Pb avec ads served by

bonjour
tout d'abord merci pour le coup de main, cela fait toujours plaisir!!!
pour commencer j'ai effacé hier un programme avec l'utilitaire de désinstallation windows et les fenêtres intempestives n'apparaissent plus au lancement de mozilla!!!! le pb est il résolu ? mystère...

sinon j'ai suivi la procédure indiquée dont voici le résultat:

Ad-Fix v0.101e
by gchris


OPTION 1 (Scan) :

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Démarré à :

17:36:10,21 02/06/2008


Executé depuis :

D:\Documents and Settings\julien\Bureau\Ad-Fix


Os :

Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Recherche de fichier manquant


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Recherche de fichiers cachés (pas forcément mauvais)


Fichiers cachés à la racine du disque système :

BOOT.BAK
BOOT.INI
Bootfont.bin
cmldr
hiberfil.sys
IO.SYS
IPH.PH
MSDOS.SYS
pagefile.sys
Thumbs.db

Fichiers cachés dans le répertoire Windows :

QTFont.qfn
super.chm
WindowsShell.Manifest
winnt.bmp
winnt256.bmp

Fichiers cachés dans le répertoire System32 :

ac3DX.ax
AVCDX.ax
cdplayer.exe.manifest
CoreAAC.ax
DiracSplitter.ax
flvDX.dll
logonui.exe.manifest
MatroskaDX.ax
msfDX.dll
ncpa.cpl.manifest
nwc.cpl.manifest
RealMediaDX.ax
RLAPEDec.ax
RLMPCDec.ax
RLOgg.ax
RLSpeexDec.ax
RLTheoraDec.ax
RLVorbisDec.ax
sapi.cpl.manifest
WindowsLogon.manifest
wuaucpl.cpl.manifest
zllictbl.dat

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Analyse du registre


---------- USER AGENT -- POST PLATFORM

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

----------

---------- AppInit_DLLs

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

----------
HKCR\Interface\{48E59292-9880-11CF-9754-00AA00C00908} Détecté !
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\media-motor.net Détecté !
HKLM\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908} Détecté !
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\contentmatch.net Détecté !
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\net-nucleus.com Détecté !


Complete!

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Recherche de fichiers et dossiers

C:\Archivos de programa Détecté !

C:\WINDOWS\unvise32qt.exe Détecté !




»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Terminé à 17:43:49,78

merci et à bientôt

me revoila
j'ai donc tout effectué.
voilà ce qui s'est passé:

lors du travail en mode sans échec est apparu le message suivant:

sous-système MS-DOS 16 bits
Ad-fix V0101e
C:\PROGRA~1\Symantec\S32EVNT1.dll.
L'initialisationde la DLL d'un pilote de périphérique installable a échoué. Choisissez "fermer" pour mettre fin à l'application.

j'ai effectué "ignorer"

puis est apparu:

Ad-fix - Nettoyage de disque
Si le nettoyage de disque bloque ou s'il devient excessivement long vous pouvez cliquer sur "annuler" pour continuer Ad-fix.

j'ai effectué "ok"

au bout de 4' le nettoyage était terminé et j'ai redémarré.


voici le rapport ad-fix

Ad-Fix v0.101e
by gchris


OPTION 2 (Fix) :

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Démarré à :

20:00:41,78 02/06/2008
en mode sans échec


Executé depuis :

D:\Documents and Settings\julien\Bureau\Ad-Fix


Os :

Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Recherche de fichier manquant


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Nettoyage du registre

HKCR\Interface\{48E59292-9880-11CF-9754-00AA00C00908} Supprimé !
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\media-motor.net Supprimé !
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\contentmatch.net Supprimé !
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\net-nucleus.com Supprimé !


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Suppression des fichiers

C:\WINDOWS\unvise32qt.exe Supprimé !
C:\Archivos de programa Supprimé !

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Terminé à 20:08:36,78


Redémarrage effectué




et le rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:17:07, on 02/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\tppaldr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\apps\ABoard\ABoard.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\APPS\skype\Phone\Skype.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe
D:\Documents and Settings\julien\Mes documents\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.mini15.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: cpmsky browser optimizer - {3d15cb84-4b95-86f0-abd6-4e2afe7e9e6f} - C:\WINDOWS\system32\{80a70ab7-e931-acf4-500c-0714296f7797}.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: DNSEred - {b636fe80-5fe6-45de-3235-6d9b1ecb043f} - C:\WINDOWS\system32\iednser.dll
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\tppaldr.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ATIPTA] "C:\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [{ee9d34db-7f19-71bc-1705-1281543ee98f}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\{80a70ab7-e931-acf4-500c-0714296f7797}.dll" DllInit
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\APPS\skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{297E2A13-5298-4A64-A39C-C1FE3E00E26F}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe Version Cue CS3 {fr_FR} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Fichiers communs\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

voici le rapport

BTFix 1.060 (par bibi26) - 02/06/2008 21:39:46 - Analyse
Lancé depuis D:\Documents and Settings\julien\Bureau\BTFix\BTFix.exe

---> Fichiers/Dossiers trouvés


---> Analyse terminée

ouf c'est fait!!!!

voici les rapports demandés

Malwarebytes' Anti-Malware 1.14
Version de la base de données: 800

23:47:41 02/06/2008
mbam-log-6-2-2008 (23-47-41).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 169090
Temps écoulé: 1 hour(s), 18 minute(s), 42 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mysearchassistant (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3d15cb84-4b95-86f0-abd6-4e2afe7e9e6f} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3d15cb84-4b95-86f0-abd6-4e2afe7e9e6f} (Trojan.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{ee9d34db-7f19-71bc-1705-1281543ee98f} (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
D:\Documents and Settings\julien\Local Settings\Application Data\Mozilla\Firefox\Profiles\bkrxw96c.default\Cache\2BFDAF34d01 (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\{23cfdea8-c1df-cd22-4b09-7abb253eae36}.dll-uninst.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\{80a70ab7-e931-acf4-500c-0714296f7797}.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\lvuvc.hs (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Program Files\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.


puis



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:06:51, on 03/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\tppaldr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\apps\ABoard\ABoard.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\apps\ABoard\AOSD.exe
C:\APPS\skype\Phone\Skype.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\julien\Mes documents\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.mini15.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3d15cb84-4b95-86f0-abd6-4e2afe7e9e6f} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: DNSEred - {b636fe80-5fe6-45de-3235-6d9b1ecb043f} - C:\WINDOWS\system32\iednser.dll
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\tppaldr.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ATIPTA] "C:\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\APPS\skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{297E2A13-5298-4A64-A39C-C1FE3E00E26F}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe Version Cue CS3 {fr_FR} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Fichiers communs\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

voila voila ça c'est fait

DiagHelp version v1.4 - http://www.malekal.com
excute le 03/06/2008 à 18:50:37,09


Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\WINDOWS\prefetch\CHCP.COM-17EDBDC9.pf -->03/06/2008 18:50:18
C:\WINDOWS\prefetch\CMD.EXE-034B0549.pf -->03/06/2008 18:50:16
C:\WINDOWS\prefetch\WINRAR.EXE-0AA31BB9.pf -->03/06/2008 18:49:26
C:\WINDOWS\prefetch\COCIMANAGER.EXE-1E454E23.pf -->03/06/2008 18:48:57
C:\WINDOWS\prefetch\TEATIMER.EXE-0390E8A7.pf -->03/06/2008 18:48:56
C:\WINDOWS\prefetch\SETPOINTUPDATE.EXE-2B40D6EE.pf -->03/06/2008 18:48:56
C:\WINDOWS\prefetch\SETPOINT.EXE-17BEEB1B.pf -->03/06/2008 18:48:56
C:\WINDOWS\prefetch\REGSVR32.EXE-396DEA2C.pf -->03/06/2008 18:48:56
C:\WINDOWS\prefetch\QUICKCAM10.EXE-278834C4.pf -->03/06/2008 18:48:56
C:\WINDOWS\prefetch\KHALMNPR.EXE-33B48526.pf -->03/06/2008 18:48:56

C:\WINDOWS\System32\drivers\fidbox.dat -->03/06/2008 18:48:38
C:\WINDOWS\System32\drivers\lvuvc.hs -->03/06/2008 18:46:55
C:\WINDOWS\System32\drivers\fidbox.idx -->03/06/2008 18:45:48
C:\WINDOWS\System32\drivers\mbamcatchme.sys -->30/05/2008 01:06:40
C:\WINDOWS\System32\drivers\mbam.sys -->30/05/2008 01:06:36
C:\WINDOWS\System32\drivers\aswSP.sys -->16/05/2008 01:20:32
C:\WINDOWS\System32\drivers\aswmon2.sys -->16/05/2008 01:18:33

C:\WINDOWS\System32\vsconfig.xml -->03/06/2008 18:47:22
C:\WINDOWS\System32\d3d8caps.dat -->02/06/2008 22:31:28
C:\WINDOWS\System32\wpa.dbl -->30/05/2008 16:19:46
C:\WINDOWS\System32\lvcoinst.log -->20/05/2008 17:54:31
C:\WINDOWS\System32\CONFIG.NT -->19/05/2008 22:26:39
C:\WINDOWS\System32\aswBoot.exe -->16/05/2008 01:24:43
C:\WINDOWS\System32\AvastSS.scr -->16/05/2008 01:12:36
C:\WINDOWS\System32\AdzgaloreDNHelper-uninstall.exe -->14/05/2008 19:29:13
C:\WINDOWS\System32\iednser.dll -->06/05/2008 19:47:26
C:\WINDOWS\System32\PerfStringBackup.INI -->07/04/2008 18:48:54
C:\WINDOWS\System32\perfh00C.dat -->07/04/2008 18:48:54
C:\WINDOWS\System32\perfh009.dat -->07/04/2008 18:48:54
C:\WINDOWS\System32\perfc00C.dat -->07/04/2008 18:48:54
C:\WINDOWS\System32\perfc009.dat -->07/04/2008 18:48:54
C:\WINDOWS\System32\FNTCACHE.DAT -->27/02/2008 14:03:39
C:\WINDOWS\System32\Sans titre.bmp -->24/02/2008 16:41:45
C:\WINDOWS\System32\zllictbl.dat -->10/02/2008 13:17:12
C:\WINDOWS\System32\lsdelete.exe -->14/12/2007 12:32:52
C:\WINDOWS\System32\vsutil_loc040c.dll -->13/12/2007 20:27:48
C:\WINDOWS\System32\imslsp_install_loc040c.dll -->13/12/2007 20:27:44
C:\WINDOWS\System32\imsinstall_loc040c.dll -->13/12/2007 20:27:44
C:\WINDOWS\System32\vsdatant.sys -->13/12/2007 20:27:14
C:\WINDOWS\System32\zpeng24.dll -->13/12/2007 20:27:04
C:\WINDOWS\System32\zlcommdb.dll -->13/12/2007 20:26:58
C:\WINDOWS\System32\zlcomm.dll -->13/12/2007 20:26:58

C:\WINDOWS\0.log -->03/06/2008 18:47:58
C:\WINDOWS\wiadebug.log -->03/06/2008 18:47:21
C:\WINDOWS\wiaservc.log -->03/06/2008 18:47:20
C:\WINDOWS\bootstat.dat -->03/06/2008 18:46:58
C:\WINDOWS\SchedLgU.Txt -->03/06/2008 18:45:36
C:\WINDOWS\WindowsUpdate.log -->03/06/2008 18:45:25
C:\WINDOWS\NeroDigital.ini -->03/06/2008 18:38:48
C:\WINDOWS\ntbtlog.txt -->02/06/2008 23:46:05
C:\WINDOWS\setupact.log -->02/06/2008 20:07:42
C:\WINDOWS\QTFont.qfn -->23/05/2008 04:01:43
C:\WINDOWS\setupapi.log -->20/05/2008 17:54:34
C:\WINDOWS\wmsetup.log -->17/05/2008 04:25:39
C:\WINDOWS\QTFont.for -->11/05/2008 19:18:43
C:\WINDOWS\KB893803v2.log -->07/04/2008 18:45:20
C:\WINDOWS\Ascd_tmp.ini -->12/03/2008 18:50:36

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed


ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 3148
Command line: C:\WINDOWS\Explorer.EXE

Base Size Version Path
0x00ae0000 0x17000 10.04.0000.1401 C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcInj.dll
0x76f80000 0x7f000 2001.12.4414.0258 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
0x01460000 0x2c6000 3.01.4000.2435 C:\WINDOWS\system32\msi.dll
0x10100000 0xe000 2.40.0849.0000 C:\Program Files\Logitech\SetPoint\lgscroll.dll
0x7c340000 0x56000 7.10.3052.0004 C:\WINDOWS\system32\MSVCR71.dll
0x7c3a0000 0x7b000 7.10.3077.0000 C:\WINDOWS\system32\MSVCP71.dll
0x10000000 0x19000 2.00.0037.0000 C:\Program Files\MSI\Security BOX Freeware\SBLFCMNU.dll
0x78130000 0x9b000 8.00.50727.0163 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\MSVCR80.dll
0x01e90000 0x185000 1.05.0000.0011 C:\PROGRA~1\SPYBOT~1\SDHelper.dll
0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
0x01400000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x028e0000 0x5b000 8.01.0000.0000 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
0x02950000 0x4c000 8.00.0000.0000 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
0x00240000 0x10000 8.00.0000.0456 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
0x02a00000 0x79000 2.00.0037.0000 C:\Program Files\MSI\Security BOX Freeware\SBLFFILE.dll
0x02a80000 0x7b000 2.00.0037.0000 C:\Program Files\MSI\Security BOX Freeware\SBLFENG.dll
0x027a0000 0xf000 2.00.0037.0000 C:\Program Files\MSI\Security BOX Freeware\SBLFWIPE.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 776
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe
0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x10000000 0x10000 6.14.0010.4118 C:\WINDOWS\system32\Ati2evxx.dll
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
0x76f80000 0x7f000 2001.12.4414.0258 C:\WINDOWS\system32\CLBCATQ.DLL


Le volume dans le lecteur C s'appelle système
Le numéro de série du volume est 28AE-D330

Répertoire de C:\WINDOWS\system

10/09/1999 13:06 4 672 WOWPOST.EXE
1 fichier(s) 4 672 octets
0 Rép(s) 15 214 239 744 octets libres
Le volume dans le lecteur C s'appelle système
Le numéro de série du volume est 28AE-D330

Répertoire de C:\WINDOWS\system32

05/08/2004 15:00 6 144 csrss.exe
1 fichier(s) 6 144 octets
0 Rép(s) 15 214 239 744 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur C s'appelle système
Le numéro de série du volume est 28AE-D330

Répertoire de C:\WINDOWS\Downloaded Program Files

03/05/2008 19:51 <REP> .
03/05/2008 19:51 <REP> ..
16/08/2004 19:08 65 desktop.ini
25/07/2002 18:13 24 576 dwusplay.dll
25/07/2002 18:13 196 608 dwusplay.exe
25/07/2002 18:05 172 032 isusweb.dll
22/02/2007 23:41 304 544 MessengerStatsPAClient.dll
5 fichier(s) 697 825 octets

Total des fichiers listés :
5 fichier(s) 697 825 octets
2 Rép(s) 15 214 239 744 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..


Liste des fichiers en exception sur le pare-feu XP SP2

"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA"
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe:*:Enabled:PANDORA"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\APPS\\Inventime\\my.exe"="C:\\APPS\\Inventime\\my.exe:*:Enabled:INVENTIME"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\\Program Files\\AOL 9.0\\aol.exe"="C:\\Program Files\\AOL 9.0\\aol.exe:*:Disabled:AOL"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\APPS\\skype\\Phone\\Skype.exe"="C:\\APPS\\skype\\Phone\\Skype.exe:*:Enabled:Skype"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"



exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001



Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
127.0.0.1 www.activexupdate.com
127.0.0.1 activexupdate.com
127.0.0.1 antispywareupdates.net
127.0.0.1 www.antispywareupdates.net
127.0.0.1 avpcheckupdate.com
127.0.0.1 www.avpcheckupdate.com
127.0.0.1 client.exeupdate.com
127.0.0.1 www.eupdatepage.com
127.0.0.1 eupdatepage.com
127.0.0.1 www.exeupdate.com
127.0.0.1 exeupdate.com
127.0.0.1 www.hotwinupdates.com
127.0.0.1 hotwinupdates.com
127.0.0.1 www.lavasoftupdate.com
127.0.0.1 lavasoftupdate.com
127.0.0.1 www.malwarewipeupdate.com
127.0.0.1 malwarewipeupdate.com
127.0.0.1 www.msupdate.net
127.0.0.1 msupdate.net
127.0.0.1 www.msupdater.net
127.0.0.1 msupdater.net
127.0.0.1 www.necessaryupdates.com
127.0.0.1 necessaryupdates.com
127.0.0.1 newupdates.lzio.com
127.0.0.1 redirect.msupdate.net
127.0.0.1 search.keyword.exeupdate.com
127.0.0.1 www.securityupdatesite.com
127.0.0.1 securityupdatesite.com
127.0.0.1 settings.updatemysettings.com
127.0.0.1 www.spyaxeupdate.com
127.0.0.1 spyaxeupdate.com
127.0.0.1 www.spyfalconupdate.com
127.0.0.1 spyfalconupdate.com
127.0.0.1 systemupdates.net
127.0.0.1 www.systemupdates.net
127.0.0.1 trial.updates.winsoftware.com
127.0.0.1 update.680180.net
127.0.0.1 update.shareaza.com
127.0.0.1 updatemysettings.com
127.0.0.1 www.updatemysettings.com
127.0.0.1 updates.spywarequake.com
127.0.0.1 www.urgentsystemupdate.biz
127.0.0.1 urgentsystemupdate.biz
127.0.0.1 www.urgentsystemupdate.com
127.0.0.1 urgentsystemupdate.com
127.0.0.1 windupdates.com
127.0.0.1 www.pandaantivirus-2007.com
127.0.0.1 pandaantivirus-2007.com
127.0.0.1 www.pandadownload-now.com
127.0.0.1 pandadownload-now.com
127.0.0.1 panda-hq.com
127.0.0.1 www.panda-hq.com
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-03 18:51:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0


KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
148 - LVPrcSrv.exe
304 - mDNSResponder.e
428 - CLCapSvc.exe
496 - CLMLService.exe
568 - HPZipm12.exe
744 - csrss.exe
776 - winlogon.exe
820 - services.exe
832 - lsass.exe
984 - svchost.exe
996 - ati2evxx.exe
1012 - svchost.exe
1104 - svchost.exe
1192 - svchost.exe
1292 - svchost.exe
1348 - svchost.exe
1388 - vsmon.exe
1692 - aawservice.exe
1764 - ashServ.exe
1952 - CLSched.exe
2020 - spoolsv.exe
2072 - ashMaiSv.exe
2108 - ashWebSv.exe
2388 - alg.exe
2516 - COCIManager.exe
3024 - ati2evxx.exe
3148 - explorer.exe
3164 - wmiprvse.exe
3268 - TPPALDR.EXE
3300 - realsched.exe
3316 - RTHDCPL.EXE
3380 - cmd.exe
3388 - atiptaxx.exe
3504 - ashDisp.exe
3524 - zlclient.exe
3592 - Communications_
3616 - QuickCam10.exe
3644 - LVComSX.exe
3660 - msnmsgr.exe
3676 - TeaTimer.exe
3704 - Skype.exe
3952 - SetPoint.exe
4012 - AOSD.EXE
4060 - KHALMNPR.EXE
5624 - svchost.exe

Total number of processes = 46
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\ntkrnlpa.exe
806E2000 - \WINDOWS\system32\hal.dll
F7ADB000 - \WINDOWS\system32\KDCOM.DLL
F79EB000 - \WINDOWS\system32\BOOTVID.dll
F74AB000 - ACPI.sys
F7ADD000 - \WINDOWS\system32\DRIVERS\WMILIB.SYS
F749A000 - pci.sys
F75DB000 - isapnp.sys
F7BA3000 - pciide.sys
F785B000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
F7ADF000 - aliide.sys
F7AE1000 - cmdide.sys
F7AE3000 - toside.sys
F7AE5000 - viaide.sys
F7AE7000 - intelide.sys
F75EB000 - MountMgr.sys
F747B000 - ftdisk.sys
F7863000 - PartMgr.sys
F75FB000 - VolSnap.sys
F79EF000 - cpqarray.sys
F7463000 - \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
F744B000 - atapi.sys
F79F3000 - aha154x.sys
F786B000 - sparrow.sys
F79F7000 - symc810.sys
F760B000 - aic78xx.sys
F79FB000 - dac960nt.sys
F761B000 - ql10wnt.sys
F79FF000 - amsint.sys
F7873000 - asc.sys
F7A03000 - asc3550.sys
F787B000 - mraid35x.sys
F7883000 - i2omp.sys
F7A07000 - ini910u.sys
F762B000 - ql1240.sys
F763B000 - aic78u2.sys
F788B000 - symc8xx.sys
F7893000 - sym_hi.sys
F789B000 - sym_u3.sys
F78A3000 - ABP480N5.SYS
F78AB000 - asc3350p.sys
F7AE9000 - cd20xrnt.sys
F764B000 - ultra.sys
F7432000 - adpu160m.sys
F78B3000 - dpti2o.sys
F765B000 - ql1080.sys
F766B000 - ql1280.sys
F767B000 - ql12160.sys
F78BB000 - perc2.sys
F7AEB000 - perc2hib.sys
F78C3000 - hpn.sys
F7A0B000 - cbidf2k.sys
F7406000 - dac2w2k.sys
F768B000 - disk.sys
F769B000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
F73E7000 - fltMgr.sys
F73D5000 - sr.sys
F76AB000 - PxHelp20.sys
F73BE000 - KSecDD.sys
F7331000 - Ntfs.sys
F7304000 - NDIS.sys
F76BB000 - viaagp.sys
F72F0000 - srescan.sys
F76CB000 - sisagp.sys
F76DB000 - ohci1394.sys
F76EB000 - \WINDOWS\system32\DRIVERS\1394BUS.SYS
F72D5000 - Mup.sys
F7200000 - iaStor.sys
F76FB000 - alim1541.sys
F770B000 - amdagp.sys
F771B000 - agp440.sys
F772B000 - agpCPQ.sys
F77EB000 - \SystemRoot\system32\DRIVERS\nic1394.sys
F784B000 - \SystemRoot\system32\DRIVERS\intelppm.sys
F6AAD000 - \SystemRoot\system32\DRIVERS\ati2mtag.sys
F6A99000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
F6A74000 - \SystemRoot\system32\DRIVERS\HDAudBus.sys
F798B000 - \SystemRoot\system32\DRIVERS\usbuhci.sys
F6A51000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
F7993000 - \SystemRoot\system32\DRIVERS\usbehci.sys
F698D000 - \SystemRoot\system32\DRIVERS\3xHybrid.sys
F696A000 - \SystemRoot\system32\DRIVERS\ks.sys
F7ABB000 - \SystemRoot\system32\DRIVERS\BdaSup.SYS
F6943000 - \SystemRoot\system32\DRIVERS\e100b325.sys
F6932000 - \SystemRoot\system32\DRIVERS\serial.sys
F7ABF000 - \SystemRoot\system32\DRIVERS\serenum.sys
F691E000 - \SystemRoot\system32\DRIVERS\parport.sys
F71E0000 - \SystemRoot\system32\DRIVERS\i8042prt.sys
F71D0000 - \SystemRoot\system32\DRIVERS\L8042mou.Sys
F690D000 - \SystemRoot\system32\DRIVERS\LMouKE.Sys
F799B000 - \SystemRoot\system32\DRIVERS\mouclass.sys
F7AC3000 - \SystemRoot\system32\DRIVERS\L8042Kbd.sys
F79A3000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
F71C0000 - \SystemRoot\system32\DRIVERS\imapi.sys
F71B0000 - \SystemRoot\system32\DRIVERS\cdrom.sys
F71A0000 - \SystemRoot\system32\DRIVERS\redbook.sys
F79AB000 - \SystemRoot\SYSTEM32\DRIVERS\GEARAspiWDM.sys
F7D00000 - \SystemRoot\system32\DRIVERS\audstub.sys
F776B000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
F7ACB000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
F68F6000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
F777B000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
F778B000 - \SystemRoot\system32\DRIVERS\raspptp.sys
F79B3000 - \SystemRoot\system32\DRIVERS\TDI.SYS
F68E5000 - \SystemRoot\system32\DRIVERS\psched.sys
F779B000 - \SystemRoot\system32\DRIVERS\msgpc.sys
F79BB000 - \SystemRoot\system32\DRIVERS\ptilink.sys
F79C3000 - \SystemRoot\system32\DRIVERS\raspti.sys
F77BB000 - \SystemRoot\system32\DRIVERS\termdd.sys
F7B17000 - \SystemRoot\system32\DRIVERS\swenum.sys
F68B1000 - \SystemRoot\system32\DRIVERS\update.sys
F7AD7000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
F6C82000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F2546000 - \SystemRoot\system32\drivers\RtkHDAud.sys
F2524000 - \SystemRoot\system32\drivers\portcls.sys
F6C42000 - \SystemRoot\system32\drivers\drmk.sys
F6C22000 - \SystemRoot\system32\DRIVERS\usbhub.sys
F7B29000 - \SystemRoot\system32\DRIVERS\USBD.SYS
F7B47000 - \SystemRoot\System32\Drivers\i2omgmt.SYS
F2439000 - \SystemRoot\system32\DRIVERS\klif.sys
F7B49000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F7D1F000 - \SystemRoot\System32\Drivers\Null.SYS
F7B4B000 - \SystemRoot\System32\Drivers\Beep.SYS
F79DB000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
F79E3000 - \SystemRoot\System32\drivers\vga.sys
F7B4D000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F7B4F000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F78D3000 - \SystemRoot\System32\Drivers\Msfs.SYS
F78EB000 - \SystemRoot\System32\Drivers\Npfs.SYS
F7A9F000 - \SystemRoot\system32\DRIVERS\rasacd.sys
F2406000 - \SystemRoot\system32\DRIVERS\ipsec.sys
F23AE000 - \SystemRoot\system32\DRIVERS\tcpip.sys
F6C12000 - \SystemRoot\System32\Drivers\aswTdi.SYS
F238D000 - \SystemRoot\system32\DRIVERS\ipnat.sys
F2365000 - \SystemRoot\system32\DRIVERS\netbt.sys
F6C02000 - \SystemRoot\system32\DRIVERS\wanarp.sys
F2305000 - \SystemRoot\System32\vsdatant.sys
F6BF2000 - \SystemRoot\system32\DRIVERS\arp1394.sys
F22BB000 - \SystemRoot\System32\drivers\afd.sys
F77CB000 - \SystemRoot\system32\DRIVERS\netbios.sys
F2290000 - \SystemRoot\system32\DRIVERS\rdbss.sys
F68A9000 - \??\C:\WINDOWS\system32\drivers\pclepci.sys
F2221000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys
F77FB000 - \SystemRoot\System32\Drivers\Fips.SYS
F220A000 - \SystemRoot\System32\Drivers\aswSP.SYS
F78FB000 - \SystemRoot\System32\Drivers\Aavmker4.SYS
F6889000 - \SystemRoot\system32\DRIVERS\lvuvcflt.sys
F7903000 - \SystemRoot\system32\DRIVERS\usbccgp.sys
F1FB4000 - \SystemRoot\system32\DRIVERS\LVMVDrv.sys
F781B000 - \SystemRoot\system32\drivers\lvusbsta.sys
F1EAD000 - \SystemRoot\system32\DRIVERS\lvuvc.sys
F1D3D000 - \SystemRoot\system32\DRIVERS\lvpopflt.sys
F782B000 - \SystemRoot\system32\drivers\usbaudio.sys
F1BA4000 - \SystemRoot\system32\DRIVERS\LVcKap.sys
F783B000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F1B8C000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F7B73000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F2301000 - \SystemRoot\System32\drivers\Dxapi.sys
F790B000 - \SystemRoot\System32\watchdog.sys
BF9C1000 - \SystemRoot\System32\drivers\dxg.sys
F7CDB000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9D3000 - \SystemRoot\System32\ati2dvag.dll
BFA0A000 - \SystemRoot\System32\ati2cqag.dll
BFA3E000 - \SystemRoot\System32\atikvmag.dll
BFA73000 - \SystemRoot\System32\ati3duag.dll
BFCB5000 - \SystemRoot\System32\ativvaxx.dll
BFFA0000 - \SystemRoot\System32\ATMFD.DLL
F792B000 - \SystemRoot\system32\DRIVERS\aswFsBlk.sys
EF97B000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
EF679000 - \SystemRoot\System32\Drivers\aswMon2.SYS
EF41C000 - \SystemRoot\system32\DRIVERS\mrxdav.sys
EF52D000 - \SystemRoot\System32\Drivers\Aspi32.SYS
EF2D9000 - \SystemRoot\system32\DRIVERS\srv.sys
EF1D4000 - \SystemRoot\system32\drivers\wdmaud.sys
EF7B7000 - \SystemRoot\system32\drivers\sysaudio.sys
F21B2000 - \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
EF1AC000 - \SystemRoot\System32\Drivers\aswRdr.SYS
EEBEC000 - \SystemRoot\System32\Drivers\HTTP.sys
F7C94000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 180

Liste des programmes installes

ABBYY PDF Transformer 1.0
Ad-Aware 2007
Adobe Acrobat 4.0
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe BridgeTalk Plugin CS3
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color Common Settings
Adobe Color EU Recommended Settings
Adobe Color JA Extra Settings
Adobe Color NA Extra Settings
Adobe Creative Suite 3 Design Premium
Adobe Default Language CS3
Adobe Device Central CS3
Adobe Dreamweaver CS3
Adobe ExtendScript Toolkit 2
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Flash CS3
Adobe Flash Player 9 ActiveX
Adobe Flash Player Plugin
Adobe Flash Video Encoder
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Illustrator CS3
Adobe InDesign CS3
Adobe InDesign CS3 Icon Handler
Adobe Linguistics CS3
Adobe MotionPicture Color Files
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Reader 8.1.2 - Français
Adobe Setup
Adobe Setup
Adobe Setup
Adobe SING CS3
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe Version Cue CS3 Server {ko_KR}
Adobe WAS CS3
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
AHV content for Acrobat and Flash
AiO_Scan_CDA
AiOSoftwareNPI
Ajouter ou supprimer Adobe Creative Suite 3 Design Premium
Alive Video Converter (version 2.6.8.0)
Archiveur WinRAR
avast! Antivirus
BufferChm
C4100
c4100_Help
CCleaner (remove only)
Codeur Windows Media Série 9
Compel Adaptec WinASPI
Correctif Windows XP - KB873333
Correctif Windows XP - KB873339
Correctif Windows XP - KB885250
Correctif Windows XP - KB885835
Correctif Windows XP - KB885836
Correctif Windows XP - KB886185
Correctif Windows XP - KB887472
Correctif Windows XP - KB888113
Correctif Windows XP - KB888302
Correctif Windows XP - KB890047
Correctif Windows XP - KB890175
Correctif Windows XP - KB890859
Correctif Windows XP - KB890923
Correctif Windows XP - KB891781
Correctif Windows XP - KB893066
Correctif Windows XP - KB893086
CP_CalendarTemplates1
cp_OnlineProjectsConfig
CP_Package_Basic1
CP_Panorama1Config
cp_PosterPrintConfig
CueTour
CustomerResearchQFolder
Destinations
DeviceManagementQFolder
DocProc
DocProcQFolder
DocumentViewer
DocumentViewerQFolder
Domain Name Helper Adzgalore
DVD Shrink 3.2
Enhancement Browser Tools Cpmsky
Eraser
eSupportQFolder
FastStone Image Viewer 3.2
Fax_CDA
ffdshow
FullDPAppQFolder
Harrap's Shorter
High Definition Audio Driver Package - KB888111
HP Customer Participation Program 7.0
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Photosmart Premier Software 6.5
HP Photosmart, Officejet and Deskjet 7.0.A
HP Software Update
HP Solution Center 7.0
HPPhotoSmartExpress
HPProductAssistant
InstantShareDevices
InstantShareDevicesMFC
Intel(R) PRO Network Connections Drivers
iPod for Windows 2005-02-07
iPod for Windows 2005-02-07
iTunes
iTunes
J2SE Runtime Environment 5.0 Update 2
LaserJet 1020 series
Lecteur Windows Media 10
LimeWire 4.17.6
Logitech Audio Echo Cancellation Component
Logitech QuickCam
Logitech SetPoint
Logitech Video Enumerator
Macromedia Shockwave Player
Malwarebytes' Anti-Malware
MarketResearch
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 French Language Pack
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (2.0.0.14)
MSN
MVision
NeoDivx Suite
Nero 6 Ultra Edition
NewCopy_CDA
OCR Software by I.R.I.S 7.0
OrderReminder HP LaserJet 1020
Panneau de contrôle ATI
PanoStandAlone
PartoucheWize
PDF Settings
PhotoGallery
ProductContextNPI
Programme de gestion Camera de Logitech®
RandMap
Readme
Realtek High Definition Audio Driver
Scan
ScannerCopy
Security BOX® Freeware 2.0
Simple Sudoku 4.1
SkinsHP1
Skype™ 3.6
SlideShow
SolutionCenter
Sonic MyDVD
Sonic RecordNow!
Sonic_PrimoSDK
Spybot - Search & Destroy
Status
SUPER © Version 2007.bld.22 (Mar 14, 2007)
TeLL me More
Toolbox
TrayApp
TubeMaster
Unload
USB Storage Adapter FX (TPP)
VideoLAN VLC media player 0.8.6c
WebFldrs XP
WebReg
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Media Format Runtime
ZoneAlarm



Le volume dans le lecteur C s'appelle système
Le numéro de série du volume est 28AE-D330

Répertoire de C:\Program Files

02/06/2008 22:26 <REP> .
02/06/2008 22:26 <REP> ..
05/08/2004 06:08 81 920 1029.mst
05/08/2004 06:08 76 288 1031.mst
05/08/2004 06:08 3 584 1033.mst
05/08/2004 06:08 71 680 1034.mst
05/08/2004 06:08 92 160 1036.mst
05/08/2004 06:08 74 752 1038.mst
05/08/2004 06:08 74 752 1040.mst
05/08/2004 06:08 71 680 1043.mst
05/08/2004 06:08 71 680 1045.mst
05/08/2004 06:08 121 856 1049.mst
13/05/2007 12:54 <REP> ABBYY PDF Transformer 1.0
09/08/2004 17:13 1 852 928 ABBYY PDF Transformer 1.0.msi
20/03/2008 20:30 <REP> Adobe
10/01/2006 21:34 <REP> Ahead
03/03/2008 16:25 <REP> Alien Outbreak 2 Invasion
17/03/2007 11:12 <REP> AliveMedia
09/02/2008 14:26 <REP> Alwil Software
06/06/2007 17:55 <REP> AviSynth 2.5
23/09/2007 14:04 <REP> Bonjour
17/02/2007 22:46 <REP> CCleaner
11/11/2005 02:34 <REP> ComPlus Applications
11/11/2005 02:34 <REP> CyberLink
05/08/2004 06:08 38 619 860 Data1.cab
10/01/2006 21:36 <REP> DVD Shrink
31/03/2008 21:50 <REP> Eraser
06/06/2007 17:54 <REP> eRightSoft
20/08/2007 22:13 <REP> EuroThink
30/07/2007 19:40 <REP> FastStone Image Viewer
23/03/2008 12:33 <REP> ffdshow
20/05/2008 17:49 <REP> Fichiers communs
11/11/2005 02:34 <REP> GMixon
12/01/2008 13:04 <REP> Harrap's Multimédia
13/01/2006 18:28 <REP> Hasbro Interactive
11/10/2006 19:21 <REP> Hewlett-Packard
02/10/2006 17:54 <REP> HP
11/03/2002 11:45 1 708 856 instmsiA.exe
11/03/2002 12:06 1 822 520 instmsiW.exe
11/11/2005 02:36 <REP> Internet Explorer
08/01/2006 13:46 <REP> iPod
08/01/2006 13:47 <REP> iTunes
11/11/2005 02:34 <REP> Java
07/08/2006 21:31 <REP> Jeux de cartes
10/02/2008 13:30 <REP> Lavasoft
11/11/2005 02:34 <REP> Learn2.com
13/05/2008 20:10 <REP> LimeWire
20/05/2008 17:49 <REP> Logitech
02/06/2008 22:26 <REP> Malwarebytes' Anti-Malware
11/11/2005 02:37 <REP> Messenger
11/11/2005 02:34 <REP> microsoft frontpage
10/01/2006 21:22 <REP> Microsoft Office
10/01/2006 21:21 <REP> Microsoft.NET
11/11/2005 02:37 <REP> Movie Maker
03/06/2008 18:43 <REP> Mozilla Firefox
12/05/2007 19:53 <REP> MSI
10/02/2008 16:13 <REP> MSN
11/11/2005 02:34 <REP> MSN Gaming Zone
09/02/2008 19:28 <REP> MSN Messenger
08/01/2006 17:47 <REP> MUSICMATCH
11/11/2005 02:37 <REP> NetMeeting
11/11/2005 02:37 <REP> Outlook Express
31/12/2007 17:41 <REP> PartoucheWize
17/06/2007 16:06 <REP> Pinnacle
23/09/2007 14:12 <REP> QuickTime
11/11/2005 02:34 <REP> Real
11/11/2005 02:34 <REP> Realtek
19/12/2007 20:42 <REP> ReflexiveArcade
10/02/2008 13:51 <REP> Screamer Radio
04/08/2004 22:15 285 setup.ini
09/08/2006 22:44 <REP> Simple Sudoku
11/11/2005 02:34 <REP> Sonic
10/02/2008 13:23 <REP> Spybot - Search & Destroy
10/04/2008 19:14 <REP> Steganos Security Suite 2006
19/04/2008 16:08 <REP> TubeMaster
11/11/2005 02:34 <REP> Ulead Systems
10/01/2006 21:39 <REP> VideoLAN
11/11/2005 02:34 <REP> Viewpoint
23/03/2008 12:33 <REP> WinASPI
11/11/2005 02:34 <REP> Windows Media Components
09/02/2008 11:48 <REP> Windows Media Player
11/11/2005 02:39 <REP> Windows NT
10/01/2006 21:33 <REP> WinRAR
11/11/2005 02:34 <REP> xerox
10/02/2008 13:15 <REP> Zone Labs
15 fichier(s) 44 744 801 octets
70 Rép(s) 15 188 586 496 octets libres
Le volume dans le lecteur C s'appelle système
Le numéro de série du volume est 28AE-D330

Répertoire de C:\Program Files\fichiers communs

20/05/2008 17:49 <REP> .
20/05/2008 17:49 <REP> ..
20/03/2008 20:22 <REP> Adobe
10/01/2006 21:34 <REP> Ahead
08/01/2006 17:02 <REP> AOL
23/09/2007 14:21 <REP> Control Panels
10/01/2006 21:23 <REP> DESIGNER
02/10/2006 17:47 <REP> Hewlett-Packard
02/10/2006 17:51 <REP> HP
08/01/2006 13:43 <REP> InstallShield
11/11/2005 02:34 <REP> Java
20/05/2008 17:49 <REP> Logishrd
20/05/2008 17:52 <REP> Logitech
23/09/2007 13:59 <REP> Macrovision Shared
17/06/2007 16:15 <REP> Microsoft Shared
11/11/2005 02:34 <REP> MSSoap
11/11/2005 02:34 <REP> Nullsoft
11/11/2005 02:34 <REP> ODBC
31/10/2006 19:19 <REP> PC SOFT
11/11/2005 02:34 <REP> Real
11/11/2005 02:34 <REP> Services
11/04/2008 20:20 <REP> Skype
11/11/2005 02:34 <REP> Sonic Shared
11/11/2005 02:34 <REP> SpeechEngines
16/06/2007 10:57 <REP> SureThing Shared
09/02/2008 14:20 <REP> Symantec Shared
11/11/2005 02:34 <REP> System
11/11/2005 02:34 <REP> Ulead Systems
10/02/2008 13:29 <REP> Wise Installation Wizard
11/11/2005 02:34 <REP> xing shared
0 fichier(s) 0 octets
30 Rép(s) 15 188 582 400 octets libres
Le volume dans le lecteur C s'appelle système
Le numéro de série du volume est 28AE-D330

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

10/01/2006 21:23 <REP> .
10/01/2006 21:23 <REP> ..
10/01/2006 21:23 <REP> 1033
10/01/2006 21:23 <REP> 1036
11/07/2003 17:15 1 292 872 MSONSEXT.DLL
15/07/2003 13:52 35 896 MSOSV.DLL
03/06/1999 13:09 122 937 MSOWS409.DLL
07/03/2001 08:00 127 033 MSOWS40c.DLL
11/07/2003 09:25 80 448 PKMWS.DLL
5 fichier(s) 1 659 186 octets
4 Rép(s) 15 188 582 400 octets libres
Le volume dans le lecteur C s'appelle système
Le numéro de série du volume est 28AE-D330

Répertoire de C:\

11/03/2002 11:45 1 708 856 instmsiA.exe
11/03/2002 12:06 1 822 520 instmsiW.exe
21/01/2004 13:05 303 104 setup.exe
09/02/2008 14:26 19 858 624 setupfre.exe
4 fichier(s) 23 693 104 octets
0 Rép(s) 15 188 582 400 octets libres





****** Fin du rapport DiagHelp
Veuillez svp envoyer le fichier C:\upload_moi_106946390318.tar.gz a l'adresse http://upload.malekal.com


là je crois que tu sais tout sur ma bécane!!!!
questions subsidiaires:

1- que puis je faire pour optimiser les performances?

2- j'utilises déja ccleaner, spyboot, avaast et zone alarm et tout ceci n'a pas empêché une infection!!!! y a t il quelque chose que tu préconises????

en tous cas merci...

voici ce que ça dit!!!

0 bytes size received / Se ha recibido un archivo vacio

ok je prend bien note.
je dois partir, je fais tout ça dès mon retour dans la soirée!!!!
à toute...

me revoici

je n'ai pas trouvé de dossier C:\OTMoveIt\Movedfiles ou quelque chose qui y ressemblait après avoir effectué ce que tu m'as dit.

par contre du côté "results" il m'a été spécifié que le fichier en question a bien été supprimé. je suis allé vérifier sur place, il est toujours présent avec marqué "0 octet" "fichier HS"

???

voila ce que j'ai:


ComboFix 08-06-01.6 - julien 2008-06-04 0:03:02.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.482 [GMT 2:00]
Endroit: D:\Documents and Settings\julien\Bureau\C-fix.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\setup.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_poof


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-03 to 2008-06-03 ))))))))))))))))))))))))))))))))))))
.

2008-06-03 23:38 . 2008-06-04 00:08 0 --a------ C:\WINDOWS\system32\drivers\lvuvc.hs
2008-06-03 18:53 . 2008-06-03 18:53 25,003,613 --a------ C:\upload_moi_106946390318.tar.gz
2008-06-02 22:31 . 2008-06-02 22:31 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-06-02 22:26 . 2008-06-02 22:26 <REP> d-------- D:\Documents and Settings\julien\Application Data\Malwarebytes
2008-06-02 22:26 . 2008-06-02 22:26 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-02 22:26 . 2008-06-02 22:26 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-02 22:26 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-02 22:26 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-02 20:00 . 2004-05-05 09:40 16,384 --a------ C:\WINDOWS\system32\restart.exe
2008-06-02 17:35 . 2007-02-09 10:26 184,320 --a------ C:\WINDOWS\system32\delnext.exe
2008-05-20 17:49 . 2008-05-20 17:49 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Logitech
2008-05-20 17:49 . 2008-05-20 17:49 <REP> d-------- C:\Program Files\Fichiers communs\Logishrd
2008-05-14 19:29 . 2008-05-14 19:29 46,299 --a------ C:\WINDOWS\system32\AdzgaloreDNHelper-uninstall.exe
2008-05-13 20:10 . 2008-05-25 19:53 <REP> d-------- D:\Documents and Settings\julien\Application Data\LimeWire
2008-05-13 20:10 . 2008-05-13 20:10 <REP> d-------- C:\Program Files\LimeWire
2008-05-11 19:18 . 2008-05-23 04:01 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-11 19:18 . 2008-05-11 19:18 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-06 19:47 . 2008-05-06 19:47 429,568 --a------ C:\WINDOWS\system32\iednser.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-03 22:10 36,050,976 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-03 22:08 1,909,875 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-06-03 22:07 431,804 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-03 16:29 --------- d-----w D:\Documents and Settings\julien\Application Data\Skype
2008-06-03 15:32 --------- d-----w D:\Documents and Settings\julien\Application Data\skypePM
2008-05-20 15:52 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-05-20 15:49 --------- d-----w C:\Program Files\Logitech
2008-05-16 21:49 2,499,072 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-04-20 20:15 1,562,624 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-04-19 14:08 --------- d-----w C:\Program Files\TubeMaster
2008-04-11 18:21 32 ----a-w D:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-04-11 18:20 --------- d-----w D:\Documents and Settings\All Users\Application Data\Skype
2008-04-11 18:20 --------- d-----w C:\Program Files\Fichiers communs\Skype
2008-04-10 17:14 --------- d-----w C:\Program Files\Steganos Security Suite 2006
2008-04-06 17:35 --------- d-----w D:\Documents and Settings\julien\Application Data\Playwize
2008-04-05 15:57 --------- d-----w D:\Documents and Settings\All Users\Application Data\DVD Shrink
2004-08-09 15:13 1,852,928 ----a-w C:\Program Files\ABBYY PDF Transformer 1.0.msi
2004-08-05 04:08 92,160 ----a-w C:\Program Files\1036.mst
2004-08-05 04:08 81,920 ----a-w C:\Program Files\1029.mst
2004-08-05 04:08 76,288 ----a-w C:\Program Files\1031.mst
2004-08-05 04:08 74,752 ----a-w C:\Program Files\1040.mst
2004-08-05 04:08 74,752 ----a-w C:\Program Files\1038.mst
2004-08-05 04:08 71,680 ----a-w C:\Program Files\1045.mst
2004-08-05 04:08 71,680 ----a-w C:\Program Files\1043.mst
2004-08-05 04:08 71,680 ----a-w C:\Program Files\1034.mst
2004-08-05 04:08 38,619,860 ----a-w C:\Program Files\Data1.cab
2004-08-05 04:08 3,584 ----a-w C:\Program Files\1033.mst
2004-08-05 04:08 121,856 ----a-w C:\Program Files\1049.mst
2004-08-04 20:15 285 ----a-w C:\Program Files\setup.ini
2002-03-11 10:06 1,822,520 ----a-w C:\Program Files\instmsiW.exe
2002-03-11 09:45 1,708,856 ----a-w C:\Program Files\instmsiA.exe
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47 31,744 --sh--r C:\WINDOWS\system32\msfDX.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b636fe80-5fe6-45de-3235-6d9b1ecb043f}]
2008-05-06 19:47 429568 --a------ C:\WINDOWS\system32\iednser.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:55 5674352]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]
"Skype"="C:\APPS\skype\Phone\Skype.exe" [2008-02-01 17:26 21974824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPP Auto Loader"="C:\WINDOWS\tppaldr.exe" [2003-08-20 12:03 118784]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-11-10 14:38 180269]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 14:25 14720000 C:\WINDOWS\RTHDCPL.EXE]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 15:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 15:00 455168]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 15:00 208952]
"ATIPTA"="C:\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05 344064]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 11:31 24576]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-12-13 20:27 919016]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 01:03 284184]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2006-11-15 21:58 746520]
"LVCOMSX"="C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe" [2006-11-15 22:01 244512]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.ulmp3acm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\ulmp3acm.acm
"msacm.mpegacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\mpegacm.acm
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\APPS\\Inventime\\my.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\APPS\\skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-05-27 13:51]
S1 SLEE_13_DRIVER;Steganos Live Encryption Engine 13 [Driver];C:\WINDOWS\system32\drivers\SLEE13.sys []
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 03:13]
S3 TPPFX;USB Storage Adapter FX (TPP);C:\WINDOWS\system32\DRIVERS\TPPFX.SYS [2002-04-07 18:00]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
S3 ZD1211U(Wireless);IEEE 802.11g USB Adapter Driver(Wireless);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2004-07-14 14:53]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{865dfe78-ac98-11db-9880-001485574699}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a018d383-f513-11dc-ab3f-001485574699}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-06-03 17:30:00 C:\WINDOWS\Tasks\Configurer mon PC.job"
- C:\Apps\SMP\PCSETUP.EXE
"2006-01-07 17:09:44 C:\WINDOWS\Tasks\Rappel d'enregistrement 3.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-04 00:09:00
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MysqlInventime]
"ImagePath"="C:\Apps\INVENT~1\mysql\bin\mysqld-nt --defaults-file=C:\Apps\Inventime\mysql\my.ini MysqlInventime"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\APPS\ABOARD\AOSD.EXE
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-04 0:12:56 - machine was rebooted [julien]
ComboFix-quarantined-files.txt 2008-06-03 22:12:49

Pre-Run: 15,021,195,264 octets libres
Post-Run: 14,932,570,112 octets libres

199


bonne lecture

bonsoir

me revoici... avec le rapport


ComboFix 08-06-01.6 - julien 2008-06-05 19:15:52.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.476 [GMT 2:00]
Endroit: D:\Documents and Settings\julien\Bureau\C-fix.exe
Command switches used :: D:\Documents and Settings\julien\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

FILE ::
C:\WINDOWS\system32\drivers\lvuvc.hs
C:\WINDOWS\system32\iednser.dll
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\_000009_.tmp.dll
C:\WINDOWS\system32\_000010_.tmp.dll
C:\WINDOWS\system32\_000011_.tmp.dll
C:\WINDOWS\system32\_000012_.tmp.dll
C:\WINDOWS\system32\_000013_.tmp.dll
C:\WINDOWS\system32\_000015_.tmp.dll
C:\WINDOWS\system32\drivers\lvuvc.hs
C:\WINDOWS\system32\iednser.dll

.
((((((((((((((((((((((((((((( Fichiers créés 2008-05-05 to 2008-06-05 ))))))))))))))))))))))))))))))))))))
.

2008-06-05 19:02 . 2008-06-05 19:02 <REP> d-------- C:\Program Files\MSXML 4.0
2008-06-05 19:01 . 2008-06-05 19:01 140 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-06-05 18:27 . 2007-07-09 15:11 584,192 --a------ C:\WINDOWS\system32\SET3AA.tmp
2008-06-05 18:27 . 2007-07-09 15:11 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-06-05 18:27 . 2007-04-02 07:59 546,304 --------- C:\WINDOWS\system32\SET3BA.tmp
2008-06-05 18:24 . 2007-10-25 18:56 8,510,976 --------- C:\WINDOWS\system32\SET3E1.tmp
2008-06-05 18:22 . 2006-12-07 08:40 2,362,184 --a------ C:\WINDOWS\system32\SET13A.tmp
2008-06-05 18:22 . 2005-10-21 00:25 1,097,728 --a------ C:\WINDOWS\system32\SET30A.tmp
2008-06-05 18:21 . 2007-04-18 18:14 2,854,400 --a------ C:\WINDOWS\system32\SET32A.tmp
2008-06-05 18:18 . 2008-06-05 18:18 <REP> d-------- C:\WINDOWS\LastGood
2008-06-03 18:53 . 2008-06-03 18:53 25,003,613 --a------ C:\upload_moi_106946390318.tar.gz
2008-06-02 22:31 . 2008-06-02 22:31 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-06-02 22:26 . 2008-06-02 22:26 <REP> d-------- D:\Documents and Settings\julien\Application Data\Malwarebytes
2008-06-02 22:26 . 2008-06-02 22:26 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-02 22:26 . 2008-06-02 22:26 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-02 22:26 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-02 22:26 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-02 20:00 . 2004-05-05 09:40 16,384 --a------ C:\WINDOWS\system32\restart.exe
2008-06-02 17:35 . 2007-02-09 10:26 184,320 --a------ C:\WINDOWS\system32\delnext.exe
2008-05-20 17:49 . 2008-05-20 17:49 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Logitech
2008-05-20 17:49 . 2008-05-20 17:49 <REP> d-------- C:\Program Files\Fichiers communs\Logishrd
2008-05-14 19:29 . 2008-05-14 19:29 46,299 --a------ C:\WINDOWS\system32\AdzgaloreDNHelper-uninstall.exe
2008-05-13 20:10 . 2008-05-25 19:53 <REP> d-------- D:\Documents and Settings\julien\Application Data\LimeWire
2008-05-13 20:10 . 2008-05-13 20:10 <REP> d-------- C:\Program Files\LimeWire
2008-05-11 19:18 . 2008-05-23 04:01 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-11 19:18 . 2008-05-11 19:18 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-05 17:19 36,780,064 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-05 17:18 --------- d-----w D:\Documents and Settings\julien\Application Data\Skype
2008-06-04 05:06 432,812 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-03 22:08 1,909,875 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-06-03 15:32 --------- d-----w D:\Documents and Settings\julien\Application Data\skypePM
2008-05-20 15:52 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-05-20 15:49 --------- d-----w C:\Program Files\Logitech
2008-05-16 21:49 2,499,072 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-04-20 20:15 1,562,624 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-04-19 14:08 --------- d-----w C:\Program Files\TubeMaster
2008-04-11 18:21 32 ----a-w D:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-04-11 18:20 --------- d-----w D:\Documents and Settings\All Users\Application Data\Skype
2008-04-11 18:20 --------- d-----w C:\Program Files\Fichiers communs\Skype
2008-04-10 17:14 --------- d-----w C:\Program Files\Steganos Security Suite 2006
2008-04-06 17:35 --------- d-----w D:\Documents and Settings\julien\Application Data\Playwize
2008-04-05 15:57 --------- d-----w D:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 621,344 ------w C:\WINDOWS\system32\dllcache\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-25 04:51 194,144 ------w C:\WINDOWS\system32\dllcache\msjint40.dll
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,376 ------w C:\WINDOWS\system32\dllcache\win32k.sys
2004-08-09 15:13 1,852,928 ----a-w C:\Program Files\ABBYY PDF Transformer 1.0.msi
2004-08-05 04:08 92,160 ----a-w C:\Program Files\1036.mst
2004-08-05 04:08 81,920 ----a-w C:\Program Files\1029.mst
2004-08-05 04:08 76,288 ----a-w C:\Program Files\1031.mst
2004-08-05 04:08 74,752 ----a-w C:\Program Files\1040.mst
2004-08-05 04:08 74,752 ----a-w C:\Program Files\1038.mst
2004-08-05 04:08 71,680 ----a-w C:\Program Files\1045.mst
2004-08-05 04:08 71,680 ----a-w C:\Program Files\1043.mst
2004-08-05 04:08 71,680 ----a-w C:\Program Files\1034.mst
2004-08-05 04:08 38,619,860 ----a-w C:\Program Files\Data1.cab
2004-08-05 04:08 3,584 ----a-w C:\Program Files\1033.mst
2004-08-05 04:08 121,856 ----a-w C:\Program Files\1049.mst
2004-08-04 20:15 285 ----a-w C:\Program Files\setup.ini
2002-03-11 10:06 1,822,520 ----a-w C:\Program Files\instmsiW.exe
2002-03-11 09:45 1,708,856 ----a-w C:\Program Files\instmsiA.exe
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47 31,744 --sh--r C:\WINDOWS\system32\msfDX.dll
.

((((((((((((((((((((((((((((( snapshot@2008-06-04_ 0.12.23.10 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-11-10 12:20:48 1,257,472 ----a-w C:\WINDOWS\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2008-06-05 17:09:25 1,265,664 ----a-w C:\WINDOWS\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
- 2005-11-10 12:20:22 1,224,704 ----a-w C:\WINDOWS\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2008-06-05 17:09:26 1,232,896 ----a-w C:\WINDOWS\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2008-06-05 17:09:37 61,440 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_7ed3e3c5\CustomMarshalers.dll
+ 2008-06-05 17:10:05 118,784 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_8583eb63\CustomMarshalers.dll
+ 2008-06-05 17:10:00 3,391,488 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_7b316baa\mscorlib.dll
+ 2008-06-05 17:10:21 8,908,800 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_d427d8c4\mscorlib.dll
+ 2008-06-05 17:09:54 1,466,368 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_3f4b6a85\System.Design.dll
+ 2008-06-05 17:10:15 3,395,584 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_73d1d655\System.Design.dll
+ 2008-06-05 17:09:39 90,112 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_c9199aa2\System.Drawing.Design.dll
+ 2008-06-05 17:10:06 192,512 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_f3fad40c\System.Drawing.Design.dll
+ 2008-06-05 17:10:17 2,244,608 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_7fdb5608\System.Drawing.dll
+ 2008-06-05 17:09:56 835,584 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_cb650d94\System.Drawing.dll
+ 2008-06-05 17:10:10 7,884,800 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_7b1c5f07\System.Windows.Forms.dll
+ 2008-06-05 17:09:45 3,018,752 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_c1c69a70\System.Windows.Forms.dll
+ 2008-06-05 17:09:50 2,088,960 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_57abcc71\System.Xml.dll
+ 2008-06-05 17:10:13 5,513,216 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_fd9538b4\System.Xml.dll
+ 2008-06-05 17:09:36 1,966,080 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_2bbf4a9d\System.dll
+ 2008-06-05 17:10:05 4,788,224 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_c4f78baf\System.dll
- 2008-06-03 22:08:16 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-05 16:16:17 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2006-02-15 00:22:26 142,464 ------w C:\WINDOWS\Driver Cache\i386\aec.sys
+ 2006-03-17 00:33:10 262,784 ------w C:\WINDOWS\Driver Cache\i386\http.sys
+ 2006-06-14 08:47:45 172,416 ------w C:\WINDOWS\Driver Cache\i386\kmixer.sys
- 2005-01-19 04:26:52 451,584 ----a-w C:\WINDOWS\Driver Cache\i386\mrxsmb.sys
+ 2006-05-05 09:41:45 453,120 ----a-w C:\WINDOWS\Driver Cache\i386\mrxsmb.sys
- 2005-03-02 18:07:56 2,137,600 ----a-w C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe
+ 2007-02-28 16:02:21 2,138,112 ----a-w C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe
- 2005-03-02 18:07:56 2,058,880 ----a-w C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
+ 2007-02-28 16:02:36 2,059,648 ----a-w C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
- 2005-03-02 18:08:02 2,017,280 ----a-w C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe
+ 2007-02-28 16:02:21 2,017,792 ----a-w C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe
- 2005-03-02 18:08:06 2,181,376 ----a-w C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
+ 2007-02-28 16:02:36 2,182,400 ----a-w C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
+ 2006-06-14 08:47:46 6,400 ------w C:\WINDOWS\Driver Cache\i386\splitter.sys
+ 2006-06-14 09:00:45 82,944 ------w C:\WINDOWS\Driver Cache\i386\wdmaud.sys
- 2001-11-16 11:16:44 1,081,344 ----a-w C:\WINDOWS\Help\SBSI\Training\orun32.exe
+ 2006-08-21 14:03:44 1,077,321 ----a-w C:\WINDOWS\Help\SBSI\Training\orun32.exe
- 2004-08-05 13:00:00 10,752 ----a-w C:\WINDOWS\hh.exe
+ 2005-05-26 23:22:01 10,752 ----a-w C:\WINDOWS\hh.exe
+ 2008-06-05 17:02:36 32,768 ----a-r C:\WINDOWS\Installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF}\icon.exe
- 2004-07-15 00:49:16 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2007-04-13 19:30:52 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
- 2004-07-15 00:49:22 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2007-04-13 19:30:52 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
- 2004-07-14 23:32:22 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2007-04-13 18:57:52 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
- 2003-02-20 18:09:14 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
+ 2007-04-13 18:57:58 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
- 2004-07-14 23:25:06 315,392 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
+ 2007-04-13 18:56:30 315,392 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
- 2004-07-14 23:33:04 102,400 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2007-04-13 18:58:00 102,400 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
- 2004-07-15 13:29:02 2,138,112 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2007-04-13 18:50:46 2,142,208 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
- 2003-02-20 18:09:18 77,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
+ 2007-04-13 18:58:02 77,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
- 2004-07-14 23:26:52 2,510,848 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
+ 2007-04-13 18:57:00 2,523,136 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
- 2004-07-14 23:28:34 2,502,656 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2007-04-13 18:57:28 2,514,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
- 2004-08-10 15:20:00 106,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe
+ 2007-01-15 14:11:26 73,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe
+ 2004-07-15 00:49:16 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW4368\_aspnet_isapi.dll
+ 2004-07-14 23:32:22 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW4368\_CORPerfMonExt.dll
+ 2004-07-14 23:24:30 282,624 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW4368\_fusion.dll
+ 2004-07-14 23:25:06 315,392 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW4368\_mscorjit.dll
+ 2004-07-15 13:29:02 2,138,112 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW4368\_mscorlib.dll
+ 2003-02-20 18:09:18 77,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW4368\_mscorsn.dll
+ 2004-07-14 23:26:52 2,510,848 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW4368\_mscorsvr.dll
+ 2004-07-14 23:28:34 2,502,656 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW4368\_mscorwks.dll
+ 2003-02-21 03:42:22 348,160 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW4368\_msvcr71.dll
+ 2004-07-14 23:34:50 94,208 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SHADOW4368\_PerfCounter.dll
- 2004-07-15 13:31:16 1,224,704 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.dll
+ 2007-04-13 19:35:38 1,232,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.dll
- 2004-10-08 05:20:12 1,257,472 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
+ 2007-04-13 19:35:46 1,265,664 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
- 2004-08-05 13:00:00 41,984 ----a-w C:\WINDOWS\msagent\agentdp2.dll
+ 2006-10-12 14:04:13 42,496 ----a-w C:\WINDOWS\msagent\agentdp2.dll
- 2004-08-05 13:00:00 256,512 ----a-w C:\WINDOWS\msagent\agentsvr.exe
+ 2006-10-12 11:09:53 256,512 ----a-w C:\WINDOWS\msagent\agentsvr.exe
- 2005-03-10 08:04:12 152,064 ----a-w C:\WINDOWS\system32\cdfview.dll
+ 2008-02-16 09:02:34 152,064 ----a-w C:\WINDOWS\system32\cdfview.dll
- 2004-08-05 13:00:00 66,560 ----a-w C:\WINDOWS\system32\cdm.dll
+ 2007-07-30 17:19:20 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
- 2004-08-05 13:00:00 2,067,968 ----a-w C:\WINDOWS\system32\cdosys.dll
+ 2005-09-10 01:55:14 2,067,968 ----a-w C:\WINDOWS\system32\cdosys.dll
- 2004-08-05 13:00:00 69,120 ----a-w C:\WINDOWS\system32\ciodm.dll
+ 2006-06-22 05:13:45 69,120 ----a-w C:\WINDOWS\system32\ciodm.dll
- 2004-08-05 13:00:00 110,080 ----a-w C:\WINDOWS\system32\clbcatex.dll
+ 2005-07-26 04:39:55 110,080 ----a-w C:\WINDOWS\system32\clbcatex.dll
- 2004-08-05 13:00:00 195,584 ----a-w C:\WINDOWS\system32\Com\comadmin.dll
+ 2005-07-26 04:39:56 195,072 ----a-w C:\WINDOWS\system32\Com\comadmin.dll
- 2004-08-05 13:00:00 611,328 ----a-w C:\WINDOWS\system32\comctl32.dll
+ 2006-08-25 15:51:14 617,472 ----a-w C:\WINDOWS\system32\comctl32.dll
- 2004-08-05 13:00:00 82,432 ----a-w C:\WINDOWS\system32\comrepl.dll
+ 2005-07-26 04:39:56 97,792 ----a-w C:\WINDOWS\system32\comrepl.dll
- 2004-08-05 13:00:00 540,160 ----a-w C:\WINDOWS\system32\comuid.dll
+ 2005-07-26 04:39:57 540,160 ----a-w C:\WINDOWS\system32\comuid.dll
- 2004-08-05 13:00:00 1,056,256 ----a-w C:\WINDOWS\system32\danim.dll
+ 2008-02-16 09:02:34 1,056,768 ----a-w C:\WINDOWS\system32\danim.dll
- 2004-08-05 13:00:00 111,616 ----a-w C:\WINDOWS\system32\dhcpcsvc.dll
+ 2006-05-19 13:23:35 112,128 ----a-w C:\WINDOWS\system32\dhcpcsvc.dll
+ 2006-08-16 11:59:27 100,352 ------w C:\WINDOWS\system32\dllcache\6to4svc.dll
- 2004-08-03 21:39:38 142,464 ----a-w C:\WINDOWS\system32\dllcache\aec.sys
+ 2006-02-15 00:22:26 142,464 ----a-w C:\WINDOWS\system32\dllcache\aec.sys
+ 2006-10-12 14:04:13 42,496 ------w C:\WINDOWS\system32\dllcache\agentdp2.dll
+ 2006-10-12 14:04:13 57,344 ------w C:\WINDOWS\system32\dllcache\agentdpv.dll
+ 2006-10-12 11:09:53 256,512 ------w C:\WINDOWS\system32\dllcache\agentsvr.exe
+ 2008-02-16 09:02:34 1,024,000 ------w C:\WINDOWS\system32\dllcache\browseui.dll
+ 2008-02-16 09:02:34 152,064 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
+ 2007-07-30 17:19:20 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
+ 2006-06-22 05:13:45 69,120 ------w C:\WINDOWS\system32\dllcache\ciodm.dll
+ 2006-08-25 15:51:14 617,472 ------w C:\WINDOWS\system32\dllcache\comctl32.dll
+ 2008-02-16 09:02:34 1,056,768 ------w C:\WINDOWS\system32\dllcache\danim.dll
+ 2008-03-25 04:50:25 554,008 ------w C:\WINDOWS\system32\dllcache\dao360.dll
+ 2006-05-19 13:23:35 112,128 ------w C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
+ 2007-05-16 15:13:53 86,528 ------w C:\WINDOWS\system32\dllcache\directdb.dll
+ 2008-02-20 05:35:05 148,992 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2008-02-20 05:35:05 45,568 ------w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
+ 2006-08-24 11:17:20 500,278 ------w C:\WINDOWS\system32\dllcache\dxmasf.dll
+ 2008-02-16 09:02:34 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-02-16 09:02:35 205,312 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2007-06-13 13:22:28 1,037,312 ------w C:\WINDOWS\system32\dllcache\explorer.exe
+ 2008-02-16 09:02:35 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2006-08-21 12:26:15 16,896 ------w C:\WINDOWS\system32\dllcache\fltlib.dll
+ 2006-08-21 09:14:58 23,040 ------w C:\WINDOWS\system32\dllcache\fltmc.exe
+ 2006-08-21 09:14:58 128,896 ------w C:\WINDOWS\system32\dllcache\fltmgr.sys
+ 2008-02-20 06:51:00 282,624 ------w C:\WINDOWS\system32\dllcache\gdi32.dll
+ 2006-07-21 08:27:28 72,704 ------w C:\WINDOWS\system32\dllcache\hlink.dll
+ 2008-02-15 09:23:37 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe
+ 2008-02-16 09:02:35 251,392 ------w C:\WINDOWS\system32\dllcache\iepeers.dll
+ 2007-08-21 06:17:23 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll
+ 2008-02-16 09:02:35 96,768 ------w C:\WINDOWS\system32\dllcache\inseng.dll
+ 2006-05-19 13:23:35 95,744 ------w C:\WINDOWS\system32\dllcache\iphlpapi.dll
+ 2006-06-01 18:48:44 163,840 ------w C:\WINDOWS\system32\dllcache\jgdw400.dll
+ 2006-06-01 18:48:44 27,648 ------w C:\WINDOWS\system32\dllcache\jgpl400.dll
+ 2007-12-18 14:41:58 450,560 ------w C:\WINDOWS\system32\dllcache\jscript.dll
+ 2008-02-16 09:02:35 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2007-04-16 15:53:11 1,049,600 ------w C:\WINDOWS\system32\dllcache\kernel32.dll
- 2004-08-03 22:07:50 171,776 ----a-w C:\WINDOWS\system32\dllcache\kmixer.sys
+ 2006-06-14 08:47:45 172,416 ----a-w C:\WINDOWS\system32\dllcache\kmixer.sys
+ 2007-11-07 09:28:31 728,576 ------w C:\WINDOWS\system32\dllcache\lsasrv.dll
+ 2007-03-08 15:37:50 40,960 ------w C:\WINDOWS\system32\dllcache\mf3216.dll
+ 2006-11-01 19:18:42 927,504 ------w C:\WINDOWS\system32\dllcache\mfc40u.dll
+ 2006-10-14 08:13:25 981,760 ------w C:\WINDOWS\system32\dllcache\mfc42u.dll
+ 2007-12-18 09:51:35 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys
+ 2006-05-05 09:41:45 453,120 ------w C:\WINDOWS\system32\dllcache\mrxsmb.sys
+ 2006-12-26 13:09:12 536,576 ------w C:\WINDOWS\system32\dllcache\msado15.dll
+ 2006-12-26 13:09:12 180,224 ------w C:\WINDOWS\system32\dllcache\msadomd.dll
+ 2006-12-26 13:09:12 200,704 ------w C:\WINDOWS\system32\dllcache\msadox.dll
+ 2008-03-25 04:50:28 518,944 ------w C:\WINDOWS\system32\dllcache\msexch40.dll
+ 2008-03-25 04:50:30 326,432 ------w C:\WINDOWS\system32\dllcache\msexcl40.dll
+ 2006-11-27 14:55:30 539,136 ------w C:\WINDOWS\system32\dllcache\msftedit.dll
+ 2008-02-16 22:32:38 3,080,704 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-02-16 09:02:36 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-03-25 04:50:34 1,516,568 ------w C:\WINDOWS\system32\dllcache\msjet40.dll
+ 2008-03-25 04:50:40 355,112 ------w C:\WINDOWS\system32\dllcache\msjetol1.dll
+ 2006-12-26 13:09:12 102,400 ------w C:\WINDOWS\system32\dllcache\msjro.dll
+ 2008-03-25 04:50:42 60,192 ------w C:\WINDOWS\system32\dllcache\msjter40.dll
+ 2008-03-25 04:50:42 248,608 ------w C:\WINDOWS\system32\dllcache\msjtes40.dll
+ 2008-03-25 04:50:44 219,936 ------w C:\WINDOWS\system32\dllcache\msltus40.dll
+ 2007-05-16 15:13:54 1,314,816 ------w C:\WINDOWS\system32\dllcache\msoe.dll
+ 2008-03-25 04:50:45 355,104 ------w C:\WINDOWS\system32\dllcache\mspbde40.dll
+ 2008-02-16 09:02:37 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-03-25 04:50:47 432,928 ------w C:\WINDOWS\system32\dllcache\msrd2x40.dll
+ 2008-03-25 04:50:49 322,336 ------w C:\WINDOWS\system32\dllcache\msrd3x40.dll
+ 2008-03-25 04:50:52 559,904 ------w C:\WINDOWS\system32\dllcache\msrepl40.dll
+ 2008-03-25 04:50:55 264,992 ------w C:\WINDOWS\system32\dllcache\mstext40.dll
+ 2008-02-16 09:02:37 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-03-25 04:50:57 838,432 ------w C:\WINDOWS\system32\dllcache\mswdat10.dll
+ 2008-03-25 04:50:58 355,104 ------w C:\WINDOWS\system32\dllcache\msxbde40.dll
+ 2007-06-26 06:09:14 1,104,896 ------w C:\WINDOWS\system32\dllcache\msxml3.dll
+ 2006-08-17 12:29:49 332,288 ------w C:\WINDOWS\system32\dllcache\netapi32.dll
+ 2007-02-09 11:10:35 574,464 ------w C:\WINDOWS\system32\dllcache\ntfs.sys
+ 2007-02-28 16:02:21 2,138,112 ------w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
+ 2007-02-28 16:02:36 2,059,648 ------w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
+ 2007-02-28 16:02:21 2,017,792 ------w C:\WINDOWS\system32\dllcache\ntkrpamp.exe
+ 2007-02-28 16:02:36 2,182,400 ------w C:\WINDOWS\system32\dllcache\ntoskrnl.exe
+ 2006-10-13 12:36:55 145,920 ------w C:\WINDOWS\system32\dllcache\nwprovau.dll
+ 2007-12-04 18:41:36 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll
+ 2006-10-16 16:16:00 124,928 ------w C:\WINDOWS\system32\dllcache\oledlg.dll
+ 2008-02-16 09:02:37 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2007-10-29 22:43:32 1,293,824 ------w C:\WINDOWS\system32\dllcache\quartz.dll
+ 2006-06-22 05:13:46 1,440,768 ------w C:\WINDOWS\system32\dllcache\query.dll
+ 2006-06-26 17:41:32 8,192 ------w C:\WINDOWS\system32\dllcache\rasadhlp.dll
+ 2006-06-22 10:48:06 181,248 ------w C:\WINDOWS\system32\dllcache\rasmans.dll
+ 2006-05-05 09:47:57 174,592 ------w C:\WINDOWS\system32\dllcache\rdbss.sys
+ 2006-11-27 14:55:31 433,152 ------w C:\WINDOWS\system32\dllcache\riched20.dll
+ 2006-07-13 08:48:58 202,240 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
+ 2007-04-25 14:22:35 144,896 ------w C:\WINDOWS\system32\dllcache\schannel.dll
+ 2008-02-16 09:02:38 1,495,040 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
+ 2007-10-25 16:56:24 8,510,976 ------w C:\WINDOWS\system32\dllcache\shell32.dll
+ 2008-02-16 09:02:38 474,624 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll
+ 2006-12-19 21:49:47 135,168 ------w C:\WINDOWS\system32\dllcache\shsvcs.dll
- 2004-08-03 22:07:48 6,400 ----a-w C:\WINDOWS\system32\dllcache\splitter.sys
+ 2006-06-14 08:47:46 6,400 ----a-w C:\WINDOWS\system32\dllcache\splitter.sys
+ 2006-08-14 10:34:41 332,928 ------w C:\WINDOWS\system32\dllcache\srv.sys
+ 2006-08-24 11:19:40 246,814 ------w C:\WINDOWS\system32\dllcache\strmdll.dll
+ 2006-10-20 01:38:44 716,800 ------w C:\WINDOWS\system32\dllcache\sxs.dll
+ 2007-10-30 17:20:55 360,064 ------w C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2006-08-16 09:37:30 225,664 ------w C:\WINDOWS\system32\dllcache\tcpip6.sys
+ 2007-04-23 10:32:54 364,160 ------w C:\WINDOWS\system32\dllcache\update.sys
+ 2007-02-05 20:19:06 185,344 ------w C:\WINDOWS\system32\dllcache\upnphost.dll
+ 2008-02-16 09:02:39 617,984 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2007-03-08 15:37:50 578,560 ------w C:\WINDOWS\system32\dllcache\user32.dll
+ 2007-12-18 14:41:59 417,792 ------w C:\WINDOWS\system32\dllcache\vbscript.dll
+ 2007-06-26 13:56:54 851,968 ------w C:\WINDOWS\system32\dllcache\vgx.dll
+ 2007-05-16 15:13:55 510,976 ------w C:\WINDOWS\system32\dllcache\wab32.dll
+ 2007-05-16 15:13:55 85,504 ------w C:\WINDOWS\system32\dllcache\wabimp.dll
- 2004-08-03 22:15:06 82,944 ----a-w C:\WINDOWS\system32\dllcache\wdmaud.sys
+ 2006-06-14 09:00:45 82,944 ----a-w C:\WINDOWS\system32\dllcache\wdmaud.sys
+ 2006-12-19 18:17:50 334,336 ------w C:\WINDOWS\system32\dllcache\wiaservc.dll
+ 2008-02-16 09:02:39 663,552 ------w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2007-03-17 13:44:47 293,376 ------w C:\WINDOWS\system32\dllcache\winsrv.dll
+ 2006-08-17 12:29:49 132,096 ------w C:\WINDOWS\system32\dllcache\wkssvc.dll
- 2004-08-10 23:41:00 229,376 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
+ 2007-10-20 04:01:32 227,328 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
- 2004-08-10 23:41:20 5,550,080 ----a-w C:\WINDOWS\system32\dllcache\wmp.dll
+ 2007-04-30 06:20:24 5,537,792 ----a-w C:\WINDOWS\system32\dllcache\wmp.dll
- 2004-08-11 00:39:08 2,362,104 ----a-w C:\WINDOWS\system32\dllcache\wmvcore.dll
+ 2006-12-07 06:40:49 2,362,184 ----a-w C:\WINDOWS\system32\dllcache\wmvcore.dll
+ 2007-07-30 17:19:36 549,720 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
+ 2007-07-30 17:19:16 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
+ 2007-07-30 17:19:42 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
+ 2007-07-30 17:19:32 325,976 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
+ 2007-07-30 17:18:40 33,624 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
+ 2007-07-30 17:19:28 203,096 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
- 2004-08-03 21:39:38 142,464 ----a-w C:\WINDOWS\system32\drivers\aec.sys
+ 2006-02-15 00:22:26 142,464 ----a-w C:\WINDOWS\system32\drivers\aec.sys
- 2004-08-05 13:00:00 124,800 ----a-w C:\WINDOWS\system32\drivers\fltMgr.sys
+ 2006-08-21 09:14:58 128,896 ----a-w C:\WINDOWS\system32\drivers\fltmgr.sys
- 2004-08-05 13:00:00 263,040 ----a-w C:\WINDOWS\system32\drivers\http.sys
+ 2006-03-17 00:33:10 262,784 ----a-w C:\WINDOWS\system32\drivers\http.sys
- 2004-08-03 22:07:50 171,776 ----a-w C:\WINDOWS\system32\drivers\kmixer.sys
+ 2006-06-14 08:47:45 172,416 ----a-w C:\WINDOWS\system32\drivers\kmixer.sys
- 2004-08-05 13:00:00 181,248 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
+ 2007-12-18 09:51:35 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
- 2005-01-19 04:26:52 451,584 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
+ 2006-05-05 09:41:45 453,120 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
- 2004-08-05 13:00:00 574,592 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys
+ 2007-02-09 11:10:35 574,464 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys
- 2004-10-28 01:13:58 174,592 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
+ 2006-05-05 09:47:57 174,592 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
- 2004-08-05 13:00:00 139,400 ----a-w C:\WINDOWS\system32\drivers\rdpwd.sys
+ 2005-06-10 04:11:22 139,528 ----a-w C:\WINDOWS\system32\drivers\rdpwd.sys
- 2004-08-05 13:00:00 200,064 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys
+ 2006-07-13 08:48:58 202,240 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
- 2004-08-05 13:00:00 27,440 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
+ 2007-11-13 10:25:54 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
- 2004-08-03 22:07:48 6,400 ----a-w C:\WINDOWS\system32\drivers\splitter.sys
+ 2006-06-14 08:47:46 6,400 ----a-w C:\WINDOWS\system32\drivers\splitter.sys
- 2004-08-05 13:00:00 336,256 ----a-w C:\WINDOWS\system32\drivers\srv.sys
+ 2006-08-14 10:34:41 332,928 ----a-w C:\WINDOWS\system32\drivers\srv.sys
- 2005-03-14 00:55:08 359,808 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
+ 2007-10-30 17:20:55 360,064 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
- 2004-08-05 13:00:00 223,616 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
+ 2006-08-16 09:37:30 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
- 2004-08-05 13:00:00 209,408 ----a-w C:\WINDOWS\system32\drivers\update.sys
+ 2007-04-23 10:32:54 364,160 ----a-w C:\WINDOWS\system32\drivers\update.sys
- 2004-08-03 22:15:06 82,944 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys
+ 2006-06-14 09:00:45 82,944 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys
- 2004-08-05 13:00:00 499,741 ----a-w C:\WINDOWS\system32\dxmasf.dll
+ 2006-08-24 11:17:20 500,278 ----a-w C:\WINDOWS\system32\dxmasf.dll
- 2004-08-05 13:00:00 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-02-16 09:02:34 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2004-08-05 13:00:00 201,728 ----a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-02-16 09:02:35 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2004-08-05 13:00:00 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll
+ 2008-02-16 09:02:35 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll
- 2004-08-05 13:00:00 79,360 ----a-w C:\WINDOWS\system32\fontsub.dll
+ 2005-10-17 21:21:08 80,896 ----a-w C:\WINDOWS\system32\fontsub.dll
- 2004-08-05 13:00:00 38,912 ----a-w C:\WINDOWS\system32\hhsetup.dll
+ 2005-05-27 02:08:06 41,472 ----a-w C:\WINDOWS\system32\hhsetup.dll
- 2004-11-16 21:17:58 68,608 ----a-w C:\WINDOWS\system32\hlink.dll
+ 2006-07-21 08:27:28 72,704 ----a-w C:\WINDOWS\system32\hlink.dll
- 2004-08-05 13:00:00 253,952 ----a-w C:\WINDOWS\system32\icm32.dll
+ 2005-06-29 01:49:41 254,976 ----a-w C:\WINDOWS\system32\icm32.dll
- 2005-03-10 08:04:12 250,880 ----a-w C:\WINDOWS\system32\iepeers.dll
+ 2008-02-16 09:02:35 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll
- 2005-03-10 08:04:12 96,768 ----a-w C:\WINDOWS\system32\inseng.dll
+ 2008-02-16 09:02:35 96,768 ----a-w C:\WINDOWS\system32\inseng.dll
- 2004-08-05 13:00:00 143,872 ----a-w C:\WINDOWS\system32\itircl.dll
+ 2005-05-27 02:08:06 155,136 ----a-w C:\WINDOWS\system32\itircl.dll
- 2004-08-05 13:00:00 134,144 ----a-w C:\WINDOWS\system32\itss.dll
+ 2005-05-27 02:08:06 137,216 ----a-w C:\WINDOWS\system32\itss.dll
- 2005-05-31 11:13:42 167,936 ----a-w C:\WINDOWS\system32\jgdw400.dll
+ 2006-06-01 18:48:44 163,840 ----a-w C:\WINDOWS\system32\jgdw400.dll
- 2005-05-31 11:13:44 42,496 ----a-w C:\WINDOWS\system32\jgpl400.dll
+ 2006-06-01 18:48:44 27,648 ----a-w C:\WINDOWS\system32\jgpl400.dll
- 2004-08-05 13:00:00 1,048,576 ----a-w C:\WINDOWS\system32\kernel32.dll
+ 2007-04-16 15:53:11 1,049,600 ----a-w C:\WINDOWS\system32\kernel32.dll
- 2004-10-28 01:24:00 728,576 ----a-w C:\WINDOWS\system32\lsasrv.dll
+ 2007-11-07 09:28:31 728,576 ----a-w C:\WINDOWS\system32\lsasrv.dll
- 2004-08-05 13:00:00 39,936 ----a-w C:\WINDOWS\system32\mf3216.dll
+ 2007-03-08 15:37:50 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
- 2004-08-05 13:00:00 924,432 ----a-w C:\WINDOWS\system32\mfc40u.dll
+ 2006-11-01 19:18:42 927,504 ----a-w C:\WINDOWS\system32\mfc40u.dll
- 2004-08-05 13:00:00 1,024,000 ----a-w C:\WINDOWS\system32\mfc42u.dll
+ 2006-10-14 08:13:25 981,760 ----a-w C:\WINDOWS\system32\mfc42u.dll
- 2005-09-23 05:28:52 270,848 ----a-w C:\WINDOWS\system32\mscoree.dll
+ 2006-12-22 10:28:14 271,360 ----a-w C:\WINDOWS\system32\mscoree.dll
- 2004-08-05 13:00:00 425,472 ----a-w C:\WINDOWS\system32\msdtcprx.dll
+ 2006-03-01 19:43:50 426,496 ----a-w C:\WINDOWS\system32\msdtcprx.dll
- 2004-08-05 13:00:00 949,248 ----a-w C:\WINDOWS\system32\msdtctm.dll
+ 2006-03-01 19:43:50 956,416 ----a-w C:\WINDOWS\system32\msdtctm.dll
- 2004-08-05 13:00:00 161,280 ----a-w C:\WINDOWS\system32\msdtcuiu.dll
+ 2006-03-01 19:43:51 161,280 ----a-w C:\WINDOWS\system32\msdtcuiu.dll
- 2004-08-05 13:00:00 512,029 ----a-w C:\WINDOWS\system32\msexch40.dll
+ 2008-03-25 04:50:28 518,944 ----a-w C:\WINDOWS\system32\msexch40.dll
- 2004-08-05 13:00:00 319,517 ----a-w C:\WINDOWS\system32\msexcl40.dll
+ 2008-03-25 04:50:30 326,432 ----a-w C:\WINDOWS\system32\msexcl40.dll
- 2004-08-05 13:00:00 537,088 ----a-w C:\WINDOWS\system32\msftedit.dll
+ 2006-11-27 14:55:30 539,136 ----a-w C:\WINDOWS\system32\msftedit.dll
- 2004-08-05 13:00:00 448,512 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-02-16 09:02:36 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2004-08-05 13:00:00 1,507,356 ----a-w C:\WINDOWS\system32\msjet40.dll
+ 2008-03-25 04:50:34 1,516,568 ----a-w C:\WINDOWS\system32\msjet40.dll
- 2004-08-05 13:00:00 358,976 ----a-w C:\WINDOWS\system32\msjetoledb40.dll
+ 2008-03-25 04:50:40 355,112 ----a-w C:\WINDOWS\system32\msjetoledb40.dll
- 2004-08-05 13:00:00 53,279 ----a-w C:\WINDOWS\system32\msjter40.dll
+ 2008-03-25 04:50:42 60,192 ----a-w C:\WINDOWS\system32\msjter40.dll
- 2004-08-05 13:00:00 241,693 ----a-w C:\WINDOWS\system32\msjtes40.dll
+ 2008-03-25 04:50:42 248,608 ----a-w C:\WINDOWS\system32\msjtes40.dll
- 2004-08-05 13:00:00 213,023 ----a-w C:\WINDOWS\system32\msltus40.dll
+ 2008-03-25 04:50:44 219,936 ----a-w C:\WINDOWS\system32\msltus40.dll
- 2004-08-05 13:00:00 348,189 ----a-w C:\WINDOWS\system32\mspbde40.dll
+ 2008-03-25 04:50:45 355,104 ----a-w C:\WINDOWS\system32\mspbde40.dll
- 2005-03-10 08:04:12 146,432 ----a-w C:\WINDOWS\system32\msrating.dll
+ 2008-02-16 09:02:37 146,432 ----a-w C:\WINDOWS\system32\msrating.dll
- 2004-08-05 13:00:00 421,919 ----a-w C:\WINDOWS\system32\msrd2x40.dll
+ 2008-03-25 04:50:47 432,928 ----a-w C:\WINDOWS\system32\msrd2x40.dll
- 2004-08-05 13:00:00 315,423 ----a-w C:\WINDOWS\system32\msrd3x40.dll
+ 2008-03-25 04:50:49 322,336 ----a-w C:\WINDOWS\system32\msrd3x40.dll
- 2004-08-05 13:00:00 552,989 ----a-w C:\WINDOWS\system32\msrepl40.dll
+ 2008-03-25 04:50:52 559,904 ----a-w C:\WINDOWS\system32\msrepl40.dll
- 2004-08-05 13:00:00 258,077 ----a-w C:\WINDOWS\system32\mstext40.dll
+ 2008-03-25 04:50:55 264,992 ----a-w C:\WINDOWS\system32\mstext40.dll
- 2004-08-05 13:00:00 530,432 ----a-w C:\WINDOWS\system32\mstime.dll
+ 2008-02-16 09:02:37 532,480 ----a-w C:\WINDOWS\system32\mstime.dll
- 2004-08-05 13:00:00 831,519 ----a-w C:\WINDOWS\system32\mswdat10.dll
+ 2008-03-25 04:50:57 838,432 ----a-w C:\WINDOWS\system32\mswdat10.dll
- 2004-08-05 13:00:00 348,189 ----a-w C:\WINDOWS\system32\msxbde40.dll
+ 2008-03-25 04:50:58 355,104 ----a-w C:\WINDOWS\system32\msxbde40.dll
- 2005-05-11 12:49:18 1,233,920 ----a-w C:\WINDOWS\system32\msxml4.dll
+ 2007-05-08 13:03:04 1,275,392 ----a-w C:\WINDOWS\system32\msxml4.dll
- 2004-08-05 13:00:00 90,112 ----a-w C:\WINDOWS\system32\mtxoci.dll
+ 2006-03-01 19:43:51 91,136 ----a-w C:\WINDOWS\system32\mtxoci.dll
- 2005-09-23 05:29:00 6,144 ----a-w C:\WINDOWS\system32\mui\[u]0/u409\mscorees.dll
+ 2006-12-22 11:02:36 6,144 ----a-w C:\WINDOWS\system32\mui\[u]0/u409\mscorees.dll
- 2005-03-02 18:08:02 2,017,280 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
+ 2007-02-28 16:02:21 2,017,792 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
- 2005-03-02 18:07:56 2,137,600 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
+ 2007-02-28 16:02:21 2,138,112 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
- 2004-08-05 13:00:00 147,968 ----a-w C:\WINDOWS\system32\nwprovau.dll
+ 2006-10-13 12:36:55 145,920 ----a-w C:\WINDOWS\system32\nwprovau.dll
- 2004-08-05 13:00:00 553,472 ----a-w C:\WINDOWS\system32\oleaut32.dll
+ 2007-12-04 18:41:36 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
- 2005-01-14 08:56:44 37,888 ----a-w C:\WINDOWS\system32\olecnv32.dll
+ 2005-07-26 04:40:00 37,888 ----a-w C:\WINDOWS\system32\olecnv32.dll
- 2004-08-05 13:00:00 119,808 ----a-w C:\WINDOWS\system32\oledlg.dll
+ 2006-10-16 16:16:00 124,928 ----a-w C:\WINDOWS\system32\oledlg.dll
- 2004-08-05 13:00:00 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-02-16 09:02:37 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2004-08-05 13:00:00 1,440,768 ----a-w C:\WINDOWS\system32\query.dll
+ 2006-06-22 05:13:46 1,440,768 ----a-w C:\WINDOWS\system32\query.dll
- 2004-08-05 13:00:00 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
+ 2007-04-25 14:22:35 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
+ 2007-07-30 17:18:40 33,624 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.381\wups.dll
- 2005-05-04 12:45:28 14,560 ------w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 11:19:06 18,296 ------w C:\WINDOWS\system32\spmsg.dll
- 2004-11-18 09:42:52 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
+ 2005-06-28 08:21:46 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
- 2004-08-05 13:00:00 246,302 ----a-w C:\WINDOWS\system32\strmdll.dll
+ 2006-08-24 11:19:40 246,814 ----a-w C:\WINDOWS\system32\strmdll.dll
- 2004-08-05 13:00:00 210,432 ----a-w C:\WINDOWS\system32\t2embed.dll
+ 2005-10-17 21:21:08 118,272 ----a-w C:\WINDOWS\system32\t2embed.dll
- 2004-08-05 13:00:00 77,824 ----a-w C:\WINDOWS\system32\telnet.exe
+ 2005-05-11 02:30:03 78,336 ----a-w C:\WINDOWS\system32\telnet.exe
- 2004-08-05 13:00:00 101,376 ----a-w C:\WINDOWS\system32\txflog.dll
+ 2005-07-26 04:40:00 101,376 ----a-w C:\WINDOWS\system32\txflog.dll
+ 2008-03-27 09:24:20 60,416 ------w C:\WINDOWS\system32\tzchange.exe
- 2004-08-05 13:00:00 185,344 ----a-w C:\WINDOWS\system32\upnphost.dll
+ 2007-02-05 20:19:06 185,344 ----a-w C:\WINDOWS\system32\upnphost.dll
+ 2006-03-17 00:38:01 28,672 ------w C:\WINDOWS\system32\verclsid.exe
- 2004-08-05 13:00:00 132,096 ----a-w C:\WINDOWS\system32\wkssvc.dll
+ 2006-08-17 12:29:49 132,096 ----a-w C:\WINDOWS\system32\wkssvc.dll
- 2004-08-05 13:00:00 432,640 ----a-w C:\WINDOWS\system32\wuapi.dll
+ 2007-07-30 17:19:36 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
- 2004-08-05 13:00:00 112,640 ----a-w C:\WINDOWS\system32\wuauclt.exe
+ 2007-07-30 17:19:16 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
- 2004-08-05 13:00:00 1,134,592 ----a-w C:\WINDOWS\system32\wuaueng.dll
+ 2007-07-30 17:19:42 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
- 2004-08-05 13:00:00 114,176 ----a-w C:\WINDOWS\system32\wucltui.dll
+ 2007-07-30 17:19:32 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
- 2004-08-05 13:00:00 36,864 ----a-w C:\WINDOWS\system32\wups.dll
+ 2007-07-30 17:18:40 33,624 ----a-w C:\WINDOWS\system32\wups.dll
+ 2007-07-30 17:19:12 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
- 2004-08-05 13:00:00 120,320 ----a-w C:\WINDOWS\system32\wuweb.dll
+ 2007-07-30 17:19:28 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
- 2004-08-05 13:00:00 11,776 ----a-w C:\WINDOWS\system32\xolehlp.dll
+ 2006-03-01 19:43:51 11,776 ----a-w C:\WINDOWS\system32\xolehlp.dll
+ 2006-10-16 10:40:51 121,856 ------w C:\WINDOWS\system32\xpsp3res.dll
+ 2008-06-05 16:16:28 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_708.dat
+ 2007-05-08 13:06:44 1,275,392 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9a\msxml4.dll
+ 2007-01-19 12:51:03 74,802 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\atl.dll
+ 2007-01-19 12:51:04 995,383 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\mfc42.dll
+ 2007-01-19 12:51:04 1,011,774 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\mfc42u.dll
+ 2007-01-19 12:51:04 401,462 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\msvcp60.dll
+ 2006-08-25 15:51:12 1,054,208 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:55 5674352]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]
"Skype"="C:\APPS\skype\Phone\Skype.exe" [2008-02-01 17:26 21974824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPP Auto Loader"="C:\WINDOWS\tppaldr.exe" [2003-08-20 12:03 118784]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-11-10 14:38 180269]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 14:25 14720000 C:\WINDOWS\RTHDCPL.EXE]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 15:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 15:00 455168]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 15:00 208952]
"ATIPTA"="C:\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05 344064]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 11:31 24576]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-12-13 20:27 919016]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 01:03 284184]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2006-11-15 21:58 746520]
"LVCOMSX"="C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe" [2006-11-15 22:01 244512]

D:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2006-01-08 12:14:45 450560]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.ulmp3acm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\ulmp3acm.acm
"msacm.mpegacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\mpegacm.acm
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\APPS\\Inventime\\my.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\APPS\\skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-05-27 13:51]
S1 SLEE_13_DRIVER;Steganos Live Encryption Engine 13 [Driver];C:\WINDOWS\system32\drivers\SLEE13.sys []
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 03:13]
S3 TPPFX;USB Storage Adapter FX (TPP);C:\WINDOWS\system32\DRIVERS\TPPFX.SYS [2002-04-07 18:00]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
S3 ZD1211U(Wireless);IEEE 802.11g USB Adapter Driver(Wireless);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2004-07-14 14:53]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{865dfe78-ac98-11db-9880-001485574699}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a018d383-f513-11dc-ab3f-001485574699}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-06-05 17:00:00 C:\WINDOWS\Tasks\Configurer mon PC.job"
- C:\Apps\SMP\PCSETUP.EXE
"2006-01-07 17:09:44 C:\WINDOWS\Tasks\Rappel d'enregistrement 3.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-05 19:19:37
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MysqlInventime]
"ImagePath"="C:\Apps\INVENT~1\mysql\bin\mysqld-nt --defaults-file=C:\Apps\Inventime\mysql\my.ini MysqlInventime"
.
Temps d'accomplissement: 2008-06-05 19:20:57
ComboFix-quarantined-files.txt 2008-06-05 17:20:51
ComboFix2.txt 2008-06-03 22:12:58

Pre-Run: 14,729,359,360 octets libres
Post-Run: 14,545,825,792 octets libres

615 --- E O F --- 2008-06-05 17:20:02

voici l'analyse




BitDefender Online Scanner







Rapport d'analyse généré à: Thu, Jun 05, 2008 - 20:36:16









Voie d'analyse: C:\;D:\;E:\;















Statistiques

Temps


00:32:58

Fichiers


171333

Directoires


12160

Secteurs de boot


4

Archives


780

Paquets programmes


27782







Résultats

Virus identifiés


2

Fichiers infectés


2

Fichiers suspects


0

Avertissements


0

Désinfectés


0

Fichiers effacés


2







Info sur les moteurs

Définition virus


1256382

Version des moteurs


AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Analyse des plugins


16

Archive des plugins


42

Unpack des plugins


7

E-mail plugins


6

Système plugins


5







Paramètres d'analyse

Première action


Désinfecté

Seconde Action


Supprimé

Heuristique


Oui

Acceptez les avertissements


Oui

Extensions analysées


exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions




Analyse d'emails


Oui

Analyse des Archives


Oui

Analyser paquets programmes


Oui

Analyse des fichiers


Oui

Analyse de boot


Oui








Fichier analysé


Statut

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP227\A0122229.dll


Détecté avec: Adware.Fotomoto.Gen

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP227\A0122229.dll


Echec de la désinfection

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP227\A0122229.dll


Supprimé

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP229\A0122499.dll


Détecté avec: Adware.Rotator.D

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP229\A0122499.dll


Supprimé

voilà, tout est fait!!!
donc tu me dis que c'est clean maintenant? merci bien pour tout le travail et le temps passé!!!
par contre je voudrais savoir plusieurs choses:

1- la seule manière dont j'ai eu connaissance de l'infection est par l'affichage intempestif de fenêtre publicitaire, voire aussi parce que le système mettait de plus en plus de temps à démarrer. est ce normal malgré les antivirus installés: avaast , spyboot , et zone alarm ???
si je n'avais pas voulu me débarrasser des ces fenêtres que je croyais simplement envoyées par une société, en fait je ne me serai aperçu de rien!!!!!

2- quel est le meilleur moyen de prévenir tout cela?
car en fait c'est un sacré cirque, et tu en sais quelque chose pour tout nettoyer.

une fois de plus merci et à bientôt

ok merci je vais tacher d'être plus prudent...même si je télécharges vraiment très rarement!!!
merci pour le coup de main et bonne continuation également