22,528 ----a-w C:\WINDOWS\system32\licmgr10.dll
  + 2007-08-13 17:44:18 40,960 ----a-w C:\WINDOWS\system32\licmgr10.dll
  - 2006-08-17 12:29:49 728,576 ----a-w C:\WINDOWS\system32\lsasrv.dll
  + 2007-11-07 09:28:31 728,576 ----a-w C:\WINDOWS\system32\lsasrv.dll
  + 2007-11-21 00:04:14 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\FlashUtil9e.exe
  - 2007-11-25 19:12:02 48,749 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
  + 2008-02-07 17:41:40 74,137 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
  - 2002-01-16 10:36:36 483,328 -c--a-w C:\WINDOWS\system32\Macromed\Shockwave 8\Control.dll
  + 2007-12-06 17:50:26 483,328 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 8\Control.dll
  - 2002-01-16 13:35:36 380,928 -c--a-w C:\WINDOWS\system32\Macromed\Shockwave 8\PluginPing.dll
  + 2007-12-06 17:50:24 380,928 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 8\PluginPing.dll
  + 2002-08-30 11:00:00 73,680 -c--a-w C:\WINDOWS\system32\mciavi.drv
  + 2002-08-30 11:00:00 25,280 -c--a-w C:\WINDOWS\system32\mciseq.drv
  + 2002-08-30 11:00:00 28,160 -c--a-w C:\WINDOWS\system32\mciwave.drv
  - 2007-11-02 07:12:57 18,238,072 -c--a-w C:\WINDOWS\system32\MRT.exe
  + 2008-03-05 16:30:54 19,148,408 -c--a-w C:\WINDOWS\system32\MRT.exe
  + 2002-08-30 11:00:00 20,992 ----a-w C:\WINDOWS\system32\msacm32.drv
  + 2007-12-07 02:08:33 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
  + 2007-12-07 02:08:33 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
  + 2007-08-13 17:36:40 12,288 ------w C:\WINDOWS\system32\msfeedssync.exe
  + 2004-08-19 23:10:08 188,416 ----a-w C:\WINDOWS\system32\msh261.drv
  + 2004-08-19 23:10:08 294,912 ----a-w C:\WINDOWS\system32\msh263.drv
  - 2004-08-19 23:09:58 29,184 ----a-w C:\WINDOWS\system32\mshta.exe
  + 2007-08-13 17:32:30 45,568 ----a-w C:\WINDOWS\system32\mshta.exe
  - 2007-08-22 13:13:07 3,079,168 ----a-w C:\WINDOWS\system32\mshtml.dll
  + 2007-12-08 05:08:36 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll
  - 2007-08-22 13:13:07 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
  + 2007-12-07 02:08:34 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll
  - 2004-08-19 23:08:26 57,344 ----a-w C:\WINDOWS\system32\mshtmler.dll
  + 2007-08-13 17:01:12 48,128 ----a-w C:\WINDOWS\system32\mshtmler.dll
  - 2002-08-30 11:00:00 146,432 ----a-w C:\WINDOWS\system32\msls31.dll
  + 2007-08-13 17:54:10 156,160 ----a-w C:\WINDOWS\system32\msls31.dll
  - 2007-08-22 13:13:07 146,432 ----a-w C:\WINDOWS\system32\msrating.dll
  + 2007-12-07 02:08:34 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
  - 2007-08-22 13:13:07 532,480 ----a-w C:\WINDOWS\system32\mstime.dll
  + 2007-12-07 02:08:34 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
  - 2004-08-19 23:09:36 97,280 ----a-w C:\WINDOWS\system32\occache.dll
  + 2007-12-07 02:08:34 102,912 ----a-w C:\WINDOWS\system32\occache.dll
  - 2007-10-28 09:15:29 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat
  + 2008-03-31 16:12:53 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat
  - 2007-10-28 09:15:29 48,616 ----a-w C:\WINDOWS\system32\perfc00C.dat
  + 2008-03-31 16:12:53 48,616 ----a-w C:\WINDOWS\system32\perfc00C.dat
  - 2007-10-28 09:15:29 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat
  + 2008-03-31 16:12:53 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat
  - 2007-10-28 09:15:29 367,658 ----a-w C:\WINDOWS\system32\perfh00C.dat
  + 2008-03-31 16:12:53 367,658 ----a-w C:\WINDOWS\system32\perfh00C.dat
  + 2006-10-24 11:30:20 412,160 ------w C:\WINDOWS\system32\photometadatahandler.dll
  - 2007-08-22 13:13:07 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll
  + 2008-01-11 05:36:55 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
  - 2005-08-30 03:55:43 1,293,312 ----a-w C:\WINDOWS\system32\quartz.dll
  + 2007-10-29 22:43:32 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
  + 2004-08-19 23:10:08 23,552 -c--a-w C:\WINDOWS\system32\ReinstallBackups\[u]0/u004\DriverFiles\i386\wdmaud.drv
  + 2000-08-31 06:00:00 98,816 ----a-w C:\WINDOWS\system32\sed.exe
  + 2007-10-18 10:31:46 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
  + 2006-01-26 19:19:52 73,728 ----a-w C:\WINDOWS\system32\sockspy.dll
  - 2007-03-06 01:34:33 15,072 ------w C:\WINDOWS\system32\spmsg.dll
  + 2006-10-16 15:10:58 14,640 ------w C:\WINDOWS\system32\spmsg.dll
  - 2006-09-06 16:43:30 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
  + 2006-10-16 15:10:58 23,856 ----a-w C:\WINDOWS\system32\spupdsvc.exe
  - 2007-07-22 17:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe
  + 2000-08-31 06:00:00 161,792 ----a-w C:\WINDOWS\system32\swreg.exe
  + 2002-08-30 11:00:00 3,360 -c--a-w C:\WINDOWS\system32\system.drv
  + 2002-08-30 11:00:00 4,096 -c--a-w C:\WINDOWS\system32\timer.drv
  - 2007-07-18 12:42:22 60,416 ------w C:\WINDOWS\system32\tzchange.exe
  + 2007-11-13 11:31:11 60,416 ------w C:\WINDOWS\system32\tzchange.exe
  - 2004-08-19 23:09:46 37,888 ----a-w C:\WINDOWS\system32\url.dll
  + 2007-12-07 02:08:34 105,984 ----a-w C:\WINDOWS\system32\url.dll
  - 2007-08-22 13:13:08 617,472 ----a-w C:\WINDOWS\system32\urlmon.dll
  + 2007-12-07 02:08:34 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
  - 2004-08-19 23:09:46 417,792 ----a-w C:\WINDOWS\system32\vbscript.dll
  + 2007-08-13 17:54:10 413,696 ----a-w C:\WINDOWS\system32\vbscript.dll
  + 2004-08-19 23:10:08 23,552 ----a-w C:\WINDOWS\system32\wdmaud.drv
  - 2004-08-19 23:09:47 281,600 ----a-w C:\WINDOWS\system32\webcheck.dll
  + 2007-12-07 02:08:34 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
  + 2002-08-30 11:00:00 13,600 -c--a-w C:\WINDOWS\system32\wfwnet.drv
  + 2006-10-24 11:30:06 716,288 ------w C:\WINDOWS\system32\WindowsCodecs.dll
  + 2006-10-24 11:29:50 352,256 ------w C:\WINDOWS\system32\WindowsCodecsExt.dll
  + 2007-08-13 17:45:16 206,336 ------w C:\WINDOWS\system32\WinFXDocObj.exe
  - 2007-08-22 13:13:08 663,040 ----a-w C:\WINDOWS\system32\wininet.dll
  + 2007-12-07 02:08:34 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
  + 2004-08-19 23:10:08 146,944 ----a-w C:\WINDOWS\system32\winspool.drv
  - 2004-08-10 23:41:00 229,376 ----a-w C:\WINDOWS\system32\wmasf.dll
  + 2007-10-20 05:01:32 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
  + 2006-10-24 11:30:00 276,992 ------w C:\WINDOWS\system32\WMPhoto.dll
  + 2000-08-31 06:00:00 68,096 ----a-w C:\WINDOWS\system32\zip.exe
  + 2006-06-05 13:14:28 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll
  + 2006-06-05 13:14:28 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll
  + 2006-06-05 13:14:28 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll
  + 2006-12-01 21:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
  + 2006-12-01 21:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
  + 2006-12-01 21:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
  .
  -- Snapshot reset to current date --
  .
  ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00D6A7E7-4A97-456f-848A-3B75BF7554D7}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0B015876-A08C-9D2E-EE9D-9172C7F7FCAD}]
  C:\WINDOWS\system32\fzzomq.dll
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B18DD50-C996-44fc-AC52-0FECFF82ED58}]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
  "Nfiom"="C:\WINDOWS\system32\w?aclt.exe" [ ]
  "Sra"="C:\PROGRA~1\YSTEM~1\userinit.exe" [ ]
  "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [ ]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [ ]
  "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
  "ATIPTA"="C:\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-06-19 13:31 335872]
  "VCSPlayer"="C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe" [2002-06-07 12:34 299008]
  "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2003-08-27 13:17 151597]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 13:03 36975]
  "SoundMan"="SOUNDMAN.EXE" [2003-04-24 16:53 54784 C:\WINDOWS\SOUNDMAN.EXE]
  "BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 17:48 290816]
  "BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 16:49 69632]
  "CleanEasyImg"="c:\apps\easydvd\cleanall.exe" [ ]
  "Windows AdControl"="C:\Program Files\Windows AdControl\WinAdCtl.exe" [ ]
  "cisaiitj"="C:\WINDOWS\system32\gmwbepdd.exe" [ ]
  "webrebates"="C:\Program Files\WebRebates4\webrebates.exe" [ ]
  "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
  "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "Sra"="C:\DOCUME~1\Capucine\MESDOC~1\CROSOF~1.NET\mmc.exe" [ ]
  "Lvospk"="C:\WINDOWS\?icrosoft\w?auboot.exe" [ ]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
  "AppInit_DLLs"=sockspy.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
  "EnableFirewall"= 0 (0x0)
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "C:\\Program Files\\iTunes\\iTunes.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
  
  R1 vcsmpdrv;vcsmpdrv;C:\WINDOWS\system32\DRIVERS\vcsmpdrv.sys [2002-06-07 12:38]
  R2 VCSSecS;Virtual CD v4 Security service (SDK - Version);C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe [2002-05-16 12:17]
  R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2007-02-02 18:40]
  R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 08:08]
  S3 fireface;Service for Fireface (WDM);C:\WINDOWS\system32\drivers\fireface.sys []
  S3 PPPoEWin;PPPoEWin Miniport;C:\WINDOWS\system32\DRIVERS\PPPoEWin.SYS []
  S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 07:58]
  
  .
  Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
  "2008-03-24 15:42:41 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
  - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
  "2004-09-25 14:10:35 C:\WINDOWS\Tasks\Rappel d'enregistrement 1.job"
  - C:\WINDOWS\System32\OOBE\oobebaln.exe
  "2004-10-02 21:20:00 C:\WINDOWS\Tasks\Rappel d'enregistrement 2.job"
  - C:\WINDOWS\System32\OOBE\oobebaln.exe
  "2004-09-25 14:10:35 C:\WINDOWS\Tasks\Rappel d'enregistrement 3.job"
  - C:\WINDOWS\System32\OOBE\oobebaln.exe
  .
  **************************************************************************
  
  catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-03-31 18:39:01
  Windows 5.1.2600 Service Pack 2 NTFS
  
  Balayage processus cachés ...
  
  Balayage caché autostart entries ...
  
  Balayage des fichiers cachés ...
  
  Scan terminé avec succès
  Les fichiers cachés: 0
  
  **************************************************************************
  .
  Temps d'accomplissement: 2008-03-31 18:40:30
  ComboFix-quarantined-files.txt 2008-03-31 16:40:25
  ComboFix2.txt 2007-12-08 15:26:42
  Pre-Run: 87,622,451,200 octets libres
  Post-Run: 87,613,218,816 octets libres
  .
  2008-03-12 07:53:46 --- E O F ---
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 18:21:43, on 31/03/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16608)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\system32\slserv.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
  C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
  C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
  C:\WINDOWS\Explorer.EXE
  C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\Softwin\BitDefender10\bdmcon.exe
  C:\Program Files\Softwin\BitDefender10\bdagent.exe
  C:\Program Files\QuickTime\QTTask.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
  C:\Program Files\Softwin\BitDefender10\vsserv.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Capucine\LOCALS~1\Temp\sp.html
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Capucine\LOCALS~1\Temp\sp.html
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
  R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O2 - BHO: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
  O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {0B015876-A08C-9D2E-EE9D-9172C7F7FCAD} - C:\WINDOWS\system32\fzzomq.dll (file missing)
  O2 - BHO: (no name) - {4B18DD50-C996-44fc-AC52-0FECFF82ED58} - (no file)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
  O2 - BHO: (no name) - {D262C9E6-55DC-414F-8410-AEBF9814262A} - C:\WINDOWS\System32\dlahh.dll (file missing)
  O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
  O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
  O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
  O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
  O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
  O4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exe
  O4 - HKLM\..\Run: [cisaiitj] C:\WINDOWS\system32\gmwbepdd.exe
  O4 - HKLM\..\Run: [webrebates] "C:\Program Files\WebRebates4\webrebates.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.e
  
  0
  
  Réagir
Réponse 3 / 6
ludsfa
bonjour ,
tu es très infecté.
Désactive tes protections résidentes (antivirus, Spybot...) !

télécharge http://download.bleepingcomputer.com/sUBs/ComboFix.exe sur ton bureau et pas ailleur.
Double clique sur combofix.exe afin de le lancer.
Tape sur la touche 1 (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

Ensuite reposte moi un hijackthis après.

0

Réagir
1. julian26 Auteur
  
  voici le rapportComboFix 08-03-30.3 - Capucine 2008-03-31 18:49:09.3 - NTFSx86
  Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.456 [GMT 2:00]
  Endroit: C:\Documents and Settings\Capucine\Local Settings\Temporary Internet Files\Content.IE5\3122NEX4\ComboFix[1].exe
  .
  
  ((((((((((((((((((((((((((((( Fichiers créés 2008-02-28 to 2008-03-31 ))))))))))))))))))))))))))))))))))))
  .
  
  2008-02-24 02:40 . 2008-02-24 02:40 <REP> d-------- C:\Program Files\iPod
  2008-02-15 22:06 . 2008-03-31 18:15 <REP> d-------- C:\Program Files\Shareaza Applications
  2008-02-15 22:06 . 2006-11-12 12:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx
  2008-02-01 12:17 . 2008-02-01 12:17 587,264 --a------ C:\WINDOWS\WLXPGSS.SCR
  2008-02-01 00:13 . 2008-02-01 00:13 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
  2008-02-01 00:13 . 2008-02-01 00:13 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
  
  .
  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-03-31 16:45 81,984 ----a-w C:\WINDOWS\system32\bdod.bin
  2008-02-28 07:52 --------- d-----w C:\Program Files\Windows Live
  2008-02-25 22:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
  2008-02-24 00:41 --------- d-----w C:\Program Files\iTunes
  2008-02-24 00:38 --------- d-----w C:\Program Files\QuickTime
  2008-02-15 19:56 --------- d-----w C:\Program Files\eMule
  2008-01-11 05:36 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
  2007-12-19 22:53 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
  2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys
  2007-12-08 05:08 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
  2007-12-06 11:03 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
  2007-12-06 11:02 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
  2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
  2007-12-06 04:59 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
  2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
  2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll
  2007-10-25 18:45 52,401 -c--a-w C:\Documents and Settings\Capucine\Mes documents.zip
  2007-04-14 14:42 775,840 -c--a-w C:\Documents and Settings\Capucine\Application Data\GDIPFONTCACHEV1.DAT
  2007-02-08 15:49 31 -c--a-w C:\Documents and Settings\Capucine\getfile.dat
  2006-01-11 20:04 28,431 -c--a-w C:\WINDOWS\Fonts\high_fiber.zip
  2005-11-14 15:55 266 ---h--w C:\Program Files\desktop.ini
  2005-11-14 15:55 11,079 -c-h--w C:\Program Files\folder.htt
  .
  
  ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00D6A7E7-4A97-456f-848A-3B75BF7554D7}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0B015876-A08C-9D2E-EE9D-9172C7F7FCAD}]
  C:\WINDOWS\system32\fzzomq.dll
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B18DD50-C996-44fc-AC52-0FECFF82ED58}]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
  "Nfiom"="C:\WINDOWS\system32\w?aclt.exe" [ ]
  "Sra"="C:\PROGRA~1\YSTEM~1\userinit.exe" [ ]
  "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [ ]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [ ]
  "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
  "ATIPTA"="C:\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-06-19 13:31 335872]
  "VCSPlayer"="C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe" [2002-06-07 12:34 299008]
  "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2003-08-27 13:17 151597]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 13:03 36975]
  "SoundMan"="SOUNDMAN.EXE" [2003-04-24 16:53 54784 C:\WINDOWS\SOUNDMAN.EXE]
  "BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 17:48 290816]
  "BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 16:49 69632]
  "CleanEasyImg"="c:\apps\easydvd\cleanall.exe" [ ]
  "Windows AdControl"="C:\Program Files\Windows AdControl\WinAdCtl.exe" [ ]
  "cisaiitj"="C:\WINDOWS\system32\gmwbepdd.exe" [ ]
  "webrebates"="C:\Program Files\WebRebates4\webrebates.exe" [ ]
  "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
  "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "Sra"="C:\DOCUME~1\Capucine\MESDOC~1\CROSOF~1.NET\mmc.exe" [ ]
  "Lvospk"="C:\WINDOWS\?icrosoft\w?auboot.exe" [ ]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
  "AppInit_DLLs"=sockspy.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
  "EnableFirewall"= 0 (0x0)
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "C:\\Program Files\\iTunes\\iTunes.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
  
  R1 vcsmpdrv;vcsmpdrv;C:\WINDOWS\system32\DRIVERS\vcsmpdrv.sys [2002-06-07 12:38]
  R2 VCSSecS;Virtual CD v4 Security service (SDK - Version);C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe [2002-05-16 12:17]
  R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2007-02-02 18:40]
  R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 08:08]
  S3 fireface;Service for Fireface (WDM);C:\WINDOWS\system32\drivers\fireface.sys []
  S3 PPPoEWin;PPPoEWin Miniport;C:\WINDOWS\system32\DRIVERS\PPPoEWin.SYS []
  S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 07:58]
  
  .
  Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
  "2008-03-24 15:42:41 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
  - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
  "2004-09-25 14:10:35 C:\WINDOWS\Tasks\Rappel d'enregistrement 1.job"
  - C:\WINDOWS\System32\OOBE\oobebaln.exe
  "2004-10-02 21:20:00 C:\WINDOWS\Tasks\Rappel d'enregistrement 2.job"
  - C:\WINDOWS\System32\OOBE\oobebaln.exe
  "2004-09-25 14:10:35 C:\WINDOWS\Tasks\Rappel d'enregistrement 3.job"
  - C:\WINDOWS\System32\OOBE\oobebaln.exe
  .
  **************************************************************************
  
  catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-03-31 18:50:31
  Windows 5.1.2600 Service Pack 2 NTFS
  
  Balayage processus cachés ...
  
  Balayage caché autostart entries ...
  
  Balayage des fichiers cachés ...
  
  Scan terminé avec succès
  Les fichiers cachés: 0
  
  **************************************************************************
  .
  Temps d'accomplissement: 2008-03-31 18:51:28
  ComboFix-quarantined-files.txt 2008-03-31 16:51:06
  ComboFix2.txt 2008-03-31 16:40:31
  ComboFix3.txt 2007-12-08 15:26:42
  Pre-Run: 87,984,377,856 octets libres
  Post-Run: 87,972,110,336 octets libres
  .
  2008-03-12 07:53:46 --- E O F ---
  
  0
  
  Réagir
Réponse 4 / 6
ludsfa
poste pour suivre.

0

Réagir
1. julian26 Auteur
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 18:54:45, on 31/03/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16608)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
  C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
  C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
  C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\Softwin\BitDefender10\bdmcon.exe
  C:\Program Files\Softwin\BitDefender10\bdagent.exe
  C:\Program Files\QuickTime\QTTask.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
  C:\Program Files\Softwin\BitDefender10\vsserv.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\WINDOWS\explorer.exe
  C:\WINDOWS\system32\notepad.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
  R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O2 - BHO: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
  O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {0B015876-A08C-9D2E-EE9D-9172C7F7FCAD} - C:\WINDOWS\system32\fzzomq.dll (file missing)
  O2 - BHO: (no name) - {4B18DD50-C996-44fc-AC52-0FECFF82ED58} - (no file)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
  O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
  O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
  O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
  O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
  O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
  O4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exe
  O4 - HKLM\..\Run: [cisaiitj] C:\WINDOWS\system32\gmwbepdd.exe
  O4 - HKLM\..\Run: [webrebates] "C:\Program Files\WebRebates4\webrebates.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [Nfiom] C:\WINDOWS\system32\w?aclt.exe
  O4 - HKCU\..\Run: [Sra] "C:\PROGRA~1\YSTEM~1\userinit.exe" -vt mt
  O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKUS\S-1-5-18\..\Run: [Sra] "C:\DOCUME~1\Capucine\MESDOC~1\CROSOF~1.NET\mmc.exe" -vt ndrv (User 'SYSTEM')
  O4 - HKUS\S-1-5-18\..\Run: [Lvospk] C:\WINDOWS\?icrosoft\w?auboot.exe (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [Sra] "C:\DOCUME~1\Capucine\MESDOC~1\CROSOF~1.NET\mmc.exe" -vt ndrv (User 'Default user')
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
  O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://c:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
  O8 - Extra context menu item: Web Rebates. - file://C:\Program Files\WebRebates4\websrebates\webtrebates\toprC0.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
  O9 - Extra button: ShopperReports - Compare travel rates - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\WINDOWS\System32\shdocvw.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
  O15 - Trusted Zone: *.blazefind.com
  O15 - Trusted Zone: *.clickspring.net
  O15 - Trusted Zone: *.flingstone.com
  O15 - Trusted Zone: *.mt-download.com
  O15 - Trusted Zone: *.my-internet.info
  O15 - Trusted Zone: *.searchbarcash.com
  O15 - Trusted Zone: *.searchmiracle.com
  O15 - Trusted Zone: *.skoobidoo.com
  O15 - Trusted Zone: *.slotch.com
  O15 - Trusted Zone: *.windupdates.com
  O15 - Trusted Zone: *.xxxtoolbar.com
  O15 - Trusted Zone: *.blazefind.com (HKLM)
  O15 - Trusted Zone: *.clickspring.net (HKLM)
  O15 - Trusted Zone: *.flingstone.com (HKLM)
  O15 - Trusted Zone: *.mt-download.com (HKLM)
  O15 - Trusted Zone: *.my-internet.info (HKLM)
  O15 - Trusted Zone: *.searchbarcash.com (HKLM)
  O15 - Trusted Zone: *.searchmiracle.com (HKLM)
  O15 - Trusted Zone: *.skoobidoo.com (HKLM)
  O15 - Trusted Zone: *.slotch.com (HKLM)
  O15 - Trusted Zone: *.windupdates.com (HKLM)
  O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
  O15 - Trusted IP range: 213.159.117.133
  O15 - Trusted IP range: 213.159.117.133 (HKLM)
  O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=714b9e99bb1ec51fadc828f5983e23109b906c2b320d9f1b39ed54699be7e97f4caf42694383070009646062296ff92e68cfba8c:eb8a1fb09d00c5943edceabcca450006
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
  O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
  O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
  O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
  O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
  O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
  O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
  
  0
  
  Réagir
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 6
ludsfa
Re,

Télécharge http://downloads.andymanchesta.com/RemovalTools/SDFix.exe(créé par AndyManchesta) et sauvegarde le sur ton Bureau.
Double clique sur SDFix.exe et choisis Install pour l'extraire sur le Bureau.

Redémarre en mode sans échec

Ouvre le dossier SDFix qui vient d'être créé à la racine de ton dique dur (C:) et double clique sur RunThis.bat pour lancer le script.
Appuie sur Y pour commencer le processus de nettoyage.
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis.

0

Réagir
Réponse 6 / 6
dam76360
Franchement, ne te coplique pas la vie!!! Télécharge trojanremover, met le à jour et il te trouvera et supprimera sans problème les trojan.
Après pour redonner une santé à ton pc, télécharge easycleaner et enlève tout se qui te parait suspect ou inutile. Mais n'utilise pas la partie doublons elle contient des erreurs.
Ensuite pour accélerer au démarrage, télècharge starup et vire tout ce qui est inutile au démarage comme par exemple des jeux, des webcams, ...

dam76360

0

Réagir
1. jlpjlp Contributeur sécurité
  
  slt trojan remover ne suffira malheureusement pas dans son cas...
  
  0
  
  Réagir

Virus trojan

6 réponses

Discussions similaires

Newsletters