Comment supprimer Vundo ?

Osmose -  
g!rly Messages postés 18462 Statut Contributeur -
Bonjour à tous !

J'ai un petit problème : lorsque je fais une analyse avec Avast, il détecte le trojan Vundo (son nom exact : Win32:Vundo@dll).
J'ai cherché sur le net, et plusieurs personnes proposent d'exécuter VundoFix en mode sans échec. Seulement voilà, lorsque je fais l'analyse avec le programme, il ne le trouve pas !
Comment dois-je donc faire pour supprimer ce trojan ?

Pour information, le pc tourne sous Vista !

Merci de vos réponses

Cordialement,

31 réponses

  • 1
  • 2
Résumé de la discussion

Une détection Avast signale le cheval de Troie Win32:Vundo@dll sous Vista, et la méthode efficace pour le supprimer reste incertaine lorsque VundoFix ne le repère pas.
Plusieurs recommandations préconisent Malwarebytes Anti-Malware, le télécharger et le mettre à jour, puis lancer une analyse complète et supprimer les éléments détectés, en fermant Internet Explorer pendant la suppression.
D'autres suggèrent aussi le mode sans échec et précisent que sur Vista certains outils posent parfois problème, comme CCleaner.
Le rapport partagé décrit des éléments trouvés, notamment des entrées de registre et des fichiers liés à wininit, montrant la complexité d'une désinfection complète.

Généré automatiquement par IA
sur la base des meilleures réponses
  1. g!rly Messages postés 18462 Statut Contributeur 407
     
    salut osmose,

    Télécharge combofix.exe (par sUBs) sur ton Bureau.

    -> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    -> Double clique combofix.exe.
    -> Tape sur la touche 1 (Yes) pour démarrer le scan.
    -> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

    NOTE : Le rapport se trouve également ici : C:\Combofix.txt

    Avant d'utiliser ComboFix :

    -> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

    -> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

    Une fois fait, sur ton bureau double-clic sur Combofix.exe.

    - Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

    /!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

    - En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

    - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

    -> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

    -> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

    -> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

    post egalement un hijack this stp

    Télécharge HijackThis ici :

    -> http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

    Tutoriel d´instalation : (Merci a Balltrap34 pour cette réalisation)

    -> http://pageperso.aol.fr/balltrap34/Hijenr.gif

    Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

    -> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

    Post le rapport généré ici stp...

    @+
    0
  2. Osmose
     
    Impossible de lancer Combofix sous Vista, aucun problème pour le lancer sous Vista cependant ! Le pc infecté tourne sous Vista comme déjà précisé, il y a donc un soucis !

    Merci pour ton aide en tous les cas.
    0
    1. Osmose
       
      Erreur de ma part : Combofix tourne sur mon xp mais sur mon vista ça ne fonctionne pas ! Et le pc infecté est bel et bien un vista. Désolé !
      0
  3. g!rly Messages postés 18462 Statut Contributeur 407
     
    combofix fonctionne sous vista !
    0
    1. Osmose
       
      Bonjour !

      J'ai tenté plusieurs fois de lancer Combofix, il n'a pas fonctionné.
      Je l'ai également téléchargé plusieurs fois, et de sources différentes, il n'a pas marché.
      0
  4. g!rly Messages postés 18462 Statut Contributeur 407
     
    reessaie...
    0
    1. Osmose
       
      J'ai déjà essayé, et comme je l'ai dit ça ne fonctionne pas.
      Je viens également de tenter d'installer CCleaner, et là, nouveau problème : impossible de l'installer.

      J'ai l'erreur suivante : "Erreur de l'ouverture du fichier en écriture".

      Il doit donc y avoir un problème quelquepart !
      0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. g!rly Messages postés 18462 Statut Contributeur 407
     
    bon,

    post moi ce rapport :

    Télécharge ComboScan sur ton Bureau en bas de cette pae en clickant sur download file

    -> http://www.geekstogo.com/forum/files/

    Ferme toutes les applications en cours : antivirus, pare-feu, etc ..
    Double-clic sur comboscan.exe, dans la fenêtre qui s'affiche, clic sur OK.
    Soit patient...
    Le rapport Comboscan.txt s'affichera, copie et colle le contenu de ce fichier ici.

    Le rapport peut-être long et en deux morceaux vérifie qu'il soit en entier.

    en esperant que ca marche...
    0
    1. Osmose
       
      J'ai trouvé le problème de Combofix, il fallait l'exécuter en tant qu'administrateur.
      Je te tiens au courant

      Merci pour ton aide
      0
  7. g!rly Messages postés 18462 Statut Contributeur 407
     
    comboscan ne marche pas non plus ?
    0
    1. Osmose
       
      Du coup, je n'ai pas essayé !
      Je n'aime pas rester sur des problèmes non résolus, il fallait que je trouve la solution !

      Combofix est en train de s'exécuter.
      0
      1. Osmose > Osmose
         
        Et voici les rapports :

        Combofix :

        ComboFix 08-05-21.3 - Olive 2008-05-24 16:26:15.1 - NTFSx86
        Microsoft® Windows Vista™ Professionnel 6.0.6000.0.1252.1.1036.18.1298 [GMT 2:00]
        Endroit: C:\Users\Olive\Desktop\ComboFix.exe
        * Création d'un nouveau point de restauration
        .

        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\Windows\system32\fccawTnk.dll
        C:\Windows\system32\x64

        .
        ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-24 to 2008-05-24 ))))))))))))))))))))))))))))))))))))
        .

        Pas de nouveau fichier cr‚‚ dans cet espace de temps

        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-05-17 16:17 --------- d-----w C:\Program Files\Google
        2008-05-17 16:09 --------- d--h--w C:\Program Files\InstallShield Installation Information
        2008-05-17 16:08 --------- d-----w C:\ProgramData\ScanSoft
        2008-05-17 16:03 --------- d-----w C:\Program Files\Canon
        2008-05-17 15:53 --------- d-----w C:\Users\Olive\AppData\Roaming\OpenOffice.org2
        2008-05-17 08:43 --------- d-----w C:\Program Files\a-squared Free
        2008-05-16 20:09 --------- d-----w C:\Program Files\The Cleaner Free
        2008-05-15 23:18 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
        2008-05-11 17:21 --------- d-----w C:\Users\Olive\AppData\Roaming\LimeWire
        2008-04-30 10:40 --------- d-----w C:\Program Files\LimeWire
        2008-04-08 13:45 --------- d-----w C:\Users\Olive\AppData\Roaming\Roxio
        2008-04-02 14:38 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
        2008-03-31 17:50 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
        2008-03-31 17:48 --------- d-----w C:\Program Files\Windows Live
        2008-03-31 17:47 --------- d-----w C:\ProgramData\WLInstaller
        2006-11-02 12:50 174 --sha-w C:\Program Files\desktop.ini
        2007-12-06 20:04 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
        2007-12-06 20:04 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
        2007-12-06 20:04 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
        .

        ------- Sigcheck -------

        .
        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

        [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC2C65E7-18A4-4CFF-B0B0-E93358B5FF79}]
        C:\Users\Olive\AppData\Local\Temp\byXnmlMF.dll

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2006-11-15 20:08 98304]
        "SigmatelSysTrayApp"="sttray.exe" [2007-02-08 07:11 303104 C:\Windows\sttray.exe]
        "PMX Daemon"="ICO.EXE" [2006-11-08 16:01 49152 C:\Windows\System32\ico.exe]
        "Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [2006-11-28 01:15 1540096]
        "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 17:15 81920]
        "BM6b1bbf98"="C:\Windows\system32\vlahlegm.dll" [2008-05-19 17:57 109056]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
        "EnableLUA"= 0 (0x0)

        [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
        "{8691F860-96E4-4FB3-8D35-531C0D1B0AC1}"= C:\Windows\system32\fccawTnk.dll [ ]

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
        "DisableMonitoring"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
        "{E9FC50E8-59B4-4DFE-AC21-80BCA26C468B}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
        "{167268F2-8413-48FB-8845-6B32F6EA6D86}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
        "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

        R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
        R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
        R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
        R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-12 01:10]
        R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-11-15 20:07]
        R3 pmxmouse;PMXMOUSE;C:\Windows\system32\DRIVERS\pmxmouse.sys [2006-10-19 18:27]
        R3 pmxusblf;PMXUSBLF;C:\Windows\system32\DRIVERS\pmxusblf.sys [2006-10-19 18:29]
        S3 fbxusb;Carte réseau virtuelle FreeBox USB;C:\Windows\system32\DRIVERS\fbxusb32.sys [2004-10-20 17:23]
        S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 09:36]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
        LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-05-24 16:36:01
        Windows 6.0.6000 NTFS

        Balayage processus cach‚s ...

        Balayage cach‚ autostart entries ...

        Balayage des fichiers cach‚s ...

        Scan termin‚ avec succŠs
        Les fichiers cach‚s: 0

        **************************************************************************
        .
        ------------------------ Other Running Processes ------------------------
        .
        C:\Windows\System32\audiodg.exe
        C:\Windows\System32\WLTRYSVC.EXE
        C:\Windows\System32\BCMWLTRY.EXE
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\Program Files\Alwil Software\Avast4\Setup\avast.setup
        C:\Windows\System32\pmxmiced.exe
        C:\Program Files\a-squared Free\a2service.exe
        C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
        C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe
        C:\Windows\System32\drivers\XAudio.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
        C:\Windows\System32\igfxsrvc.exe
        C:\Windows\System32\dllhost.exe
        .
        **************************************************************************
        .
        Temps d'accomplissement: 2008-05-24 16:38:36 - machine was rebooted
        ComboFix-quarantined-files.txt 2008-05-24 14:38:29

        Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
        Le texte du message associ‚ au num‚ro 0x2379 est introuvable dans le fichier de messages pour Application.

        111 --- E O F --- 2008-05-17 08:44:50




        HiJackThis :

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 16:42:22, on 24/05/2008
        Platform: Windows Vista (WinNT 6.00.1904)
        MSIE: Internet Explorer v7.00 (7.00.6000.16643)
        Boot mode: Normal

        Running processes:
        C:\Windows\system32\Dwm.exe
        C:\Windows\System32\igfxtray.exe
        C:\Windows\sttray.exe
        C:\Windows\System32\ico.exe
        C:\Windows\System32\WLTRAY.EXE
        C:\Windows\System32\Pmxmiced.exe
        C:\Windows\Explorer.exe
        C:\Windows\system32\taskeng.exe
        C:\Windows\system32\conime.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
        C:\Windows\system32\SearchFilterHost.exe
        C:\Users\Olive\Desktop\HiJackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: (no name) - {BC2C65E7-18A4-4CFF-B0B0-E93358B5FF79} - C:\Users\Olive\AppData\Local\Temp\byXnmlMF.dll (file missing)
        O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
        O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
        O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
        O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
        O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
        O4 - HKLM\..\Run: [BM6b1bbf98] Rundll32.exe "C:\Windows\system32\vlahlegm.dll",s
        O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
        O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
        O13 - Gopher Prefix:
        O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/ImageUploader4.cab
        O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
        O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
        O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
        O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
        O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
        O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
        0
  8. g!rly Messages postés 18462 Statut Contributeur 407
     
    ok cool

    mais si tu as bien lu les instructions, il faut se deconnecter du net et desactiver ses protections !!!

    @+
    0
    1. Osmose
       
      Les instructions ont été bien lues, les fenêtres toutes fermées, même chose pour l'anti-virus et la connexion Internet. J'ai à disposition deux pc, c'est avec le pc clean que je vous réponds !
      0
  9. g!rly Messages postés 18462 Statut Contributeur 407
     
    ok

    la suite :

    vide tes fichiers temporaires avec ccleaner si tu as reussi a l´installer...

    puis

    Copie le texte ci-dessous :

    File::
    C:\Windows\system32\vlahlegm.dll
    C:\Windows\system32\fccawTnk.dll

    Folder::

    Registry::
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC2C65E7-18A4-4CFF-B0B0-E93358B5FF79}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BM6b1bbf98"=-
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{8691F860-96E4-4FB3-8D35-531C0D1B0AC1}"=-

    Ouvre le Bloc-Notes puis colle le texte copié.
    (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
    Sauvegarde ce fichier sous le nom de CFScript.txt.

    Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

    http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

    Cela va relancer Combofix,

    Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

    Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

    Ne touche à rien tant que le scan n'est pas terminé.

    Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

    S'il n'y a pas de rédémarrage, poste quand même les rapports.

    @+
    0
  10. Osmose
     
    Voici le rapport Combofix :

    ComboFix 08-05-21.3 - Olive 2008-05-24 17:47:02.2 - NTFSx86
    Microsoft® Windows Vista™ Professionnel 6.0.6000.0.1252.1.1036.18.1083 [GMT 2:00]
    Endroit: C:\Users\Olive\Desktop\ComboFix.exe
    Command switches used :: C:\Users\Olive\Desktop\CFScript.lnk
    * Création d'un nouveau point de restauration
    .

    ((((((((((((((((((((((((((((( Fichiers créés 2008-04-24 to 2008-05-24 ))))))))))))))))))))))))))))))))))))
    .

    Pas de nouveau fichier créé dans cet espace de temps

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-24 14:26 1,572,864 --sha-w C:\Users\Charlène\NTUSER.DAT
    2008-05-24 14:26 1,572,864 --sha-w C:\Users\Charlène\NTUSER.DAT
    2008-05-24 13:51 --------- d-----w C:\Users\Charlène\AppData\Roaming\OpenOffice.org2
    2008-05-19 15:57 109,056 ----a-w C:\Windows\System32\vlahlegm.dll
    2008-05-17 16:17 --------- d-----w C:\Program Files\Google
    2008-05-17 16:09 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-05-17 16:08 --------- d-----w C:\ProgramData\ScanSoft
    2008-05-17 16:03 --------- d-----w C:\Program Files\Canon
    2008-05-17 15:53 --------- d-----w C:\Users\Olive\AppData\Roaming\OpenOffice.org2
    2008-05-17 08:43 --------- d-----w C:\Program Files\a-squared Free
    2008-05-16 20:09 --------- d-----w C:\Program Files\The Cleaner Free
    2008-05-15 23:18 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
    2008-05-11 17:21 --------- d-----w C:\Users\Olive\AppData\Roaming\LimeWire
    2008-04-30 10:40 --------- d-----w C:\Program Files\LimeWire
    2008-04-08 13:45 --------- d-----w C:\Users\Olive\AppData\Roaming\Roxio
    2008-04-02 14:38 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-03-31 17:50 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
    2008-03-31 17:48 --------- d-----w C:\Program Files\Windows Live
    2008-03-31 17:47 --------- d-----w C:\ProgramData\WLInstaller
    2008-03-31 17:46 --------- d-s---w C:\Users\Charlène\AppData\Roaming\Microsoft
    2008-02-29 06:51 19,000 ----a-w C:\Windows\System32\kd1394.dll
    2008-02-29 06:39 40,960 ----a-w C:\Windows\System32\srclient.dll
    2008-02-29 06:39 371,712 ----a-w C:\Windows\System32\srcore.dll
    2008-02-29 06:38 313,856 ----a-w C:\Windows\System32\rstrui.exe
    2008-02-29 06:38 16,384 ----a-w C:\Windows\System32\srdelayed.exe
    2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
    2008-02-29 06:34 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll
    2008-02-29 04:16 2,027,008 ----a-w C:\Windows\System32\win32k.sys
    2008-02-03 10:53 118 ----a-w C:\Users\Charlène\AppData\Roaming\wklnhst.dat
    2006-11-02 12:50 174 --sha-w C:\Program Files\desktop.ini
    2007-12-06 20:04 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    2007-12-06 20:04 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    2007-12-06 20:04 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    .

    ------- Sigcheck -------

    .
    ((((((((((((((((((((((((((((( snapshot@2008-05-24_16.38.03.68 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-05-24 15:46:53 5,894,144 ----a-w C:\Windows\erdnt\Hiv-backup\SCHEMA.DAT
    + 2008-05-24 14:35:17 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2008-05-24 14:35:17 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2008-05-24 14:35:24 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2008-05-24 14:43:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2008-05-24 14:35:24 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2008-05-24 14:43:13 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2008-05-24 14:35:24 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2008-05-24 14:43:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2008-05-24 14:29:42 103,924 ----a-w C:\Windows\System32\perfc009.dat
    + 2008-05-24 14:41:06 103,924 ----a-w C:\Windows\System32\perfc009.dat
    - 2008-05-24 14:29:43 117,572 ----a-w C:\Windows\System32\perfc00C.dat
    + 2008-05-24 14:41:07 117,572 ----a-w C:\Windows\System32\perfc00C.dat
    - 2008-05-24 14:29:43 610,142 ----a-w C:\Windows\System32\perfh009.dat
    + 2008-05-24 14:41:07 610,142 ----a-w C:\Windows\System32\perfh009.dat
    - 2008-05-24 14:29:43 690,832 ----a-w C:\Windows\System32\perfh00C.dat
    + 2008-05-24 14:41:07 690,832 ----a-w C:\Windows\System32\perfh00C.dat
    - 2008-05-19 16:02:21 6,029,312 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
    + 2008-05-24 14:42:40 6,029,312 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
    - 2008-05-24 14:24:29 7,956 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2797674674-2034626984-2998799533-1000_UserData.bin
    + 2008-05-24 14:40:06 8,210 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2797674674-2034626984-2998799533-1000_UserData.bin
    - 2008-05-24 14:24:29 61,420 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    + 2008-05-24 14:40:06 61,630 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    - 2008-05-19 15:53:36 38,911,201 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
    + 2008-05-24 14:46:56 38,934,604 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
    + 2007-08-31 02:28:20 258,232 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.16553_none_206f74b9d10718ea\acpi.sys
    + 2007-08-31 02:27:20 28,344 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.16553_none_206f74b9d10718ea\battc.sys
    + 2007-08-31 02:27:04 20,920 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.16553_none_206f74b9d10718ea\compbatt.sys
    + 2007-08-31 00:57:48 11,264 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.16553_none_206f74b9d10718ea\wmiacpi.sys
    + 2007-08-31 02:22:53 258,232 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.20672_none_20e27162ea35d73f\acpi.sys
    + 2007-08-31 02:21:27 28,344 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.20672_none_20e27162ea35d73f\battc.sys
    + 2007-08-31 02:21:14 20,920 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.20672_none_20e27162ea35d73f\compbatt.sys
    + 2007-08-31 01:02:00 11,264 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.20672_none_20e27162ea35d73f\wmiacpi.sys
    + 2007-08-31 02:27:20 28,344 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.16553_none_140e43a256cf6f52\battc.sys
    + 2007-08-31 00:57:48 14,208 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.16553_none_140e43a256cf6f52\CmBatt.sys
    + 2007-08-31 00:57:49 21,504 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.16553_none_140e43a256cf6f52\hidbatt.sys
    + 2007-08-31 02:21:27 28,344 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.20672_none_1481404b6ffe2da7\battc.sys
    + 2007-08-31 01:02:00 14,208 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.20672_none_1481404b6ffe2da7\CmBatt.sys
    + 2007-08-31 01:02:01 21,504 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.20672_none_1481404b6ffe2da7\hidbatt.sys
    + 2007-05-04 00:31:44 53,760 ----a-w C:\Windows\winsxs\x86_hdaudbus.inf_31bf3856ad364e35_6.0.6000.16481_none_74e5d15989a08e89\hdaudbus.sys
    + 2007-05-05 00:37:12 53,760 ----a-w C:\Windows\winsxs\x86_hdaudbus.inf_31bf3856ad364e35_6.0.6000.20592_none_75659e82a2c5639b\hdaudbus.sys
    + 2008-01-29 00:15:55 2,560 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6000.16633_none_0a1e8a9df53b7ab4\AcRes.dll
    + 2008-01-30 00:29:13 2,560 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6000.20762_none_0a86b75b0e7254fa\AcRes.dll
    + 2008-01-29 04:16:31 2,144,256 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6000.16633_none_0a208b31f539ad62\AcGenral.dll
    + 2008-01-30 04:24:55 2,144,768 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6000.20762_none_0a88b7ef0e7087a8\AcGenral.dll
    + 2008-01-29 04:16:31 449,536 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6000.16633_none_0a218b7bf538c6b9\AcSpecfc.dll
    + 2008-01-30 04:24:56 450,560 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6000.20762_none_0a89b8390e6fa0ff\AcSpecfc.dll
    + 2008-01-29 04:16:31 537,600 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.16633_none_0a228bc5f537e010\AcLayers.dll
    + 2008-01-29 04:16:31 173,056 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.16633_none_0a228bc5f537e010\AcXtrnal.dll
    + 2008-01-30 04:24:55 537,600 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.20762_none_0a8ab8830e6eba56\AcLayers.dll
    + 2008-01-30 04:24:56 173,056 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.20762_none_0a8ab8830e6eba56\AcXtrnal.dll
    + 2007-06-27 02:21:31 1,984,512 ----a-w C:\Windows\winsxs\x86_microsoft-windows-authentication-authui_31bf3856ad364e35_6.0.6000.16513_none_0a056d7cf846bbd5\authui.dll
    + 2007-06-27 02:14:53 1,984,512 ----a-w C:\Windows\winsxs\x86_microsoft-windows-authentication-authui_31bf3856ad364e35_6.0.6000.20628_none_0a893bce1167f643\authui.dll
    + 2007-06-27 02:21:23 967,680 ----a-w C:\Windows\winsxs\x86_microsoft-windows-calendar_31bf3856ad364e35_6.0.6000.16513_none_8f02a43161a69634\WinCal.exe
    + 2007-06-27 01:22:15 967,168 ----a-w C:\Windows\winsxs\x86_microsoft-windows-calendar_31bf3856ad364e35_6.0.6000.20628_none_8f8672827ac7d0a2\WinCal.exe
    + 2007-06-29 02:21:13 134,656 ----a-w C:\Windows\winsxs\x86_microsoft-windows-d..frastructure-server_31bf3856ad364e35_6.0.6000.16515_none_663e618f9f0e757e\dps.dll
    + 2007-06-29 02:21:53 134,656 ----a-w C:\Windows\winsxs\x86_microsoft-windows-d..frastructure-server_31bf3856ad364e35_6.0.6000.20630_none_66ad5d10b840ce77\dps.dll
    + 2007-06-26 02:49:06 10,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.16512_none_d56b19bc316f9001\dhcpcmonitor.dll
    + 2007-06-26 02:49:06 204,800 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.16512_none_d56b19bc316f9001\dhcpcsvc.dll
    + 2007-06-26 02:49:06 120,320 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.16512_none_d56b19bc316f9001\dhcpcsvc6.dll
    + 2007-06-26 02:36:21 10,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.20627_none_d5eee80d4a90ca6f\dhcpcmonitor.dll
    + 2007-06-26 02:36:21 203,776 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.20627_none_d5eee80d4a90ca6f\dhcpcsvc.dll
    + 2007-06-26 02:36:21 120,320 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.20627_none_d5eee80d4a90ca6f\dhcpcsvc6.dll
    + 2007-08-27 03:10:03 2,923,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
    + 2007-08-27 02:01:58 2,923,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
    + 2008-01-29 04:16:32 1,686,528 ----a-w C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.16633_none_3ffca182c42c1062\gameux.dll
    + 2008-01-29 00:30:10 4,247,552 ----a-w C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.16633_none_3ffca182c42c1062\GameUXLegacyGDFs.dll
    + 2008-01-30 04:26:09 1,686,528 ----a-w C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.20762_none_4064ce3fdd62eaa8\gameux.dll
    + 2008-01-30 00:43:26 4,247,552 ----a-w C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.20762_none_4064ce3fdd62eaa8\GameUXLegacyGDFs.dll
    + 2007-07-03 02:08:22 36,864 ----a-w C:\Windows\winsxs\x86_microsoft-windows-lddmcore_31bf3856ad364e35_6.0.6000.16517_none_a9de8a2ce66804b6\cdd.dll
    + 2007-07-03 01:01:16 619,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-lddmcore_31bf3856ad364e35_6.0.6000.16517_none_a9de8a2ce66804b6\dxgkrnl.sys
    + 2007-07-03 02:16:20 36,864 ----a-w C:\Windows\winsxs\x86_microsoft-windows-lddmcore_31bf3856ad364e35_6.0.6000.20632_none_aa4d85adff9a5daf\cdd.dll
    + 2007-07-03 01:07:51 619,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-lddmcore_31bf3856ad364e35_6.0.6000.20632_none_aa4d85adff9a5daf\dxgkrnl.sys
    + 2007-09-11 02:20:02 356,864 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediametadatahandler_31bf3856ad364e35_6.0.6000.16557_none_890b997ff4e3a637\MediaMetadataHandler.dll
    + 2007-09-08 04:52:23 356,864 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediametadatahandler_31bf3856ad364e35_6.0.6000.20676_none_897e96290e12648c\MediaMetadataHandler.dll
    + 2007-09-11 02:21:17 4,096 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\dxmasf.dll
    + 2007-09-11 02:21:01 7,680 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\spwmp.dll
    + 2007-09-11 02:21:39 10,617,344 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmp.dll
    + 2007-09-11 02:19:09 107,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmpconfig.exe
    + 2007-09-11 02:19:09 168,960 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmplayer.exe
    + 2007-09-11 01:36:49 8,147,968 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmploc.DLL
    + 2007-09-11 02:19:10 107,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmpshare.exe
    + 2007-09-08 04:53:43 4,096 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\dxmasf.dll
    + 2007-09-08 04:53:26 7,680 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\spwmp.dll
    + 2007-09-08 04:54:02 10,616,832 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmp.dll
    + 2007-09-08 04:14:59 107,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmpconfig.exe
    + 2007-09-08 04:14:51 168,960 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmplayer.exe
    + 2007-09-08 04:14:54 8,147,968 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmploc.DLL
    + 2007-09-08 04:14:35 107,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmpshare.exe
    + 2007-07-03 02:13:44 564,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-msftedit_31bf3856ad364e35_6.0.6000.16517_none_d3e6ea943a0ccc2e\msftedit.dll
    + 2007-07-03 02:18:02 564,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-msftedit_31bf3856ad364e35_6.0.6000.20632_none_d455e615533f2527\msftedit.dll
    + 2007-06-21 02:12:44 268,288 ----a-w C:\Windows\winsxs\x86_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.0.6000.16509_none_182f5e49b7a9aadf\mcbuilder.exe
    + 2007-06-21 00:51:18 268,288 ----a-w C:\Windows\winsxs\x86_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.0.6000.20624_none_189e59cad0dc03d8\mcbuilder.exe
    + 2008-01-19 03:06:36 154,624 ----a-w C:\Windows\winsxs\x86_microsoft-windows-native-80211_31bf3856ad364e35_6.0.6000.16632_none_4d03fb3a91e27bd0\nwifi.sys
    + 2008-01-19 02:32:39 154,624 ----a-w C:\Windows\winsxs\x86_microsoft-windows-native-80211_31bf3856ad364e35_6.0.6000.20757_none_4d7cf99fab0bd22f\nwifi.sys
    + 2007-07-03 02:14:14 384,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ndis-tdi-bindingengine_31bf3856ad364e35_6.0.6000.16517_none_3c2ad8f2286305c8\netcfgx.dll
    + 2007-07-03 02:18:48 384,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ndis-tdi-bindingengine_31bf3856ad364e35_6.0.6000.20632_none_3c99d47341955ec1\netcfgx.dll
    + 2007-10-26 11:12:53 1,060,920 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.16586_none_a43a6b8d2000830d\ntfs.sys
    + 2007-12-16 22:50:41 1,060,920 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.16615_none_a4851c9d1fc8a346\ntfs.sys
    + 2007-10-26 04:22:05 1,061,432 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.20709_none_a51d8a7c38da8c7b\ntfs.sys
    + 2007-12-16 22:52:59 1,061,944 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.20740_none_a4e9483239031830\ntfs.sys
    + 2008-04-16 00:49:12 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.16674_none_f05a2d326e88eb29\OESpamFilter.dat
    + 2008-04-16 00:44:28 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.20815_none_f125abb58774f9cb\OESpamFilter.dat
    + 2008-04-16 00:44:37 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.18054_none_f2560bb06b9f4438\OESpamFilter.dat
    + 2008-04-16 00:43:45 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.22159_none_f2e4a9ed84b862b5\OESpamFilter.dat
    + 2007-06-19 00:48:30 320,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.0.6000.16508_none_9c6a0aab5eb986b6\csc.sys
    + 2007-06-19 02:09:12 105,984 ----a-w C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.0.6000.16508_none_9c6a0aab5eb986b6\CscMig.dll
    + 2007-06-19 00:49:28 320,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.0.6000.20622_none_9cd805e277ecc658\csc.sys
    + 2007-06-19 02:03:43 105,984 ----a-w C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.0.6000.20622_none_9cd805e277ecc658\CscMig.dll
    + 2007-10-30 03:12:15 558,080 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ole-automation_31bf3856ad364e35_6.0.6000.16588_none_bacb6cf1fe8d4f50\oleaut32.dll
    + 2007-10-30 03:56:09 559,104 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ole-automation_31bf3856ad364e35_6.0.6000.20711_none_bb99b91117787749\oleaut32.dll
    + 2007-06-28 02:30:09 3,504,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16514_none_6a435250b701059d\ntkrnlpa.exe
    + 2007-06-28 02:30:09 3,470,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16514_none_6a435250b701059d\ntoskrnl.exe
    + 2007-08-29 03:11:59 3,504,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16551_none_6a1511c2b724295c\ntkrnlpa.exe
    + 2007-08-29 03:11:57 3,471,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16551_none_6a1511c2b724295c\ntoskrnl.exe
    + 2007-10-24 03:58:11 3,504,696 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16584_none_69f7a2dcb739c934\ntkrnlpa.exe
    + 2007-10-24 03:58:10 3,470,392 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16584_none_69f7a2dcb739c934\ntoskrnl.exe
    + 2007-06-28 02:29:58 3,504,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20629_none_6ac720a1d022400b\ntkrnlpa.exe
    + 2007-06-28 02:29:57 3,470,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20629_none_6ac720a1d022400b\ntoskrnl.exe
    + 2007-08-29 02:50:20 3,504,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20670_none_6a880e6bd052e7b1\ntkrnlpa.exe
    + 2007-08-29 02:50:18 3,471,544 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20670_none_6a880e6bd052e7b1\ntoskrnl.exe
    + 2007-10-24 04:13:51 3,505,720 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20707_none_6adac1cbd013d2a2\ntkrnlpa.exe
    + 2007-10-24 04:13:50 3,471,928 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20707_none_6adac1cbd013d2a2\ntoskrnl.exe
    + 2007-06-29 02:21:45 694,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..ooler-core-localspl_31bf3856ad364e35_6.0.6000.16515_none_2e2f4ef5958b2567\localspl.dll
    + 2007-06-29 02:22:49 694,272 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..ooler-core-localspl_31bf3856ad364e35_6.0.6000.20630_none_2e9e4a76aebd7e60\localspl.dll
    + 2007-06-26 02:51:24 220,160 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.0.6000.16512_none_ee146a58804bf72b\ntprint.dll
    + 2007-06-26 02:21:16 61,440 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.0.6000.16512_none_ee146a58804bf72b\ntprint.exe
    + 2007-06-26 02:38:21 220,160 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.0.6000.20627_none_ee9838a9996d3199\ntprint.dll
    + 2007-06-26 02:10:18 61,440 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.0.6000.20627_none_ee9838a9996d3199\ntprint.exe
    + 2007-06-22 02:16:39 704,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.16510_none_69dd6e605b578d62\PhotoScreensaver.scr
    + 2007-08-30 04:00:33 704,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.16552_none_69b42f445b762fd4\PhotoScreensaver.scr
    + 2007-06-22 01:31:04 704,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.20625_none_6a613cb17478c7d0\PhotoScreensaver.scr
    + 2007-08-30 02:40:37 704,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.20671_none_6a272bed74a4ee29\PhotoScreensaver.scr
    + 2007-07-04 01:27:33 70,144 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.16518_none_ac625a685a7efa74\pacer.sys
    + 2007-07-04 02:22:30 15,360 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.16518_none_ac625a685a7efa74\pacerprf.dll
    + 2007-07-04 02:22:55 33,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.16518_none_ac625a685a7efa74\traffic.dll
    + 2007-07-04 02:23:18 13,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.16518_none_ac625a685a7efa74\wshqos.dll
    + 2007-07-04 01:26:58 70,144 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.20633_none_acd155e973b1536d\pacer.sys
    + 2007-07-04 02:15:22 15,360 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.20633_none_acd155e973b1536d\pacerprf.dll
    + 2007-07-04 02:15:47 33,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.20633_none_acd155e973b1536d\traffic.dll
    + 2007-07-04 02:16:06 13,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.20633_none_acd155e973b1536d\wshqos.dll
    + 2007-07-04 01:28:10 20,480 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\ndistapi.sys
    + 2007-07-04 01:28:13 48,640 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\ndproxy.sys
    + 2007-07-04 02:22:38 77,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\rascfg.dll
    + 2007-07-04 02:22:38 52,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\rasdiag.dll
    + 2007-07-04 02:22:38 32,768 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\rasmxs.dll
    + 2007-07-04 02:22:38 22,016 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\rasser.dll
    + 2007-07-04 01:28:17 61,952 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\wanarp.sys
    + 2007-07-04 01:27:35 20,480 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\ndistapi.sys
    + 2007-07-04 01:27:38 48,640 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\ndproxy.sys
    + 2007-07-04 02:15:28 77,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\rascfg.dll
    + 2007-07-04 02:15:28 52,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\rasdiag.dll
    + 2007-07-04 02:15:29 32,768 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\rasmxs.dll
    + 2007-07-04 02:15:29 22,016 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\rasser.dll
    + 2007-07-04 01:27:42 61,952 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\wanarp.sys
    + 2007-07-03 02:14:39 467,456 ----a-w C:\Windows\winsxs\x86_microsoft-windows-riched32_31bf3856ad364e35_6.0.6000.16517_none_9b16a5648576e40a\riched20.dll
    + 2007-07-03 02:14:39 8,192 ----a-w C:\Windows\winsxs\x86_microsoft-windows-riched32_31bf3856ad364e35_6.0.6000.16517_none_9b16a5648576e40a\riched32.dll
    + 2007-07-03 02:19:22 467,456 ----a-w C:\Windows\winsxs\x86_microsoft-windows-riched32_31bf3856ad364e35_6.0.6000.20632_none_9b85a0e59ea93d03\riched20.dll
    + 2007-07-03 02:19:22 8,192 ----a-w C:\Windows\winsxs\x86_microsoft-windows-riched32_31bf3856ad364e35_6.0.6000.20632_none_9b85a0e59ea93d03\riched32.dll
    + 2007-06-21 02:15:28 223,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..icensing-slc-client_31bf3856ad364e35_6.0.6000.16509_none_c3421cfda8beb1db\SLC.dll
    + 2007-06-21 02:08:07 223,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..icensing-slc-client_31bf3856ad364e35_6.0.6000.20624_none_c3b1187ec1f10ad4\SLC.dll
    + 2007-08-29 03:06:53 542,720 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..mmaintenanceservice_31bf3856ad364e35_6.0.6000.16551_none_3b32a26ce33869cb\sysmain.dll
    + 2007-08-29 02:45:24 542,720 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..mmaintenanceservice_31bf3856ad364e35_6.0.6000.20670_none_3ba59f15fc672820\sysmain.dll
    + 2007-06-21 02:15:29 566,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.16509_none_889ab124b8091615\SLCommDlg.dll
    + 2007-06-21 02:12:55 186,368 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.16509_none_889ab124b8091615\SLLUA.exe
    + 2007-06-21 02:12:55 351,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.16509_none_889ab124b8091615\SLUI.exe
    + 2007-06-21 02:15:29 57,856 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.16509_none_889ab124b8091615\SLUINotify.dll
    + 2007-06-21 02:08:07 566,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.20624_none_8909aca5d13b6f0e\SLCommDlg.dll
    + 2007-06-21 01:06:23 186,368 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.20624_none_8909aca5d13b6f0e\SLLUA.exe
    + 2007-06-21 01:06:32 351,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.20624_none_8909aca5d13b6f0e\SLUI.exe
    + 2007-06-21 02:08:07 57,856 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.20624_none_8909aca5d13b6f0e\SLUINotify.dll
    + 2007-06-21 02:15:28 39,936 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-slc_31bf3856ad364e35_6.0.6000.16509_none_4c9a3f87fc5750bf\slcinst.dll
    + 2007-06-21 02:12:55 2,605,568 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-slc_31bf3856ad364e35_6.0.6000.16509_none_4c9a3f87fc5750bf\SLsvc.exe
    + 2007-06-21 02:08:07 39,936 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-slc_31bf3856ad364e35_6.0.6000.20624_none_4d093b091589a9b8\slcinst.dll
    + 2007-06-21 01:50:39 2,605,568 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-slc_31bf3856ad364e35_6.0.6000.20624_none_4d093b091589a9b8\SLsvc.exe
    + 2007-06-21 02:15:29 33,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-wmi_31bf3856ad364e35_6.0.6000.16509_none_4c6f7771fc7773a0\slwmi.dll
    + 2007-06-21 02:08:07 33,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-wmi_31bf3856ad364e35_6.0.6000.20624_none_4cde72f315a9cc99\slwmi.dll
    + 2007-06-19 02:10:48 269,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-schannel_31bf3856ad364e35_6.0.6000.16508_none_20380cd258151361\schannel.dll
    + 2007-06-19 02:05:45 269,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-schannel_31bf3856ad364e35_6.0.6000.20622_none_20a6080971485303\schannel.dll
    + 2007-05-24 02:25:48 69,632 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sendmail_31bf3856ad364e35_6.0.6000.16493_none_58a4e9811f22ea1c\sendmail.dll
    + 2007-05-24 02:19:34 69,632 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sendmail_31bf3856ad364e35_6.0.6000.20605_none_5991d81237f5be42\sendmail.dll
    + 2007-07-12 04:08:09 13,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.0.6000.16522_none_02d37ed64c3424df\icsunattend.exe
    + 2007-07-12 04:09:14 286,208 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.0.6000.16522_none_02d37ed64c3424df\ipnathlp.dll
    + 2007-07-12 01:52:52 13,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.0.6000.20638_none_03584d71655478a4\icsunattend.exe
    + 2007-07-12 02:43:31 285,696 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.0.6000.20638_none_03584d71655478a4\ipnathlp.dll
    + 2007-06-27 02:23:27 11,315,200 ----a-w C:\Windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.0.6000.16513_none_6a3b1b4414dac79d\shell32.dll
    + 2007-06-27 02:17:57 11,315,200 ----a-w C:\Windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.0.6000.20628_none_6abee9952dfc020b\shell32.dll
    + 2007-07-13 02:20:52 8,138,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ssbranded_31bf3856ad364e35_6.0.6000.16523_none_36921e330a735e63\ssBranded.scr
    + 2007-07-13 01:19:54 8,138,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ssbranded_31bf3856ad364e35_6.0.6000.20639_none_3716ecce2393b228\ssBranded.scr
    + 2007-08-31 02:17:56 24,064 ----a-w C:\Windows\winsxs\x86_microsoft-windows-t..services-publicapis_31bf3856ad364e35_6.0.6000.16553_none_c5179c13c95485bd\wtsapi32.dll
    + 2007-08-31 02:14:51 24,064 ----a-w C:\Windows\winsxs\x86_microsoft-windows-t..services-publicapis_31bf3856ad364e35_6.0.6000.20672_none_c58a98bce2834412\wtsapi32.dll
    + 2007-06-27 02:21:31 65,024 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\avicap32.dll
    + 2007-06-27 02:21:31 88,576 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\avifil32.dll
    + 2007-06-27 02:22:18 82,944 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\mciavi32.dll
    + 2007-06-27 02:22:36 12,800 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\msrle32.dll
    + 2007-06-27 02:22:39 123,904 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\msvfw32.dll
    + 2007-06-27 02:22:39 31,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\msvidc32.dll
    + 2007-06-27 02:14:54 65,024 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\avicap32.dll
    + 2007-06-27 02:14:54 88,576 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\avifil32.dll
    + 2007-06-27 02:16:24 82,944 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\mciavi32.dll
    + 2007-06-27 02:16:47 12,800 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\msrle32.dll
    + 2007-06-27 02:16:50 123,904 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\msvfw32.dll
    + 2007-06-27 02:16:50 31,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\msvidc32.dll
    + 2007-08-29 01:52:47 2,027,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-win32k_31bf3856ad364e35_6.0.6000.16551_none_b6d829dc9d87e0b4\win32k.sys
    + 2007-08-29 01:35:43 2,028,544 ----a-w C:\Windows\winsxs\x86_microsoft-windows-win32k_31bf3856ad364e35_6.0.6000.20670_none_b74b2685b6b69f09\win32k.sys
    + 2007-05-24 02:26:10 712,192 ----a-w C:\Windows\winsxs\x86_microsoft-windows-windowscodec_31bf3856ad364e35_6.0.6000.16493_none_943d269aa43dda3a\WindowsCodecs.dll
    + 2007-05-24 02:19:50 712,704 ----a-w C:\Windows\winsxs\x86_microsoft-windows-windowscodec_31bf3856ad364e35_6.0.6000.20605_none_952a152bbd10ae60\WindowsCodecs.dll
    + 2007-08-29 03:07:04 47,104 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlanapi.dll
    + 2007-08-29 03:07:04 67,584 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlanhlp.dll
    + 2007-08-29 03:07:04 290,816 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlanmsm.dll
    + 2007-08-29 03:07:05 297,984 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlansec.dll
    + 2007-08-29 03:07:05 502,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlansvc.dll
    + 2007-08-29 02:45:37 47,104 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlanapi.dll
    + 2007-08-29 02:45:38 67,584 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlanhlp.dll
    + 2007-08-29 02:45:38 289,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlanmsm.dll
    + 2007-08-29 02:45:38 299,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlansec.dll
    + 2007-08-29 02:45:38 502,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlansvc.dll
    + 2007-08-31 02:17:42 356,352 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wmi-core-wbemcomn-dll_31bf3856ad364e35_6.0.6000.16553_none_0161deb32631b63d\wbemcomn.dll
    + 2007-08-31 02:14:37 356,352 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wmi-core-wbemcomn-dll_31bf3856ad364e35_6.0.6000.20672_none_01d4db5c3f607492\wbemcomn.dll
    + 2008-05-24 14:44:21 1,275,392 ----a-w C:\Windows\winsxs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9849.0_none_b7e911727b2899b7\msxml4.dll
    + 2007-12-16 09:56:45 41,984 ----a-w C:\Windows\winsxs\x86_monitor.inf_31bf3856ad364e35_6.0.6000.16615_none_4117345983213804\monitor.sys
    + 2007-12-16 09:50:45 41,984 ----a-w C:\Windows\winsxs\x86_monitor.inf_31bf3856ad364e35_6.0.6000.20740_none_417b5fee9c5bacee\monitor.sys
    + 2008-01-19 05:06:34 17,464 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\aliide.sys
    + 2008-01-19 05:06:40 17,976 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\amdide.sys
    + 2008-01-19 05:06:48 21,560 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
    + 2008-01-19 05:08:03 109,624 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\ataport.sys
    + 2008-01-19 05:06:41 19,000 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\cmdide.sys
    + 2008-01-19 05:06:34 17,464 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\intelide.sys
    + 2008-01-19 05:06:55 25,656 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\msahci.sys
    + 2008-01-19 05:06:34 15,928 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\pciide.sys
    + 2008-01-19 05:07:19 45,112 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\pciidex.sys
    + 2008-01-19 05:07:08 20,024 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\viaide.sys
    + 2008-01-19 04:33:11 17,464 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\aliide.sys
    + 2008-01-19 04:33:11 17,976 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\amdide.sys
    + 2008-01-19 04:33:23 21,560 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
    + 2008-01-19 04:34:32 110,136 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\ataport.sys
    + 2008-01-19 04:33:17 19,000 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\cmdide.sys
    + 2008-01-19 04:33:16 17,976 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\intelide.sys
    + 2008-01-19 04:33:29 28,216 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\msahci.sys
    + 2008-01-19 04:33:11 15,928 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\pciide.sys
    + 2008-01-19 04:33:50 45,112 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\pciidex.sys
    + 2008-01-19 04:34:00 20,024 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\viaide.sys
    + 2007-09-01 02:23:47 81,592 ----a-w C:\Windows\winsxs\x86_sbp2.inf_31bf3856ad364e35_6.0.6000.16554_none_432055ecf9219c67\sbp2port.sys
    + 2007-09-01 02:22:02 81,592 ----a-w C:\Windows\winsxs\x86_sbp2.inf_31bf3856ad364e35_6.0.6000.20673_none_4393529612505abc\sbp2port.sys
    + 2007-04-28 02:15:33 82,432 ----a-w C:\Windows\winsxs\x86_sdbus.inf_31bf3856ad364e35_6.0.6000.16478_none_6fb8cd2dcd6214ea\sdbus.sys
    + 2007-04-28 02:10:55 82,432 ----a-w C:\Windows\winsxs\x86_sdbus.inf_31bf3856ad364e35_6.0.6000.20588_none_70379a0ce687d0a5\sdbus.sys
    + 2007-04-28 02:35:46 13,312 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.16478_none_a211996cecf4f6d9\sffdisk.sys
    + 2007-04-28 02:35:46 12,800 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.16478_none_a211996cecf4f6d9\sffp_mmc.sys
    + 2007-04-28 02:35:45 12,800 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.16478_none_a211996cecf4f6d9\sffp_sd.sys
    + 2007-04-28 02:28:23 13,312 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.20588_none_a290664c061ab294\sffdisk.sys
    + 2007-04-28 02:28:23 12,800 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.20588_none_a290664c061ab294\sffp_mmc.sys
    + 2007-04-28 02:28:23 12,800 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.20588_none_a290664c061ab294\sffp_sd.sys
    + 2007-04-28 02:39:34 55,296 ----a-w C:\Windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6000.16478_none_465c5f209ade1e53\USBSTOR.SYS
    + 2007-04-28 02:31:47 55,296 ----a-w C:\Windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6000.20588_none_46db2bffb403da0e\USBSTOR.SYS
    + 2007-10-26 11:14:11 211,000 ----a-w C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6000.16586_none_137ff950ff29e447\volsnap.sys
    + 2007-10-26 04:22:53 211,000 ----a-w C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6000.20709_none_146318401803edb5\volsnap.sys
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC2C65E7-18A4-4CFF-B0B0-E93358B5FF79}]
    C:\Users\Olive\AppData\Local\Temp\byXnmlMF.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2006-11-15 20:08 98304]
    "SigmatelSysTrayApp"="sttray.exe" [2007-02-08 07:11 303104 C:\Windows\sttray.exe]
    "PMX Daemon"="ICO.EXE" [2006-11-08 16:01 49152 C:\Windows\System32\ico.exe]
    "Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [2006-11-28 01:15 1540096]
    "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 17:15 81920]
    "BM6b1bbf98"="C:\Windows\system32\vlahlegm.dll" [2008-05-19 17:57 109056]

    C:\Users\CharlŠne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 22:57:56 393216]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{8691F860-96E4-4FB3-8D35-531C0D1B0AC1}"= C:\Windows\system32\fccawTnk.dll [ ]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{E9FC50E8-59B4-4DFE-AC21-80BCA26C468B}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
    "{167268F2-8413-48FB-8845-6B32F6EA6D86}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
    R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
    R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
    R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-12 01:10]
    R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-11-15 20:07]
    R3 pmxmouse;PMXMOUSE;C:\Windows\system32\DRIVERS\pmxmouse.sys [2006-10-19 18:27]
    R3 pmxusblf;PMXUSBLF;C:\Windows\system32\DRIVERS\pmxusblf.sys [2006-10-19 18:29]
    S3 fbxusb;Carte réseau virtuelle FreeBox USB;C:\Windows\system32\DRIVERS\fbxusb32.sys [2004-10-20 17:23]
    S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 09:36]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-24 17:48:46
    Windows 6.0.6000 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    Temps d'accomplissement: 2008-05-24 17:49:47
    ComboFix-quarantined-files.txt 2008-05-24 15:49:42
    ComboFix2.txt 2008-05-24 14:38:37

    Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
    Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.

    364 --- E O F --- 2008-05-24 14:50:43

    Et voici le rapport hijackthis :

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:50:35, on 24/05/2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16643)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\sttray.exe
    C:\Windows\System32\ico.exe
    C:\Windows\System32\WLTRAY.EXE
    C:\Windows\System32\Pmxmiced.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Windows\system32\conime.exe
    C:\Windows\Explorer.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\System32\mobsync.exe
    C:\Users\Olive\Desktop\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {BC2C65E7-18A4-4CFF-B0B0-E93358B5FF79} - C:\Users\Olive\AppData\Local\Temp\byXnmlMF.dll (file missing)
    O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
    O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
    O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [BM6b1bbf98] Rundll32.exe "C:\Windows\system32\vlahlegm.dll",s
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O13 - Gopher Prefix:
    O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/ImageUploader4.cab
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
    O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
    0
  11. g!rly Messages postés 18462 Statut Contributeur 407
     
    ca n´a pas marché
    tu es sur d´avoir bien effectué le script ?
    0
  12. Osmose
     
    J'ai copié collé le texte suivant :

    File::
    C:\Windows\system32\vlahlegm.dll
    C:\Windows\system32\fccawTnk.dll

    Folder::

    Registry::
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC2C65E7-18A4-4CFF-B0B0-E93358B5FF79}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BM6b1bbf98"=-
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{8691F860-96E4-4FB3-8D35-531C0D1B0AC1}"=-

    Dans un bloc note. J'ai fait enregistrer sous le nom de CFScript. J'ai ensuite glisser le fichier dans ComboFix, qui s'est lancé. Après, je n'ai rien eu à faire, tout s'est fait tout seul.
    Je refais la manip au cas où !
    0
  13. g!rly Messages postés 18462 Statut Contributeur 407
     
    on va faire comme ca :

    * Télécharge OTMoveIt2 (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

    n´y touche pas

    redemarre en mode sans echec:

    Comment redémarrer en mode sans echec?

    Tu redemarre le pc et tapote la touche F8 des le début de l allumage sans t´arrêter.
    Une fenêtre sur fond noir va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
    capture d´ecran : http://www.coupdepoucepc.com/images_cdppc4/fichespratiques/windowsxp/modese/modese2.jpg
    Une fois sur le bureau si il n y a pas toutes les couleurs et autres c´est normal!
    Ps : si F8 ne marche pas utilise la touche F5.

    Note : en mode sans echec tu n´auras plus acces au net alors imprime ou copie les instructions ci dessous dans un fichier texte que tu pourras consulter a souhait
    une fois en mode sans echec.

    Fix.reg

    Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisie nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en citation ci-dessous (copie tout d'un trait-sans les barres(x)) :

    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    REGEDIT4

    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC2C65E7-18A4-4CFF-B0B0-E93358B5FF79}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BM6b1bbf98"=-
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{8691F860-96E4-4FB3-8D35-531C0D1B0AC1}"=-

    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    Note : Regedit4 est sur la premiere ligne dans le bloc note et il y a une ligne blanche a la fin.
    Puis click sur "fichier"/"enregistrer sous" :
    dans : sur le bureau
    Nom du fichier : fix.reg
    Type de fichier : "tous les fichiers"
    clique sur "enregistrer"

    ca doit ressembler a ca une fois enrregistré :

    http://img520.imageshack.us/img520/4251/screenshot005ps2.png

    double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
    Si c'est bien le cas, clique sur "oui"

    * Double-clique sur OTMoveIt.exe pour lancer le programme,
    * Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste Custom List of Files/Folders to Move" :

    C:\Windows\system32\vlahlegm.dll
    C:\Windows\system32\fccawTnk.dll

    * Clique sur MoveIt! pour lancer la suppression,
    * Le résultat appraraîtra dans le cadre Results.
    * Clique sur Exit pour fermer le programme.
    * Poste le rapport qui est situé ici : C:\\\_OTMoveIt\MovedFiles
    * Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

    Redemarre normalement et post le rapport de ot_move it ici stp ainsi qu´un nouveau rapport hijack this.

    @´+
    0
  14. Osmose
     
    J'ai tenté de réutiliser la première méthode avec le CFScript. Si cela n'a pas fonctionné j'essaierai avec la dernière méthode que tu m'as donnée.

    Voici les rapports :

    Combofix
    ComboFix 08-05-21.3 - Olive 2008-05-24 17:47:02.2 - NTFSx86
    Microsoft® Windows Vista™ Professionnel 6.0.6000.0.1252.1.1036.18.1083 [GMT 2:00]
    Endroit: C:\Users\Olive\Desktop\ComboFix.exe
    Command switches used :: C:\Users\Olive\Desktop\CFScript.lnk
    * Création d'un nouveau point de restauration
    .

    ((((((((((((((((((((((((((((( Fichiers créés 2008-04-24 to 2008-05-24 ))))))))))))))))))))))))))))))))))))
    .

    Pas de nouveau fichier créé dans cet espace de temps

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-24 14:26 1,572,864 --sha-w C:\Users\Charlène\NTUSER.DAT
    2008-05-24 14:26 1,572,864 --sha-w C:\Users\Charlène\NTUSER.DAT
    2008-05-24 13:51 --------- d-----w C:\Users\Charlène\AppData\Roaming\OpenOffice.org2
    2008-05-19 15:57 109,056 ----a-w C:\Windows\System32\vlahlegm.dll
    2008-05-17 16:17 --------- d-----w C:\Program Files\Google
    2008-05-17 16:09 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-05-17 16:08 --------- d-----w C:\ProgramData\ScanSoft
    2008-05-17 16:03 --------- d-----w C:\Program Files\Canon
    2008-05-17 15:53 --------- d-----w C:\Users\Olive\AppData\Roaming\OpenOffice.org2
    2008-05-17 08:43 --------- d-----w C:\Program Files\a-squared Free
    2008-05-16 20:09 --------- d-----w C:\Program Files\The Cleaner Free
    2008-05-15 23:18 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
    2008-05-11 17:21 --------- d-----w C:\Users\Olive\AppData\Roaming\LimeWire
    2008-04-30 10:40 --------- d-----w C:\Program Files\LimeWire
    2008-04-08 13:45 --------- d-----w C:\Users\Olive\AppData\Roaming\Roxio
    2008-04-02 14:38 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-03-31 17:50 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
    2008-03-31 17:48 --------- d-----w C:\Program Files\Windows Live
    2008-03-31 17:47 --------- d-----w C:\ProgramData\WLInstaller
    2008-03-31 17:46 --------- d-s---w C:\Users\Charlène\AppData\Roaming\Microsoft
    2008-02-29 06:51 19,000 ----a-w C:\Windows\System32\kd1394.dll
    2008-02-29 06:39 40,960 ----a-w C:\Windows\System32\srclient.dll
    2008-02-29 06:39 371,712 ----a-w C:\Windows\System32\srcore.dll
    2008-02-29 06:38 313,856 ----a-w C:\Windows\System32\rstrui.exe
    2008-02-29 06:38 16,384 ----a-w C:\Windows\System32\srdelayed.exe
    2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
    2008-02-29 06:34 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll
    2008-02-29 04:16 2,027,008 ----a-w C:\Windows\System32\win32k.sys
    2008-02-03 10:53 118 ----a-w C:\Users\Charlène\AppData\Roaming\wklnhst.dat
    2006-11-02 12:50 174 --sha-w C:\Program Files\desktop.ini
    2007-12-06 20:04 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    2007-12-06 20:04 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    2007-12-06 20:04 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    .

    ------- Sigcheck -------

    .
    ((((((((((((((((((((((((((((( snapshot@2008-05-24_16.38.03.68 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-05-24 15:46:53 5,894,144 ----a-w C:\Windows\erdnt\Hiv-backup\SCHEMA.DAT
    + 2008-05-24 14:35:17 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2008-05-24 14:35:17 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2008-05-24 14:35:24 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2008-05-24 14:43:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2008-05-24 14:35:24 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2008-05-24 14:43:13 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2008-05-24 14:35:24 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2008-05-24 14:43:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2008-05-24 14:29:42 103,924 ----a-w C:\Windows\System32\perfc009.dat
    + 2008-05-24 14:41:06 103,924 ----a-w C:\Windows\System32\perfc009.dat
    - 2008-05-24 14:29:43 117,572 ----a-w C:\Windows\System32\perfc00C.dat
    + 2008-05-24 14:41:07 117,572 ----a-w C:\Windows\System32\perfc00C.dat
    - 2008-05-24 14:29:43 610,142 ----a-w C:\Windows\System32\perfh009.dat
    + 2008-05-24 14:41:07 610,142 ----a-w C:\Windows\System32\perfh009.dat
    - 2008-05-24 14:29:43 690,832 ----a-w C:\Windows\System32\perfh00C.dat
    + 2008-05-24 14:41:07 690,832 ----a-w C:\Windows\System32\perfh00C.dat
    - 2008-05-19 16:02:21 6,029,312 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
    + 2008-05-24 14:42:40 6,029,312 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
    - 2008-05-24 14:24:29 7,956 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2797674674-2034626984-2998799533-1000_UserData.bin
    + 2008-05-24 14:40:06 8,210 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2797674674-2034626984-2998799533-1000_UserData.bin
    - 2008-05-24 14:24:29 61,420 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    + 2008-05-24 14:40:06 61,630 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    - 2008-05-19 15:53:36 38,911,201 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
    + 2008-05-24 14:46:56 38,934,604 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
    + 2007-08-31 02:28:20 258,232 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.16553_none_206f74b9d10718ea\acpi.sys
    + 2007-08-31 02:27:20 28,344 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.16553_none_206f74b9d10718ea\battc.sys
    + 2007-08-31 02:27:04 20,920 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.16553_none_206f74b9d10718ea\compbatt.sys
    + 2007-08-31 00:57:48 11,264 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.16553_none_206f74b9d10718ea\wmiacpi.sys
    + 2007-08-31 02:22:53 258,232 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.20672_none_20e27162ea35d73f\acpi.sys
    + 2007-08-31 02:21:27 28,344 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.20672_none_20e27162ea35d73f\battc.sys
    + 2007-08-31 02:21:14 20,920 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.20672_none_20e27162ea35d73f\compbatt.sys
    + 2007-08-31 01:02:00 11,264 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.20672_none_20e27162ea35d73f\wmiacpi.sys
    + 2007-08-31 02:27:20 28,344 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.16553_none_140e43a256cf6f52\battc.sys
    + 2007-08-31 00:57:48 14,208 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.16553_none_140e43a256cf6f52\CmBatt.sys
    + 2007-08-31 00:57:49 21,504 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.16553_none_140e43a256cf6f52\hidbatt.sys
    + 2007-08-31 02:21:27 28,344 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.20672_none_1481404b6ffe2da7\battc.sys
    + 2007-08-31 01:02:00 14,208 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.20672_none_1481404b6ffe2da7\CmBatt.sys
    + 2007-08-31 01:02:01 21,504 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.20672_none_1481404b6ffe2da7\hidbatt.sys
    + 2007-05-04 00:31:44 53,760 ----a-w C:\Windows\winsxs\x86_hdaudbus.inf_31bf3856ad364e35_6.0.6000.16481_none_74e5d15989a08e89\hdaudbus.sys
    + 2007-05-05 00:37:12 53,760 ----a-w C:\Windows\winsxs\x86_hdaudbus.inf_31bf3856ad364e35_6.0.6000.20592_none_75659e82a2c5639b\hdaudbus.sys
    + 2008-01-29 00:15:55 2,560 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6000.16633_none_0a1e8a9df53b7ab4\AcRes.dll
    + 2008-01-30 00:29:13 2,560 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6000.20762_none_0a86b75b0e7254fa\AcRes.dll
    + 2008-01-29 04:16:31 2,144,256 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6000.16633_none_0a208b31f539ad62\AcGenral.dll
    + 2008-01-30 04:24:55 2,144,768 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6000.20762_none_0a88b7ef0e7087a8\AcGenral.dll
    + 2008-01-29 04:16:31 449,536 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6000.16633_none_0a218b7bf538c6b9\AcSpecfc.dll
    + 2008-01-30 04:24:56 450,560 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6000.20762_none_0a89b8390e6fa0ff\AcSpecfc.dll
    + 2008-01-29 04:16:31 537,600 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.16633_none_0a228bc5f537e010\AcLayers.dll
    + 2008-01-29 04:16:31 173,056 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.16633_none_0a228bc5f537e010\AcXtrnal.dll
    + 2008-01-30 04:24:55 537,600 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.20762_none_0a8ab8830e6eba56\AcLayers.dll
    + 2008-01-30 04:24:56 173,056 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.20762_none_0a8ab8830e6eba56\AcXtrnal.dll
    + 2007-06-27 02:21:31 1,984,512 ----a-w C:\Windows\winsxs\x86_microsoft-windows-authentication-authui_31bf3856ad364e35_6.0.6000.16513_none_0a056d7cf846bbd5\authui.dll
    + 2007-06-27 02:14:53 1,984,512 ----a-w C:\Windows\winsxs\x86_microsoft-windows-authentication-authui_31bf3856ad364e35_6.0.6000.20628_none_0a893bce1167f643\authui.dll
    + 2007-06-27 02:21:23 967,680 ----a-w C:\Windows\winsxs\x86_microsoft-windows-calendar_31bf3856ad364e35_6.0.6000.16513_none_8f02a43161a69634\WinCal.exe
    + 2007-06-27 01:22:15 967,168 ----a-w C:\Windows\winsxs\x86_microsoft-windows-calendar_31bf3856ad364e35_6.0.6000.20628_none_8f8672827ac7d0a2\WinCal.exe
    + 2007-06-29 02:21:13 134,656 ----a-w C:\Windows\winsxs\x86_microsoft-windows-d..frastructure-server_31bf3856ad364e35_6.0.6000.16515_none_663e618f9f0e757e\dps.dll
    + 2007-06-29 02:21:53 134,656 ----a-w C:\Windows\winsxs\x86_microsoft-windows-d..frastructure-server_31bf3856ad364e35_6.0.6000.20630_none_66ad5d10b840ce77\dps.dll
    + 2007-06-26 02:49:06 10,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.16512_none_d56b19bc316f9001\dhcpcmonitor.dll
    + 2007-06-26 02:49:06 204,800 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.16512_none_d56b19bc316f9001\dhcpcsvc.dll
    + 2007-06-26 02:49:06 120,320 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.16512_none_d56b19bc316f9001\dhcpcsvc6.dll
    + 2007-06-26 02:36:21 10,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.20627_none_d5eee80d4a90ca6f\dhcpcmonitor.dll
    + 2007-06-26 02:36:21 203,776 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.20627_none_d5eee80d4a90ca6f\dhcpcsvc.dll
    + 2007-06-26 02:36:21 120,320 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.20627_none_d5eee80d4a90ca6f\dhcpcsvc6.dll
    + 2007-08-27 03:10:03 2,923,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
    + 2007-08-27 02:01:58 2,923,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
    + 2008-01-29 04:16:32 1,686,528 ----a-w C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.16633_none_3ffca182c42c1062\gameux.dll
    + 2008-01-29 00:30:10 4,247,552 ----a-w C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.16633_none_3ffca182c42c1062\GameUXLegacyGDFs.dll
    + 2008-01-30 04:26:09 1,686,528 ----a-w C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.20762_none_4064ce3fdd62eaa8\gameux.dll
    + 2008-01-30 00:43:26 4,247,552 ----a-w C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.20762_none_4064ce3fdd62eaa8\GameUXLegacyGDFs.dll
    + 2007-07-03 02:08:22 36,864 ----a-w C:\Windows\winsxs\x86_microsoft-windows-lddmcore_31bf3856ad364e35_6.0.6000.16517_none_a9de8a2ce66804b6\cdd.dll
    + 2007-07-03 01:01:16 619,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-lddmcore_31bf3856ad364e35_6.0.6000.16517_none_a9de8a2ce66804b6\dxgkrnl.sys
    + 2007-07-03 02:16:20 36,864 ----a-w C:\Windows\winsxs\x86_microsoft-windows-lddmcore_31bf3856ad364e35_6.0.6000.20632_none_aa4d85adff9a5daf\cdd.dll
    + 2007-07-03 01:07:51 619,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-lddmcore_31bf3856ad364e35_6.0.6000.20632_none_aa4d85adff9a5daf\dxgkrnl.sys
    + 2007-09-11 02:20:02 356,864 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediametadatahandler_31bf3856ad364e35_6.0.6000.16557_none_890b997ff4e3a637\MediaMetadataHandler.dll
    + 2007-09-08 04:52:23 356,864 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediametadatahandler_31bf3856ad364e35_6.0.6000.20676_none_897e96290e12648c\MediaMetadataHandler.dll
    + 2007-09-11 02:21:17 4,096 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\dxmasf.dll
    + 2007-09-11 02:21:01 7,680 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\spwmp.dll
    + 2007-09-11 02:21:39 10,617,344 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmp.dll
    + 2007-09-11 02:19:09 107,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmpconfig.exe
    + 2007-09-11 02:19:09 168,960 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmplayer.exe
    + 2007-09-11 01:36:49 8,147,968 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmploc.DLL
    + 2007-09-11 02:19:10 107,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmpshare.exe
    + 2007-09-08 04:53:43 4,096 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\dxmasf.dll
    + 2007-09-08 04:53:26 7,680 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\spwmp.dll
    + 2007-09-08 04:54:02 10,616,832 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmp.dll
    + 2007-09-08 04:14:59 107,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmpconfig.exe
    + 2007-09-08 04:14:51 168,960 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmplayer.exe
    + 2007-09-08 04:14:54 8,147,968 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmploc.DLL
    + 2007-09-08 04:14:35 107,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmpshare.exe
    + 2007-07-03 02:13:44 564,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-msftedit_31bf3856ad364e35_6.0.6000.16517_none_d3e6ea943a0ccc2e\msftedit.dll
    + 2007-07-03 02:18:02 564,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-msftedit_31bf3856ad364e35_6.0.6000.20632_none_d455e615533f2527\msftedit.dll
    + 2007-06-21 02:12:44 268,288 ----a-w C:\Windows\winsxs\x86_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.0.6000.16509_none_182f5e49b7a9aadf\mcbuilder.exe
    + 2007-06-21 00:51:18 268,288 ----a-w C:\Windows\winsxs\x86_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.0.6000.20624_none_189e59cad0dc03d8\mcbuilder.exe
    + 2008-01-19 03:06:36 154,624 ----a-w C:\Windows\winsxs\x86_microsoft-windows-native-80211_31bf3856ad364e35_6.0.6000.16632_none_4d03fb3a91e27bd0\nwifi.sys
    + 2008-01-19 02:32:39 154,624 ----a-w C:\Windows\winsxs\x86_microsoft-windows-native-80211_31bf3856ad364e35_6.0.6000.20757_none_4d7cf99fab0bd22f\nwifi.sys
    + 2007-07-03 02:14:14 384,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ndis-tdi-bindingengine_31bf3856ad364e35_6.0.6000.16517_none_3c2ad8f2286305c8\netcfgx.dll
    + 2007-07-03 02:18:48 384,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ndis-tdi-bindingengine_31bf3856ad364e35_6.0.6000.20632_none_3c99d47341955ec1\netcfgx.dll
    + 2007-10-26 11:12:53 1,060,920 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.16586_none_a43a6b8d2000830d\ntfs.sys
    + 2007-12-16 22:50:41 1,060,920 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.16615_none_a4851c9d1fc8a346\ntfs.sys
    + 2007-10-26 04:22:05 1,061,432 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.20709_none_a51d8a7c38da8c7b\ntfs.sys
    + 2007-12-16 22:52:59 1,061,944 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.20740_none_a4e9483239031830\ntfs.sys
    + 2008-04-16 00:49:12 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.16674_none_f05a2d326e88eb29\OESpamFilter.dat
    + 2008-04-16 00:44:28 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.20815_none_f125abb58774f9cb\OESpamFilter.dat
    + 2008-04-16 00:44:37 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.18054_none_f2560bb06b9f4438\OESpamFilter.dat
    + 2008-04-16 00:43:45 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.22159_none_f2e4a9ed84b862b5\OESpamFilter.dat
    + 2007-06-19 00:48:30 320,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.0.6000.16508_none_9c6a0aab5eb986b6\csc.sys
    + 2007-06-19 02:09:12 105,984 ----a-w C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.0.6000.16508_none_9c6a0aab5eb986b6\CscMig.dll
    + 2007-06-19 00:49:28 320,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.0.6000.20622_none_9cd805e277ecc658\csc.sys
    + 2007-06-19 02:03:43 105,984 ----a-w C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.0.6000.20622_none_9cd805e277ecc658\CscMig.dll
    + 2007-10-30 03:12:15 558,080 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ole-automation_31bf3856ad364e35_6.0.6000.16588_none_bacb6cf1fe8d4f50\oleaut32.dll
    + 2007-10-30 03:56:09 559,104 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ole-automation_31bf3856ad364e35_6.0.6000.20711_none_bb99b91117787749\oleaut32.dll
    + 2007-06-28 02:30:09 3,504,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16514_none_6a435250b701059d\ntkrnlpa.exe
    + 2007-06-28 02:30:09 3,470,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16514_none_6a435250b701059d\ntoskrnl.exe
    + 2007-08-29 03:11:59 3,504,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16551_none_6a1511c2b724295c\ntkrnlpa.exe
    + 2007-08-29 03:11:57 3,471,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16551_none_6a1511c2b724295c\ntoskrnl.exe
    + 2007-10-24 03:58:11 3,504,696 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16584_none_69f7a2dcb739c934\ntkrnlpa.exe
    + 2007-10-24 03:58:10 3,470,392 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16584_none_69f7a2dcb739c934\ntoskrnl.exe
    + 2007-06-28 02:29:58 3,504,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20629_none_6ac720a1d022400b\ntkrnlpa.exe
    + 2007-06-28 02:29:57 3,470,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20629_none_6ac720a1d022400b\ntoskrnl.exe
    + 2007-08-29 02:50:20 3,504,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20670_none_6a880e6bd052e7b1\ntkrnlpa.exe
    + 2007-08-29 02:50:18 3,471,544 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20670_none_6a880e6bd052e7b1\ntoskrnl.exe
    + 2007-10-24 04:13:51 3,505,720 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20707_none_6adac1cbd013d2a2\ntkrnlpa.exe
    + 2007-10-24 04:13:50 3,471,928 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20707_none_6adac1cbd013d2a2\ntoskrnl.exe
    + 2007-06-29 02:21:45 694,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..ooler-core-localspl_31bf3856ad364e35_6.0.6000.16515_none_2e2f4ef5958b2567\localspl.dll
    + 2007-06-29 02:22:49 694,272 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..ooler-core-localspl_31bf3856ad364e35_6.0.6000.20630_none_2e9e4a76aebd7e60\localspl.dll
    + 2007-06-26 02:51:24 220,160 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.0.6000.16512_none_ee146a58804bf72b\ntprint.dll
    + 2007-06-26 02:21:16 61,440 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.0.6000.16512_none_ee146a58804bf72b\ntprint.exe
    + 2007-06-26 02:38:21 220,160 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.0.6000.20627_none_ee9838a9996d3199\ntprint.dll
    + 2007-06-26 02:10:18 61,440 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.0.6000.20627_none_ee9838a9996d3199\ntprint.exe
    + 2007-06-22 02:16:39 704,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.16510_none_69dd6e605b578d62\PhotoScreensaver.scr
    + 2007-08-30 04:00:33 704,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.16552_none_69b42f445b762fd4\PhotoScreensaver.scr
    + 2007-06-22 01:31:04 704,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.20625_none_6a613cb17478c7d0\PhotoScreensaver.scr
    + 2007-08-30 02:40:37 704,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.20671_none_6a272bed74a4ee29\PhotoScreensaver.scr
    + 2007-07-04 01:27:33 70,144 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.16518_none_ac625a685a7efa74\pacer.sys
    + 2007-07-04 02:22:30 15,360 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.16518_none_ac625a685a7efa74\pacerprf.dll
    + 2007-07-04 02:22:55 33,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.16518_none_ac625a685a7efa74\traffic.dll
    + 2007-07-04 02:23:18 13,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.16518_none_ac625a685a7efa74\wshqos.dll
    + 2007-07-04 01:26:58 70,144 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.20633_none_acd155e973b1536d\pacer.sys
    + 2007-07-04 02:15:22 15,360 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.20633_none_acd155e973b1536d\pacerprf.dll
    + 2007-07-04 02:15:47 33,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.20633_none_acd155e973b1536d\traffic.dll
    + 2007-07-04 02:16:06 13,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.20633_none_acd155e973b1536d\wshqos.dll
    + 2007-07-04 01:28:10 20,480 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\ndistapi.sys
    + 2007-07-04 01:28:13 48,640 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\ndproxy.sys
    + 2007-07-04 02:22:38 77,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\rascfg.dll
    + 2007-07-04 02:22:38 52,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\rasdiag.dll
    + 2007-07-04 02:22:38 32,768 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\rasmxs.dll
    + 2007-07-04 02:22:38 22,016 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\rasser.dll
    + 2007-07-04 01:28:17 61,952 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\wanarp.sys
    + 2007-07-04 01:27:35 20,480 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\ndistapi.sys
    + 2007-07-04 01:27:38 48,640 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\ndproxy.sys
    + 2007-07-04 02:15:28 77,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\rascfg.dll
    + 2007-07-04 02:15:28 52,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\rasdiag.dll
    + 2007-07-04 02:15:29 32,768 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\rasmxs.dll
    + 2007-07-04 02:15:29 22,016 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\rasser.dll
    + 2007-07-04 01:27:42 61,952 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\wanarp.sys
    + 2007-07-03 02:14:39 467,456 ----a-w C:\Windows\winsxs\x86_microsoft-windows-riched32_31bf3856ad364e35_6.0.6000.16517_none_9b16a5648576e40a\riched20.dll
    + 2007-07-03 02:14:39 8,192 ----a-w C:\Windows\winsxs\x86_microsoft-windows-riched32_31bf3856ad364e35_6.0.6000.16517_none_9b16a5648576e40a\riched32.dll
    + 2007-07-03 02:19:22 467,456 ----a-w C:\Windows\winsxs\x86_microsoft-windows-riched32_31bf3856ad364e35_6.0.6000.20632_none_9b85a0e59ea93d03\riched20.dll
    + 2007-07-03 02:19:22 8,192 ----a-w C:\Windows\winsxs\x86_microsoft-windows-riched32_31bf3856ad364e35_6.0.6000.20632_none_9b85a0e59ea93d03\riched32.dll
    + 2007-06-21 02:15:28 223,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..icensing-slc-client_31bf3856ad364e35_6.0.6000.16509_none_c3421cfda8beb1db\SLC.dll
    + 2007-06-21 02:08:07 223,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..icensing-slc-client_31bf3856ad364e35_6.0.6000.20624_none_c3b1187ec1f10ad4\SLC.dll
    + 2007-08-29 03:06:53 542,720 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..mmaintenanceservice_31bf3856ad364e35_6.0.6000.16551_none_3b32a26ce33869cb\sysmain.dll
    + 2007-08-29 02:45:24 542,720 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..mmaintenanceservice_31bf3856ad364e35_6.0.6000.20670_none_3ba59f15fc672820\sysmain.dll
    + 2007-06-21 02:15:29 566,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.16509_none_889ab124b8091615\SLCommDlg.dll
    + 2007-06-21 02:12:55 186,368 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.16509_none_889ab124b8091615\SLLUA.exe
    + 2007-06-21 02:12:55 351,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.16509_none_889ab124b8091615\SLUI.exe
    + 2007-06-21 02:15:29 57,856 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.16509_none_889ab124b8091615\SLUINotify.dll
    + 2007-06-21 02:08:07 566,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.20624_none_8909aca5d13b6f0e\SLCommDlg.dll
    + 2007-06-21 01:06:23 186,368 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.20624_none_8909aca5d13b6f0e\SLLUA.exe
    + 2007-06-21 01:06:32 351,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.20624_none_8909aca5d13b6f0e\SLUI.exe
    + 2007-06-21 02:08:07 57,856 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.20624_none_8909aca5d13b6f0e\SLUINotify.dll
    + 2007-06-21 02:15:28 39,936 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-slc_31bf3856ad364e35_6.0.6000.16509_none_4c9a3f87fc5750bf\slcinst.dll
    + 2007-06-21 02:12:55 2,605,568 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-slc_31bf3856ad364e35_6.0.6000.16509_none_4c9a3f87fc5750bf\SLsvc.exe
    + 2007-06-21 02:08:07 39,936 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-slc_31bf3856ad364e35_6.0.6000.20624_none_4d093b091589a9b8\slcinst.dll
    + 2007-06-21 01:50:39 2,605,568 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-slc_31bf3856ad364e35_6.0.6000.20624_none_4d093b091589a9b8\SLsvc.exe
    + 2007-06-21 02:15:29 33,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-wmi_31bf3856ad364e35_6.0.6000.16509_none_4c6f7771fc7773a0\slwmi.dll
    + 2007-06-21 02:08:07 33,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-wmi_31bf3856ad364e35_6.0.6000.20624_none_4cde72f315a9cc99\slwmi.dll
    + 2007-06-19 02:10:48 269,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-schannel_31bf3856ad364e35_6.0.6000.16508_none_20380cd258151361\schannel.dll
    + 2007-06-19 02:05:45 269,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-schannel_31bf3856ad364e35_6.0.6000.20622_none_20a6080971485303\schannel.dll
    + 2007-05-24 02:25:48 69,632 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sendmail_31bf3856ad364e35_6.0.6000.16493_none_58a4e9811f22ea1c\sendmail.dll
    + 2007-05-24 02:19:34 69,632 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sendmail_31bf3856ad364e35_6.0.6000.20605_none_5991d81237f5be42\sendmail.dll
    + 2007-07-12 04:08:09 13,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.0.6000.16522_none_02d37ed64c3424df\icsunattend.exe
    + 2007-07-12 04:09:14 286,208 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.0.6000.16522_none_02d37ed64c3424df\ipnathlp.dll
    + 2007-07-12 01:52:52 13,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.0.6000.20638_none_03584d71655478a4\icsunattend.exe
    + 2007-07-12 02:43:31 285,696 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.0.6000.20638_none_03584d71655478a4\ipnathlp.dll
    + 2007-06-27 02:23:27 11,315,200 ----a-w C:\Windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.0.6000.16513_none_6a3b1b4414dac79d\shell32.dll
    + 2007-06-27 02:17:57 11,315,200 ----a-w C:\Windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.0.6000.20628_none_6abee9952dfc020b\shell32.dll
    + 2007-07-13 02:20:52 8,138,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ssbranded_31bf3856ad364e35_6.0.6000.16523_none_36921e330a735e63\ssBranded.scr
    + 2007-07-13 01:19:54 8,138,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ssbranded_31bf3856ad364e35_6.0.6000.20639_none_3716ecce2393b228\ssBranded.scr
    + 2007-08-31 02:17:56 24,064 ----a-w C:\Windows\winsxs\x86_microsoft-windows-t..services-publicapis_31bf3856ad364e35_6.0.6000.16553_none_c5179c13c95485bd\wtsapi32.dll
    + 2007-08-31 02:14:51 24,064 ----a-w C:\Windows\winsxs\x86_microsoft-windows-t..services-publicapis_31bf3856ad364e35_6.0.6000.20672_none_c58a98bce2834412\wtsapi32.dll
    + 2007-06-27 02:21:31 65,024 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\avicap32.dll
    + 2007-06-27 02:21:31 88,576 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\avifil32.dll
    + 2007-06-27 02:22:18 82,944 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\mciavi32.dll
    + 2007-06-27 02:22:36 12,800 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\msrle32.dll
    + 2007-06-27 02:22:39 123,904 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\msvfw32.dll
    + 2007-06-27 02:22:39 31,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\msvidc32.dll
    + 2007-06-27 02:14:54 65,024 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\avicap32.dll
    + 2007-06-27 02:14:54 88,576 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\avifil32.dll
    + 2007-06-27 02:16:24 82,944 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\mciavi32.dll
    + 2007-06-27 02:16:47 12,800 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\msrle32.dll
    + 2007-06-27 02:16:50 123,904 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\msvfw32.dll
    + 2007-06-27 02:16:50 31,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\msvidc32.dll
    + 2007-08-29 01:52:47 2,027,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-win32k_31bf3856ad364e35_6.0.6000.16551_none_b6d829dc9d87e0b4\win32k.sys
    + 2007-08-29 01:35:43 2,028,544 ----a-w C:\Windows\winsxs\x86_microsoft-windows-win32k_31bf3856ad364e35_6.0.6000.20670_none_b74b2685b6b69f09\win32k.sys
    + 2007-05-24 02:26:10 712,192 ----a-w C:\Windows\winsxs\x86_microsoft-windows-windowscodec_31bf3856ad364e35_6.0.6000.16493_none_943d269aa43dda3a\WindowsCodecs.dll
    + 2007-05-24 02:19:50 712,704 ----a-w C:\Windows\winsxs\x86_microsoft-windows-windowscodec_31bf3856ad364e35_6.0.6000.20605_none_952a152bbd10ae60\WindowsCodecs.dll
    + 2007-08-29 03:07:04 47,104 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlanapi.dll
    + 2007-08-29 03:07:04 67,584 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlanhlp.dll
    + 2007-08-29 03:07:04 290,816 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlanmsm.dll
    + 2007-08-29 03:07:05 297,984 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlansec.dll
    + 2007-08-29 03:07:05 502,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlansvc.dll
    + 2007-08-29 02:45:37 47,104 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlanapi.dll
    + 2007-08-29 02:45:38 67,584 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlanhlp.dll
    + 2007-08-29 02:45:38 289,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlanmsm.dll
    + 2007-08-29 02:45:38 299,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlansec.dll
    + 2007-08-29 02:45:38 502,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlansvc.dll
    + 2007-08-31 02:17:42 356,352 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wmi-core-wbemcomn-dll_31bf3856ad364e35_6.0.6000.16553_none_0161deb32631b63d\wbemcomn.dll
    + 2007-08-31 02:14:37 356,352 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wmi-core-wbemcomn-dll_31bf3856ad364e35_6.0.6000.20672_none_01d4db5c3f607492\wbemcomn.dll
    + 2008-05-24 14:44:21 1,275,392 ----a-w C:\Windows\winsxs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9849.0_none_b7e911727b2899b7\msxml4.dll
    + 2007-12-16 09:56:45 41,984 ----a-w C:\Windows\winsxs\x86_monitor.inf_31bf3856ad364e35_6.0.6000.16615_none_4117345983213804\monitor.sys
    + 2007-12-16 09:50:45 41,984 ----a-w C:\Windows\winsxs\x86_monitor.inf_31bf3856ad364e35_6.0.6000.20740_none_417b5fee9c5bacee\monitor.sys
    + 2008-01-19 05:06:34 17,464 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\aliide.sys
    + 2008-01-19 05:06:40 17,976 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\amdide.sys
    + 2008-01-19 05:06:48 21,560 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
    + 2008-01-19 05:08:03 109,624 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\ataport.sys
    + 2008-01-19 05:06:41 19,000 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\cmdide.sys
    + 2008-01-19 05:06:34 17,464 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\intelide.sys
    + 2008-01-19 05:06:55 25,656 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\msahci.sys
    + 2008-01-19 05:06:34 15,928 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\pciide.sys
    + 2008-01-19 05:07:19 45,112 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\pciidex.sys
    + 2008-01-19 05:07:08 20,024 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\viaide.sys
    + 2008-01-19 04:33:11 17,464 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\aliide.sys
    + 2008-01-19 04:33:11 17,976 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\amdide.sys
    + 2008-01-19 04:33:23 21,560 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
    + 2008-01-19 04:34:32 110,136 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\ataport.sys
    + 2008-01-19 04:33:17 19,000 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\cmdide.sys
    + 2008-01-19 04:33:16 17,976 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\intelide.sys
    + 2008-01-19 04:33:29 28,216 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\msahci.sys
    + 2008-01-19 04:33:11 15,928 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\pciide.sys
    + 2008-01-19 04:33:50 45,112 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\pciidex.sys
    + 2008-01-19 04:34:00 20,024 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\viaide.sys
    + 2007-09-01 02:23:47 81,592 ----a-w C:\Windows\winsxs\x86_sbp2.inf_31bf3856ad364e35_6.0.6000.16554_none_432055ecf9219c67\sbp2port.sys
    + 2007-09-01 02:22:02 81,592 ----a-w C:\Windows\winsxs\x86_sbp2.inf_31bf3856ad364e35_6.0.6000.20673_none_4393529612505abc\sbp2port.sys
    + 2007-04-28 02:15:33 82,432 ----a-w C:\Windows\winsxs\x86_sdbus.inf_31bf3856ad364e35_6.0.6000.16478_none_6fb8cd2dcd6214ea\sdbus.sys
    + 2007-04-28 02:10:55 82,432 ----a-w C:\Windows\winsxs\x86_sdbus.inf_31bf3856ad364e35_6.0.6000.20588_none_70379a0ce687d0a5\sdbus.sys
    + 2007-04-28 02:35:46 13,312 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.16478_none_a211996cecf4f6d9\sffdisk.sys
    + 2007-04-28 02:35:46 12,800 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.16478_none_a211996cecf4f6d9\sffp_mmc.sys
    + 2007-04-28 02:35:45 12,800 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.16478_none_a211996cecf4f6d9\sffp_sd.sys
    + 2007-04-28 02:28:23 13,312 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.20588_none_a290664c061ab294\sffdisk.sys
    + 2007-04-28 02:28:23 12,800 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.20588_none_a290664c061ab294\sffp_mmc.sys
    + 2007-04-28 02:28:23 12,800 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.20588_none_a290664c061ab294\sffp_sd.sys
    + 2007-04-28 02:39:34 55,296 ----a-w C:\Windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6000.16478_none_465c5f209ade1e53\USBSTOR.SYS
    + 2007-04-28 02:31:47 55,296 ----a-w C:\Windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6000.20588_none_46db2bffb403da0e\USBSTOR.SYS
    + 2007-10-26 11:14:11 211,000 ----a-w C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6000.16586_none_137ff950ff29e447\volsnap.sys
    + 2007-10-26 04:22:53 211,000 ----a-w C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6000.20709_none_146318401803edb5\volsnap.sys
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC2C65E7-18A4-4CFF-B0B0-E93358B5FF79}]
    C:\Users\Olive\AppData\Local\Temp\byXnmlMF.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2006-11-15 20:08 98304]
    "SigmatelSysTrayApp"="sttray.exe" [2007-02-08 07:11 303104 C:\Windows\sttray.exe]
    "PMX Daemon"="ICO.EXE" [2006-11-08 16:01 49152 C:\Windows\System32\ico.exe]
    "Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [2006-11-28 01:15 1540096]
    "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 17:15 81920]
    "BM6b1bbf98"="C:\Windows\system32\vlahlegm.dll" [2008-05-19 17:57 109056]

    C:\Users\CharlŠne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 22:57:56 393216]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{8691F860-96E4-4FB3-8D35-531C0D1B0AC1}"= C:\Windows\system32\fccawTnk.dll [ ]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{E9FC50E8-59B4-4DFE-AC21-80BCA26C468B}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
    "{167268F2-8413-48FB-8845-6B32F6EA6D86}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
    R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
    R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
    R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-12 01:10]
    R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-11-15 20:07]
    R3 pmxmouse;PMXMOUSE;C:\Windows\system32\DRIVERS\pmxmouse.sys [2006-10-19 18:27]
    R3 pmxusblf;PMXUSBLF;C:\Windows\system32\DRIVERS\pmxusblf.sys [2006-10-19 18:29]
    S3 fbxusb;Carte réseau virtuelle FreeBox USB;C:\Windows\system32\DRIVERS\fbxusb32.sys [2004-10-20 17:23]
    S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 09:36]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-24 17:48:46
    Windows 6.0.6000 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    Temps d'accomplissement: 2008-05-24 17:49:47
    ComboFix-quarantined-files.txt 2008-05-24 15:49:42
    ComboFix2.txt 2008-05-24 14:38:37

    Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
    Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.

    364 --- E O F --- 2008-05-24 14:50:43


    hijackthis

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:07:48, on 24/05/2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16643)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\sttray.exe
    C:\Windows\System32\ico.exe
    C:\Windows\System32\WLTRAY.EXE
    C:\Windows\System32\Pmxmiced.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\conime.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\Explorer.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Users\Olive\Desktop\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
    O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
    O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O13 - Gopher Prefix:
    O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/ImageUploader4.cab
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
    O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
    0
  15. g!rly Messages postés 18462 Statut Contributeur 407
     
    non ca le fais pas...

    puis y a un fichier temp qui c´est rajouté ;-(

    * Télécharge OTMoveIt2 (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

    n´y touche pas

    redemarre en mode sans echec:

    Comment redémarrer en mode sans echec?

    Tu redemarre le pc et tapote la touche F8 des le début de l allumage sans t´arrêter.
    Une fenêtre sur fond noir va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
    capture d´ecran : http://www.coupdepoucepc.com/
    Une fois sur le bureau si il n y a pas toutes les couleurs et autres c´est normal!
    Ps : si F8 ne marche pas utilise la touche F5.

    Note : en mode sans echec tu n´auras plus acces au net alors imprime ou copie les instructions ci dessous dans un fichier texte que tu pourras consulter a souhait
    une fois en mode sans echec.

    Fix.reg

    Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisie nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en citation ci-dessous (copie tout d'un trait-sans les barres(x)) :

    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    REGEDIT4

    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC2C65E7-18A4-4CFF-B0B0-E93358B5FF79}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BM6b1bbf98"=-
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{8691F860-96E4-4FB3-8D35-531C0D1B0AC1}"=-
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC2C65E7-18A4-4CFF-B0B0-E93358B5FF79}]

    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    Note : Regedit4 est sur la premiere ligne dans le bloc note et il y a une ligne blanche a la fin.
    Puis click sur "fichier"/"enregistrer sous" :
    dans : sur le bureau
    Nom du fichier : fix.reg
    Type de fichier : "tous les fichiers"
    clique sur "enregistrer"

    ca doit ressembler a ca une fois enrregistré :

    http://img520.imageshack.us/img520/4251/screenshot005ps2.png

    double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
    Si c'est bien le cas, clique sur "oui"

    * Double-clique sur OTMoveIt.exe pour lancer le programme,
    * Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste Custom List of Files/Folders to Move" :

    C:\Windows\system32\vlahlegm.dll
    C:\Windows\system32\fccawTnk.dll
    C:\Users\Olive\AppData\Local\Temp\byXnmlMF.dll

    * Clique sur MoveIt! pour lancer la suppression,
    * Le résultat appraraîtra dans le cadre Results.
    * Clique sur Exit pour fermer le programme.
    * Poste le rapport qui est situé ici : C:\\\_OTMoveIt\MovedFiles
    * Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

    Redemarre normalement et post le rapport de ot_move it ici stp ainsi qu´un nouveau rapport hijack this.

    @´+
    0
  16. Osmose
     
    Voici le rapport ot move it :

    File/Folder C:\Windows\system32\vlahlegm.dll not found.
    File/Folder C:\Windows\system32\fccawTnk.dll not found.
    File/Folder C:\Users\Olive\AppData\Local\Temp\byXnmlMF.dll not found.

    OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 05242008_183905

    Et hijackthis :

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:45:52, on 24/05/2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16643)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Windows\System32\igfxtray.exe
    C:\Windows\sttray.exe
    C:\Windows\System32\ico.exe
    C:\Windows\System32\WLTRAY.EXE
    C:\Windows\System32\Pmxmiced.exe
    C:\Windows\system32\NOTEPAD.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Windows\system32\wuauclt.exe
    C:\Users\Olive\Desktop\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
    O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
    O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O13 - Gopher Prefix:
    O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/ImageUploader4.cab
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
    O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
    0
  17. g!rly Messages postés 18462 Statut Contributeur 407
     
    bon peux tu repasser combofix stp
    @+
    0
    1. Osmose
       
      Voici le rapport Combofix (je l'ai utilisé "normalement", j'entends par là que je me suis contenté de le lancer) :

      ComboFix 08-05-21.3 - Olive 2008-05-24 17:47:02.2 - NTFSx86
      Microsoft® Windows Vista™ Professionnel 6.0.6000.0.1252.1.1036.18.1083 [GMT 2:00]
      Endroit: C:\Users\Olive\Desktop\ComboFix.exe
      Command switches used :: C:\Users\Olive\Desktop\CFScript.lnk
      * Création d'un nouveau point de restauration
      .

      ((((((((((((((((((((((((((((( Fichiers créés 2008-04-24 to 2008-05-24 ))))))))))))))))))))))))))))))))))))
      .

      Pas de nouveau fichier créé dans cet espace de temps

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-05-24 14:26 1,572,864 --sha-w C:\Users\Charlène\NTUSER.DAT
      2008-05-24 14:26 1,572,864 --sha-w C:\Users\Charlène\NTUSER.DAT
      2008-05-24 13:51 --------- d-----w C:\Users\Charlène\AppData\Roaming\OpenOffice.org2
      2008-05-19 15:57 109,056 ----a-w C:\Windows\System32\vlahlegm.dll
      2008-05-17 16:17 --------- d-----w C:\Program Files\Google
      2008-05-17 16:09 --------- d--h--w C:\Program Files\InstallShield Installation Information
      2008-05-17 16:08 --------- d-----w C:\ProgramData\ScanSoft
      2008-05-17 16:03 --------- d-----w C:\Program Files\Canon
      2008-05-17 15:53 --------- d-----w C:\Users\Olive\AppData\Roaming\OpenOffice.org2
      2008-05-17 08:43 --------- d-----w C:\Program Files\a-squared Free
      2008-05-16 20:09 --------- d-----w C:\Program Files\The Cleaner Free
      2008-05-15 23:18 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
      2008-05-11 17:21 --------- d-----w C:\Users\Olive\AppData\Roaming\LimeWire
      2008-04-30 10:40 --------- d-----w C:\Program Files\LimeWire
      2008-04-08 13:45 --------- d-----w C:\Users\Olive\AppData\Roaming\Roxio
      2008-04-02 14:38 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
      2008-03-31 17:50 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
      2008-03-31 17:48 --------- d-----w C:\Program Files\Windows Live
      2008-03-31 17:47 --------- d-----w C:\ProgramData\WLInstaller
      2008-03-31 17:46 --------- d-s---w C:\Users\Charlène\AppData\Roaming\Microsoft
      2008-02-29 06:51 19,000 ----a-w C:\Windows\System32\kd1394.dll
      2008-02-29 06:39 40,960 ----a-w C:\Windows\System32\srclient.dll
      2008-02-29 06:39 371,712 ----a-w C:\Windows\System32\srcore.dll
      2008-02-29 06:38 313,856 ----a-w C:\Windows\System32\rstrui.exe
      2008-02-29 06:38 16,384 ----a-w C:\Windows\System32\srdelayed.exe
      2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
      2008-02-29 06:34 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll
      2008-02-29 04:16 2,027,008 ----a-w C:\Windows\System32\win32k.sys
      2008-02-03 10:53 118 ----a-w C:\Users\Charlène\AppData\Roaming\wklnhst.dat
      2006-11-02 12:50 174 --sha-w C:\Program Files\desktop.ini
      2007-12-06 20:04 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
      2007-12-06 20:04 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
      2007-12-06 20:04 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
      .

      ------- Sigcheck -------

      .
      ((((((((((((((((((((((((((((( snapshot@2008-05-24_16.38.03.68 )))))))))))))))))))))))))))))))))))))))))
      .
      + 2008-05-24 15:46:53 5,894,144 ----a-w C:\Windows\erdnt\Hiv-backup\SCHEMA.DAT
      + 2008-05-24 14:35:17 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
      + 2008-05-24 14:35:17 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
      - 2008-05-24 14:35:24 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
      + 2008-05-24 14:43:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
      - 2008-05-24 14:35:24 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
      + 2008-05-24 14:43:13 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
      - 2008-05-24 14:35:24 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
      + 2008-05-24 14:43:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
      - 2008-05-24 14:29:42 103,924 ----a-w C:\Windows\System32\perfc009.dat
      + 2008-05-24 14:41:06 103,924 ----a-w C:\Windows\System32\perfc009.dat
      - 2008-05-24 14:29:43 117,572 ----a-w C:\Windows\System32\perfc00C.dat
      + 2008-05-24 14:41:07 117,572 ----a-w C:\Windows\System32\perfc00C.dat
      - 2008-05-24 14:29:43 610,142 ----a-w C:\Windows\System32\perfh009.dat
      + 2008-05-24 14:41:07 610,142 ----a-w C:\Windows\System32\perfh009.dat
      - 2008-05-24 14:29:43 690,832 ----a-w C:\Windows\System32\perfh00C.dat
      + 2008-05-24 14:41:07 690,832 ----a-w C:\Windows\System32\perfh00C.dat
      - 2008-05-19 16:02:21 6,029,312 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
      + 2008-05-24 14:42:40 6,029,312 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
      - 2008-05-24 14:24:29 7,956 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2797674674-2034626984-2998799533-1000_UserData.bin
      + 2008-05-24 14:40:06 8,210 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2797674674-2034626984-2998799533-1000_UserData.bin
      - 2008-05-24 14:24:29 61,420 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
      + 2008-05-24 14:40:06 61,630 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
      - 2008-05-19 15:53:36 38,911,201 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
      + 2008-05-24 14:46:56 38,934,604 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
      + 2007-08-31 02:28:20 258,232 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.16553_none_206f74b9d10718ea\acpi.sys
      + 2007-08-31 02:27:20 28,344 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.16553_none_206f74b9d10718ea\battc.sys
      + 2007-08-31 02:27:04 20,920 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.16553_none_206f74b9d10718ea\compbatt.sys
      + 2007-08-31 00:57:48 11,264 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.16553_none_206f74b9d10718ea\wmiacpi.sys
      + 2007-08-31 02:22:53 258,232 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.20672_none_20e27162ea35d73f\acpi.sys
      + 2007-08-31 02:21:27 28,344 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.20672_none_20e27162ea35d73f\battc.sys
      + 2007-08-31 02:21:14 20,920 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.20672_none_20e27162ea35d73f\compbatt.sys
      + 2007-08-31 01:02:00 11,264 ----a-w C:\Windows\winsxs\x86_acpi.inf_31bf3856ad364e35_6.0.6000.20672_none_20e27162ea35d73f\wmiacpi.sys
      + 2007-08-31 02:27:20 28,344 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.16553_none_140e43a256cf6f52\battc.sys
      + 2007-08-31 00:57:48 14,208 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.16553_none_140e43a256cf6f52\CmBatt.sys
      + 2007-08-31 00:57:49 21,504 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.16553_none_140e43a256cf6f52\hidbatt.sys
      + 2007-08-31 02:21:27 28,344 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.20672_none_1481404b6ffe2da7\battc.sys
      + 2007-08-31 01:02:00 14,208 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.20672_none_1481404b6ffe2da7\CmBatt.sys
      + 2007-08-31 01:02:01 21,504 ----a-w C:\Windows\winsxs\x86_battery.inf_31bf3856ad364e35_6.0.6000.20672_none_1481404b6ffe2da7\hidbatt.sys
      + 2007-05-04 00:31:44 53,760 ----a-w C:\Windows\winsxs\x86_hdaudbus.inf_31bf3856ad364e35_6.0.6000.16481_none_74e5d15989a08e89\hdaudbus.sys
      + 2007-05-05 00:37:12 53,760 ----a-w C:\Windows\winsxs\x86_hdaudbus.inf_31bf3856ad364e35_6.0.6000.20592_none_75659e82a2c5639b\hdaudbus.sys
      + 2008-01-29 00:15:55 2,560 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6000.16633_none_0a1e8a9df53b7ab4\AcRes.dll
      + 2008-01-30 00:29:13 2,560 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6000.20762_none_0a86b75b0e7254fa\AcRes.dll
      + 2008-01-29 04:16:31 2,144,256 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6000.16633_none_0a208b31f539ad62\AcGenral.dll
      + 2008-01-30 04:24:55 2,144,768 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6000.20762_none_0a88b7ef0e7087a8\AcGenral.dll
      + 2008-01-29 04:16:31 449,536 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6000.16633_none_0a218b7bf538c6b9\AcSpecfc.dll
      + 2008-01-30 04:24:56 450,560 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6000.20762_none_0a89b8390e6fa0ff\AcSpecfc.dll
      + 2008-01-29 04:16:31 537,600 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.16633_none_0a228bc5f537e010\AcLayers.dll
      + 2008-01-29 04:16:31 173,056 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.16633_none_0a228bc5f537e010\AcXtrnal.dll
      + 2008-01-30 04:24:55 537,600 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.20762_none_0a8ab8830e6eba56\AcLayers.dll
      + 2008-01-30 04:24:56 173,056 ----a-w C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.20762_none_0a8ab8830e6eba56\AcXtrnal.dll
      + 2007-06-27 02:21:31 1,984,512 ----a-w C:\Windows\winsxs\x86_microsoft-windows-authentication-authui_31bf3856ad364e35_6.0.6000.16513_none_0a056d7cf846bbd5\authui.dll
      + 2007-06-27 02:14:53 1,984,512 ----a-w C:\Windows\winsxs\x86_microsoft-windows-authentication-authui_31bf3856ad364e35_6.0.6000.20628_none_0a893bce1167f643\authui.dll
      + 2007-06-27 02:21:23 967,680 ----a-w C:\Windows\winsxs\x86_microsoft-windows-calendar_31bf3856ad364e35_6.0.6000.16513_none_8f02a43161a69634\WinCal.exe
      + 2007-06-27 01:22:15 967,168 ----a-w C:\Windows\winsxs\x86_microsoft-windows-calendar_31bf3856ad364e35_6.0.6000.20628_none_8f8672827ac7d0a2\WinCal.exe
      + 2007-06-29 02:21:13 134,656 ----a-w C:\Windows\winsxs\x86_microsoft-windows-d..frastructure-server_31bf3856ad364e35_6.0.6000.16515_none_663e618f9f0e757e\dps.dll
      + 2007-06-29 02:21:53 134,656 ----a-w C:\Windows\winsxs\x86_microsoft-windows-d..frastructure-server_31bf3856ad364e35_6.0.6000.20630_none_66ad5d10b840ce77\dps.dll
      + 2007-06-26 02:49:06 10,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.16512_none_d56b19bc316f9001\dhcpcmonitor.dll
      + 2007-06-26 02:49:06 204,800 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.16512_none_d56b19bc316f9001\dhcpcsvc.dll
      + 2007-06-26 02:49:06 120,320 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.16512_none_d56b19bc316f9001\dhcpcsvc6.dll
      + 2007-06-26 02:36:21 10,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.20627_none_d5eee80d4a90ca6f\dhcpcmonitor.dll
      + 2007-06-26 02:36:21 203,776 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.20627_none_d5eee80d4a90ca6f\dhcpcsvc.dll
      + 2007-06-26 02:36:21 120,320 ----a-w C:\Windows\winsxs\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.0.6000.20627_none_d5eee80d4a90ca6f\dhcpcsvc6.dll
      + 2007-08-27 03:10:03 2,923,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
      + 2007-08-27 02:01:58 2,923,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
      + 2008-01-29 04:16:32 1,686,528 ----a-w C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.16633_none_3ffca182c42c1062\gameux.dll
      + 2008-01-29 00:30:10 4,247,552 ----a-w C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.16633_none_3ffca182c42c1062\GameUXLegacyGDFs.dll
      + 2008-01-30 04:26:09 1,686,528 ----a-w C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.20762_none_4064ce3fdd62eaa8\gameux.dll
      + 2008-01-30 00:43:26 4,247,552 ----a-w C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.20762_none_4064ce3fdd62eaa8\GameUXLegacyGDFs.dll
      + 2007-07-03 02:08:22 36,864 ----a-w C:\Windows\winsxs\x86_microsoft-windows-lddmcore_31bf3856ad364e35_6.0.6000.16517_none_a9de8a2ce66804b6\cdd.dll
      + 2007-07-03 01:01:16 619,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-lddmcore_31bf3856ad364e35_6.0.6000.16517_none_a9de8a2ce66804b6\dxgkrnl.sys
      + 2007-07-03 02:16:20 36,864 ----a-w C:\Windows\winsxs\x86_microsoft-windows-lddmcore_31bf3856ad364e35_6.0.6000.20632_none_aa4d85adff9a5daf\cdd.dll
      + 2007-07-03 01:07:51 619,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-lddmcore_31bf3856ad364e35_6.0.6000.20632_none_aa4d85adff9a5daf\dxgkrnl.sys
      + 2007-09-11 02:20:02 356,864 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediametadatahandler_31bf3856ad364e35_6.0.6000.16557_none_890b997ff4e3a637\MediaMetadataHandler.dll
      + 2007-09-08 04:52:23 356,864 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediametadatahandler_31bf3856ad364e35_6.0.6000.20676_none_897e96290e12648c\MediaMetadataHandler.dll
      + 2007-09-11 02:21:17 4,096 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\dxmasf.dll
      + 2007-09-11 02:21:01 7,680 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\spwmp.dll
      + 2007-09-11 02:21:39 10,617,344 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmp.dll
      + 2007-09-11 02:19:09 107,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmpconfig.exe
      + 2007-09-11 02:19:09 168,960 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmplayer.exe
      + 2007-09-11 01:36:49 8,147,968 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmploc.DLL
      + 2007-09-11 02:19:10 107,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16557_none_095474fd52156893\wmpshare.exe
      + 2007-09-08 04:53:43 4,096 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\dxmasf.dll
      + 2007-09-08 04:53:26 7,680 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\spwmp.dll
      + 2007-09-08 04:54:02 10,616,832 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmp.dll
      + 2007-09-08 04:14:59 107,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmpconfig.exe
      + 2007-09-08 04:14:51 168,960 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmplayer.exe
      + 2007-09-08 04:14:54 8,147,968 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmploc.DLL
      + 2007-09-08 04:14:35 107,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20676_none_09c771a66b4426e8\wmpshare.exe
      + 2007-07-03 02:13:44 564,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-msftedit_31bf3856ad364e35_6.0.6000.16517_none_d3e6ea943a0ccc2e\msftedit.dll
      + 2007-07-03 02:18:02 564,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-msftedit_31bf3856ad364e35_6.0.6000.20632_none_d455e615533f2527\msftedit.dll
      + 2007-06-21 02:12:44 268,288 ----a-w C:\Windows\winsxs\x86_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.0.6000.16509_none_182f5e49b7a9aadf\mcbuilder.exe
      + 2007-06-21 00:51:18 268,288 ----a-w C:\Windows\winsxs\x86_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.0.6000.20624_none_189e59cad0dc03d8\mcbuilder.exe
      + 2008-01-19 03:06:36 154,624 ----a-w C:\Windows\winsxs\x86_microsoft-windows-native-80211_31bf3856ad364e35_6.0.6000.16632_none_4d03fb3a91e27bd0\nwifi.sys
      + 2008-01-19 02:32:39 154,624 ----a-w C:\Windows\winsxs\x86_microsoft-windows-native-80211_31bf3856ad364e35_6.0.6000.20757_none_4d7cf99fab0bd22f\nwifi.sys
      + 2007-07-03 02:14:14 384,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ndis-tdi-bindingengine_31bf3856ad364e35_6.0.6000.16517_none_3c2ad8f2286305c8\netcfgx.dll
      + 2007-07-03 02:18:48 384,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ndis-tdi-bindingengine_31bf3856ad364e35_6.0.6000.20632_none_3c99d47341955ec1\netcfgx.dll
      + 2007-10-26 11:12:53 1,060,920 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.16586_none_a43a6b8d2000830d\ntfs.sys
      + 2007-12-16 22:50:41 1,060,920 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.16615_none_a4851c9d1fc8a346\ntfs.sys
      + 2007-10-26 04:22:05 1,061,432 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.20709_none_a51d8a7c38da8c7b\ntfs.sys
      + 2007-12-16 22:52:59 1,061,944 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.20740_none_a4e9483239031830\ntfs.sys
      + 2008-04-16 00:49:12 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.16674_none_f05a2d326e88eb29\OESpamFilter.dat
      + 2008-04-16 00:44:28 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.20815_none_f125abb58774f9cb\OESpamFilter.dat
      + 2008-04-16 00:44:37 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.18054_none_f2560bb06b9f4438\OESpamFilter.dat
      + 2008-04-16 00:43:45 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.22159_none_f2e4a9ed84b862b5\OESpamFilter.dat
      + 2007-06-19 00:48:30 320,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.0.6000.16508_none_9c6a0aab5eb986b6\csc.sys
      + 2007-06-19 02:09:12 105,984 ----a-w C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.0.6000.16508_none_9c6a0aab5eb986b6\CscMig.dll
      + 2007-06-19 00:49:28 320,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.0.6000.20622_none_9cd805e277ecc658\csc.sys
      + 2007-06-19 02:03:43 105,984 ----a-w C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.0.6000.20622_none_9cd805e277ecc658\CscMig.dll
      + 2007-10-30 03:12:15 558,080 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ole-automation_31bf3856ad364e35_6.0.6000.16588_none_bacb6cf1fe8d4f50\oleaut32.dll
      + 2007-10-30 03:56:09 559,104 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ole-automation_31bf3856ad364e35_6.0.6000.20711_none_bb99b91117787749\oleaut32.dll
      + 2007-06-28 02:30:09 3,504,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16514_none_6a435250b701059d\ntkrnlpa.exe
      + 2007-06-28 02:30:09 3,470,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16514_none_6a435250b701059d\ntoskrnl.exe
      + 2007-08-29 03:11:59 3,504,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16551_none_6a1511c2b724295c\ntkrnlpa.exe
      + 2007-08-29 03:11:57 3,471,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16551_none_6a1511c2b724295c\ntoskrnl.exe
      + 2007-10-24 03:58:11 3,504,696 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16584_none_69f7a2dcb739c934\ntkrnlpa.exe
      + 2007-10-24 03:58:10 3,470,392 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16584_none_69f7a2dcb739c934\ntoskrnl.exe
      + 2007-06-28 02:29:58 3,504,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20629_none_6ac720a1d022400b\ntkrnlpa.exe
      + 2007-06-28 02:29:57 3,470,520 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20629_none_6ac720a1d022400b\ntoskrnl.exe
      + 2007-08-29 02:50:20 3,504,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20670_none_6a880e6bd052e7b1\ntkrnlpa.exe
      + 2007-08-29 02:50:18 3,471,544 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20670_none_6a880e6bd052e7b1\ntoskrnl.exe
      + 2007-10-24 04:13:51 3,505,720 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20707_none_6adac1cbd013d2a2\ntkrnlpa.exe
      + 2007-10-24 04:13:50 3,471,928 ----a-w C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20707_none_6adac1cbd013d2a2\ntoskrnl.exe
      + 2007-06-29 02:21:45 694,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..ooler-core-localspl_31bf3856ad364e35_6.0.6000.16515_none_2e2f4ef5958b2567\localspl.dll
      + 2007-06-29 02:22:49 694,272 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..ooler-core-localspl_31bf3856ad364e35_6.0.6000.20630_none_2e9e4a76aebd7e60\localspl.dll
      + 2007-06-26 02:51:24 220,160 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.0.6000.16512_none_ee146a58804bf72b\ntprint.dll
      + 2007-06-26 02:21:16 61,440 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.0.6000.16512_none_ee146a58804bf72b\ntprint.exe
      + 2007-06-26 02:38:21 220,160 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.0.6000.20627_none_ee9838a9996d3199\ntprint.dll
      + 2007-06-26 02:10:18 61,440 ----a-w C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.0.6000.20627_none_ee9838a9996d3199\ntprint.exe
      + 2007-06-22 02:16:39 704,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.16510_none_69dd6e605b578d62\PhotoScreensaver.scr
      + 2007-08-30 04:00:33 704,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.16552_none_69b42f445b762fd4\PhotoScreensaver.scr
      + 2007-06-22 01:31:04 704,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.20625_none_6a613cb17478c7d0\PhotoScreensaver.scr
      + 2007-08-30 02:40:37 704,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.20671_none_6a272bed74a4ee29\PhotoScreensaver.scr
      + 2007-07-04 01:27:33 70,144 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.16518_none_ac625a685a7efa74\pacer.sys
      + 2007-07-04 02:22:30 15,360 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.16518_none_ac625a685a7efa74\pacerprf.dll
      + 2007-07-04 02:22:55 33,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.16518_none_ac625a685a7efa74\traffic.dll
      + 2007-07-04 02:23:18 13,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.16518_none_ac625a685a7efa74\wshqos.dll
      + 2007-07-04 01:26:58 70,144 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.20633_none_acd155e973b1536d\pacer.sys
      + 2007-07-04 02:15:22 15,360 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.20633_none_acd155e973b1536d\pacerprf.dll
      + 2007-07-04 02:15:47 33,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.20633_none_acd155e973b1536d\traffic.dll
      + 2007-07-04 02:16:06 13,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6000.20633_none_acd155e973b1536d\wshqos.dll
      + 2007-07-04 01:28:10 20,480 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\ndistapi.sys
      + 2007-07-04 01:28:13 48,640 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\ndproxy.sys
      + 2007-07-04 02:22:38 77,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\rascfg.dll
      + 2007-07-04 02:22:38 52,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\rasdiag.dll
      + 2007-07-04 02:22:38 32,768 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\rasmxs.dll
      + 2007-07-04 02:22:38 22,016 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\rasser.dll
      + 2007-07-04 01:28:17 61,952 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.16518_none_0bf759b97d499daa\wanarp.sys
      + 2007-07-04 01:27:35 20,480 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\ndistapi.sys
      + 2007-07-04 01:27:38 48,640 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\ndproxy.sys
      + 2007-07-04 02:15:28 77,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\rascfg.dll
      + 2007-07-04 02:15:28 52,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\rasdiag.dll
      + 2007-07-04 02:15:29 32,768 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\rasmxs.dll
      + 2007-07-04 02:15:29 22,016 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\rasser.dll
      + 2007-07-04 01:27:42 61,952 ----a-w C:\Windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6000.20633_none_0c66553a967bf6a3\wanarp.sys
      + 2007-07-03 02:14:39 467,456 ----a-w C:\Windows\winsxs\x86_microsoft-windows-riched32_31bf3856ad364e35_6.0.6000.16517_none_9b16a5648576e40a\riched20.dll
      + 2007-07-03 02:14:39 8,192 ----a-w C:\Windows\winsxs\x86_microsoft-windows-riched32_31bf3856ad364e35_6.0.6000.16517_none_9b16a5648576e40a\riched32.dll
      + 2007-07-03 02:19:22 467,456 ----a-w C:\Windows\winsxs\x86_microsoft-windows-riched32_31bf3856ad364e35_6.0.6000.20632_none_9b85a0e59ea93d03\riched20.dll
      + 2007-07-03 02:19:22 8,192 ----a-w C:\Windows\winsxs\x86_microsoft-windows-riched32_31bf3856ad364e35_6.0.6000.20632_none_9b85a0e59ea93d03\riched32.dll
      + 2007-06-21 02:15:28 223,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..icensing-slc-client_31bf3856ad364e35_6.0.6000.16509_none_c3421cfda8beb1db\SLC.dll
      + 2007-06-21 02:08:07 223,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..icensing-slc-client_31bf3856ad364e35_6.0.6000.20624_none_c3b1187ec1f10ad4\SLC.dll
      + 2007-08-29 03:06:53 542,720 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..mmaintenanceservice_31bf3856ad364e35_6.0.6000.16551_none_3b32a26ce33869cb\sysmain.dll
      + 2007-08-29 02:45:24 542,720 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..mmaintenanceservice_31bf3856ad364e35_6.0.6000.20670_none_3ba59f15fc672820\sysmain.dll
      + 2007-06-21 02:15:29 566,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.16509_none_889ab124b8091615\SLCommDlg.dll
      + 2007-06-21 02:12:55 186,368 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.16509_none_889ab124b8091615\SLLUA.exe
      + 2007-06-21 02:12:55 351,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.16509_none_889ab124b8091615\SLUI.exe
      + 2007-06-21 02:15:29 57,856 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.16509_none_889ab124b8091615\SLUINotify.dll
      + 2007-06-21 02:08:07 566,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.20624_none_8909aca5d13b6f0e\SLCommDlg.dll
      + 2007-06-21 01:06:23 186,368 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.20624_none_8909aca5d13b6f0e\SLLUA.exe
      + 2007-06-21 01:06:32 351,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.20624_none_8909aca5d13b6f0e\SLUI.exe
      + 2007-06-21 02:08:07 57,856 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6000.20624_none_8909aca5d13b6f0e\SLUINotify.dll
      + 2007-06-21 02:15:28 39,936 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-slc_31bf3856ad364e35_6.0.6000.16509_none_4c9a3f87fc5750bf\slcinst.dll
      + 2007-06-21 02:12:55 2,605,568 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-slc_31bf3856ad364e35_6.0.6000.16509_none_4c9a3f87fc5750bf\SLsvc.exe
      + 2007-06-21 02:08:07 39,936 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-slc_31bf3856ad364e35_6.0.6000.20624_none_4d093b091589a9b8\slcinst.dll
      + 2007-06-21 01:50:39 2,605,568 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-slc_31bf3856ad364e35_6.0.6000.20624_none_4d093b091589a9b8\SLsvc.exe
      + 2007-06-21 02:15:29 33,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-wmi_31bf3856ad364e35_6.0.6000.16509_none_4c6f7771fc7773a0\slwmi.dll
      + 2007-06-21 02:08:07 33,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-licensing-wmi_31bf3856ad364e35_6.0.6000.20624_none_4cde72f315a9cc99\slwmi.dll
      + 2007-06-19 02:10:48 269,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-schannel_31bf3856ad364e35_6.0.6000.16508_none_20380cd258151361\schannel.dll
      + 2007-06-19 02:05:45 269,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-security-schannel_31bf3856ad364e35_6.0.6000.20622_none_20a6080971485303\schannel.dll
      + 2007-05-24 02:25:48 69,632 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sendmail_31bf3856ad364e35_6.0.6000.16493_none_58a4e9811f22ea1c\sendmail.dll
      + 2007-05-24 02:19:34 69,632 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sendmail_31bf3856ad364e35_6.0.6000.20605_none_5991d81237f5be42\sendmail.dll
      + 2007-07-12 04:08:09 13,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.0.6000.16522_none_02d37ed64c3424df\icsunattend.exe
      + 2007-07-12 04:09:14 286,208 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.0.6000.16522_none_02d37ed64c3424df\ipnathlp.dll
      + 2007-07-12 01:52:52 13,824 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.0.6000.20638_none_03584d71655478a4\icsunattend.exe
      + 2007-07-12 02:43:31 285,696 ----a-w C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.0.6000.20638_none_03584d71655478a4\ipnathlp.dll
      + 2007-06-27 02:23:27 11,315,200 ----a-w C:\Windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.0.6000.16513_none_6a3b1b4414dac79d\shell32.dll
      + 2007-06-27 02:17:57 11,315,200 ----a-w C:\Windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.0.6000.20628_none_6abee9952dfc020b\shell32.dll
      + 2007-07-13 02:20:52 8,138,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ssbranded_31bf3856ad364e35_6.0.6000.16523_none_36921e330a735e63\ssBranded.scr
      + 2007-07-13 01:19:54 8,138,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ssbranded_31bf3856ad364e35_6.0.6000.20639_none_3716ecce2393b228\ssBranded.scr
      + 2007-08-31 02:17:56 24,064 ----a-w C:\Windows\winsxs\x86_microsoft-windows-t..services-publicapis_31bf3856ad364e35_6.0.6000.16553_none_c5179c13c95485bd\wtsapi32.dll
      + 2007-08-31 02:14:51 24,064 ----a-w C:\Windows\winsxs\x86_microsoft-windows-t..services-publicapis_31bf3856ad364e35_6.0.6000.20672_none_c58a98bce2834412\wtsapi32.dll
      + 2007-06-27 02:21:31 65,024 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\avicap32.dll
      + 2007-06-27 02:21:31 88,576 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\avifil32.dll
      + 2007-06-27 02:22:18 82,944 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\mciavi32.dll
      + 2007-06-27 02:22:36 12,800 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\msrle32.dll
      + 2007-06-27 02:22:39 123,904 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\msvfw32.dll
      + 2007-06-27 02:22:39 31,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.16513_none_9043e1118ba0edc7\msvidc32.dll
      + 2007-06-27 02:14:54 65,024 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\avicap32.dll
      + 2007-06-27 02:14:54 88,576 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\avifil32.dll
      + 2007-06-27 02:16:24 82,944 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\mciavi32.dll
      + 2007-06-27 02:16:47 12,800 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\msrle32.dll
      + 2007-06-27 02:16:50 123,904 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\msvfw32.dll
      + 2007-06-27 02:16:50 31,232 ----a-w C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.0.6000.20628_none_90c7af62a4c22835\msvidc32.dll
      + 2007-08-29 01:52:47 2,027,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-win32k_31bf3856ad364e35_6.0.6000.16551_none_b6d829dc9d87e0b4\win32k.sys
      + 2007-08-29 01:35:43 2,028,544 ----a-w C:\Windows\winsxs\x86_microsoft-windows-win32k_31bf3856ad364e35_6.0.6000.20670_none_b74b2685b6b69f09\win32k.sys
      + 2007-05-24 02:26:10 712,192 ----a-w C:\Windows\winsxs\x86_microsoft-windows-windowscodec_31bf3856ad364e35_6.0.6000.16493_none_943d269aa43dda3a\WindowsCodecs.dll
      + 2007-05-24 02:19:50 712,704 ----a-w C:\Windows\winsxs\x86_microsoft-windows-windowscodec_31bf3856ad364e35_6.0.6000.20605_none_952a152bbd10ae60\WindowsCodecs.dll
      + 2007-08-29 03:07:04 47,104 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlanapi.dll
      + 2007-08-29 03:07:04 67,584 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlanhlp.dll
      + 2007-08-29 03:07:04 290,816 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlanmsm.dll
      + 2007-08-29 03:07:05 297,984 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlansec.dll
      + 2007-08-29 03:07:05 502,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16551_none_9a28f27507e7382c\wlansvc.dll
      + 2007-08-29 02:45:37 47,104 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlanapi.dll
      + 2007-08-29 02:45:38 67,584 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlanhlp.dll
      + 2007-08-29 02:45:38 289,280 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlanmsm.dll
      + 2007-08-29 02:45:38 299,008 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlansec.dll
      + 2007-08-29 02:45:38 502,784 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.20670_none_9a9bef1e2115f681\wlansvc.dll
      + 2007-08-31 02:17:42 356,352 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wmi-core-wbemcomn-dll_31bf3856ad364e35_6.0.6000.16553_none_0161deb32631b63d\wbemcomn.dll
      + 2007-08-31 02:14:37 356,352 ----a-w C:\Windows\winsxs\x86_microsoft-windows-wmi-core-wbemcomn-dll_31bf3856ad364e35_6.0.6000.20672_none_01d4db5c3f607492\wbemcomn.dll
      + 2008-05-24 14:44:21 1,275,392 ----a-w C:\Windows\winsxs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9849.0_none_b7e911727b2899b7\msxml4.dll
      + 2007-12-16 09:56:45 41,984 ----a-w C:\Windows\winsxs\x86_monitor.inf_31bf3856ad364e35_6.0.6000.16615_none_4117345983213804\monitor.sys
      + 2007-12-16 09:50:45 41,984 ----a-w C:\Windows\winsxs\x86_monitor.inf_31bf3856ad364e35_6.0.6000.20740_none_417b5fee9c5bacee\monitor.sys
      + 2008-01-19 05:06:34 17,464 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\aliide.sys
      + 2008-01-19 05:06:40 17,976 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\amdide.sys
      + 2008-01-19 05:06:48 21,560 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
      + 2008-01-19 05:08:03 109,624 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\ataport.sys
      + 2008-01-19 05:06:41 19,000 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\cmdide.sys
      + 2008-01-19 05:06:34 17,464 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\intelide.sys
      + 2008-01-19 05:06:55 25,656 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\msahci.sys
      + 2008-01-19 05:06:34 15,928 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\pciide.sys
      + 2008-01-19 05:07:19 45,112 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\pciidex.sys
      + 2008-01-19 05:07:08 20,024 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\viaide.sys
      + 2008-01-19 04:33:11 17,464 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\aliide.sys
      + 2008-01-19 04:33:11 17,976 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\amdide.sys
      + 2008-01-19 04:33:23 21,560 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
      + 2008-01-19 04:34:32 110,136 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\ataport.sys
      + 2008-01-19 04:33:17 19,000 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\cmdide.sys
      + 2008-01-19 04:33:16 17,976 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\intelide.sys
      + 2008-01-19 04:33:29 28,216 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\msahci.sys
      + 2008-01-19 04:33:11 15,928 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\pciide.sys
      + 2008-01-19 04:33:50 45,112 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\pciidex.sys
      + 2008-01-19 04:34:00 20,024 ----a-w C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\viaide.sys
      + 2007-09-01 02:23:47 81,592 ----a-w C:\Windows\winsxs\x86_sbp2.inf_31bf3856ad364e35_6.0.6000.16554_none_432055ecf9219c67\sbp2port.sys
      + 2007-09-01 02:22:02 81,592 ----a-w C:\Windows\winsxs\x86_sbp2.inf_31bf3856ad364e35_6.0.6000.20673_none_4393529612505abc\sbp2port.sys
      + 2007-04-28 02:15:33 82,432 ----a-w C:\Windows\winsxs\x86_sdbus.inf_31bf3856ad364e35_6.0.6000.16478_none_6fb8cd2dcd6214ea\sdbus.sys
      + 2007-04-28 02:10:55 82,432 ----a-w C:\Windows\winsxs\x86_sdbus.inf_31bf3856ad364e35_6.0.6000.20588_none_70379a0ce687d0a5\sdbus.sys
      + 2007-04-28 02:35:46 13,312 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.16478_none_a211996cecf4f6d9\sffdisk.sys
      + 2007-04-28 02:35:46 12,800 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.16478_none_a211996cecf4f6d9\sffp_mmc.sys
      + 2007-04-28 02:35:45 12,800 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.16478_none_a211996cecf4f6d9\sffp_sd.sys
      + 2007-04-28 02:28:23 13,312 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.20588_none_a290664c061ab294\sffdisk.sys
      + 2007-04-28 02:28:23 12,800 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.20588_none_a290664c061ab294\sffp_mmc.sys
      + 2007-04-28 02:28:23 12,800 ----a-w C:\Windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6000.20588_none_a290664c061ab294\sffp_sd.sys
      + 2007-04-28 02:39:34 55,296 ----a-w C:\Windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6000.16478_none_465c5f209ade1e53\USBSTOR.SYS
      + 2007-04-28 02:31:47 55,296 ----a-w C:\Windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6000.20588_none_46db2bffb403da0e\USBSTOR.SYS
      + 2007-10-26 11:14:11 211,000 ----a-w C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6000.16586_none_137ff950ff29e447\volsnap.sys
      + 2007-10-26 04:22:53 211,000 ----a-w C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6000.20709_none_146318401803edb5\volsnap.sys
      .
      -- Snapshot reset to current date --
      .
      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      REGEDIT4
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC2C65E7-18A4-4CFF-B0B0-E93358B5FF79}]
      C:\Users\Olive\AppData\Local\Temp\byXnmlMF.dll

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2006-11-15 20:08 98304]
      "SigmatelSysTrayApp"="sttray.exe" [2007-02-08 07:11 303104 C:\Windows\sttray.exe]
      "PMX Daemon"="ICO.EXE" [2006-11-08 16:01 49152 C:\Windows\System32\ico.exe]
      "Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [2006-11-28 01:15 1540096]
      "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 17:15 81920]
      "BM6b1bbf98"="C:\Windows\system32\vlahlegm.dll" [2008-05-19 17:57 109056]

      C:\Users\CharlŠne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
      OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 22:57:56 393216]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "EnableLUA"= 0 (0x0)

      [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
      "{8691F860-96E4-4FB3-8D35-531C0D1B0AC1}"= C:\Windows\system32\fccawTnk.dll [ ]

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
      "DisableMonitoring"=dword:00000001

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
      "{E9FC50E8-59B4-4DFE-AC21-80BCA26C468B}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
      "{167268F2-8413-48FB-8845-6B32F6EA6D86}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
      "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

      R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
      R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
      R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
      R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-12 01:10]
      R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-11-15 20:07]
      R3 pmxmouse;PMXMOUSE;C:\Windows\system32\DRIVERS\pmxmouse.sys [2006-10-19 18:27]
      R3 pmxusblf;PMXUSBLF;C:\Windows\system32\DRIVERS\pmxusblf.sys [2006-10-19 18:29]
      S3 fbxusb;Carte réseau virtuelle FreeBox USB;C:\Windows\system32\DRIVERS\fbxusb32.sys [2004-10-20 17:23]
      S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 09:36]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
      LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

      .
      **************************************************************************

      catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-05-24 17:48:46
      Windows 6.0.6000 NTFS

      Balayage processus cachés ...

      Balayage caché autostart entries ...

      Balayage des fichiers cachés ...

      Scan terminé avec succès
      Les fichiers cachés: 0

      **************************************************************************
      .
      Temps d'accomplissement: 2008-05-24 17:49:47
      ComboFix-quarantined-files.txt 2008-05-24 15:49:42
      ComboFix2.txt 2008-05-24 14:38:37

      Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
      Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.

      364 --- E O F --- 2008-05-24 14:50:43
      0
  18. g!rly Messages postés 18462 Statut Contributeur 407
     
    y a un truc qui cloche, tu dois avoir plusieurs rapports combofix, post moi le dernier...
    0
    1. Osmose
       
      Vraiment désolé j'ai dû confondre...

      Voici donc le dernier log, et j'en suis sûr !


      ComboFix 08-05-21.3 - Olive 2008-05-24 21:40:14.5 - NTFSx86
      Microsoft® Windows Vista™ Professionnel 6.0.6000.0.1252.1.1036.18.1504 [GMT 2:00]
      Endroit: C:\Users\Olive\Desktop\ComboFix.exe
      .

      ((((((((((((((((((((((((((((( Fichiers créés 2008-04-24 to 2008-05-24 ))))))))))))))))))))))))))))))))))))
      .

      2008-05-24 18:39 . 2008-05-24 18:39 <REP> d-------- C:\_OTMoveIt
      2008-05-24 14:15 . 2008-05-24 14:15 <REP> d-------- C:\VundoFix Backups
      2008-05-17 18:05 . 2008-05-17 18:05 59 --a------ C:\Windows\wininit.ini
      2008-05-17 17:51 . 2008-05-17 17:51 268 --ah----- C:\sqmdata01.sqm
      2008-05-17 17:51 . 2008-05-17 17:51 244 --ah----- C:\sqmnoopt01.sqm
      2008-05-17 16:36 . 2008-05-17 16:36 268 --ah----- C:\sqmdata00.sqm
      2008-05-17 16:36 . 2008-05-17 16:36 244 --ah----- C:\sqmnoopt00.sqm
      2008-05-17 16:35 . 2006-11-15 20:08 167,936 --a------ C:\Windows\System32\igfxres.dll
      2008-05-17 10:44 . 2008-05-17 10:44 215 --a------ C:\Windows\System32\MRT.INI
      2008-05-16 22:20 . 2008-05-17 10:43 <REP> d-------- C:\Program Files\a-squared Free
      2008-05-16 20:46 . 2008-05-16 22:09 <REP> d-------- C:\Program Files\The Cleaner Free
      2008-04-29 19:41 . 2008-04-30 12:40 <REP> d-------- C:\Program Files\LimeWire

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-05-24 16:29 174 --sha-w C:\Program Files\desktop.ini
      2008-05-24 16:25 --------- d-----w C:\Program Files\Windows Mail
      2008-05-24 16:25 --------- d-----w C:\Program Files\Windows Calendar
      2008-05-24 14:26 1,572,864 --sha-w C:\Users\Charlène\NTUSER.DAT
      2008-05-24 14:26 1,572,864 --sha-w C:\Users\Charlène\NTUSER.DAT
      2008-05-24 13:51 --------- d-----w C:\Users\Charlène\AppData\Roaming\OpenOffice.org2
      2008-05-17 16:17 --------- d-----w C:\Program Files\Google
      2008-05-17 16:09 --------- d--h--w C:\Program Files\InstallShield Installation Information
      2008-05-17 16:08 --------- d-----w C:\ProgramData\ScanSoft
      2008-05-17 16:03 --------- d-----w C:\Program Files\Canon
      2008-05-17 15:53 --------- d-----w C:\Users\Olive\AppData\Roaming\OpenOffice.org2
      2008-05-15 23:18 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
      2008-05-11 17:21 --------- d-----w C:\Users\Olive\AppData\Roaming\LimeWire
      2008-04-08 13:45 --------- d-----w C:\Users\Olive\AppData\Roaming\Roxio
      2008-04-02 14:38 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
      2008-03-31 17:50 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
      2008-03-31 17:48 --------- d-----w C:\Program Files\Windows Live
      2008-03-31 17:47 --------- d-----w C:\ProgramData\WLInstaller
      2008-03-31 17:46 --------- d-s---w C:\Users\Charlène\AppData\Roaming\Microsoft
      2008-02-29 06:51 19,000 ----a-w C:\Windows\System32\kd1394.dll
      2008-02-29 06:39 40,960 ----a-w C:\Windows\System32\srclient.dll
      2008-02-29 06:39 371,712 ----a-w C:\Windows\System32\srcore.dll
      2008-02-29 06:38 313,856 ----a-w C:\Windows\System32\rstrui.exe
      2008-02-29 06:38 16,384 ----a-w C:\Windows\System32\srdelayed.exe
      2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
      2008-02-29 06:34 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll
      2008-02-29 04:16 2,027,008 ----a-w C:\Windows\System32\win32k.sys
      2008-02-03 10:53 118 ----a-w C:\Users\Charlène\AppData\Roaming\wklnhst.dat
      2007-12-06 20:04 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
      2007-12-06 20:04 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
      2007-12-06 20:04 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
      .

      ------- Sigcheck -------

      .
      ((((((((((((((((((((((((((((( snapshot_2008-05-24_20.11.04,68 )))))))))))))))))))))))))))))))))))))))))
      .
      - 2008-05-24 18:06:33 67,584 --s-a-w C:\Windows\bootstat.dat
      + 2008-05-24 19:39:39 67,584 --s-a-w C:\Windows\bootstat.dat
      - 2008-05-24 16:47:27 103,924 ----a-w C:\Windows\System32\perfc009.dat
      + 2008-05-24 18:13:15 103,924 ----a-w C:\Windows\System32\perfc009.dat
      - 2008-05-24 16:47:27 117,572 ----a-w C:\Windows\System32\perfc00C.dat
      + 2008-05-24 18:13:15 117,572 ----a-w C:\Windows\System32\perfc00C.dat
      - 2008-05-24 16:47:27 610,142 ----a-w C:\Windows\System32\perfh009.dat
      + 2008-05-24 18:13:15 610,142 ----a-w C:\Windows\System32\perfh009.dat
      - 2008-05-24 16:47:27 690,832 ----a-w C:\Windows\System32\perfh00C.dat
      + 2008-05-24 18:13:15 690,832 ----a-w C:\Windows\System32\perfh00C.dat
      - 2008-05-24 16:10:30 216,732 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
      + 2008-05-24 19:39:40 218,856 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
      .
      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      REGEDIT4
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2006-11-15 20:08 98304]
      "SigmatelSysTrayApp"="sttray.exe" [2007-02-08 07:11 303104 C:\Windows\sttray.exe]
      "PMX Daemon"="ICO.EXE" [2006-11-08 16:01 49152 C:\Windows\System32\ico.exe]
      "Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [2006-11-28 01:15 1540096]
      "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 17:15 81920]

      C:\Users\CharlŠne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
      OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 22:57:56 393216]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "EnableLUA"= 0 (0x0)

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
      "DisableMonitoring"=dword:00000001

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
      "{E9FC50E8-59B4-4DFE-AC21-80BCA26C468B}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
      "{167268F2-8413-48FB-8845-6B32F6EA6D86}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
      "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

      R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
      R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
      R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
      R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-12 01:10]
      R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-11-15 20:07]
      R3 pmxmouse;PMXMOUSE;C:\Windows\system32\DRIVERS\pmxmouse.sys [2006-10-19 18:27]
      R3 pmxusblf;PMXUSBLF;C:\Windows\system32\DRIVERS\pmxusblf.sys [2006-10-19 18:29]
      S3 fbxusb;Carte réseau virtuelle FreeBox USB;C:\Windows\system32\DRIVERS\fbxusb32.sys [2004-10-20 17:23]
      S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 09:36]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
      LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

      .
      **************************************************************************

      catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-05-24 21:41:17
      Windows 6.0.6000 NTFS

      Balayage processus cachés ...

      Balayage caché autostart entries ...

      Balayage des fichiers cachés ...

      Scan terminé avec succès
      Les fichiers cachés: 0

      **************************************************************************
      .
      Temps d'accomplissement: 2008-05-24 21:42:02
      ComboFix-quarantined-files.txt 2008-05-24 19:41:58
      ComboFix2.txt 2008-05-24 18:11:22
      ComboFix3.txt 2008-05-24 16:06:41
      ComboFix4.txt 2008-05-24 15:49:47
      ComboFix5.txt 2008-05-24 14:38:37

      Pre-Run: 105,512,112,128 octets libres
      Post-Run: 105,483,927,552 octets libres

      123 --- E O F --- 2008-05-24 14:50:43
      0
  19. g!rly Messages postés 18462 Statut Contributeur 407
     
    ok tres bien ;-)

    Fais un scan avec cet antispyware :

    Telecharge malwarebytes + tutoriel :

    -> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

    Tu l´instale; le programme va se mettre automatiquement a jour.

    Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

    Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

    Puis click sur "rechercher".

    Laisse le scanner le pc...

    Si des elements on ete trouvés > click sur supprimer la selection.

    si il t´es demandé de redemarrer > click sur "yes".

    A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

    Copie et colle le rapport stp.

    @+
    0
    1. Osmose
       
      Et voici le rapport :

      Malwarebytes' Anti-Malware 1.12
      Version de la base de données: 784

      Type de recherche: Examen complet (C:\|D:\|)
      Eléments examinés: 128318
      Temps écoulé: 21 minute(s), 35 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 2
      Valeur(s) du Registre infectée(s): 0
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 5

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      C:\QooBox\Quarantine\C\Windows\System32\fccawTnk.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\Users\Charlène\AppData\Local\Temp\bYOiifEX.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\Users\Charlène\AppData\Local\Temp\fcCttqoL.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\Users\Charlène\AppData\Local\Temp\nnnmmnkj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\Users\Charlène\AppData\Local\Temp\tmp0000f823 (Trojan.Vundo) -> Quarantined and deleted successfully.
      0
  20. g!rly Messages postés 18462 Statut Contributeur 407
     
    ok

    Télécharge Clean:

    -> http://www.malekal.com/download/clean.zip

    -> Dézippe tout le contenu dans un dossier que tu auras cré au préalable (sur ton bureau par exemple). Double clic sur clean ou clean.cmd choisie l'option 1.

    Un rapport va s'ouvrir, copie et colle le contenu sur le forum.

    -> pour ceux ou celles qui auraient un doute sur comment deziper un fichier :

    http://www.tutopat.com/viewtopic.php?t=933&sid=34215b238376bfb22ef9e8eca9995914

    @+
    0
    1. Osmose
       
      Voici le rapport :


      25/05/2008 a 0:01:05,63

      *** Recherche C:

      *** Recherche C:\Windows\

      *** Recherche C:\Windows\system32
      C:\Windows\system32\wininit.exe FOUND
      C:\Windows\system32\wininit.exe FOUND

      *** Recherche C:\Program Files
      *** End of the report !
      0
  21. g!rly Messages postés 18462 Statut Contributeur 407
     
    salut osmose

    -> Redémarre en mode sans échec :

    Comment redémarrer en mode sans echec?

    Tu redemarre le pc et tapote la touche F8 des le début de l allumage sans t´arrêter.
    Une fenêtre sur fond noir va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
    Une fois sur le bureau si il n y a pas toutes les couleurs et autres c´est normal!
    Ps : si F8 ne marche pas utilise la touche F5.

    -> Tuto : http://forum.telecharger.01net.com/forum/high-tech/SECURITE/Securite/redemarrer-mode-echec-sujet_1526_1.htm

    -> Une fois en mode sans echec, ouvre le dossier que tu auvais crée et click sur clean.cmd et choisis l'option 2.

    -> Redémarre normalement et poste le rapport de clean.

    Post egalement un nouveau rapport hijack this stp

    @+
    0
    1. Osmose
       
      Bonjour !

      Voici le rapport clean :

      Script executed in Safe Mode
      Rapport clean par Malekal_morte - http://www.malekal.com
      Script executed in Safe Mode 25/05/2008 a 15:23:28,43

      Microsoft Windows [version 6.0.6000]

      *** Suppression C:

      *** Suppression C:\Windows\

      *** Suppression C:\Windows\system32
      tentative de suppression de C:\Windows\system32\wininit.exe
      Impossible de supprimer C:\Windows\system32\wininit.exe
      tentative de suppression de C:\Windows\system32\wininit.exe
      Impossible de supprimer C:\Windows\system32\wininit.exe

      *** Suppression C:\Program Files

      *** Deletion of the registry keys successful..
      *** End of the report !



      Voici le hijackthis :

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 15:28:56, on 25/05/2008
      Platform: Windows Vista (WinNT 6.00.1904)
      MSIE: Internet Explorer v7.00 (7.00.6000.16643)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\taskeng.exe
      C:\Windows\system32\Dwm.exe
      C:\Windows\Explorer.EXE
      C:\Windows\System32\igfxtray.exe
      C:\Windows\sttray.exe
      C:\Windows\System32\ico.exe
      C:\Windows\System32\WLTRAY.EXE
      C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
      C:\Windows\System32\Pmxmiced.exe
      C:\Users\Olive\Desktop\HiJackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
      O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
      O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
      O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
      O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
      O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
      O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O13 - Gopher Prefix:
      O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
      O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
      O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
      O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
      O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
      O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
      0
  • 1
  • 2

Discussions similaires

Supprimer l'historique de commandes et d'achats sur Amazon
Matthew5 -
Adraen -

25 réponses
instagram comment supprimer un groupe que l on a crée
jess.mi -
JulieGe -

3 réponses