Cheval de troie? ecran bleu lenteur HELP
kalia1608
Messages postés
23
Date d'inscription
Statut
Membre
Dernière intervention
-
anthony5151 Messages postés 10573 Date d'inscription Statut Contributeur sécurité Dernière intervention -
anthony5151 Messages postés 10573 Date d'inscription Statut Contributeur sécurité Dernière intervention -
Bonjour,
Il y a quelques jours mon écran de pc portable (acer aspire 3690) affichait et affiche toujours un fond bleu avec écrit en bleu :
"Warning: threat hes been detected on your pc","Your computer has several fatal errors due to spyware activity" quelque chose dans ce genre ... J'ai appeler mon frere en renfort et j'ai passer mon ordi avec AVG ou EWIDO qui dure environ 15h ou 18h ces derniers temps et encore AVAST mon antivirus de base qui détecté des cheval de troie donc je les ai supprimer mais mon ordi est, ou devient plus lent chaque jour, un icone en bas à droite me dit toujours que mon pc est toujours infecté (soit toutes les 3 secondes) et aussi que j'ai une attack venant d'internet mais j'ai désactiver mon wifi ...
Depuis je sais plus trop quoi faire etant donne que je suis pas un pro de l'ordi ... je vais essayer de coller un rapport hijackthis mais vu la longueur du pc rien que pour detecter ma clé ca va me prendre des heures ...
Merci de m'aider.
Il y a quelques jours mon écran de pc portable (acer aspire 3690) affichait et affiche toujours un fond bleu avec écrit en bleu :
"Warning: threat hes been detected on your pc","Your computer has several fatal errors due to spyware activity" quelque chose dans ce genre ... J'ai appeler mon frere en renfort et j'ai passer mon ordi avec AVG ou EWIDO qui dure environ 15h ou 18h ces derniers temps et encore AVAST mon antivirus de base qui détecté des cheval de troie donc je les ai supprimer mais mon ordi est, ou devient plus lent chaque jour, un icone en bas à droite me dit toujours que mon pc est toujours infecté (soit toutes les 3 secondes) et aussi que j'ai une attack venant d'internet mais j'ai désactiver mon wifi ...
Depuis je sais plus trop quoi faire etant donne que je suis pas un pro de l'ordi ... je vais essayer de coller un rapport hijackthis mais vu la longueur du pc rien que pour detecter ma clé ca va me prendre des heures ...
Merci de m'aider.
A voir également:
- Cheval de troie? ecran bleu lenteur HELP
- Supprimer rond bleu whatsapp - Guide
- Lenteur pc - Guide
- Double ecran - Guide
- Écran bleu - Guide
- Capture d'écran whatsapp - Accueil - Messagerie instantanée
40 réponses
Est-ce que tu es bien sur une session administrateur (pas une session limitée) ?
Essaye de redémarrer ton ordinateur, de désactiver ton antivirus et de réessayer ensuite.
Essaye de redémarrer ton ordinateur, de désactiver ton antivirus et de réessayer ensuite.
Eh bien je pense que je suis sur la session administrateur non étant donné que c'est mon pc et que je n'ai pas d'autres comptes ?
Pour ce qui est de msnfix ça ne marche toujours pas et vu que ce doit etre la 3ieme fois que je redemarre mon ordi ...
Pour ce qui est de msnfix ça ne marche toujours pas et vu que ce doit etre la 3ieme fois que je redemarre mon ordi ...
_ _ _ _ _
| \ | | ___ _ __ | | | |
| \| |/ _ \| '_ \ | | | |
| |\ | (_) | | | | |_|_|_|
|_| \_|\___/|_| |_| (_|_|_)
| \ | | ___ _ __ | | | |
| \| |/ _ \| '_ \ | | | |
| |\ | (_) | | | | |_|_|_|
|_| \_|\___/|_| |_| (_|_|_)
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
OK tant pis. Poste un nouveau rapport hijackthis.
Ensuite, on va utiliser Combofix. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...
Fais exactement ce qui suit :
Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation : en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!
Dans ton cas, il s'agit de Avast et de AVG Anti-spyware
---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...
Tuto ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
---------------------------------------------------------------------------------------------------------------------------------
Ensuite :
double-clique sur C-Fix.exe (= combofix.exe ) .
Appuie sur une touche pour démarrer le scan .
Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer
Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp
Ensuite, on va utiliser Combofix. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...
Fais exactement ce qui suit :
Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation : en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!
Dans ton cas, il s'agit de Avast et de AVG Anti-spyware
---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...
Tuto ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
---------------------------------------------------------------------------------------------------------------------------------
Ensuite :
double-clique sur C-Fix.exe (= combofix.exe ) .
Appuie sur une touche pour démarrer le scan .
Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer
Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp
Voila le rapport hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:22:01, on 23/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
D:\ipod\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Trend Micro\jack.exe\jack.exe.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\ipod\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [AnumanLive] C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\moua\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://gamenextfr.oberon-media.com/online/online2/luxor_2/mjolauncher.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://kaliaspace.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {B9907873-6560-4A36-B76B-9DADE84A7F55} (FnacmusicDnl.DnlManager) - http://www.fnacmusic.com/telechargementFnacmusic/FnacmusicDnl.CAB
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MusicManagerPlugin.MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/bejeweled2/Oberongamesloader.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:22:01, on 23/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
D:\ipod\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Trend Micro\jack.exe\jack.exe.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\ipod\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [AnumanLive] C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\moua\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://gamenextfr.oberon-media.com/online/online2/luxor_2/mjolauncher.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://kaliaspace.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {B9907873-6560-4A36-B76B-9DADE84A7F55} (FnacmusicDnl.DnlManager) - http://www.fnacmusic.com/telechargementFnacmusic/FnacmusicDnl.CAB
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MusicManagerPlugin.MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/bejeweled2/Oberongamesloader.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
Voila le rapport de combofix j'espère que ca va aller la 1ere fois il a fait redemarrer mon pc puis j'ai du relancer la procedure :
ComboFix 08-09-20.05 - moua 2008-09-23 13:30:46.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.271 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\moua\Bureau\ComboFix.exe
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\moua\Cookies\moua@isohunt[1].txt
C:\Documents and Settings\moua\Local Settings\Temporary Internet Files\CPV.stt
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-08-23 au 2008-09-23 ))))))))))))))))))))))))))))))))))))
.
2008-09-22 23:16 . 2008-09-22 23:16 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-21 21:26 . 2008-09-21 21:26 <REP> d-------- C:\Documents and Settings\moua\Application Data\Malwarebytes
2008-09-21 20:20 . 2008-09-21 20:20 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-21 20:20 . 2008-09-21 20:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-21 20:20 . 2008-09-21 20:20 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2008-09-21 20:20 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-21 20:20 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-21 18:46 . 2008-09-21 18:46 <REP> d-------- C:\WINDOWS\ERUNT
2008-09-21 18:35 . 2008-09-19 02:57 <REP> d-------- C:\SDFix
2008-09-21 18:34 . 2008-09-21 18:34 <REP> d-------- C:\Program Files\Trend Micro
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-09-21 18:31 . 2006-08-25 06:17 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-09-21 18:31 . 2006-08-25 05:55 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-09-21 18:31 . 2006-08-25 06:17 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-09-21 18:31 . 2006-08-25 06:35 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Acer
2008-09-21 18:31 . 2008-09-21 18:31 <REP> d-------- C:\Documents and Settings\Administrateur
2008-09-17 16:36 . 2008-09-17 16:36 <REP> d--hs---- C:\FOUND.014
2008-09-16 23:53 . 2008-09-16 23:53 <REP> d--hs---- C:\FOUND.013
2008-09-16 09:42 . 2008-09-16 09:42 <REP> d--hs---- C:\FOUND.012
2008-09-16 08:49 . 2008-09-16 08:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-09-16 00:10 . 2008-09-16 00:10 <REP> d-------- C:\Program Files\CCleaner
2008-09-16 00:09 . 2008-09-16 00:09 <REP> d-------- C:\Documents and Settings\moua\Application Data\Grisoft
2008-09-16 00:09 . 2008-09-16 00:09 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-09-16 00:09 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-09-12 15:44 . 2008-09-12 15:45 <REP> d-------- C:\Program Files\Fichiers communs\xing shared
2008-09-10 17:06 . 2008-09-10 17:06 <REP> d-------- C:\Documents and Settings\moua\Application Data\Zylom
2008-08-30 22:24 . 2008-05-01 16:31 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe
2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-09-08 21:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-02 14:51 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-08-18 10:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\dllcache\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 16:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
2008-06-24 08:28 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:21 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:21 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-01-01 986112]
"AnumanLive"="C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe" [2007-08-29 347648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]
"QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" [2008-05-27 413696]
"iTunesHelper"="D:\ipod\iTunesHelper.exe" [2008-07-10 289064]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-09-12 185896]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15360]
C:\Documents and Settings\moua\Menu D‚marrer\Programmes\D‚marrage\
OneNote 2007 - Capture d'‚cran et lancement.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Acer\\Acer Arcade\\PCMService.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\System32\\dpvsetup.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\ipod\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11924:TCP"= 11924:TCP:u torrent
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R1 OsaFsLoc;OsaFsLoc;C:\WINDOWS\system32\drivers\OsaFsLoc.sys [2005-10-15 12106]
R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 69632]
R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30 7296]
R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14 4010]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 26496]
S3 Boonty Games;Boonty Games;C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2007-01-06 69120]
S3 NdisFilt;OSA NdisFilter Protocol;C:\WINDOWS\system32\Drivers\NdisFilt.sys [2005-09-13 4392]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14258a98-b718-11dc-b4cc-0016d4666bdb}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23593f5a-231a-11dd-b4e9-0016d4666bdb}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{38a9ceca-d18a-11db-b483-0016d4666bdb}]
\Shell\AutoRun\command - F:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6b2ca0cc-6f02-11dd-b4f9-0016d4666bdb}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa3f438d-c73c-11dc-b4d8-0016d4666bdb}]
\Shell\AutoRun\command - G:\RavMon.exe
.
Contenu du dossier 'Tâches planifiées'
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
HKLM-Run-NBKeyScan - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\moua\Application Data\Mozilla\Firefox\Profiles\go5zkgep.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-23 13:31:51
Windows 5.1.2600 Service Pack 2 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-09-23 13:32:22
ComboFix-quarantined-files.txt 2008-09-23 11:32:20
Avant-CF: 3,107,307,520 octets libres
Après-CF: 3,261,022,208 octets libres
159 --- E O F --- 2008-09-11 01:24:49
ComboFix 08-09-20.05 - moua 2008-09-23 13:30:46.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.271 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\moua\Bureau\ComboFix.exe
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\moua\Cookies\moua@isohunt[1].txt
C:\Documents and Settings\moua\Local Settings\Temporary Internet Files\CPV.stt
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-08-23 au 2008-09-23 ))))))))))))))))))))))))))))))))))))
.
2008-09-22 23:16 . 2008-09-22 23:16 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-21 21:26 . 2008-09-21 21:26 <REP> d-------- C:\Documents and Settings\moua\Application Data\Malwarebytes
2008-09-21 20:20 . 2008-09-21 20:20 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-21 20:20 . 2008-09-21 20:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-21 20:20 . 2008-09-21 20:20 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2008-09-21 20:20 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-21 20:20 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-21 18:46 . 2008-09-21 18:46 <REP> d-------- C:\WINDOWS\ERUNT
2008-09-21 18:35 . 2008-09-19 02:57 <REP> d-------- C:\SDFix
2008-09-21 18:34 . 2008-09-21 18:34 <REP> d-------- C:\Program Files\Trend Micro
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-09-21 18:31 . 2006-08-25 06:17 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-09-21 18:31 . 2006-08-25 05:55 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-09-21 18:31 . 2006-08-25 06:17 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-09-21 18:31 . 2006-08-25 06:35 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Acer
2008-09-21 18:31 . 2008-09-21 18:31 <REP> d-------- C:\Documents and Settings\Administrateur
2008-09-17 16:36 . 2008-09-17 16:36 <REP> d--hs---- C:\FOUND.014
2008-09-16 23:53 . 2008-09-16 23:53 <REP> d--hs---- C:\FOUND.013
2008-09-16 09:42 . 2008-09-16 09:42 <REP> d--hs---- C:\FOUND.012
2008-09-16 08:49 . 2008-09-16 08:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-09-16 00:10 . 2008-09-16 00:10 <REP> d-------- C:\Program Files\CCleaner
2008-09-16 00:09 . 2008-09-16 00:09 <REP> d-------- C:\Documents and Settings\moua\Application Data\Grisoft
2008-09-16 00:09 . 2008-09-16 00:09 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-09-16 00:09 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-09-12 15:44 . 2008-09-12 15:45 <REP> d-------- C:\Program Files\Fichiers communs\xing shared
2008-09-10 17:06 . 2008-09-10 17:06 <REP> d-------- C:\Documents and Settings\moua\Application Data\Zylom
2008-08-30 22:24 . 2008-05-01 16:31 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe
2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-09-08 21:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-02 14:51 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-08-18 10:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\dllcache\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 16:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
2008-06-24 08:28 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:21 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:21 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-01-01 986112]
"AnumanLive"="C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe" [2007-08-29 347648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]
"QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" [2008-05-27 413696]
"iTunesHelper"="D:\ipod\iTunesHelper.exe" [2008-07-10 289064]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-09-12 185896]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15360]
C:\Documents and Settings\moua\Menu D‚marrer\Programmes\D‚marrage\
OneNote 2007 - Capture d'‚cran et lancement.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Acer\\Acer Arcade\\PCMService.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\System32\\dpvsetup.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\ipod\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11924:TCP"= 11924:TCP:u torrent
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R1 OsaFsLoc;OsaFsLoc;C:\WINDOWS\system32\drivers\OsaFsLoc.sys [2005-10-15 12106]
R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 69632]
R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30 7296]
R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14 4010]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 26496]
S3 Boonty Games;Boonty Games;C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2007-01-06 69120]
S3 NdisFilt;OSA NdisFilter Protocol;C:\WINDOWS\system32\Drivers\NdisFilt.sys [2005-09-13 4392]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14258a98-b718-11dc-b4cc-0016d4666bdb}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23593f5a-231a-11dd-b4e9-0016d4666bdb}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{38a9ceca-d18a-11db-b483-0016d4666bdb}]
\Shell\AutoRun\command - F:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6b2ca0cc-6f02-11dd-b4f9-0016d4666bdb}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa3f438d-c73c-11dc-b4d8-0016d4666bdb}]
\Shell\AutoRun\command - G:\RavMon.exe
.
Contenu du dossier 'Tâches planifiées'
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
HKLM-Run-NBKeyScan - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\moua\Application Data\Mozilla\Firefox\Profiles\go5zkgep.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-23 13:31:51
Windows 5.1.2600 Service Pack 2 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-09-23 13:32:22
ComboFix-quarantined-files.txt 2008-09-23 11:32:20
Avant-CF: 3,107,307,520 octets libres
Après-CF: 3,261,022,208 octets libres
159 --- E O F --- 2008-09-11 01:24:49
Merci de faire tout ce qui suit dans l'ordre :
1) Avec toutes les logiciels de protection désactivés, fais ceci :
Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :
----------------------------------------------------------
File::
C:\RavMon.exe
Folder::
C:\Program Files\Fichiers communs\BOONTY Shared
Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14258a98-b718-11dc-b4cc-0016d4666bdb}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23593f5a-231a-11dd-b4e9-0016d4666bdb}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6b2ca0cc-6f02-11dd-b4f9-0016d4666bdb}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa3f438d-c73c-11dc-b4d8-0016d4666bdb}]
Driver::
Boonty Games
------------------------------------------------------------------
- Enregistre ce fichier sur ton bureau (et pas ailleurs !) sous le nom CFScript.txt
- Quitte le Bloc Notes
· Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) comme sur ce lien :
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
* Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort), tape 1 puis valide.
* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
2) Aussitôt, réactive tes protections, puis désinfecte tous tes disques amovibles (clés USB, disques durs externes, lecteurs mp3...)
Télécharge l'outil Flash_Disinfector (de sUBs) :
ici http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe
ou ici download.bleepingcomputer.com/sUBs/Flash_Disinfector.exe
Enregistre Flash_Disinfector.exe sur ton bureau.
Double clique sur Flash_Disinfector.exe pour l'exécuter.
Quand le message : [Plug in yours flash drive & clic Ok to begin disinfection] apparaitra :
Connecte au pc tous tes disques amovibles, sans les ouvrir) !
Puis clique sur OK
Les icônes sur le bureau vont disparaître jusqu'à l'apparition du message: [Done!!]
Appuie ensuite sur OK, pour faire réapparaître le bureau.
1) Avec toutes les logiciels de protection désactivés, fais ceci :
Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :
----------------------------------------------------------
File::
C:\RavMon.exe
Folder::
C:\Program Files\Fichiers communs\BOONTY Shared
Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14258a98-b718-11dc-b4cc-0016d4666bdb}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23593f5a-231a-11dd-b4e9-0016d4666bdb}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6b2ca0cc-6f02-11dd-b4f9-0016d4666bdb}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa3f438d-c73c-11dc-b4d8-0016d4666bdb}]
Driver::
Boonty Games
------------------------------------------------------------------
- Enregistre ce fichier sur ton bureau (et pas ailleurs !) sous le nom CFScript.txt
- Quitte le Bloc Notes
· Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) comme sur ce lien :
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
* Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort), tape 1 puis valide.
* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
2) Aussitôt, réactive tes protections, puis désinfecte tous tes disques amovibles (clés USB, disques durs externes, lecteurs mp3...)
Télécharge l'outil Flash_Disinfector (de sUBs) :
ici http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe
ou ici download.bleepingcomputer.com/sUBs/Flash_Disinfector.exe
Enregistre Flash_Disinfector.exe sur ton bureau.
Double clique sur Flash_Disinfector.exe pour l'exécuter.
Quand le message : [Plug in yours flash drive & clic Ok to begin disinfection] apparaitra :
Connecte au pc tous tes disques amovibles, sans les ouvrir) !
Puis clique sur OK
Les icônes sur le bureau vont disparaître jusqu'à l'apparition du message: [Done!!]
Appuie ensuite sur OK, pour faire réapparaître le bureau.
voila le rapport combofix:
ComboFix 08-09-25.05 - moua 2008-09-26 10:44:46.2 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.235 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\moua\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\moua\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
FILE ::
C:\RavMon.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_BOONTY_GAMES
-------\Service_Boonty Games
((((((((((((((((((((((((((((( Fichiers créés du 2008-08-26 au 2008-09-26 ))))))))))))))))))))))))))))))))))))
.
2008-09-26 10:29 . 2008-09-26 10:29 <REP> d-------- C:\Documents and Settings\moua\Contacts
2008-09-24 22:33 . 2008-09-24 22:33 <REP> d-------- C:\WINDOWS\system32\fr
2008-09-24 22:33 . 2008-09-24 22:33 <REP> d-------- C:\WINDOWS\system32\bits
2008-09-24 22:33 . 2008-09-24 22:33 <REP> d-------- C:\WINDOWS\l2schemas
2008-09-23 22:07 . 2008-09-23 22:07 <REP> d-------- C:\Program Files\Zylom Games
2008-09-23 00:46 . 2008-04-14 04:04 93,184 --------- C:\WINDOWS\system32\dllcache\msxml6r.dll
2008-09-23 00:43 . 2006-12-28 21:01 19,569 --a------ C:\WINDOWS\[u]0[/u]03534_.tmp
2008-09-23 00:42 . 2008-04-14 04:10 2,524 --------- C:\WINDOWS\system32\pid.inf
2008-09-21 21:26 . 2008-09-21 21:26 <REP> d-------- C:\Documents and Settings\moua\Application Data\Malwarebytes
2008-09-21 20:20 . 2008-09-21 20:20 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-21 20:20 . 2008-09-21 20:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-21 20:20 . 2008-09-21 20:20 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2008-09-21 20:20 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-21 20:20 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-21 18:46 . 2008-09-21 18:46 <REP> d-------- C:\WINDOWS\ERUNT
2008-09-21 18:35 . 2008-09-19 02:57 <REP> d-------- C:\SDFix
2008-09-21 18:34 . 2008-09-21 18:34 <REP> d-------- C:\Program Files\Trend Micro
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-09-21 18:31 . 2006-08-25 06:17 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-09-21 18:31 . 2006-08-25 05:55 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-09-21 18:31 . 2006-08-25 06:17 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-09-21 18:31 . 2006-08-25 06:35 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Acer
2008-09-21 18:31 . 2008-09-21 18:31 <REP> d-------- C:\Documents and Settings\Administrateur
2008-09-17 16:36 . 2008-09-17 16:36 <REP> d--hs---- C:\FOUND.014
2008-09-16 23:53 . 2008-09-16 23:53 <REP> d--hs---- C:\FOUND.013
2008-09-16 09:42 . 2008-09-16 09:42 <REP> d--hs---- C:\FOUND.012
2008-09-16 08:49 . 2008-09-16 08:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-09-16 00:10 . 2008-09-16 00:10 <REP> d-------- C:\Program Files\CCleaner
2008-09-16 00:09 . 2008-09-16 00:09 <REP> d-------- C:\Documents and Settings\moua\Application Data\Grisoft
2008-09-16 00:09 . 2008-09-16 00:09 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-09-16 00:09 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-09-12 15:44 . 2008-09-12 15:45 <REP> d-------- C:\Program Files\Fichiers communs\xing shared
2008-09-10 17:06 . 2008-09-10 17:06 <REP> d-------- C:\Documents and Settings\moua\Application Data\Zylom
2008-08-30 22:24 . 2008-05-01 16:36 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-30 22:18 . 2008-04-11 21:05 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe
2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-09-08 21:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-02 14:51 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-08-18 10:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:28 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
.
((((((((((((((((((((((((((((( snapshot@2008-09-23_13.32.05.25 )))))))))))))))))))))))))))))))))))))))))
.
- 2004-08-19 14:09:34 82,944 ------w C:\WINDOWS\$NtUninstallKB946648$\msgsc.dll
- 2006-07-13 07:48:58 202,240 ------w C:\WINDOWS\$NtUninstallKB950762$\rmcast.sys
+ 2006-07-13 07:48:58 202,240 ------w C:\WINDOWS\$NtUninstallKB950762_0$\rmcast.sys
+ 2007-11-30 12:39:30 234,872 ------w C:\WINDOWS\$NtUninstallKB950762_0$\spuninst\spuninst.exe
+ 2007-11-30 12:39:32 406,392 ------w C:\WINDOWS\$NtUninstallKB950762_0$\spuninst\updspapi.dll
- 2005-07-26 03:39:58 243,200 ------w C:\WINDOWS\$NtUninstallKB950974$\es.dll
- 2007-08-21 06:17:24 683,520 ------w C:\WINDOWS\$NtUninstallKB951066$\inetcomm.dll
- 2008-04-14 15:52:46 272,768 ------w C:\WINDOWS\$NtUninstallKB951376-v2$\bthport.sys
+ 2008-04-14 15:52:46 272,768 ------w C:\WINDOWS\$NtUninstallKB951376-v2_0$\bthport.sys
+ 2007-11-30 11:19:06 234,872 ------w C:\WINDOWS\$NtUninstallKB951376-v2_0$\spuninst\spuninst.exe
+ 2007-11-30 11:19:10 406,392 ------w C:\WINDOWS\$NtUninstallKB951376-v2_0$\spuninst\updspapi.dll
- 2004-08-03 22:40:30 274,944 ------w C:\WINDOWS\$NtUninstallKB951376$\bthport.sys
+ 2004-08-03 22:40:30 274,944 ------w C:\WINDOWS\$NtUninstallKB951376_0$\bthport.sys
+ 2007-11-30 11:19:06 234,872 ------w C:\WINDOWS\$NtUninstallKB951376_0$\spuninst\spuninst.exe
+ 2007-11-30 11:19:10 406,392 ------w C:\WINDOWS\$NtUninstallKB951376_0$\spuninst\updspapi.dll
- 2007-10-29 21:43:32 1,293,824 ------w C:\WINDOWS\$NtUninstallKB951698$\quartz.dll
+ 2007-10-29 21:43:32 1,293,824 ------w C:\WINDOWS\$NtUninstallKB951698_0$\quartz.dll
+ 2007-11-30 11:19:06 234,872 ------w C:\WINDOWS\$NtUninstallKB951698_0$\spuninst\spuninst.exe
+ 2007-11-30 12:39:32 406,392 ------w C:\WINDOWS\$NtUninstallKB951698_0$\spuninst\updspapi.dll
- 2004-08-05 03:00:00 138,496 ------w C:\WINDOWS\$NtUninstallKB951748$\afd.sys
- 2008-02-20 05:35:06 148,992 ------w C:\WINDOWS\$NtUninstallKB951748$\dnsapi.dll
- 2004-08-19 14:09:36 247,808 ------w C:\WINDOWS\$NtUninstallKB951748$\mswsock.dll
- 2007-10-30 16:20:56 360,064 ------w C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
- 2006-08-16 08:37:30 225,664 ------w C:\WINDOWS\$NtUninstallKB951748$\tcpip6.sys
+ 2004-08-05 03:00:00 138,496 ------w C:\WINDOWS\$NtUninstallKB951748_0$\afd.sys
+ 2008-02-20 05:35:06 148,992 ------w C:\WINDOWS\$NtUninstallKB951748_0$\dnsapi.dll
+ 2004-08-19 14:09:36 247,808 ------w C:\WINDOWS\$NtUninstallKB951748_0$\mswsock.dll
+ 2007-11-30 12:39:30 234,872 ------w C:\WINDOWS\$NtUninstallKB951748_0$\spuninst\spuninst.exe
+ 2007-11-30 12:39:30 406,392 ------w C:\WINDOWS\$NtUninstallKB951748_0$\spuninst\updspapi.dll
+ 2007-10-30 16:20:56 360,064 ------w C:\WINDOWS\$NtUninstallKB951748_0$\tcpip.sys
+ 2006-08-16 08:37:30 225,664 ------w C:\WINDOWS\$NtUninstallKB951748_0$\tcpip6.sys
- 2004-08-19 14:09:34 331,776 ------w C:\WINDOWS\$NtUninstallKB952287$\msadce.dll
- 2005-06-29 00:49:42 74,240 ------w C:\WINDOWS\$NtUninstallKB952954$\mscms.dll
- 2006-10-04 13:05:26 39,424 ------w C:\WINDOWS\AppPatch\acadproc.dll
+ 2008-04-14 02:33:18 39,424 ----a-w C:\WINDOWS\AppPatch\acadproc.dll
- 2004-08-19 14:09:20 1,852,416 ----a-w C:\WINDOWS\AppPatch\AcGenral.dll
+ 2008-04-14 02:33:18 1,852,928 ----a-w C:\WINDOWS\AppPatch\AcGenral.dll
- 2004-08-19 14:09:20 450,048 ----a-w C:\WINDOWS\AppPatch\AcLayers.dll
+ 2008-04-14 02:33:18 451,072 ----a-w C:\WINDOWS\AppPatch\AcLayers.dll
- 2004-08-19 14:09:20 137,728 ----a-w C:\WINDOWS\AppPatch\AcLua.dll
+ 2008-04-14 02:33:18 141,312 ----a-w C:\WINDOWS\AppPatch\AcLua.dll
- 2004-08-19 14:09:20 244,736 ----a-w C:\WINDOWS\AppPatch\AcSpecfc.dll
+ 2008-04-14 02:33:18 245,248 ----a-w C:\WINDOWS\AppPatch\AcSpecfc.dll
- 2004-08-19 14:09:20 116,224 ----a-w C:\WINDOWS\AppPatch\AcXtrnal.dll
+ 2008-04-14 02:33:18 116,224 ----a-w C:\WINDOWS\AppPatch\AcXtrnal.dll
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
- 2007-06-13 13:22:28 1,037,312 ----a-w C:\WINDOWS\explorer.exe
+ 2008-04-14 02:34:04 1,037,824 ----a-w C:\WINDOWS\explorer.exe
- 2004-08-19 14:09:44 34,816 ----a-w C:\WINDOWS\Help\sniffpol.dll
+ 2008-04-14 02:33:42 34,816 ----a-w C:\WINDOWS\Help\sniffpol.dll
- 2004-08-19 14:09:46 33,280 ----a-w C:\WINDOWS\Help\sstub.dll
+ 2008-04-14 02:33:46 33,280 ----a-w C:\WINDOWS\Help\sstub.dll
- 2004-08-19 14:09:48 279,040 ----a-w C:\WINDOWS\Help\tshoot.dll
+ 2008-04-14 02:33:46 279,040 ----a-w C:\WINDOWS\Help\tshoot.dll
- 2005-05-26 22:22:02 10,752 ----a-w C:\WINDOWS\hh.exe
+ 2008-04-14 02:34:06 10,752 ----a-w C:\WINDOWS\hh.exe
- 2004-08-05 03:00:00 175,104 ----a-w C:\WINDOWS\ime\chsime\applets\PINTLCSA.DLL
+ 2008-04-14 02:32:16 175,104 ----a-w C:\WINDOWS\ime\chsime\applets\pintlcsa.dll
- 2004-08-05 03:00:00 53,760 ----a-w C:\WINDOWS\ime\chsime\applets\PINTLCSD.DLL
+ 2008-04-14 02:32:16 53,760 ----a-w C:\WINDOWS\ime\chsime\applets\pintlcsd.dll
- 2004-08-05 03:00:00 97,792 ----a-w C:\WINDOWS\ime\CHTIME\Applets\CHTMBX.DLL
+ 2008-04-14 02:31:04 97,792 ----a-w C:\WINDOWS\ime\CHTIME\Applets\chtmbx.dll
- 2004-08-05 03:00:00 56,320 ----a-w C:\WINDOWS\ime\CHTIME\Applets\CHTSKDIC.DLL
+ 2008-04-14 02:31:04 56,320 ----a-w C:\WINDOWS\ime\CHTIME\Applets\chtskdic.dll
- 2004-08-05 03:00:00 173,568 ----a-w C:\WINDOWS\ime\CHTIME\Applets\CHTSKF.DLL
+ 2008-04-14 02:31:04 173,568 ----a-w C:\WINDOWS\ime\CHTIME\Applets\chtskf.dll
- 2004-08-05 03:00:00 13,463,552 ----a-w C:\WINDOWS\ime\imjp8_1\applets\hwxjpn.dll
+ 2008-04-14 02:31:30 13,463,552 ----a-w C:\WINDOWS\ime\imjp8_1\applets\hwxjpn.dll
- 2004-08-05 03:00:00 315,452 ----a-w C:\WINDOWS\ime\imjp8_1\applets\imskf.dll
+ 2008-04-14 02:31:34 315,455 ----a-w C:\WINDOWS\ime\imjp8_1\applets\imskf.dll
- 2004-08-05 03:00:00 426,041 ----a-w C:\WINDOWS\ime\imjp8_1\applets\voicepad.dll
+ 2008-04-14 02:32:46 426,041 ----a-w C:\WINDOWS\ime\imjp8_1\applets\voicepad.dll
- 2004-08-05 03:00:00 86,073 ----a-w C:\WINDOWS\ime\imjp8_1\applets\voicesub.dll
+ 2008-04-14 02:32:46 86,073 ----a-w C:\WINDOWS\ime\imjp8_1\applets\voicesub.dll
- 2004-08-05 03:00:00 368,696 ----a-w C:\WINDOWS\ime\imjp8_1\imjpcic.dll
+ 2008-04-14 02:31:34 368,696 ----a-w C:\WINDOWS\ime\imjp8_1\imjpcic.dll
- 2004-08-05 03:00:00 716,856 ----a-w C:\WINDOWS\ime\imjp8_1\imjpcus.dll
+ 2008-04-14 02:31:34 716,856 ----a-w C:\WINDOWS\ime\imjp8_1\imjpcus.dll
- 2004-08-05 03:00:00 81,976 ----a-w C:\WINDOWS\ime\imjp8_1\imjpdct.dll
+ 2008-04-14 02:31:34 81,976 ----a-w C:\WINDOWS\ime\imjp8_1\imjpdct.dll
- 2004-08-05 03:00:00 274,489 ----a-w C:\WINDOWS\ime\imjp8_1\imjputyc.dll
+ 2008-04-14 02:31:34 274,489 ----a-w C:\WINDOWS\ime\imjp8_1\imjputyc.dll
- 2004-08-05 03:00:00 86,016 ----a-w C:\WINDOWS\ime\imkr6_1\applets\imekrmbx.dll
+ 2008-04-14 02:31:34 86,016 ----a-w C:\WINDOWS\ime\imkr6_1\applets\imekrmbx.dll
- 2004-08-05 03:00:00 106,496 ----a-w C:\WINDOWS\ime\imkr6_1\imekrcic.dll
+ 2008-04-14 02:31:34 106,496 ----a-w C:\WINDOWS\ime\imkr6_1\imekrcic.dll
- 2004-08-19 14:09:34 220,160 ----a-w C:\WINDOWS\ime\mscandui.dll
+ 2008-04-14 02:33:30 220,160 ----a-w C:\WINDOWS\ime\mscandui.dll
- 2004-08-05 03:00:00 102,456 ----a-w C:\WINDOWS\ime\shared\imlang.dll
+ 2008-04-14 02:31:34 102,456 ----a-w C:\WINDOWS\ime\shared\imlang.dll
- 2004-08-05 03:00:00 15,872 ----a-w C:\WINDOWS\ime\shared\res\PADRS404.DLL
+ 2008-04-14 02:32:16 15,872 ----a-w C:\WINDOWS\ime\shared\res\padrs404.dll
- 2004-08-05 03:00:00 15,360 ----a-w C:\WINDOWS\ime\shared\res\padrs804.dll
+ 2008-04-14 02:32:16 15,360 ----a-w C:\WINDOWS\ime\shared\res\padrs804.dll
- 2004-08-19 14:09:44 130,048 ----a-w C:\WINDOWS\ime\softkbd.dll
+ 2008-04-14 02:33:42 130,048 ----a-w C:\WINDOWS\ime\softkbd.dll
- 2004-08-19 14:08:56 62,976 ----a-w C:\WINDOWS\ime\spgrmr.dll
+ 2008-04-13 16:43:18 62,976 ----a-w C:\WINDOWS\ime\spgrmr.dll
- 2004-08-19 14:09:44 272,384 ----a-w C:\WINDOWS\ime\sptip.dll
+ 2008-04-14 02:33:46 272,384 ----a-w C:\WINDOWS\ime\sptip.dll
- 2007-12-11 15:49:10 29,926 ----a-r C:\WINDOWS\Installer\{BADF6744-3787-48F6-B8C9-4C4995401D65}\MsblIco.Exe
+ 2008-09-24 20:44:58 29,926 ----a-r C:\WINDOWS\Installer\{BADF6744-3787-48F6-B8C9-4C4995401D65}\MsblIco.Exe
+ 2008-01-18 15:13:10 2,247 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscdsbl.bat
- 2006-11-07 08:06:48 16,832 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscinst.vbs
+ 2007-12-12 10:33:52 18,917 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscinst.vbs
- 2006-11-07 08:06:48 12,451 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscuinst.vbs
+ 2007-10-30 10:06:46 13,801 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscuinst.vbs
+ 2008-04-14 02:33:06 25,600 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscupdc.dll
- 2004-08-19 14:09:20 24,064 ----a-w C:\WINDOWS\msagent\agentanm.dll
+ 2008-04-14 02:33:18 24,064 ----a-w C:\WINDOWS\msagent\agentanm.dll
- 2004-08-19 14:09:20 214,016 ----a-w C:\WINDOWS\msagent\agentctl.dll
+ 2008-04-14 02:33:18 214,016 ----a-w C:\WINDOWS\msagent\agentctl.dll
- 2006-10-12 13:04:14 42,496 ----a-w C:\WINDOWS\msagent\agentdp2.dll
+ 2008-04-14 02:33:18 42,496 ----a-w C:\WINDOWS\msagent\agentdp2.dll
- 2007-03-09 14:00:38 57,344 ----a-w C:\WINDOWS\msagent\agentdpv.dll
+ 2008-04-14 02:33:18 57,344 ----a-w C:\WINDOWS\msagent\agentdpv.dll
- 2004-08-19 14:09:20 49,152 ----a-w C:\WINDOWS\msagent\agentmpx.dll
+ 2008-04-14 02:33:18 49,152 ----a-w C:\WINDOWS\msagent\agentmpx.dll
- 2004-08-19 14:09:20 24,064 ----a-w C:\WINDOWS\msagent\agentpsh.dll
+ 2008-04-14 02:33:18 24,064 ----a-w C:\WINDOWS\msagent\agentpsh.dll
- 2004-08-19 14:09:20 44,032 ----a-w C:\WINDOWS\msagent\agentsr.dll
+ 2008-04-14 02:33:18 44,032 ----a-w C:\WINDOWS\msagent\agentsr.dll
- 2006-10-12 10:09:54 256,512 ----a-w C:\WINDOWS\msagent\agentsvr.exe
+ 2008-04-14 02:33:54 256,512 ----a-w C:\WINDOWS\msagent\agentsvr.exe
- 2004-08-19 14:09:20 24,064 ----a-w C:\WINDOWS\msagent\agtintl.dll
+ 2008-04-14 02:33:20 24,064 ----a-w C:\WINDOWS\msagent\agtintl.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0401.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0401.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0404.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0404.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0405.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0405.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0406.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0406.dll
- 2004-08-05 03:00:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt0407.dll
+ 2007-04-02 18:26:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt0407.dll
- 2004-08-05 03:00:00 22,016 ----a-w C:\WINDOWS\msagent\intl\agt0408.dll
+ 2007-04-02 18:26:00 22,016 ----a-w C:\WINDOWS\msagent\intl\agt0408.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0409.dll
+ 2008-04-13 17:32:28 19,968 ----a-w C:\WINDOWS\msagent\intl\agt0409.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt040b.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt040b.dll
- 2004-08-05 03:00:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt040c.dll
+ 2007-04-02 18:26:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt040c.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt040d.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt040d.dll
- 2004-08-05 03:00:00 19,968 ----a-w C:\WINDOWS\msagent\intl\agt040e.dll
+ 2007-04-02 18:26:00 19,968 ----a-w C:\WINDOWS\msagent\intl\agt040e.dll
- 2004-08-05 03:00:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0410.dll
+ 2007-04-02 18:26:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0410.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0411.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0411.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0412.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0412.dll
- 2004-08-05 03:00:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0413.dll
+ 2007-04-02 18:26:02 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0413.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0414.dll
+ 2007-04-02 18:26:02 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0414.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0415.dll
+ 2007-04-02 18:26:02 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0415.dll
- 2004-08-05 03:00:00 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0416.dll
+ 2007-04-02 18:26:02 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0416.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0419.dll
+ 2007-04-02 18:26:02 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0419.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041d.dll
+ 2007-04-02 18:26:02 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041d.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041f.dll
+ 2007-04-02 18:26:02 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041f.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0804.dll
+ 2007-04-02 18:26:02 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0804.dll
- 2004-08-05 03:00:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0816.dll
+ 2007-04-02 18:26:02 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0816.dll
- 2004-08-05 03:00:00 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0c0a.dll
+ 2007-04-02 18:26:02 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0c0a.dll
- 2004-08-19 14:09:34 39,936 ----a-w C:\WINDOWS\msagent\mslwvtts.dll
+ 2008-04-14 02:33:32 39,936 ----a-w C:\WINDOWS\msagent\mslwvtts.dll
- 2006-06-02 18:32:20 33,792 ------w C:\WINDOWS\network diagnostic\custsat.dll
+ 2008-04-14 02:33:22 33,792 ------w C:\WINDOWS\network diagnostic\custsat.dll
- 2006-10-10 11:44:50 557,568 ------w C:\WINDOWS\network diagnostic\xpnetdiag.exe
+ 2008-04-13 18:53:32 558,080 ------w C:\WINDOWS\network diagnostic\xpnetdiag.exe
- 2004-08-19 14:10:00 70,656 ----a-w C:\WINDOWS\notepad.exe
+ 2008-04-14 02:34:16 70,656 ----a-w C:\WINDOWS\notepad.exe
- 2004-08-19 14:09:56 768,512 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
+ 2008-04-14 02:34:06 769,024 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
- 2004-08-19 14:09:56 743,936 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe
+ 2008-04-14 02:34:06 744,448 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe
- 2004-08-19 14:09:56 18,944 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe
+ 2008-04-14 02:34:06 18,432 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe
- 2004-08-19 14:10:00 160,768 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
+ 2008-04-14 02:34:12 172,544 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
- 2004-08-19 14:09:34 381,952 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msinfo.dll
+ 2008-04-14 02:33:32 382,464 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msinfo.dll
- 2004-08-19 14:09:38 102,400 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchshell.dll
+ 2008-04-14 02:33:38 102,912 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchshell.dll
- 2004-08-19 14:09:38 38,912 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll
+ 2008-04-14 02:33:38 38,400 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll
- 2006-12-30 03:04:44 76,507 ----a-w C:\WINDOWS\pchealth\helpctr\OfflineCache\index.dat
+ 2008-09-24 20:35:56 76,507 ----a-w C:\WINDOWS\pchealth\helpctr\OfflineCache\index.dat
- 2006-12-30 03:04:44 2,398 ----a-w C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
+ 2008-09-24 20:35:56 2,704 ----a-w C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
- 2004-08-19 14:10:04 151,040 ----a-w C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe
+ 2008-04-14 02:34:26 151,040 ----a-w C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe
- 2004-08-19 14:09:46 151,552 ----a-w C:\WINDOWS\PeerNet\sqldb20.dll
+ 2008-04-14 02:33:46 151,552 ----a-w C:\WINDOWS\PeerNet\sqldb20.dll
- 2004-08-19 14:09:46 462,848 ----a-w C:\WINDOWS\PeerNet\sqlqp20.dll
+ 2008-04-14 02:33:46 462,848 ----a-w C:\WINDOWS\PeerNet\sqlqp20.dll
- 2004-08-19 14:09:46 110,592 ----a-w C:\WINDOWS\PeerNet\sqlse20.dll
+ 2008-04-14 02:33:46 110,592 ----a-w C:\WINDOWS\PeerNet\sqlse20.dll
- 2004-08-19 14:10:04 153,088 ----a-w C:\WINDOWS\regedit.exe
+ 2008-04-14 02:34:20 153,088 ----a-w C:\WINDOWS\regedit.exe
- 2004-08-03 21:10:08 53,248 ------w C:\WINDOWS\ServicePackFiles\i386\1394bus.sys
+ 2008-04-13 18:46:18 53,376 ------w C:\WINDOWS\ServicePackFiles\i386\1394bus.sys
- 2004-08-03 21:00:04 12,288 ------w C:\WINDOWS\ServicePackFiles\i386\4mmdat.sys
+ 2008-04-13 18:40:50 12,288 ------w C:\WINDOWS\ServicePackFiles\i386\4mmdat.sys
- 2004-08-03 21:10:12 48,128 ------w C:\WINDOWS\ServicePackFiles\i386\61883.sys
+ 2008-04-13 18:46:20 48,128 ------w C:\WINDOWS\ServicePackFiles\i386\61883.sys
- 2004-08-19 14:09:20 100,352 ------w C:\WINDOWS\ServicePackFiles\i386\6to4svc.dll
+ 2008-04-14 02:33:18 100,352 ------w C:\WINDOWS\ServicePackFiles\i386\6to4svc.dll
+ 2008-04-14 02:33:18 136,192 ------w C:\WINDOWS\ServicePackFiles\i386\aaclient.dll
+ 2008-04-14 02:33:18 39,424 ------w C:\WINDOWS\ServicePackFiles\i386\acadproc.dll
- 2004-08-19 14:09:52 189,952 ------w C:\WINDOWS\ServicePackFiles\i386\accwiz.exe
+ 2008-04-14 02:33:54 190,464 ------w C:\WINDOWS\ServicePackFiles\i386\accwiz.exe
- 2004-08-19 14:09:20 1,852,416 ------w C:\WINDOWS\ServicePackFiles\i386\acgenral.dll
+ 2008-04-14 02:33:18 1,852,928 ------w C:\WINDOWS\ServicePackFiles\i386\acgenral.dll
- 2004-08-19 14:09:20 450,048 ------w C:\WINDOWS\ServicePackFiles\i386\aclayers.dll
+ 2008-04-14 02:33:18 451,072 ------w C:\WINDOWS\ServicePackFiles\i386\aclayers.dll
- 2004-08-19 14:09:20 137,728 ------w C:\WINDOWS\ServicePackFiles\i386\aclua.dll
+ 2008-04-14 02:33:18 141,312 ------w C:\WINDOWS\ServicePackFiles\i386\aclua.dll
- 2004-08-19 14:09:20 119,296 ------w C:\WINDOWS\ServicePackFiles\i386\aclui.dll
+ 2008-04-14 02:33:18 120,320 ------w C:\WINDOWS\ServicePackFiles\i386\aclui.dll
- 2004-08-19 13:51:56 188,672 ------w C:\WINDOWS\ServicePackFiles\i386\acpi.sys
+ 2008-04-14 01:52:42 188,672 ------w C:\WINDOWS\ServicePackFiles\i386\acpi.sys
- 2004-08-19 14:09:20 244,736 ------w C:\WINDOWS\ServicePackFiles\i386\acspecfc.dll
+ 2008-04-14 02:33:18 245,248 ------w C:\WINDOWS\ServicePackFiles\i386\acspecfc.dll
- 2004-08-19 14:09:20 194,048 ------w C:\WINDOWS\ServicePackFiles\i386\activeds.dll
+ 2008-04-14 02:33:18 193,536 ------w C:\WINDOWS\ServicePackFiles\i386\activeds.dll
- 2004-08-19 14:09:52 4,096 ------w C:\WINDOWS\ServicePackFiles\i386\actmovie.exe
+ 2008-04-14 02:33:54 4,096 ------w C:\WINDOWS\ServicePackFiles\i386\actmovie.exe
- 2004-08-19 14:09:20 101,888 ------w C:\WINDOWS\ServicePackFiles\i386\actxprxy.dll
+ 2008-04-14 02:33:18 98,304 ------w C:\WINDOWS\ServicePackFiles\i386\actxprxy.dll
- 2004-08-19 14:09:20 116,224 ------w C:\WINDOWS\ServicePackFiles\i386\acxtrnal.dll
+ 2008-04-14 02:33:18 116,224 ------w C:\WINDOWS\ServicePackFiles\i386\acxtrnal.dll
- 2004-08-19 14:09:20 20,540 ------w C:\WINDOWS\ServicePackFiles\i386\admin.dll
+ 2008-04-14 02:33:18 20,540 ------w C:\WINDOWS\ServicePackFiles\i386\admin.dll
- 2004-08-19 14:09:52 16,439 ------w C:\WINDOWS\ServicePackFiles\i386\admin.exe
+ 2008-04-14 02:33:54 16,439 ------w C:\WINDOWS\ServicePackFiles\i386\admin.exe
- 2004-08-19 14:09:20 61,440 ------w C:\WINDOWS\ServicePackFiles\i386\admparse.dll
+ 2008-04-14 02:33:18 61,440 ------w C:\WINDOWS\ServicePackFiles\i386\admparse.dll
- 2004-08-19 14:09:20 175,616 ------w C:\WINDOWS\ServicePackFiles\i386\adsldp.dll
+ 2008-04-14 02:33:18 175,616 ------w C:\WINDOWS\ServicePackFiles\i386\adsldp.dll
- 2004-08-19 14:09:20 143,360 ------w C:\WINDOWS\ServicePackFiles\i386\adsldpc.dll
+ 2008-04-14 02:33:18 143,360 ------w C:\WINDOWS\ServicePackFiles\i386\adsldpc.dll
- 2004-08-19 14:09:20 68,096 ------w C:\WINDOWS\ServicePackFiles\i386\adsmsext.dll
+ 2008-04-14 02:33:18 68,096 ------w C:\WINDOWS\ServicePackFiles\i386\adsmsext.dll
- 2004-08-19 14:09:20 263,680 ------w C:\WINDOWS\ServicePackFiles\i386\adsnt.dll
+ 2008-04-14 02:33:18 263,680 ------w C:\WINDOWS\ServicePackFiles\i386\adsnt.dll
- 2004-08-19 14:09:20 4,255 ------w C:\WINDOWS\ServicePackFiles\i386\adv01nt5.dll
+ 2008-04-14 02:33:18 4,255 ------w C:\WINDOWS\ServicePackFiles\i386\adv01nt5.dll
- 2004-08-19 14:09:20 3,967 ------w C:\WINDOWS\ServicePackFiles\i386\adv02nt5.dll
+ 2008-04-14 02:33:18 3,967 ------w C:\WINDOWS\ServicePackFiles\i386\adv02nt5.dll
- 2004-08-19 14:09:20 3,615 ------w C:\WINDOWS\ServicePackFiles\i386\adv05nt5.dll
+ 2008-04-14 02:33:18 3,615 ------w C:\WINDOWS\ServicePackFiles\i386\adv05nt5.dll
- 2004-08-19 14:09:20 3,647 ------w C:\WINDOWS\ServicePackFiles\i386\adv07nt5.dll
+ 2008-04-14 02:33:18 3,647 ------w C:\WINDOWS\ServicePackFiles\i386\adv07nt5.dll
- 2004-08-19 14:09:20 3,135 ------w C:\WINDOWS\ServicePackFiles\i386\adv08nt5.dll
+ 2008-04-14 02:33:18 3,135 ------w C:\WINDOWS\ServicePackFiles\i386\adv08nt5.dll
- 2004-08-19 14:09:20 3,711 ------w C:\WINDOWS\ServicePackFiles\i386\adv09nt5.dll
+ 2008-04-14 02:33:18 3,711 ------w C:\WINDOWS\ServicePackFiles\i386\adv09nt5.dll
- 2004-08-19 14:09:20 3,775 ------w C:\WINDOWS\ServicePackFiles\i386\adv11nt5.dll
+ 2008-04-14 02:33:18 3,775 ------w C:\WINDOWS\ServicePackFiles\i386\adv11nt5.dll
- 2004-08-19 14:09:20 685,056 ------w C:\WINDOWS\ServicePackFiles\i386\advapi32.dll
+ 2008-04-14 02:33:18 685,568 ------w C:\WINDOWS\ServicePackFiles\i386\advapi32.dll
- 2004-08-19 14:09:20 101,888 ------w C:\WINDOWS\ServicePackFiles\i386\advpack.dll
+ 2008-04-14 02:33:18 101,888 ------w C:\WINDOWS\ServicePackFiles\i386\advpack.dll
- 2004-08-03 20:39:38 142,464 ------w C:\WINDOWS\ServicePackFiles\i386\aec.sys
+ 2008-04-13 16:39:24 142,592 ------w C:\WINDOWS\ServicePackFiles\i386\aec.sys
- 2004-08-03 21:14:16 138,496 ------w C:\WINDOWS\ServicePackFiles\i386\afd.sys
+ 2008-04-13 19:19:24 138,112 ------w C:\WINDOWS\ServicePackFiles\i386\afd.sys
- 2004-08-19 14:09:20 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agentanm.dll
+ 2008-04-14 02:33:18 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agentanm.dll
- 2004-08-19 14:09:20 214,016 ------w C:\WINDOWS\ServicePackFiles\i386\agentctl.dll
+ 2008-04-14 02:33:18 214,016 ------w C:\WINDOWS\ServicePackFiles\i386\agentctl.dll
- 2004-08-19 14:09:20 41,984 ------w C:\WINDOWS\ServicePackFiles\i386\agentdp2.dll
+ 2008-04-14 02:33:18 42,496 ------w C:\WINDOWS\ServicePackFiles\i386\agentdp2.dll
- 2004-08-19 14:09:20 58,880 ------w C:\WINDOWS\ServicePackFiles\i386\agentdpv.dll
+ 2008-04-14 02:33:18 57,344 ------w C:\WINDOWS\ServicePackFiles\i386\agentdpv.dll
- 2004-08-19 14:09:20 49,152 ------w C:\WINDOWS\ServicePackFiles\i386\agentmpx.dll
+ 2008-04-14 02:33:18 49,152 ------w C:\WINDOWS\ServicePackFiles\i386\agentmpx.dll
- 2004-08-19 14:09:20 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agentpsh.dll
+ 2008-04-14 02:33:18 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agentpsh.dll
- 2004-08-19 14:09:20 44,032 ------w C:\WINDOWS\ServicePackFiles\i386\agentsr.dll
+ 2008-04-14 02:33:18 44,032 ------w C:\WINDOWS\ServicePackFiles\i386\agentsr.dll
- 2004-08-19 14:09:52 256,512 ------w C:\WINDOWS\ServicePackFiles\i386\agentsvr.exe
+ 2008-04-14 02:33:54 256,512 ------w C:\WINDOWS\ServicePackFiles\i386\agentsvr.exe
- 2004-08-03 21:07:42 42,368 ------w C:\WINDOWS\ServicePackFiles\i386\agp440.sys
+ 2008-04-13 18:36:38 42,368 ------w C:\WINDOWS\ServicePackFiles\i386\agp440.sys
- 2004-08-03 21:07:44 44,928 ------w C:\WINDOWS\ServicePackFiles\i386\agpcpq.sys
+ 2008-04-13 18:36:40 44,928 ------w C:\WINDOWS\ServicePackFiles\i386\agpcpq.sys
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0401.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0404.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0405.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0406.dll
+ 2007-04-02 18:26:00 21,504 ------w C:\WINDOWS\ServicePackFiles\i386\agt0407.dll
+ 2007-04-02 18:26:00 22,016 ------w C:\WINDOWS\ServicePackFiles\i386\agt0408.dll
+ 2008-04-13 17:32:28 19,968 ------w C:\WINDOWS\ServicePackFiles\i386\agt0409.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt040b.dll
+ 2007-04-02 18:26:00 21,504 ------w C:\WINDOWS\ServicePackFiles\i386\agt040c.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt040d.dll
+ 2007-04-02 18:26:00 19,968 ------w C:\WINDOWS\ServicePackFiles\i386\agt040e.dll
+ 2007-04-02 18:26:00 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\agt0410.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0411.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0412.dll
+ 2007-04-02 18:26:02 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\agt0413.dll
+ 2007-04-02 18:26:02 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0414.dll
+ 2007-04-02 18:26:02 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0415.dll
+ 2007-04-02 18:26:02 20,480 ------w C:\WINDOWS\ServicePackFiles\i386\agt0416.dll
+ 2007-04-02 18:26:02 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0419.dll
+ 2007-04-02 18:26:02 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt041d.dll
+ 2007-04-02 18:26:02 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt041f.dll
+ 2007-04-02 18:26:02 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0804.dll
+ 2007-04-02 18:26:02 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\agt0816.dll
+ 2007-04-02 18:26:02 20,480 ------w C:\WINDOWS\ServicePackFiles\i386\agt0c0a.dll
- 2004-08-19 14:09:20 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agtintl.dll
+ 2008-04-14 02:33:20 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agtintl.dll
- 2004-08-19 14:09:52 98,304 ------w C:\WINDOWS\ServicePackFiles\i386\ahui.exe
+ 2008-04-14 02:33:54 98,304 ------w C:\WINDOWS\ServicePackFiles\i386\ahui.exe
- 2004-08-19 14:09:52 44,544 ------w C:\WINDOWS\ServicePackFiles\i386\alg.exe
+ 2008-04-14 02:33:54 44,544 ------w C:\WINDOWS\ServicePackFiles\i386\alg.exe
- 2004-08-03 21:07:42 42,752 ------w C:\WINDOWS\ServicePackFiles\i386\alim1541.sys
+ 2008-04-13 18:36:38 42,752 ------w C:\WINDOWS\ServicePackFiles\i386\alim1541.sys
- 2004-08-19 14:09:20 17,408 ------w C:\WINDOWS\ServicePackFiles\i386\alrsvc.dll
+ 2008-04-14 02:33:20 17,408 ------w C:\WINDOWS\ServicePackFiles\i386\alrsvc.dll
- 2004-08-03 21:07:44 43,008 ------w C:\WINDOWS\ServicePackFiles\i386\amdagp.sys
+ 2008-04-13 18:36:40 43,008 ------w C:\WINDOWS\ServicePackFiles\i386\amdagp.sys
- 2004-08-19 13:52:42 41,216 ------w C:\WINDOWS\ServicePackFiles\i386\amdk6.sys
+ 2008-04-14 01:54:28 41,472 ------w C:\WINDOWS\ServicePackFiles\i386\amdk6.sys
- 2004-08-19 13:52:44 41,600 ------w C:\WINDOWS\ServicePackFiles\i386\amdk7.sys
+ 2008-04-14 01:54:30 41,856 ------w C:\WINDOWS\ServicePackFiles\i386\amdk7.sys
- 2004-08-19 14:09:20 70,656 ------w C:\WINDOWS\ServicePackFiles\i386\amstream.dll
+ 2008-04-14 02:33:20 70,656 ------w C:\WINDOWS\ServicePackFiles\i386\amstream.dll
- 2004-08-19 14:09:20 126,976 ------w C:\WINDOWS\ServicePackFiles\i386\apphelp.dll
+ 2008-04-14 02:33:20 125,952 ------w C:\WINDOWS\ServicePackFiles\i386\apphelp.dll
- 2004-08-19 14:09:20 334,336 ------w C:\WINDOWS\ServicePackFiles\i386\aqueue.dll
+ 2008-04-14 02:33:20 334,336 ------w C:\WINDOWS\ServicePackFiles\i386\aqueue.dll
- 2004-08-03 20:58:30 60,800 ------w C:\WINDOWS\ServicePackFiles\i386\arp1394.sys
+ 2008-04-13 18:51:26 60,800 ------w C:\WINDOWS\ServicePackFiles\i386\arp1394.sys
- 2004-08-19 14:09:20 65,024 ------w C:\WINDOWS\ServicePackFiles\i386\asycfilt.dll
+ 2008-04-14 02:33:20 65,024 ------w C:\WINDOWS\ServicePackFiles\i386\asycfilt.dll
- 2004-08-03 21:05:04 14,336 ------w C:\WINDOWS\ServicePackFiles\i386\asyncmac.sys
+ 2008-04-13 18:57:28 14,336 ------w C:\WINDOWS\ServicePackFiles\i386\asyncmac.sys
- 2004-08-19 14:09:52 25,088 ------w C:\WINDOWS\ServicePackFiles\i386\at.exe
+ 2008-04-14 02:33:54 25,088 ------w C:\WINDOWS\ServicePackFiles\i386\at.exe
- 2004-08-03 20:59:44 95,360 ------w C:\WINDOWS\ServicePackFiles\i386\atapi.sys
+ 2008-04-13 18:40:30 96,512 ------w C:\WINDOWS\ServicePackFiles\i386\atapi.sys
- 2004-08-19 14:09:20 229,376 ------w C:\WINDOWS\ServicePackFiles\i386\ati2cqag.dll
+ 2008-04-14 02:33:20 229,376 ------w C:\WINDOWS\ServicePackFiles\i386\ati2cqag.dll
- 2004-08-19 14:09:20 377,984 ------w C:\WINDOWS\ServicePackFiles\i386\ati2dvaa.dll
+ 2008-04-14 02:33:20 377,984 ------w C:\WINDOWS\ServicePackFiles\i386\ati2dvaa.dll
- 2004-08-19 14:09:20 201,728 ------w C:\WINDOWS\ServicePackFiles\i386\ati2dvag.dll
+ 2008-04-14 02:33:20 201,728 ------w C:\WINDOWS\ServicePackFiles\i386\ati2dvag.dll
- 2004-08-19 14:09:20 870,784 ------w C:\WINDOWS\ServicePackFiles\i386\ati3d1ag.dll
+ 2008-04-14 02:33:20 870,784 ------w C:\WINDOWS\ServicePackFiles\i386\ati3d1ag.dll
- 2004-08-19 14:09:20 1,057,760 ------w C:\WINDOWS\ServicePackFiles\i386\ati3d2ag.dll
+ 2008-04-14 02:33:20 1,057,760 ------w C:\WINDOWS\ServicePackFiles\i386\ati3d2ag.dll
- 2004-08-19 14:09:20 1,888,992 ------w C:\WINDOWS\ServicePackFiles\i386\ati3duag.dll
+ 2008-04-14 02:33:20 1,888,992 ------w C:\WINDOWS\ServicePackFiles\i386\ati3duag.dll
- 2004-08-19 14:09:20 32,768 ------w C:\WINDOWS\ServicePackFiles\i386\ativtmxx.dll
+ 2008-04-14 02:33:20 32,768 ------w C:\WINDOWS\ServicePackFiles\i386\ativtmxx.dll
- 2004-08-19 14:09:20 516,768 ------w C:\WINDOWS\ServicePackFiles\i386\ativvaxx.dll
+ 2008-04-14 02:33:20 516,768 ------w C:\WINDOWS\ServicePackFiles\i386\ativvaxx.dll
- 2004-08-19 14:09:20 58,880 ------w C:\WINDOWS\ServicePackFiles\i386\atl.dll
+ 2008-04-14 02:33:20 58,880 ------w C:\WINDOWS\ServicePackFiles\i386\atl.dll
- 2004-08-19 14:09:52 11,264 ------w C:\WINDOWS\ServicePackFiles\i386\atmadm.exe
+ 2008-04-14 02:33:54 11,264 ------w C:\WINDOWS\ServicePackFiles\i386\atmadm.exe
- 2004-08-03 20:58:32 59,904 ------w C:\WINDOWS\ServicePackFiles\i386\atmarpc.sys
+ 2008-04-13 18:51:26 59,904 ------w C:\WINDOWS\ServicePackFiles\i386\atmarpc.sys
- 2004-08-19 14:08:02 285,696 ------w C:\WINDOWS\ServicePackFiles\i386\atmfd.dll
+ 2008-04-14 02:31:00 285,696 ------w C:\WINDOWS\ServicePackFiles\i386\atmfd.dll
- 2004-08-03 20:58:36 55,936 ------w C:\WINDOWS\ServicePackFiles\i386\atmlane.sys
+ 2008-04-13 18:51:30 55,808 ------w C:\WINDOWS\ServicePackFiles\i386\atmlane.sys
- 2004-08-19 14:09:22 30,208 ------w C:\WINDOWS\ServicePackFiles\i386\atmlib.dll
+ 2008-04-14 02:33:20 30,208 ------w C:\WINDOWS\ServicePackFiles\i386\atmlib.dll
+ 2008-04-14 02:33:54 12,288 ------w C:\WINDOWS\ServicePackFiles\i386\attrib.exe
- 2004-08-19 14:09:22 21,183 ------w C:\WINDOWS\ServicePackFiles\i386\atv01nt5.dll
+ 2008-04-14 02:33:20 21,183 ------w C:\WINDOWS\ServicePackFiles\i386\atv01nt5.dll
- 2004-08-19 14:09:22 11,359 ------w C:\WINDOWS\ServicePackFiles\i386\atv02nt5.dll
+ 2008-04-14 02:33:20 11,359 ------w C:\WINDOWS\ServicePackFiles\i386\atv02nt5.dll
- 2004-08-19 14:09:22 25,471 ------w C:\WINDOWS\ServicePackFiles\i386\atv04nt5.dll
+ 2008-04-14 02:33:20 25,471 ------w C:\WINDOWS\ServicePackFiles\i386\atv04nt5.dll
- 2004-08-19 14:09:22 14,143 ------w C:\WINDOWS\ServicePackFiles\i386\atv06nt5.dll
+ 2008-04-14 02:33:20 14,143 ------w C:\WINDOWS\ServicePackFiles\i386\atv06nt5.dll
- 2004-08-19 14:09:22 17,279 ------w C:\WINDOWS\ServicePackFiles\i386\atv10nt5.dll
+ 2008-04-14 02:33:20 17,279 ------w C:\WINDOWS\ServicePackFiles\i386\atv10nt5.dll
- 2004-08-19 14:09:22 42,496 ------w C:\WINDOWS\ServicePackFiles\i386\audiosrv.dll
+ 2008-04-14 02:33:20 42,496 ------w C:\WINDOWS\ServicePackFiles\i386\audiosrv.dll
- 2004-08-19 14:09:52 14,336 ------w C:\WINDOWS\ServicePackFiles\i386\auditusr.exe
+ 2008-04-14 02:33:54 14,336 ------w C:\WINDOWS\ServicePackFiles\i386\auditusr.exe
- 2004-08-19 14:09:22 20,540 ------w C:\WINDOWS\ServicePackFiles\i386\author.dll
+ 2008-04-14 02:33:20 20,540 ------w C:\WINDOWS\ServicePackFiles\i386\author.dll
- 2004-08-19 14:09:52 16,439 ------w C:\WINDOWS\ServicePackFiles\i386\author.exe
+ 2008-04-14 02:33:54 16,439 ------w C:\WINDOWS\ServicePackFiles\i386\author.exe
- 2004-08-19 14:09:22 56,832 ------w C:\WINDOWS\ServicePackFiles\i386\authz.dll
+ 2008-04-14 02:33:20 62,464 ------w C:\WINDOWS\ServicePackFiles\i386\authz.dll
- 2004-08-19 14:09:52 625,152 ------w C:\WINDOWS\ServicePackFiles\i386\autochk.exe
+ 2008-04-14 02:33:54 625,152 ------w C:\WINDOWS\ServicePackFiles\i386\autochk.exe
- 2004-08-19 14:09:52 638,976 ------w C:\WINDOWS\ServicePackFiles\i386\autoconv.exe
+ 2008-04-14 02:33:54 638,976 ------w C:\WINDOWS\ServicePackFiles\i386\autoconv.exe
- 2004-08-19 14:09:52 616,960 ------w C:\WINDOWS\ServicePackFiles\i386\autofmt.exe
+ 2008-04-14 02:33:54 616,960 ------w C:\WINDOWS\ServicePackFiles\i386\autofmt.exe
- 2004-08-19 14:09:52 11,264 ------w C:\WINDOWS\ServicePackFiles\i386\autolfn.exe
+ 2008-04-14 02:33:54 11,264 ------w C:\WINDOWS\ServicePackFiles\i386\autolfn.exe
- 2004-08-03 21:10:12 38,912 ------w C:\WINDOWS\ServicePackFiles\i386\avc.sys
+ 2008-04-13 18:46:20 38,912 ------w C:\WINDOWS\ServicePackFiles\i386\avc.sys
- 2004-08-03 21:10:00 13,696 ------w C:\WINDOWS\ServicePackFiles\i386\avcstrm.sys
+ 2008-04-13 18:46:08 13,696 ------w C:\WINDOWS\ServicePackFiles\i386\avcstrm.sys
- 2004-08-19 14:09:22 85,504 ------w C:\WINDOWS\ServicePackFiles\i386\avifil32.dll
+ 2008-04-14 02:33:20 85,504 ------w C:\WINDOWS\ServicePackFiles\i386\avifil32.dll
+ 2008-04-14 02:33:20 233,472 ------w C:\WINDOWS\ServicePackFiles\i386\azroles.dll
- 2004-08-19 14:09:22 52,736 ------w C:\WINDOWS\ServicePackFiles\i386\basesrv.dll
+ 2008-04-14 02:33:20 52,736 ------w C:\WINDOWS\ServicePackFiles\i386\basesrv.dll
- 2004-08-19 14:09:22 28,672 ------w C:\WINDOWS\ServicePackFiles\i386\batmeter.dll
+ 2008-04-14 02:33:20 29,184 ------w C:\WINDOWS\ServicePackFiles\i386\batmeter.dll
- 2004-08-19 14:09:22 8,704 ------w C:\WINDOWS\ServicePackFiles\i386\batt.dll
+ 2008-04-14 02:33:20 8,704 ------w C:\WINDOWS\ServicePackFiles\i386\batt.dll
+ 2008-04-13 18:36:32 14,208 ------w C:\WINDOWS\ServicePackFiles\i386\battc.sys
- 2004-08-03 21:10:14 11,776 ------w C:\WINDOWS\ServicePackFiles\i386\bdasup.sys
+ 2008-04-13 18:46:22 11,776 ------w C:\WINDOWS\ServicePackFiles\i386\bdasup.sys
- 2004-08-19 14:09:22 17,408 ------w C:\WINDOWS\ServicePackFiles\i386\bidispl.dll
+ 2008-04-14 02:33:20 17,408 ------w C:\WINDOWS\ServicePackFiles\i386\bidispl.dll
- 2004-08-19 14:09:22 8,192 ------w C:\WINDOWS\ServicePackFiles\i386\bitsprx2.dll
+ 2008-04-14 02:33:20 8,192 ------w C:\WINDOWS\ServicePackFiles\i386\bitsprx2.dll
- 2004-08-19 14:09:22 7,168 ------w C:\WINDOWS\ServicePackFiles\i386\bitsprx3.dll
+ 2008-04-14 02:33:20 7,168 ------w C:\WINDOWS\ServicePackFiles\i386\bitsprx3.dll
+ 2008-04-14 02:33:20 7,168 ------w C:\WINDOWS\ServicePackFiles\i386\bitsprx4.dll
- 2004-08-19 14:09:52 71,680 ------w C:\WINDOWS\ServicePackFiles\i386\blastcln.exe
+ 2008-04-14 02:33:56 71,680 ------w C:\WINDOWS\ServicePackFiles\i386\blastcln.exe
- 2004-08-03 20:59:58 71,552 ------w C:\WINDOWS\ServicePackFiles\i386\bridge.sys
+ 2008-04-13 18:53:24 71,552 ------w C:\WINDOWS\ServicePackFiles\i386\bridge.sys
- 2004-08-19 14:08:04 70,144 ------w C:\WINDOWS\ServicePackFiles\i386\browselc.dll
+ 2008-04-14 01:57:48 70,144 ------w C:\WINDOWS\ServicePackFiles\i386\browselc.dll
- 2004-08-19 14:09:22 77,312 ------w C:\WINDOWS\ServicePackFiles\i386\browser.dll
+ 2008-04-14 02:33:20 77,824 ------w C:\WINDOWS\ServicePackFiles\i386\browser.dll
- 2004-08-19 14:09:22 1,017,344 ------w C:\WINDOWS\ServicePackFiles\i386\browseui.dll
+ 2008-04-14 02:33:20 1,025,024 ------w C:\WINDOWS\ServicePackFiles\i386\browseui.dll
- 2004-08-19 14:09:22 78,336 ------w C:\WINDOWS\ServicePackFiles\i386\browsewm.dll
+ 2008-04-14 02:33:20 78,336 ------w C:\WINDOWS\ServicePackFiles\i386\browsewm.dll
- 2004-08-19 14:09:22 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\bthci.dll
+ 2008-04-14 02:33:20 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\bthci.dll
- 2004-08-03 21:10:40 17,024 ------w C:\WINDOWS\ServicePackFiles\i386\bthenum.sys
+ 2008-04-13 18:46:34 17,024 ------w C:\WINDOWS\ServicePackFiles\i386\bthenum.sys
- 2004-08-03 21:10:40 38,016 ------w C:\WINDOWS\ServicePackFiles\i386\bthmodem.sys
+ 2008-04-13 18:46:34 37,888 ------w C:\WINDOWS\ServicePackFiles\i386\bthmodem.sys
- 2004-08-03 20:58:40 100,992 ------w C:\WINDOWS\ServicePackFiles\i386\bthpan.sys
+ 2008-04-13 18:51:34 101,120 ------w C:\WINDOWS\ServicePackFiles\i386\bthpan.sys
- 2004-08-19 13:55:32 274,944 ------w C:\WINDOWS\ServicePackFiles\i386\bthport.sys
+ 2008-04-14 01:58:00 273,664 ------w C:\WINDOWS\ServicePackFiles\i386\bthport.sys
- 2004-08-03 21:10:38 35,456 ------w C:\WINDOWS\ServicePackFiles\i386\bthprint.sys
+ 2008-04-13 18:46:32 36,480 ------w C:\WINDOWS\ServicePackFiles\i386\bthprint.sys
- 2004-08-19 14:09:22 30,208 ------w C:\WINDOWS\ServicePackFiles\i386\bthserv.dll
+ 2008-04-14 02:33:20 30,208 ------w C:\WINDOWS\ServicePackFiles\i386\bthserv.dll
- 2004-08-03 21:10:36 18,944 ------w C:\WINDOWS\ServicePackFiles\i386\bthusb.sys
+ 2008-04-13 18:46:30 18,944 ------w C:\WINDOWS\ServicePackFiles\i386\bthusb.sys
- 2004-08-19 14:09:22 50,688 ------w C:\WINDOWS\ServicePackFiles\i386\btpanui.dll
+ 2008-04-14 02:33:20 50,688 ------w C:\WINDOWS\ServicePackFiles\i386\btpanui.dll
+ 2008-04-14 02:33:20 218,112 ------w C:\WINDOWS\ServicePackFiles\i386\c_g18030.dll
- 2004-08-19 14:09:22 59,904 ------w C:\WINDOWS\ServicePackFiles\i386\cabinet.dll
+ 2008-04-14 02:33:20 60,416 ------w C:\WINDOWS\ServicePackFiles\i386\cabinet.dll
- 2004-08-19 14:09:22 85,504 ------w C:\WINDOWS\ServicePackFiles\i386\cabview.dll
+ 2008-04-14 02:33:20 85,504 ------w C:\WINDOWS\ServicePackFiles\i386\cabview.dll
+ 2008-04-14 02:33:56 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\cacls.exe
- 2004-08-19 14:09:22 385,024 ------w C:\WINDOWS\ServicePackFiles\i386\callcont.dll
+ 2008-04-14 02:33:20 385,024 ------w C:\WINDOWS\ServicePackFiles\i386\callcont.dll
+ 2008-04-14 02:33:20 121,856 ------w C:\WINDOWS\ServicePackFiles\i386\camext30.dll
- 2004-08-19 14:09:22 50,688 ------w C:\WINDOWS\ServicePackFiles\i386\camocx.dll
+ 2008-04-14 02:33:20 50,688 ------w C:\WINDOWS\ServicePackFiles\i386\camocx.dll
+ 2008-04-14 02:33:20 153,600 ------w C:\WINDOWS\ServicePackFiles\i386\capesnpn.dll
- 2004-08-19 14:09:22 229,888 ------w C:\WINDOWS\ServicePackFiles\i386\catsrv.dll
+ 2008-04-14 02:33:20 226,304 ------w C:\WINDOWS\ServicePackFiles\i386\catsrv.dll
- 2004-08-19 14:09:22 85,504 ------w C:\WINDOWS\ServicePackFiles\i386\catsrvps.dll
+ 2008-04-14 02:33:20 85,504 ------w C:\WINDOWS\ServicePackFiles\i386\catsrvps.dll
- 2004-08-19 14:09:22 628,224 ------w C:\WINDOWS\ServicePackFiles\i386\catsrvut.dll
+ 2008-04-14 02:33:20 625,664 ------w C:\WINDOWS\ServicePackFiles\i386\catsrvut.dll
- 2004-08-03 21:10:18 17,024 ------w C:\WINDOWS\ServicePackFiles\i386\ccdecode.sys
+ 2008-04-13 18:46:24 17,024 ------w C:\WINDOWS\ServicePackFiles\i386\ccdecode.sys
- 2004-08-03 21:14:12 63,744 ------w C:\WINDOWS\ServicePackFiles\i386\cdfs.sys
+ 2008-04-13 19:14:22 63,744 ------w C:\WINDOWS\ServicePackFiles\i386\cdfs.sys
- 2004-08-19 14:09:22 151,552 ------w C:\WINDOWS\ServicePackFiles\i386\cdfview.dll
+ 2008-04-14 02:33:20 152,064 ------w C:\WINDOWS\ServicePackFiles\i386\cdfview.dll
- 2004-08-19 14:09:22 66,560 ------w C:\WINDOWS\ServicePackFiles\i386\cdm.dll
+ 2008-04-14 02:33:20 66,560 ------w C:\WINDOWS\ServicePackFiles\i386\cdm.dll
- 2004-08-19 14:09:22 2,067,968 ------w C:\WINDOWS\ServicePackFiles\i386\cdosys.dll
+ 2008-04-14 02:33:20 2,091,520 ------w C:\WINDOWS\ServicePackFiles\i386\cdosys.dll
- 2004-08-03 20:59:54 49,536 ------w C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
+ 2008-04-13 18:40:46 62,976 ------w C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
- 2004-08-19 14:09:22 200,192 ------w C:\WINDOWS\ServicePackFiles\i386\certcli.dll
+ 2008-04-14 02:33:20 200,192 ------w C:\WINDOWS\ServicePackFiles\i386\certcli.dll
- 2004-08-19 14:09:22 467,968 ------w C:\WINDOWS\ServicePackFiles\i386\certmgr.dll
+ 2008-04-14 02:33:20 467,968 ------w C:\WINDOWS\ServicePackFiles\i386\certmgr.dll
- 2004-08-19 14:09:22 39,424 ------w C:\WINDOWS\ServicePackFiles\i386\cfgbkend.dll
+ 2008-04-14 02:33:20 39,424 ------w C:\WINDOWS\ServicePackFiles\i386\cfgbkend.dll
- 2004-08-19 14:08:04 16,896 ------w C:\WINDOWS\ServicePackFiles\i386\cfgmgr32.dll
+ 2008-04-14 02:31:04 16,896 ------w C:\WINDOWS\ServicePackFiles\i386\cfgmgr32.dll
- 2004-08-19 14:09:52 188,480 ------w C:\WINDOWS\ServicePackFiles\i386\cfgwiz.exe
+ 2008-04-14 02:33:56 188,480 ------w C:\WINDOWS\ServicePackFiles\i386\cfgwiz.exe
- 2004-08-19 14:09:22 15,423 ------w C:\WINDOWS\ServicePackFiles\i386\ch7xxnt5.dll
+ 2008-04-14 02:33:20 15,423 ------w C:\WINDOWS\ServicePackFiles\i386\ch7xxnt5.dll
- 2004-08-03 21:00:14 8,192 ------w C:\WINDOWS\ServicePackFiles\i386\changer.sys
+ 2008-04-13 18:40:58 8,192 ------w C:\WINDOWS\ServicePackFiles\i386\changer.sys
+ 2008-04-14 02:33:20 148,480 ------w C:\WINDOWS\ServicePackFiles\i386\cic.dll
- 2004-08-19 14:09:22 1,352,704 ------w C:\WINDOWS\ServicePackFiles\i386\cimwin32.dll
+ 2008-04-14 02:33:20 1,359,360 ------w C:\WINDOWS\ServicePackFiles\i386\cimwin32.dll
- 2004-08-19 14:09:22 69,120 ------w C:\WINDOWS\ServicePackFiles\i386\ciodm.dll
+ 2008-04-14 02:33:20 69,120 ------w C:\WINDOWS\ServicePackFiles\i386\ciodm.dll
- 2004-08-19 14:09:52 5,632 ------w C:\WINDOWS\ServicePackFiles\i386\cisvc.exe
+ 2008-04-14 02:33:58 5,632 ------w C:\WINDOWS\ServicePackFiles\i386\cisvc.exe
- 2004-08-03 21:14:28 49,664 ------w C:\WINDOWS\ServicePackFiles\i386\classpnp.sys
+ 2008-04-13 19:16:22 49,536 ------w C:\WINDOWS\ServicePackFiles\i386\classpnp.sys
- 2004-08-19 14:09:22 110,080 ------w C:\WINDOWS\ServicePackFiles\i386\clbcatex.dll
+ 2008-04-14 02:33:22 110,592 ------w C:\WINDOWS\ServicePackFiles\i386\clbcatex.dll
- 2004-08-19 14:09:22 501,248 ------w C:\WINDOWS\ServicePackFiles\i386\clbcatq.dll
+ 2008-04-14 02:33:22 498,688 ------w C:\WINDOWS\ServicePackFiles\i386\clbcatq.dll
- 2004-08-19 14:09:52 65,536 ------w C:\WINDOWS\ServicePackFiles\i386\cleanmgr.exe
+ 2008-04-14 02:33:58 65,536 ------w C:\WINDOWS\ServicePackFiles\i386\cleanmgr.exe
- 2004-08-19 14:09:22 77,824 ------w C:\WINDOWS\ServicePackFiles\i386\cliconfg.dll
+ 2008-04-14 02:33:22 77,824 ------w C:\WINDOWS\ServicePackFiles\i386\cliconfg.dll
- 2004-08-19 14:09:52 20,480 ------w C:\WINDOWS\ServicePackFiles\i386\cliconfg.exe
+ 2008-04-14 02:33:58 20,480 ------w C:\WINDOWS\ServicePackFiles\i386\cliconfg.exe
- 2004-08-19 14:09:52 104,448 ------w C:\WINDOWS\ServicePackFiles\i386\clipbrd.exe
+ 2008-04-14 02:33:58 104,448 ------w C:\WINDOWS\ServicePackFiles\i386\clipbrd.exe
- 2004-08-19 14:09:52 33,280 ------w C:\WINDOWS\ServicePackFiles\i386\clipsrv.exe
+ 2008-04-14 02:33:58 33,280 ------w C:\WINDOWS\ServicePackFiles\i386\clipsrv.exe
- 2004-08-19 14:09:22 57,856 ------w C:\WINDOWS\ServicePackFiles\i386\clusapi.dll
+ 2008-04-14 02:33:22 58,368 ------w C:\WINDOWS\ServicePackFiles\i386\clusapi.dll
- 2004-08-03 21:07:40 14,080 ------w C:\WINDOWS\ServicePackFiles\i386\cmbatt.sys
+ 2008-04-13 18:36:38 13,952 ------w C:\WINDOWS\ServicePackFiles\i386\cmbatt.sys
- 2004-08-19 14:09:22 15,872 ------w C:\WINDOWS\ServicePackFiles\i386\cmcfg32.dll
+ 2008-04-14 02:33:22 15,872 ------w C:\WINDOWS\ServicePackFiles\i386\cmcfg32.dll
- 2004-08-19 14:09:52 400,896 ------w C:\WINDOWS\ServicePackFiles\i386\cmd.exe
+ 2008-04-14 02:33:58 401,408 ------w C:\WINDOWS\ServicePackFiles\i386\cmd.exe
- 2004-08-19 14:09:22 352,256 ------w C:\WINDOWS\ServicePackFiles\i386\cmdial32.dll
+ 2008-04-14 02:33:22 353,280 ------w C:\WINDOWS\ServicePackFiles\i386\cmdial32.dll
- 2004-08-19 14:09:52 47,104 ------w C:\WINDOWS\ServicePackFiles\i386\cmdl32.exe
+ 2008-04-14 02:33:58 25,600 ------w C:\WINDOWS\ServicePackFiles\i386\cmdl32.exe
- 2004-08-19 14:09:52 40,448 ------w C:\WINDOWS\ServicePackFiles\i386\cmmon32.exe
+ 2008-04-14 02:33:58 39,936 ------w C:\WINDOWS\ServicePackFiles\i386\cmmon32.exe
- 2004-08-19 14:09:22 191,488 ------w C:\WINDOWS\ServicePackFiles\i386\cmprops.dll
+ 2008-04-14 02:33:22 191,488 ------w C:\WINDOWS\ServicePackFiles\i386\cmprops.dll
- 2004-08-19 14:09:22 13,824 ------w C:\WINDOWS\ServicePackFiles\i386\cmsetacl.dll
+ 2008-04-14 02:33:22 13,312 ------w C:\WINDOWS\ServicePackFiles\i386\cmsetacl.dll
- 2004-08-19 14:09:52 65,536 ------w C:\WINDOWS\ServicePackFiles\i386\cmstp.exe
+ 2008-04-14 02:33:58 65,536 ------w C:\WINDOWS\ServicePackFiles\i386\cmstp.exe
- 2004-08-19 14:09:22 40,960 ------w C:\WINDOWS\ServicePackFiles\i386\cmutil.dll
+ 2008-04-14 02:33:22 40,960 ------w C:\WINDOWS\ServicePackFiles\i386\cmutil.dll
- 2004-08-19 14:09:22 50,688 ------w C:\WINDOWS\ServicePackFiles\i386\cnbjmon.dll
+ 2008-04-14 02:33:22 50,688 ------w C:\WINDOWS\ServicePackFiles\i386\cnbjmon.dll
- 2004-08-19 14:09:22 83,968 ------w C:\WINDOWS\ServicePackFiles\i386\cnbjmon2.dll
+ 2008-04-14 02:33:22 83,968 ------w C:\WINDOWS\ServicePackFiles\i386\cnbjmon2.dll
+ 2008-04-13 16:44:16 17,920 ------w C:\WINDOWS\ServicePackFiles\i386\cobramsg.dll
- 2004-08-19 14:09:22 62,464 ------w C:\WINDOWS\ServicePackFiles\i386\colbact.dll
+ 2008-04-14 02:33:22 60,416 ------w C:\WINDOWS\ServicePackFiles\i386\colbact.dll
+ 2008-04-14 02:33:22 28,160 ------w C:\WINDOWS\ServicePackFiles\i386\comaddin.dll
- 2004-08-19 14:09:22 195,584 ------w C:\WINDOWS\ServicePackFiles\i386\comadmin.dll
+ 2008-04-14 02:33:22 195,072 ------w C:\WINDOWS\ServicePackFiles\i386\comadmin.dll
- 2004-08-19 14:09:22 611,328 ------w C:\WINDOWS\ServicePackFiles\i386\comctl32.dll
+ 2008-04-14 02:33:22 617,472 ------w C:\WINDOWS\ServicePackFiles\i386\comctl32.dll
- 2004-08-19 14:09:22 281,088 ------w C:\WINDOWS\ServicePackFiles\i386\comdlg32.dll
+ 2008-04-14 02:33:22 281,600 ------w C:\WINDOWS\ServicePackFiles\i386\comdlg32.dll
- 2004-08-19 14:09:22 253,440 ------w C:\WINDOWS\ServicePackFiles\i386\compatui.dll
+ 2008-04-14 02:33:22 253,440 ------w C:\WINDOWS\ServicePackFiles\i386\compatui.dll
+ 2008-04-13 18:36:38 10,240 ------w C:\WINDOWS\ServicePackFiles\i386\compbatt.sys
- 2004-08-19 14:09:22 230,912 ------w C:\WINDOWS\ServicePackFiles\i386\compstui.dll
+ 2008-04-14 02:33:22 230,912 ------w C:\WINDOWS\ServicePackFiles\i386\compstui.dll
+ 2008-04-14 02:33:22 97,792 ------w C:\WINDOWS\ServicePackFiles\i386\comrepl.dll
- 2004-08-19 14:09:52 9,728 ------w C:\WINDOWS\ServicePackFiles\i386\comrepl.exe
+ 2008-04-14 02:33:58 9,728 ------w C:\WINDOWS\ServicePackFiles\i386\comrepl.exe
+ 2008-04-14 02:33:58 6,144 ------w C:\WINDOWS\ServicePackFiles\i386\comrereg.exe
- 2004-08-19 14:09:22 851,968 ------w C:\WINDOWS\ServicePackFiles\i386\comres.dll
+ 2008-04-14 02:33:22 851,968 ------w C:\WINDOWS\ServicePackFiles\i386\comres.dll
+ 2008-04-14 02:33:22 274,944 ------w C:\WINDOWS\ServicePackFiles\i386\comsetup.dll
+ 2008-04-14 02:33:22 167,424 ------w C:\WINDOWS\ServicePackFiles\i386\comsnap.dll
- 2004-08-19 14:09:22 1,251,840 ------w C:\WINDOWS\ServicePackFiles\i386\comsvcs.dll
+ 2008-04-14 02:33:22 1,267,200 ------w C:\WINDOWS\ServicePackFiles\i386\comsvcs.dll
- 2004-08-19 14:09:22 540,160 ------w C:\WINDOWS\ServicePackFiles\i386\comuid.dll
+ 2008-04-14 02:33:22 539,648 ------w C:\WINDOWS\ServicePackFiles\i386\comuid.dll
- 2004-08-19 14:09:52 1,044,480 ------w C:\WINDOWS\ServicePackFiles\i386\conf.exe
+ 2008-04-14 02:33:58 1,044,480 ------w C:\WINDOWS\ServicePackFiles\i386\conf.exe
- 2004-08-19 14:09:22 45,056 ------w C:\WINDOWS\ServicePackFiles\i386\confmrsl.dll
+ 2008-04-14 02:33:22 45,056 ------w C:\WINDOWS\ServicePackFiles\i386\confmrsl.dll
+ 2008-04-14 02:33:22 358,400 ------w C:\WINDOWS\ServicePackFiles\i386\confmsp.dll
- 2004-08-19 14:09:52 27,648 ------w C:\WINDOWS\ServicePackFiles\i386\conime.exe
+ 2008-04-14 02:34:00 27,648 ------w C:\WINDOWS\ServicePackFiles\i386\conime.exe
- 2004-08-19 14:09:22 35,328 ------w C:\WINDOWS\ServicePackFiles\i386\corpol.dll
+ 2008-04-14 02:33:22 35,328 ------w C:\WINDOWS\ServicePackFiles\i386\corpol.dll
+ 2008-04-14 02:33:22 12,800 ------w C:\WINDOWS\ServicePackFiles\i386\credssp.dll
- 2004-08-19 14:09:22 165,888 ------w C:\WINDOWS\ServicePackFiles\i386\credui.dll
+ 2008-04-14 02:33:22 165,888 ------w C:\WINDOWS\ServicePackFiles\i386\credui.dll
- 2004-08-19 13:59:26 40,704 ------w C:\WINDOWS\ServicePackFiles\i386\crusoe.sys
+ 2008-04-14 02:02:48 40,960 ------w C:\WINDOWS\ServicePackFiles\i386\crusoe.sys
- 2004-08-19 14:09:22 604,672 ------w C:\WINDOWS\ServicePackFiles\i386\crypt32.dll
+ 2008-04-14 02:33:22 606,208 ------w C:\WINDOWS\ServicePackFiles\i386\crypt32.dll
- 2004-08-19 14:09:22 75,776 ------w C:\WINDOWS\ServicePackFiles\i386\cryptdlg.dll
+ 2008-04-14 02:33:22 75,776 ------w C:\WINDOWS\ServicePackFiles\i386\cryptdlg.dll
- 2004-08-19 14:09:22 33,280 ------w C:\WINDOWS\ServicePackFiles\i386\cryptdll.dll
+ 2008-04-14 02:33:22 33,280 ------w C:\WINDOWS\ServicePackFiles\i386\cryptdll.dll
- 2004-08-19 14:09:22 54,784 ------w C:\WINDOWS\ServicePackFiles\i386\cryptext.dll
+ 2008-04-14 02:33:22 54,784 ------w C:\WINDOWS\ServicePackFiles\i386\cryptext.dll
- 2004-08-19 14:09:22 63,488 ------w C:\WINDOWS\ServicePackFiles\i386\cryptnet.dll
+ 2008-04-14 02:33:22 64,512 ------w C:\WINDOWS\ServicePackFiles\i386\cryptnet.dll
- 2004-08-19 14:09:22 60,416 ------w C:\WINDOWS\ServicePackFiles\i386\cryptsvc.dll
+ 2008-04-14 02:33:22 62,464 ------w C:\WINDOWS\ServicePackFiles\i386\cryptsvc.dll
- 2004-08-19 14:09:22 530,432 ------w C:\WINDOWS\ServicePackFiles\i386\cryptui.dll
+ 2008-04-14 02:33:22 530,432 ------w C:\WINDOWS\ServicePackFiles\i386\cryptui.dll
- 2004-08-19 14:09:22 102,912 ------w C:\WINDOWS\ServicePackFiles\i386\cscdll.dll
+ 2008-04-14 02:33:22 102,912 ------w C:\WINDOWS\ServicePackFiles\i386\cscdll.dll
- 2004-08-19 14:09:52 98,304 ------w C:\WINDOWS\ServicePackFiles\i386\cscript.exe
+ 2008-04-14 02:34:00 139,264 ------w C:\WINDOWS\ServicePackFiles\i386\cscript.exe
- 2004-08-19 14:09:22 337,920 ------w C:\WINDOWS\ServicePackFiles\i386\cscui.dll
+ 2008-04-14 02:33:22 337,920 ------w C:\WINDOWS\ServicePackFiles\i386\cscui.dll
- 2004-08-19 14:09:22 32,768 ------w C:\WINDOWS\ServicePackFiles\i386\csrsrv.dll
+ 2008-04-14 02:33:22 32,256 ------w C:\WINDOWS\ServicePackFiles\i386\csrsrv.dll
- 2004-08-19 14:09:52 6,144 ------w C:\WINDOWS\ServicePackFiles\i386\csrss.exe
+ 2008-04-14 02:34:00 6,144 ------w C:\WINDOWS\ServicePackFiles\i386\csrss.exe
- 2004-08-19 14:09:52 15,360 ------w C:\WINDOWS\ServicePackFiles\i386\ctfmon.exe
+ 2008-04-14 02:34:00 15,360 ------w C:\WINDOWS\ServicePackFiles\i386\ctfmon.exe
- 2004-08-19 14:09:22 252,416 ------w C:\WINDOWS\ServicePackFiles\i386\ctmasetp.dll
+ 2008-04-14 02:33:22 252,416 ------w C:\WINDOWS\ServicePackFiles\i386\ctmasetp.dll
- 2004-08-19 14:09:22 28,672 ------w C:\WINDOWS\ServicePackFiles\i386\custsat.dll
+ 2008-04-14 02:33:22 33,792 ------w C:\WINDOWS\ServicePackFiles\i386\custsat.dll
- 2004-08-19 14:09:22 1,179,648 ------w C:\WINDOWS\ServicePackFiles\i386\d3d8.dll
+ 2008-04-14 02:33:22 1,179,648 ------w C:\WINDOWS\ServicePackFiles\i386\d3d8.dll
- 2004-08-19 14:09:22 8,192 ------w C:\WINDOWS\ServicePackFiles\i386\d3d8thk.dll
+ 2008-04-14 02:33:22 8,192 ------w C:\WINDOWS\ServicePackFiles\i386\d3d8thk.dll
- 2004-08-19 14:09:22 1,689,088 ------w C:\WINDOWS\ServicePackFiles\i386\d3d9.dll
+ 2008-04-14 02:33:22 1,689,088 ------w C:\WINDOWS\ServicePackFiles\i386\d3d9.dll
- 2004-08-19 14:09:24 825,344 ------w C:\WINDOWS\ServicePackFiles\i386\d3dim700.dll
+ 2008-04-14 02:33:22 824,320 ------w C:\WINDOWS\ServicePackFiles\i386\d3dim700.dll
- 2004-08-19 14:09:24 1,056,256 ------w C:\WINDOWS\ServicePackFiles\i386\danim.dll
+ 2008-04-14 02:33:22 1,056,768 ------w C:\WINDOWS\ServicePackFiles\i386\danim.dll
- 2004-08-19 14:09:24 561,179 ------w C:\WINDOWS\ServicePackFiles\i386\dao360.dll
+ 2008-03-25 04:50:26 554,008 ------w C:\WINDOWS\ServicePackFiles\i386\dao360.dll
- 2004-08-19 14:09:24 55,296 ------w C:\WINDOWS\ServicePackFiles\i386\dataclen.dll
+ 2008-04-14 02:33:22 55,296 ------w C:\WINDOWS\ServicePackFiles\i386\dataclen.dll
+ 2008-04-14 02:33:22 165,376 ------w C:\WINDOWS\ServicePackFiles\i386\datime.dll
- 2004-08-19 14:09:24 25,088 ------w C:\WINDOWS\ServicePackFiles\i386\davclnt.dll
+ 2008-04-14 02:33:22 25,600 ------w C:\WINDOWS\ServicePackFiles\i386\davclnt.dll
- 2004-08-19 14:09:24 640,000 ------w C:\WINDOWS\ServicePackFiles\i386\dbghelp.dll
+ 2008-04-14 02:33:22 640,000 ------w C:\WINDOWS\ServicePackFiles\i386\dbghelp.dll
- 2004-08-19 14:09:24 24,576 ------w C:\WINDOWS\ServicePackFiles\i386\dbmsrpcn.dll
+ 2008-04-14 02:33:22 24,576 ------w C:\WINDOWS\ServicePackFiles\i386\dbmsrpcn.dll
- 2004-08-19 14:09:24 110,592 ------w C:\WINDOWS\ServicePackFiles\i386\dbnetlib.dll
+ 2008-04-14 02:33:22 110,592 ------w C:\WINDOWS\ServicePackFiles\i386\dbnetlib.dll
- 2004-08-19 14:09:24 28,672 ------w C:\WINDOWS\ServicePackFiles\i386\dbnmpntw.dll
+ 2008-04-14 02:33:22 28,672 ------w C:\WINDOWS\ServicePackFiles\i386\dbnmpntw.dll
- 2004-08-19 14:23:26 1,788 ------w C:\WINDOWS\ServicePackFiles\i386\dcache.bin
+ 2008-04-14 02:50:20 1,804 ------w C:\WINDOWS\ServicePackFiles\i386\dcache.bin
- 2004-08-19 14:09:24 40,960 ------w C:\WINDOWS\ServicePackFiles\i386\dcap32.dll
+ 2008-04-14 02:33:22 40,960 ------w C:\WINDOWS\ServicePackFiles\i386\dcap32.dll
- 2004-08-19 14:09:24 8,704 ------w C:\WINDOWS\ServicePackFiles\i386\dciman32.dll
+ 2008-04-14 02:33:22 8,704 ------w C:\WINDOWS\ServicePackFiles\i386\dciman32.dll
+ 2008-04-14 02:34:00 6,144 ------w C:\WINDOWS\ServicePackFiles\i386\dcomcnfg.exe
- 2004-08-19 14:09:52 31,744 ------w C:\WINDOWS\ServicePackFiles\i386\ddeshare.exe
+ 2008-04-14 02:34:00 31,744 ------w C:\WINDOWS\ServicePackFiles\i386\ddeshare.exe
- 2004-08-19 14:09:24 266,240 ------w C:\WINDOWS\ServicePackFiles\i386\ddraw.dll
+ 2008-04-14 02:33:22 279,552 ------w C:\WINDOWS\ServicePackFiles\i386\ddraw.dll
- 2004-08-19 14:09:24 27,136 ------w C:\WINDOWS\ServicePackFiles\i386\ddrawex.dll
+ 2008-04-14 02:33:22 27,136 ------w C:\WINDOWS\Serv
ComboFix 08-09-25.05 - moua 2008-09-26 10:44:46.2 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.235 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\moua\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\moua\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
FILE ::
C:\RavMon.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_BOONTY_GAMES
-------\Service_Boonty Games
((((((((((((((((((((((((((((( Fichiers créés du 2008-08-26 au 2008-09-26 ))))))))))))))))))))))))))))))))))))
.
2008-09-26 10:29 . 2008-09-26 10:29 <REP> d-------- C:\Documents and Settings\moua\Contacts
2008-09-24 22:33 . 2008-09-24 22:33 <REP> d-------- C:\WINDOWS\system32\fr
2008-09-24 22:33 . 2008-09-24 22:33 <REP> d-------- C:\WINDOWS\system32\bits
2008-09-24 22:33 . 2008-09-24 22:33 <REP> d-------- C:\WINDOWS\l2schemas
2008-09-23 22:07 . 2008-09-23 22:07 <REP> d-------- C:\Program Files\Zylom Games
2008-09-23 00:46 . 2008-04-14 04:04 93,184 --------- C:\WINDOWS\system32\dllcache\msxml6r.dll
2008-09-23 00:43 . 2006-12-28 21:01 19,569 --a------ C:\WINDOWS\[u]0[/u]03534_.tmp
2008-09-23 00:42 . 2008-04-14 04:10 2,524 --------- C:\WINDOWS\system32\pid.inf
2008-09-21 21:26 . 2008-09-21 21:26 <REP> d-------- C:\Documents and Settings\moua\Application Data\Malwarebytes
2008-09-21 20:20 . 2008-09-21 20:20 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-21 20:20 . 2008-09-21 20:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-21 20:20 . 2008-09-21 20:20 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2008-09-21 20:20 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-21 20:20 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-21 18:46 . 2008-09-21 18:46 <REP> d-------- C:\WINDOWS\ERUNT
2008-09-21 18:35 . 2008-09-19 02:57 <REP> d-------- C:\SDFix
2008-09-21 18:34 . 2008-09-21 18:34 <REP> d-------- C:\Program Files\Trend Micro
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-09-21 18:31 . 2006-08-25 06:17 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-09-21 18:31 . 2006-08-25 05:55 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-09-21 18:31 . 2006-08-25 06:17 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-09-21 18:31 . 2006-08-25 05:55 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-09-21 18:31 . 2006-08-25 06:35 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Acer
2008-09-21 18:31 . 2008-09-21 18:31 <REP> d-------- C:\Documents and Settings\Administrateur
2008-09-17 16:36 . 2008-09-17 16:36 <REP> d--hs---- C:\FOUND.014
2008-09-16 23:53 . 2008-09-16 23:53 <REP> d--hs---- C:\FOUND.013
2008-09-16 09:42 . 2008-09-16 09:42 <REP> d--hs---- C:\FOUND.012
2008-09-16 08:49 . 2008-09-16 08:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-09-16 00:10 . 2008-09-16 00:10 <REP> d-------- C:\Program Files\CCleaner
2008-09-16 00:09 . 2008-09-16 00:09 <REP> d-------- C:\Documents and Settings\moua\Application Data\Grisoft
2008-09-16 00:09 . 2008-09-16 00:09 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-09-16 00:09 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-09-12 15:44 . 2008-09-12 15:45 <REP> d-------- C:\Program Files\Fichiers communs\xing shared
2008-09-10 17:06 . 2008-09-10 17:06 <REP> d-------- C:\Documents and Settings\moua\Application Data\Zylom
2008-08-30 22:24 . 2008-05-01 16:36 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-30 22:18 . 2008-04-11 21:05 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe
2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-09-08 21:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-02 14:51 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-08-18 10:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:28 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
.
((((((((((((((((((((((((((((( snapshot@2008-09-23_13.32.05.25 )))))))))))))))))))))))))))))))))))))))))
.
- 2004-08-19 14:09:34 82,944 ------w C:\WINDOWS\$NtUninstallKB946648$\msgsc.dll
- 2006-07-13 07:48:58 202,240 ------w C:\WINDOWS\$NtUninstallKB950762$\rmcast.sys
+ 2006-07-13 07:48:58 202,240 ------w C:\WINDOWS\$NtUninstallKB950762_0$\rmcast.sys
+ 2007-11-30 12:39:30 234,872 ------w C:\WINDOWS\$NtUninstallKB950762_0$\spuninst\spuninst.exe
+ 2007-11-30 12:39:32 406,392 ------w C:\WINDOWS\$NtUninstallKB950762_0$\spuninst\updspapi.dll
- 2005-07-26 03:39:58 243,200 ------w C:\WINDOWS\$NtUninstallKB950974$\es.dll
- 2007-08-21 06:17:24 683,520 ------w C:\WINDOWS\$NtUninstallKB951066$\inetcomm.dll
- 2008-04-14 15:52:46 272,768 ------w C:\WINDOWS\$NtUninstallKB951376-v2$\bthport.sys
+ 2008-04-14 15:52:46 272,768 ------w C:\WINDOWS\$NtUninstallKB951376-v2_0$\bthport.sys
+ 2007-11-30 11:19:06 234,872 ------w C:\WINDOWS\$NtUninstallKB951376-v2_0$\spuninst\spuninst.exe
+ 2007-11-30 11:19:10 406,392 ------w C:\WINDOWS\$NtUninstallKB951376-v2_0$\spuninst\updspapi.dll
- 2004-08-03 22:40:30 274,944 ------w C:\WINDOWS\$NtUninstallKB951376$\bthport.sys
+ 2004-08-03 22:40:30 274,944 ------w C:\WINDOWS\$NtUninstallKB951376_0$\bthport.sys
+ 2007-11-30 11:19:06 234,872 ------w C:\WINDOWS\$NtUninstallKB951376_0$\spuninst\spuninst.exe
+ 2007-11-30 11:19:10 406,392 ------w C:\WINDOWS\$NtUninstallKB951376_0$\spuninst\updspapi.dll
- 2007-10-29 21:43:32 1,293,824 ------w C:\WINDOWS\$NtUninstallKB951698$\quartz.dll
+ 2007-10-29 21:43:32 1,293,824 ------w C:\WINDOWS\$NtUninstallKB951698_0$\quartz.dll
+ 2007-11-30 11:19:06 234,872 ------w C:\WINDOWS\$NtUninstallKB951698_0$\spuninst\spuninst.exe
+ 2007-11-30 12:39:32 406,392 ------w C:\WINDOWS\$NtUninstallKB951698_0$\spuninst\updspapi.dll
- 2004-08-05 03:00:00 138,496 ------w C:\WINDOWS\$NtUninstallKB951748$\afd.sys
- 2008-02-20 05:35:06 148,992 ------w C:\WINDOWS\$NtUninstallKB951748$\dnsapi.dll
- 2004-08-19 14:09:36 247,808 ------w C:\WINDOWS\$NtUninstallKB951748$\mswsock.dll
- 2007-10-30 16:20:56 360,064 ------w C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
- 2006-08-16 08:37:30 225,664 ------w C:\WINDOWS\$NtUninstallKB951748$\tcpip6.sys
+ 2004-08-05 03:00:00 138,496 ------w C:\WINDOWS\$NtUninstallKB951748_0$\afd.sys
+ 2008-02-20 05:35:06 148,992 ------w C:\WINDOWS\$NtUninstallKB951748_0$\dnsapi.dll
+ 2004-08-19 14:09:36 247,808 ------w C:\WINDOWS\$NtUninstallKB951748_0$\mswsock.dll
+ 2007-11-30 12:39:30 234,872 ------w C:\WINDOWS\$NtUninstallKB951748_0$\spuninst\spuninst.exe
+ 2007-11-30 12:39:30 406,392 ------w C:\WINDOWS\$NtUninstallKB951748_0$\spuninst\updspapi.dll
+ 2007-10-30 16:20:56 360,064 ------w C:\WINDOWS\$NtUninstallKB951748_0$\tcpip.sys
+ 2006-08-16 08:37:30 225,664 ------w C:\WINDOWS\$NtUninstallKB951748_0$\tcpip6.sys
- 2004-08-19 14:09:34 331,776 ------w C:\WINDOWS\$NtUninstallKB952287$\msadce.dll
- 2005-06-29 00:49:42 74,240 ------w C:\WINDOWS\$NtUninstallKB952954$\mscms.dll
- 2006-10-04 13:05:26 39,424 ------w C:\WINDOWS\AppPatch\acadproc.dll
+ 2008-04-14 02:33:18 39,424 ----a-w C:\WINDOWS\AppPatch\acadproc.dll
- 2004-08-19 14:09:20 1,852,416 ----a-w C:\WINDOWS\AppPatch\AcGenral.dll
+ 2008-04-14 02:33:18 1,852,928 ----a-w C:\WINDOWS\AppPatch\AcGenral.dll
- 2004-08-19 14:09:20 450,048 ----a-w C:\WINDOWS\AppPatch\AcLayers.dll
+ 2008-04-14 02:33:18 451,072 ----a-w C:\WINDOWS\AppPatch\AcLayers.dll
- 2004-08-19 14:09:20 137,728 ----a-w C:\WINDOWS\AppPatch\AcLua.dll
+ 2008-04-14 02:33:18 141,312 ----a-w C:\WINDOWS\AppPatch\AcLua.dll
- 2004-08-19 14:09:20 244,736 ----a-w C:\WINDOWS\AppPatch\AcSpecfc.dll
+ 2008-04-14 02:33:18 245,248 ----a-w C:\WINDOWS\AppPatch\AcSpecfc.dll
- 2004-08-19 14:09:20 116,224 ----a-w C:\WINDOWS\AppPatch\AcXtrnal.dll
+ 2008-04-14 02:33:18 116,224 ----a-w C:\WINDOWS\AppPatch\AcXtrnal.dll
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
- 2007-06-13 13:22:28 1,037,312 ----a-w C:\WINDOWS\explorer.exe
+ 2008-04-14 02:34:04 1,037,824 ----a-w C:\WINDOWS\explorer.exe
- 2004-08-19 14:09:44 34,816 ----a-w C:\WINDOWS\Help\sniffpol.dll
+ 2008-04-14 02:33:42 34,816 ----a-w C:\WINDOWS\Help\sniffpol.dll
- 2004-08-19 14:09:46 33,280 ----a-w C:\WINDOWS\Help\sstub.dll
+ 2008-04-14 02:33:46 33,280 ----a-w C:\WINDOWS\Help\sstub.dll
- 2004-08-19 14:09:48 279,040 ----a-w C:\WINDOWS\Help\tshoot.dll
+ 2008-04-14 02:33:46 279,040 ----a-w C:\WINDOWS\Help\tshoot.dll
- 2005-05-26 22:22:02 10,752 ----a-w C:\WINDOWS\hh.exe
+ 2008-04-14 02:34:06 10,752 ----a-w C:\WINDOWS\hh.exe
- 2004-08-05 03:00:00 175,104 ----a-w C:\WINDOWS\ime\chsime\applets\PINTLCSA.DLL
+ 2008-04-14 02:32:16 175,104 ----a-w C:\WINDOWS\ime\chsime\applets\pintlcsa.dll
- 2004-08-05 03:00:00 53,760 ----a-w C:\WINDOWS\ime\chsime\applets\PINTLCSD.DLL
+ 2008-04-14 02:32:16 53,760 ----a-w C:\WINDOWS\ime\chsime\applets\pintlcsd.dll
- 2004-08-05 03:00:00 97,792 ----a-w C:\WINDOWS\ime\CHTIME\Applets\CHTMBX.DLL
+ 2008-04-14 02:31:04 97,792 ----a-w C:\WINDOWS\ime\CHTIME\Applets\chtmbx.dll
- 2004-08-05 03:00:00 56,320 ----a-w C:\WINDOWS\ime\CHTIME\Applets\CHTSKDIC.DLL
+ 2008-04-14 02:31:04 56,320 ----a-w C:\WINDOWS\ime\CHTIME\Applets\chtskdic.dll
- 2004-08-05 03:00:00 173,568 ----a-w C:\WINDOWS\ime\CHTIME\Applets\CHTSKF.DLL
+ 2008-04-14 02:31:04 173,568 ----a-w C:\WINDOWS\ime\CHTIME\Applets\chtskf.dll
- 2004-08-05 03:00:00 13,463,552 ----a-w C:\WINDOWS\ime\imjp8_1\applets\hwxjpn.dll
+ 2008-04-14 02:31:30 13,463,552 ----a-w C:\WINDOWS\ime\imjp8_1\applets\hwxjpn.dll
- 2004-08-05 03:00:00 315,452 ----a-w C:\WINDOWS\ime\imjp8_1\applets\imskf.dll
+ 2008-04-14 02:31:34 315,455 ----a-w C:\WINDOWS\ime\imjp8_1\applets\imskf.dll
- 2004-08-05 03:00:00 426,041 ----a-w C:\WINDOWS\ime\imjp8_1\applets\voicepad.dll
+ 2008-04-14 02:32:46 426,041 ----a-w C:\WINDOWS\ime\imjp8_1\applets\voicepad.dll
- 2004-08-05 03:00:00 86,073 ----a-w C:\WINDOWS\ime\imjp8_1\applets\voicesub.dll
+ 2008-04-14 02:32:46 86,073 ----a-w C:\WINDOWS\ime\imjp8_1\applets\voicesub.dll
- 2004-08-05 03:00:00 368,696 ----a-w C:\WINDOWS\ime\imjp8_1\imjpcic.dll
+ 2008-04-14 02:31:34 368,696 ----a-w C:\WINDOWS\ime\imjp8_1\imjpcic.dll
- 2004-08-05 03:00:00 716,856 ----a-w C:\WINDOWS\ime\imjp8_1\imjpcus.dll
+ 2008-04-14 02:31:34 716,856 ----a-w C:\WINDOWS\ime\imjp8_1\imjpcus.dll
- 2004-08-05 03:00:00 81,976 ----a-w C:\WINDOWS\ime\imjp8_1\imjpdct.dll
+ 2008-04-14 02:31:34 81,976 ----a-w C:\WINDOWS\ime\imjp8_1\imjpdct.dll
- 2004-08-05 03:00:00 274,489 ----a-w C:\WINDOWS\ime\imjp8_1\imjputyc.dll
+ 2008-04-14 02:31:34 274,489 ----a-w C:\WINDOWS\ime\imjp8_1\imjputyc.dll
- 2004-08-05 03:00:00 86,016 ----a-w C:\WINDOWS\ime\imkr6_1\applets\imekrmbx.dll
+ 2008-04-14 02:31:34 86,016 ----a-w C:\WINDOWS\ime\imkr6_1\applets\imekrmbx.dll
- 2004-08-05 03:00:00 106,496 ----a-w C:\WINDOWS\ime\imkr6_1\imekrcic.dll
+ 2008-04-14 02:31:34 106,496 ----a-w C:\WINDOWS\ime\imkr6_1\imekrcic.dll
- 2004-08-19 14:09:34 220,160 ----a-w C:\WINDOWS\ime\mscandui.dll
+ 2008-04-14 02:33:30 220,160 ----a-w C:\WINDOWS\ime\mscandui.dll
- 2004-08-05 03:00:00 102,456 ----a-w C:\WINDOWS\ime\shared\imlang.dll
+ 2008-04-14 02:31:34 102,456 ----a-w C:\WINDOWS\ime\shared\imlang.dll
- 2004-08-05 03:00:00 15,872 ----a-w C:\WINDOWS\ime\shared\res\PADRS404.DLL
+ 2008-04-14 02:32:16 15,872 ----a-w C:\WINDOWS\ime\shared\res\padrs404.dll
- 2004-08-05 03:00:00 15,360 ----a-w C:\WINDOWS\ime\shared\res\padrs804.dll
+ 2008-04-14 02:32:16 15,360 ----a-w C:\WINDOWS\ime\shared\res\padrs804.dll
- 2004-08-19 14:09:44 130,048 ----a-w C:\WINDOWS\ime\softkbd.dll
+ 2008-04-14 02:33:42 130,048 ----a-w C:\WINDOWS\ime\softkbd.dll
- 2004-08-19 14:08:56 62,976 ----a-w C:\WINDOWS\ime\spgrmr.dll
+ 2008-04-13 16:43:18 62,976 ----a-w C:\WINDOWS\ime\spgrmr.dll
- 2004-08-19 14:09:44 272,384 ----a-w C:\WINDOWS\ime\sptip.dll
+ 2008-04-14 02:33:46 272,384 ----a-w C:\WINDOWS\ime\sptip.dll
- 2007-12-11 15:49:10 29,926 ----a-r C:\WINDOWS\Installer\{BADF6744-3787-48F6-B8C9-4C4995401D65}\MsblIco.Exe
+ 2008-09-24 20:44:58 29,926 ----a-r C:\WINDOWS\Installer\{BADF6744-3787-48F6-B8C9-4C4995401D65}\MsblIco.Exe
+ 2008-01-18 15:13:10 2,247 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscdsbl.bat
- 2006-11-07 08:06:48 16,832 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscinst.vbs
+ 2007-12-12 10:33:52 18,917 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscinst.vbs
- 2006-11-07 08:06:48 12,451 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscuinst.vbs
+ 2007-10-30 10:06:46 13,801 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscuinst.vbs
+ 2008-04-14 02:33:06 25,600 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscupdc.dll
- 2004-08-19 14:09:20 24,064 ----a-w C:\WINDOWS\msagent\agentanm.dll
+ 2008-04-14 02:33:18 24,064 ----a-w C:\WINDOWS\msagent\agentanm.dll
- 2004-08-19 14:09:20 214,016 ----a-w C:\WINDOWS\msagent\agentctl.dll
+ 2008-04-14 02:33:18 214,016 ----a-w C:\WINDOWS\msagent\agentctl.dll
- 2006-10-12 13:04:14 42,496 ----a-w C:\WINDOWS\msagent\agentdp2.dll
+ 2008-04-14 02:33:18 42,496 ----a-w C:\WINDOWS\msagent\agentdp2.dll
- 2007-03-09 14:00:38 57,344 ----a-w C:\WINDOWS\msagent\agentdpv.dll
+ 2008-04-14 02:33:18 57,344 ----a-w C:\WINDOWS\msagent\agentdpv.dll
- 2004-08-19 14:09:20 49,152 ----a-w C:\WINDOWS\msagent\agentmpx.dll
+ 2008-04-14 02:33:18 49,152 ----a-w C:\WINDOWS\msagent\agentmpx.dll
- 2004-08-19 14:09:20 24,064 ----a-w C:\WINDOWS\msagent\agentpsh.dll
+ 2008-04-14 02:33:18 24,064 ----a-w C:\WINDOWS\msagent\agentpsh.dll
- 2004-08-19 14:09:20 44,032 ----a-w C:\WINDOWS\msagent\agentsr.dll
+ 2008-04-14 02:33:18 44,032 ----a-w C:\WINDOWS\msagent\agentsr.dll
- 2006-10-12 10:09:54 256,512 ----a-w C:\WINDOWS\msagent\agentsvr.exe
+ 2008-04-14 02:33:54 256,512 ----a-w C:\WINDOWS\msagent\agentsvr.exe
- 2004-08-19 14:09:20 24,064 ----a-w C:\WINDOWS\msagent\agtintl.dll
+ 2008-04-14 02:33:20 24,064 ----a-w C:\WINDOWS\msagent\agtintl.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0401.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0401.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0404.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0404.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0405.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0405.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0406.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0406.dll
- 2004-08-05 03:00:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt0407.dll
+ 2007-04-02 18:26:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt0407.dll
- 2004-08-05 03:00:00 22,016 ----a-w C:\WINDOWS\msagent\intl\agt0408.dll
+ 2007-04-02 18:26:00 22,016 ----a-w C:\WINDOWS\msagent\intl\agt0408.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0409.dll
+ 2008-04-13 17:32:28 19,968 ----a-w C:\WINDOWS\msagent\intl\agt0409.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt040b.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt040b.dll
- 2004-08-05 03:00:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt040c.dll
+ 2007-04-02 18:26:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt040c.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt040d.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt040d.dll
- 2004-08-05 03:00:00 19,968 ----a-w C:\WINDOWS\msagent\intl\agt040e.dll
+ 2007-04-02 18:26:00 19,968 ----a-w C:\WINDOWS\msagent\intl\agt040e.dll
- 2004-08-05 03:00:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0410.dll
+ 2007-04-02 18:26:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0410.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0411.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0411.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0412.dll
+ 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0412.dll
- 2004-08-05 03:00:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0413.dll
+ 2007-04-02 18:26:02 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0413.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0414.dll
+ 2007-04-02 18:26:02 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0414.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0415.dll
+ 2007-04-02 18:26:02 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0415.dll
- 2004-08-05 03:00:00 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0416.dll
+ 2007-04-02 18:26:02 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0416.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0419.dll
+ 2007-04-02 18:26:02 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0419.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041d.dll
+ 2007-04-02 18:26:02 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041d.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041f.dll
+ 2007-04-02 18:26:02 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041f.dll
- 2004-08-05 03:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0804.dll
+ 2007-04-02 18:26:02 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0804.dll
- 2004-08-05 03:00:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0816.dll
+ 2007-04-02 18:26:02 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0816.dll
- 2004-08-05 03:00:00 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0c0a.dll
+ 2007-04-02 18:26:02 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0c0a.dll
- 2004-08-19 14:09:34 39,936 ----a-w C:\WINDOWS\msagent\mslwvtts.dll
+ 2008-04-14 02:33:32 39,936 ----a-w C:\WINDOWS\msagent\mslwvtts.dll
- 2006-06-02 18:32:20 33,792 ------w C:\WINDOWS\network diagnostic\custsat.dll
+ 2008-04-14 02:33:22 33,792 ------w C:\WINDOWS\network diagnostic\custsat.dll
- 2006-10-10 11:44:50 557,568 ------w C:\WINDOWS\network diagnostic\xpnetdiag.exe
+ 2008-04-13 18:53:32 558,080 ------w C:\WINDOWS\network diagnostic\xpnetdiag.exe
- 2004-08-19 14:10:00 70,656 ----a-w C:\WINDOWS\notepad.exe
+ 2008-04-14 02:34:16 70,656 ----a-w C:\WINDOWS\notepad.exe
- 2004-08-19 14:09:56 768,512 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
+ 2008-04-14 02:34:06 769,024 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
- 2004-08-19 14:09:56 743,936 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe
+ 2008-04-14 02:34:06 744,448 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe
- 2004-08-19 14:09:56 18,944 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe
+ 2008-04-14 02:34:06 18,432 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe
- 2004-08-19 14:10:00 160,768 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
+ 2008-04-14 02:34:12 172,544 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
- 2004-08-19 14:09:34 381,952 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msinfo.dll
+ 2008-04-14 02:33:32 382,464 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msinfo.dll
- 2004-08-19 14:09:38 102,400 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchshell.dll
+ 2008-04-14 02:33:38 102,912 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchshell.dll
- 2004-08-19 14:09:38 38,912 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll
+ 2008-04-14 02:33:38 38,400 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll
- 2006-12-30 03:04:44 76,507 ----a-w C:\WINDOWS\pchealth\helpctr\OfflineCache\index.dat
+ 2008-09-24 20:35:56 76,507 ----a-w C:\WINDOWS\pchealth\helpctr\OfflineCache\index.dat
- 2006-12-30 03:04:44 2,398 ----a-w C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
+ 2008-09-24 20:35:56 2,704 ----a-w C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
- 2004-08-19 14:10:04 151,040 ----a-w C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe
+ 2008-04-14 02:34:26 151,040 ----a-w C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe
- 2004-08-19 14:09:46 151,552 ----a-w C:\WINDOWS\PeerNet\sqldb20.dll
+ 2008-04-14 02:33:46 151,552 ----a-w C:\WINDOWS\PeerNet\sqldb20.dll
- 2004-08-19 14:09:46 462,848 ----a-w C:\WINDOWS\PeerNet\sqlqp20.dll
+ 2008-04-14 02:33:46 462,848 ----a-w C:\WINDOWS\PeerNet\sqlqp20.dll
- 2004-08-19 14:09:46 110,592 ----a-w C:\WINDOWS\PeerNet\sqlse20.dll
+ 2008-04-14 02:33:46 110,592 ----a-w C:\WINDOWS\PeerNet\sqlse20.dll
- 2004-08-19 14:10:04 153,088 ----a-w C:\WINDOWS\regedit.exe
+ 2008-04-14 02:34:20 153,088 ----a-w C:\WINDOWS\regedit.exe
- 2004-08-03 21:10:08 53,248 ------w C:\WINDOWS\ServicePackFiles\i386\1394bus.sys
+ 2008-04-13 18:46:18 53,376 ------w C:\WINDOWS\ServicePackFiles\i386\1394bus.sys
- 2004-08-03 21:00:04 12,288 ------w C:\WINDOWS\ServicePackFiles\i386\4mmdat.sys
+ 2008-04-13 18:40:50 12,288 ------w C:\WINDOWS\ServicePackFiles\i386\4mmdat.sys
- 2004-08-03 21:10:12 48,128 ------w C:\WINDOWS\ServicePackFiles\i386\61883.sys
+ 2008-04-13 18:46:20 48,128 ------w C:\WINDOWS\ServicePackFiles\i386\61883.sys
- 2004-08-19 14:09:20 100,352 ------w C:\WINDOWS\ServicePackFiles\i386\6to4svc.dll
+ 2008-04-14 02:33:18 100,352 ------w C:\WINDOWS\ServicePackFiles\i386\6to4svc.dll
+ 2008-04-14 02:33:18 136,192 ------w C:\WINDOWS\ServicePackFiles\i386\aaclient.dll
+ 2008-04-14 02:33:18 39,424 ------w C:\WINDOWS\ServicePackFiles\i386\acadproc.dll
- 2004-08-19 14:09:52 189,952 ------w C:\WINDOWS\ServicePackFiles\i386\accwiz.exe
+ 2008-04-14 02:33:54 190,464 ------w C:\WINDOWS\ServicePackFiles\i386\accwiz.exe
- 2004-08-19 14:09:20 1,852,416 ------w C:\WINDOWS\ServicePackFiles\i386\acgenral.dll
+ 2008-04-14 02:33:18 1,852,928 ------w C:\WINDOWS\ServicePackFiles\i386\acgenral.dll
- 2004-08-19 14:09:20 450,048 ------w C:\WINDOWS\ServicePackFiles\i386\aclayers.dll
+ 2008-04-14 02:33:18 451,072 ------w C:\WINDOWS\ServicePackFiles\i386\aclayers.dll
- 2004-08-19 14:09:20 137,728 ------w C:\WINDOWS\ServicePackFiles\i386\aclua.dll
+ 2008-04-14 02:33:18 141,312 ------w C:\WINDOWS\ServicePackFiles\i386\aclua.dll
- 2004-08-19 14:09:20 119,296 ------w C:\WINDOWS\ServicePackFiles\i386\aclui.dll
+ 2008-04-14 02:33:18 120,320 ------w C:\WINDOWS\ServicePackFiles\i386\aclui.dll
- 2004-08-19 13:51:56 188,672 ------w C:\WINDOWS\ServicePackFiles\i386\acpi.sys
+ 2008-04-14 01:52:42 188,672 ------w C:\WINDOWS\ServicePackFiles\i386\acpi.sys
- 2004-08-19 14:09:20 244,736 ------w C:\WINDOWS\ServicePackFiles\i386\acspecfc.dll
+ 2008-04-14 02:33:18 245,248 ------w C:\WINDOWS\ServicePackFiles\i386\acspecfc.dll
- 2004-08-19 14:09:20 194,048 ------w C:\WINDOWS\ServicePackFiles\i386\activeds.dll
+ 2008-04-14 02:33:18 193,536 ------w C:\WINDOWS\ServicePackFiles\i386\activeds.dll
- 2004-08-19 14:09:52 4,096 ------w C:\WINDOWS\ServicePackFiles\i386\actmovie.exe
+ 2008-04-14 02:33:54 4,096 ------w C:\WINDOWS\ServicePackFiles\i386\actmovie.exe
- 2004-08-19 14:09:20 101,888 ------w C:\WINDOWS\ServicePackFiles\i386\actxprxy.dll
+ 2008-04-14 02:33:18 98,304 ------w C:\WINDOWS\ServicePackFiles\i386\actxprxy.dll
- 2004-08-19 14:09:20 116,224 ------w C:\WINDOWS\ServicePackFiles\i386\acxtrnal.dll
+ 2008-04-14 02:33:18 116,224 ------w C:\WINDOWS\ServicePackFiles\i386\acxtrnal.dll
- 2004-08-19 14:09:20 20,540 ------w C:\WINDOWS\ServicePackFiles\i386\admin.dll
+ 2008-04-14 02:33:18 20,540 ------w C:\WINDOWS\ServicePackFiles\i386\admin.dll
- 2004-08-19 14:09:52 16,439 ------w C:\WINDOWS\ServicePackFiles\i386\admin.exe
+ 2008-04-14 02:33:54 16,439 ------w C:\WINDOWS\ServicePackFiles\i386\admin.exe
- 2004-08-19 14:09:20 61,440 ------w C:\WINDOWS\ServicePackFiles\i386\admparse.dll
+ 2008-04-14 02:33:18 61,440 ------w C:\WINDOWS\ServicePackFiles\i386\admparse.dll
- 2004-08-19 14:09:20 175,616 ------w C:\WINDOWS\ServicePackFiles\i386\adsldp.dll
+ 2008-04-14 02:33:18 175,616 ------w C:\WINDOWS\ServicePackFiles\i386\adsldp.dll
- 2004-08-19 14:09:20 143,360 ------w C:\WINDOWS\ServicePackFiles\i386\adsldpc.dll
+ 2008-04-14 02:33:18 143,360 ------w C:\WINDOWS\ServicePackFiles\i386\adsldpc.dll
- 2004-08-19 14:09:20 68,096 ------w C:\WINDOWS\ServicePackFiles\i386\adsmsext.dll
+ 2008-04-14 02:33:18 68,096 ------w C:\WINDOWS\ServicePackFiles\i386\adsmsext.dll
- 2004-08-19 14:09:20 263,680 ------w C:\WINDOWS\ServicePackFiles\i386\adsnt.dll
+ 2008-04-14 02:33:18 263,680 ------w C:\WINDOWS\ServicePackFiles\i386\adsnt.dll
- 2004-08-19 14:09:20 4,255 ------w C:\WINDOWS\ServicePackFiles\i386\adv01nt5.dll
+ 2008-04-14 02:33:18 4,255 ------w C:\WINDOWS\ServicePackFiles\i386\adv01nt5.dll
- 2004-08-19 14:09:20 3,967 ------w C:\WINDOWS\ServicePackFiles\i386\adv02nt5.dll
+ 2008-04-14 02:33:18 3,967 ------w C:\WINDOWS\ServicePackFiles\i386\adv02nt5.dll
- 2004-08-19 14:09:20 3,615 ------w C:\WINDOWS\ServicePackFiles\i386\adv05nt5.dll
+ 2008-04-14 02:33:18 3,615 ------w C:\WINDOWS\ServicePackFiles\i386\adv05nt5.dll
- 2004-08-19 14:09:20 3,647 ------w C:\WINDOWS\ServicePackFiles\i386\adv07nt5.dll
+ 2008-04-14 02:33:18 3,647 ------w C:\WINDOWS\ServicePackFiles\i386\adv07nt5.dll
- 2004-08-19 14:09:20 3,135 ------w C:\WINDOWS\ServicePackFiles\i386\adv08nt5.dll
+ 2008-04-14 02:33:18 3,135 ------w C:\WINDOWS\ServicePackFiles\i386\adv08nt5.dll
- 2004-08-19 14:09:20 3,711 ------w C:\WINDOWS\ServicePackFiles\i386\adv09nt5.dll
+ 2008-04-14 02:33:18 3,711 ------w C:\WINDOWS\ServicePackFiles\i386\adv09nt5.dll
- 2004-08-19 14:09:20 3,775 ------w C:\WINDOWS\ServicePackFiles\i386\adv11nt5.dll
+ 2008-04-14 02:33:18 3,775 ------w C:\WINDOWS\ServicePackFiles\i386\adv11nt5.dll
- 2004-08-19 14:09:20 685,056 ------w C:\WINDOWS\ServicePackFiles\i386\advapi32.dll
+ 2008-04-14 02:33:18 685,568 ------w C:\WINDOWS\ServicePackFiles\i386\advapi32.dll
- 2004-08-19 14:09:20 101,888 ------w C:\WINDOWS\ServicePackFiles\i386\advpack.dll
+ 2008-04-14 02:33:18 101,888 ------w C:\WINDOWS\ServicePackFiles\i386\advpack.dll
- 2004-08-03 20:39:38 142,464 ------w C:\WINDOWS\ServicePackFiles\i386\aec.sys
+ 2008-04-13 16:39:24 142,592 ------w C:\WINDOWS\ServicePackFiles\i386\aec.sys
- 2004-08-03 21:14:16 138,496 ------w C:\WINDOWS\ServicePackFiles\i386\afd.sys
+ 2008-04-13 19:19:24 138,112 ------w C:\WINDOWS\ServicePackFiles\i386\afd.sys
- 2004-08-19 14:09:20 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agentanm.dll
+ 2008-04-14 02:33:18 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agentanm.dll
- 2004-08-19 14:09:20 214,016 ------w C:\WINDOWS\ServicePackFiles\i386\agentctl.dll
+ 2008-04-14 02:33:18 214,016 ------w C:\WINDOWS\ServicePackFiles\i386\agentctl.dll
- 2004-08-19 14:09:20 41,984 ------w C:\WINDOWS\ServicePackFiles\i386\agentdp2.dll
+ 2008-04-14 02:33:18 42,496 ------w C:\WINDOWS\ServicePackFiles\i386\agentdp2.dll
- 2004-08-19 14:09:20 58,880 ------w C:\WINDOWS\ServicePackFiles\i386\agentdpv.dll
+ 2008-04-14 02:33:18 57,344 ------w C:\WINDOWS\ServicePackFiles\i386\agentdpv.dll
- 2004-08-19 14:09:20 49,152 ------w C:\WINDOWS\ServicePackFiles\i386\agentmpx.dll
+ 2008-04-14 02:33:18 49,152 ------w C:\WINDOWS\ServicePackFiles\i386\agentmpx.dll
- 2004-08-19 14:09:20 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agentpsh.dll
+ 2008-04-14 02:33:18 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agentpsh.dll
- 2004-08-19 14:09:20 44,032 ------w C:\WINDOWS\ServicePackFiles\i386\agentsr.dll
+ 2008-04-14 02:33:18 44,032 ------w C:\WINDOWS\ServicePackFiles\i386\agentsr.dll
- 2004-08-19 14:09:52 256,512 ------w C:\WINDOWS\ServicePackFiles\i386\agentsvr.exe
+ 2008-04-14 02:33:54 256,512 ------w C:\WINDOWS\ServicePackFiles\i386\agentsvr.exe
- 2004-08-03 21:07:42 42,368 ------w C:\WINDOWS\ServicePackFiles\i386\agp440.sys
+ 2008-04-13 18:36:38 42,368 ------w C:\WINDOWS\ServicePackFiles\i386\agp440.sys
- 2004-08-03 21:07:44 44,928 ------w C:\WINDOWS\ServicePackFiles\i386\agpcpq.sys
+ 2008-04-13 18:36:40 44,928 ------w C:\WINDOWS\ServicePackFiles\i386\agpcpq.sys
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0401.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0404.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0405.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0406.dll
+ 2007-04-02 18:26:00 21,504 ------w C:\WINDOWS\ServicePackFiles\i386\agt0407.dll
+ 2007-04-02 18:26:00 22,016 ------w C:\WINDOWS\ServicePackFiles\i386\agt0408.dll
+ 2008-04-13 17:32:28 19,968 ------w C:\WINDOWS\ServicePackFiles\i386\agt0409.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt040b.dll
+ 2007-04-02 18:26:00 21,504 ------w C:\WINDOWS\ServicePackFiles\i386\agt040c.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt040d.dll
+ 2007-04-02 18:26:00 19,968 ------w C:\WINDOWS\ServicePackFiles\i386\agt040e.dll
+ 2007-04-02 18:26:00 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\agt0410.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0411.dll
+ 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0412.dll
+ 2007-04-02 18:26:02 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\agt0413.dll
+ 2007-04-02 18:26:02 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0414.dll
+ 2007-04-02 18:26:02 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0415.dll
+ 2007-04-02 18:26:02 20,480 ------w C:\WINDOWS\ServicePackFiles\i386\agt0416.dll
+ 2007-04-02 18:26:02 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0419.dll
+ 2007-04-02 18:26:02 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt041d.dll
+ 2007-04-02 18:26:02 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt041f.dll
+ 2007-04-02 18:26:02 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0804.dll
+ 2007-04-02 18:26:02 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\agt0816.dll
+ 2007-04-02 18:26:02 20,480 ------w C:\WINDOWS\ServicePackFiles\i386\agt0c0a.dll
- 2004-08-19 14:09:20 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agtintl.dll
+ 2008-04-14 02:33:20 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agtintl.dll
- 2004-08-19 14:09:52 98,304 ------w C:\WINDOWS\ServicePackFiles\i386\ahui.exe
+ 2008-04-14 02:33:54 98,304 ------w C:\WINDOWS\ServicePackFiles\i386\ahui.exe
- 2004-08-19 14:09:52 44,544 ------w C:\WINDOWS\ServicePackFiles\i386\alg.exe
+ 2008-04-14 02:33:54 44,544 ------w C:\WINDOWS\ServicePackFiles\i386\alg.exe
- 2004-08-03 21:07:42 42,752 ------w C:\WINDOWS\ServicePackFiles\i386\alim1541.sys
+ 2008-04-13 18:36:38 42,752 ------w C:\WINDOWS\ServicePackFiles\i386\alim1541.sys
- 2004-08-19 14:09:20 17,408 ------w C:\WINDOWS\ServicePackFiles\i386\alrsvc.dll
+ 2008-04-14 02:33:20 17,408 ------w C:\WINDOWS\ServicePackFiles\i386\alrsvc.dll
- 2004-08-03 21:07:44 43,008 ------w C:\WINDOWS\ServicePackFiles\i386\amdagp.sys
+ 2008-04-13 18:36:40 43,008 ------w C:\WINDOWS\ServicePackFiles\i386\amdagp.sys
- 2004-08-19 13:52:42 41,216 ------w C:\WINDOWS\ServicePackFiles\i386\amdk6.sys
+ 2008-04-14 01:54:28 41,472 ------w C:\WINDOWS\ServicePackFiles\i386\amdk6.sys
- 2004-08-19 13:52:44 41,600 ------w C:\WINDOWS\ServicePackFiles\i386\amdk7.sys
+ 2008-04-14 01:54:30 41,856 ------w C:\WINDOWS\ServicePackFiles\i386\amdk7.sys
- 2004-08-19 14:09:20 70,656 ------w C:\WINDOWS\ServicePackFiles\i386\amstream.dll
+ 2008-04-14 02:33:20 70,656 ------w C:\WINDOWS\ServicePackFiles\i386\amstream.dll
- 2004-08-19 14:09:20 126,976 ------w C:\WINDOWS\ServicePackFiles\i386\apphelp.dll
+ 2008-04-14 02:33:20 125,952 ------w C:\WINDOWS\ServicePackFiles\i386\apphelp.dll
- 2004-08-19 14:09:20 334,336 ------w C:\WINDOWS\ServicePackFiles\i386\aqueue.dll
+ 2008-04-14 02:33:20 334,336 ------w C:\WINDOWS\ServicePackFiles\i386\aqueue.dll
- 2004-08-03 20:58:30 60,800 ------w C:\WINDOWS\ServicePackFiles\i386\arp1394.sys
+ 2008-04-13 18:51:26 60,800 ------w C:\WINDOWS\ServicePackFiles\i386\arp1394.sys
- 2004-08-19 14:09:20 65,024 ------w C:\WINDOWS\ServicePackFiles\i386\asycfilt.dll
+ 2008-04-14 02:33:20 65,024 ------w C:\WINDOWS\ServicePackFiles\i386\asycfilt.dll
- 2004-08-03 21:05:04 14,336 ------w C:\WINDOWS\ServicePackFiles\i386\asyncmac.sys
+ 2008-04-13 18:57:28 14,336 ------w C:\WINDOWS\ServicePackFiles\i386\asyncmac.sys
- 2004-08-19 14:09:52 25,088 ------w C:\WINDOWS\ServicePackFiles\i386\at.exe
+ 2008-04-14 02:33:54 25,088 ------w C:\WINDOWS\ServicePackFiles\i386\at.exe
- 2004-08-03 20:59:44 95,360 ------w C:\WINDOWS\ServicePackFiles\i386\atapi.sys
+ 2008-04-13 18:40:30 96,512 ------w C:\WINDOWS\ServicePackFiles\i386\atapi.sys
- 2004-08-19 14:09:20 229,376 ------w C:\WINDOWS\ServicePackFiles\i386\ati2cqag.dll
+ 2008-04-14 02:33:20 229,376 ------w C:\WINDOWS\ServicePackFiles\i386\ati2cqag.dll
- 2004-08-19 14:09:20 377,984 ------w C:\WINDOWS\ServicePackFiles\i386\ati2dvaa.dll
+ 2008-04-14 02:33:20 377,984 ------w C:\WINDOWS\ServicePackFiles\i386\ati2dvaa.dll
- 2004-08-19 14:09:20 201,728 ------w C:\WINDOWS\ServicePackFiles\i386\ati2dvag.dll
+ 2008-04-14 02:33:20 201,728 ------w C:\WINDOWS\ServicePackFiles\i386\ati2dvag.dll
- 2004-08-19 14:09:20 870,784 ------w C:\WINDOWS\ServicePackFiles\i386\ati3d1ag.dll
+ 2008-04-14 02:33:20 870,784 ------w C:\WINDOWS\ServicePackFiles\i386\ati3d1ag.dll
- 2004-08-19 14:09:20 1,057,760 ------w C:\WINDOWS\ServicePackFiles\i386\ati3d2ag.dll
+ 2008-04-14 02:33:20 1,057,760 ------w C:\WINDOWS\ServicePackFiles\i386\ati3d2ag.dll
- 2004-08-19 14:09:20 1,888,992 ------w C:\WINDOWS\ServicePackFiles\i386\ati3duag.dll
+ 2008-04-14 02:33:20 1,888,992 ------w C:\WINDOWS\ServicePackFiles\i386\ati3duag.dll
- 2004-08-19 14:09:20 32,768 ------w C:\WINDOWS\ServicePackFiles\i386\ativtmxx.dll
+ 2008-04-14 02:33:20 32,768 ------w C:\WINDOWS\ServicePackFiles\i386\ativtmxx.dll
- 2004-08-19 14:09:20 516,768 ------w C:\WINDOWS\ServicePackFiles\i386\ativvaxx.dll
+ 2008-04-14 02:33:20 516,768 ------w C:\WINDOWS\ServicePackFiles\i386\ativvaxx.dll
- 2004-08-19 14:09:20 58,880 ------w C:\WINDOWS\ServicePackFiles\i386\atl.dll
+ 2008-04-14 02:33:20 58,880 ------w C:\WINDOWS\ServicePackFiles\i386\atl.dll
- 2004-08-19 14:09:52 11,264 ------w C:\WINDOWS\ServicePackFiles\i386\atmadm.exe
+ 2008-04-14 02:33:54 11,264 ------w C:\WINDOWS\ServicePackFiles\i386\atmadm.exe
- 2004-08-03 20:58:32 59,904 ------w C:\WINDOWS\ServicePackFiles\i386\atmarpc.sys
+ 2008-04-13 18:51:26 59,904 ------w C:\WINDOWS\ServicePackFiles\i386\atmarpc.sys
- 2004-08-19 14:08:02 285,696 ------w C:\WINDOWS\ServicePackFiles\i386\atmfd.dll
+ 2008-04-14 02:31:00 285,696 ------w C:\WINDOWS\ServicePackFiles\i386\atmfd.dll
- 2004-08-03 20:58:36 55,936 ------w C:\WINDOWS\ServicePackFiles\i386\atmlane.sys
+ 2008-04-13 18:51:30 55,808 ------w C:\WINDOWS\ServicePackFiles\i386\atmlane.sys
- 2004-08-19 14:09:22 30,208 ------w C:\WINDOWS\ServicePackFiles\i386\atmlib.dll
+ 2008-04-14 02:33:20 30,208 ------w C:\WINDOWS\ServicePackFiles\i386\atmlib.dll
+ 2008-04-14 02:33:54 12,288 ------w C:\WINDOWS\ServicePackFiles\i386\attrib.exe
- 2004-08-19 14:09:22 21,183 ------w C:\WINDOWS\ServicePackFiles\i386\atv01nt5.dll
+ 2008-04-14 02:33:20 21,183 ------w C:\WINDOWS\ServicePackFiles\i386\atv01nt5.dll
- 2004-08-19 14:09:22 11,359 ------w C:\WINDOWS\ServicePackFiles\i386\atv02nt5.dll
+ 2008-04-14 02:33:20 11,359 ------w C:\WINDOWS\ServicePackFiles\i386\atv02nt5.dll
- 2004-08-19 14:09:22 25,471 ------w C:\WINDOWS\ServicePackFiles\i386\atv04nt5.dll
+ 2008-04-14 02:33:20 25,471 ------w C:\WINDOWS\ServicePackFiles\i386\atv04nt5.dll
- 2004-08-19 14:09:22 14,143 ------w C:\WINDOWS\ServicePackFiles\i386\atv06nt5.dll
+ 2008-04-14 02:33:20 14,143 ------w C:\WINDOWS\ServicePackFiles\i386\atv06nt5.dll
- 2004-08-19 14:09:22 17,279 ------w C:\WINDOWS\ServicePackFiles\i386\atv10nt5.dll
+ 2008-04-14 02:33:20 17,279 ------w C:\WINDOWS\ServicePackFiles\i386\atv10nt5.dll
- 2004-08-19 14:09:22 42,496 ------w C:\WINDOWS\ServicePackFiles\i386\audiosrv.dll
+ 2008-04-14 02:33:20 42,496 ------w C:\WINDOWS\ServicePackFiles\i386\audiosrv.dll
- 2004-08-19 14:09:52 14,336 ------w C:\WINDOWS\ServicePackFiles\i386\auditusr.exe
+ 2008-04-14 02:33:54 14,336 ------w C:\WINDOWS\ServicePackFiles\i386\auditusr.exe
- 2004-08-19 14:09:22 20,540 ------w C:\WINDOWS\ServicePackFiles\i386\author.dll
+ 2008-04-14 02:33:20 20,540 ------w C:\WINDOWS\ServicePackFiles\i386\author.dll
- 2004-08-19 14:09:52 16,439 ------w C:\WINDOWS\ServicePackFiles\i386\author.exe
+ 2008-04-14 02:33:54 16,439 ------w C:\WINDOWS\ServicePackFiles\i386\author.exe
- 2004-08-19 14:09:22 56,832 ------w C:\WINDOWS\ServicePackFiles\i386\authz.dll
+ 2008-04-14 02:33:20 62,464 ------w C:\WINDOWS\ServicePackFiles\i386\authz.dll
- 2004-08-19 14:09:52 625,152 ------w C:\WINDOWS\ServicePackFiles\i386\autochk.exe
+ 2008-04-14 02:33:54 625,152 ------w C:\WINDOWS\ServicePackFiles\i386\autochk.exe
- 2004-08-19 14:09:52 638,976 ------w C:\WINDOWS\ServicePackFiles\i386\autoconv.exe
+ 2008-04-14 02:33:54 638,976 ------w C:\WINDOWS\ServicePackFiles\i386\autoconv.exe
- 2004-08-19 14:09:52 616,960 ------w C:\WINDOWS\ServicePackFiles\i386\autofmt.exe
+ 2008-04-14 02:33:54 616,960 ------w C:\WINDOWS\ServicePackFiles\i386\autofmt.exe
- 2004-08-19 14:09:52 11,264 ------w C:\WINDOWS\ServicePackFiles\i386\autolfn.exe
+ 2008-04-14 02:33:54 11,264 ------w C:\WINDOWS\ServicePackFiles\i386\autolfn.exe
- 2004-08-03 21:10:12 38,912 ------w C:\WINDOWS\ServicePackFiles\i386\avc.sys
+ 2008-04-13 18:46:20 38,912 ------w C:\WINDOWS\ServicePackFiles\i386\avc.sys
- 2004-08-03 21:10:00 13,696 ------w C:\WINDOWS\ServicePackFiles\i386\avcstrm.sys
+ 2008-04-13 18:46:08 13,696 ------w C:\WINDOWS\ServicePackFiles\i386\avcstrm.sys
- 2004-08-19 14:09:22 85,504 ------w C:\WINDOWS\ServicePackFiles\i386\avifil32.dll
+ 2008-04-14 02:33:20 85,504 ------w C:\WINDOWS\ServicePackFiles\i386\avifil32.dll
+ 2008-04-14 02:33:20 233,472 ------w C:\WINDOWS\ServicePackFiles\i386\azroles.dll
- 2004-08-19 14:09:22 52,736 ------w C:\WINDOWS\ServicePackFiles\i386\basesrv.dll
+ 2008-04-14 02:33:20 52,736 ------w C:\WINDOWS\ServicePackFiles\i386\basesrv.dll
- 2004-08-19 14:09:22 28,672 ------w C:\WINDOWS\ServicePackFiles\i386\batmeter.dll
+ 2008-04-14 02:33:20 29,184 ------w C:\WINDOWS\ServicePackFiles\i386\batmeter.dll
- 2004-08-19 14:09:22 8,704 ------w C:\WINDOWS\ServicePackFiles\i386\batt.dll
+ 2008-04-14 02:33:20 8,704 ------w C:\WINDOWS\ServicePackFiles\i386\batt.dll
+ 2008-04-13 18:36:32 14,208 ------w C:\WINDOWS\ServicePackFiles\i386\battc.sys
- 2004-08-03 21:10:14 11,776 ------w C:\WINDOWS\ServicePackFiles\i386\bdasup.sys
+ 2008-04-13 18:46:22 11,776 ------w C:\WINDOWS\ServicePackFiles\i386\bdasup.sys
- 2004-08-19 14:09:22 17,408 ------w C:\WINDOWS\ServicePackFiles\i386\bidispl.dll
+ 2008-04-14 02:33:20 17,408 ------w C:\WINDOWS\ServicePackFiles\i386\bidispl.dll
- 2004-08-19 14:09:22 8,192 ------w C:\WINDOWS\ServicePackFiles\i386\bitsprx2.dll
+ 2008-04-14 02:33:20 8,192 ------w C:\WINDOWS\ServicePackFiles\i386\bitsprx2.dll
- 2004-08-19 14:09:22 7,168 ------w C:\WINDOWS\ServicePackFiles\i386\bitsprx3.dll
+ 2008-04-14 02:33:20 7,168 ------w C:\WINDOWS\ServicePackFiles\i386\bitsprx3.dll
+ 2008-04-14 02:33:20 7,168 ------w C:\WINDOWS\ServicePackFiles\i386\bitsprx4.dll
- 2004-08-19 14:09:52 71,680 ------w C:\WINDOWS\ServicePackFiles\i386\blastcln.exe
+ 2008-04-14 02:33:56 71,680 ------w C:\WINDOWS\ServicePackFiles\i386\blastcln.exe
- 2004-08-03 20:59:58 71,552 ------w C:\WINDOWS\ServicePackFiles\i386\bridge.sys
+ 2008-04-13 18:53:24 71,552 ------w C:\WINDOWS\ServicePackFiles\i386\bridge.sys
- 2004-08-19 14:08:04 70,144 ------w C:\WINDOWS\ServicePackFiles\i386\browselc.dll
+ 2008-04-14 01:57:48 70,144 ------w C:\WINDOWS\ServicePackFiles\i386\browselc.dll
- 2004-08-19 14:09:22 77,312 ------w C:\WINDOWS\ServicePackFiles\i386\browser.dll
+ 2008-04-14 02:33:20 77,824 ------w C:\WINDOWS\ServicePackFiles\i386\browser.dll
- 2004-08-19 14:09:22 1,017,344 ------w C:\WINDOWS\ServicePackFiles\i386\browseui.dll
+ 2008-04-14 02:33:20 1,025,024 ------w C:\WINDOWS\ServicePackFiles\i386\browseui.dll
- 2004-08-19 14:09:22 78,336 ------w C:\WINDOWS\ServicePackFiles\i386\browsewm.dll
+ 2008-04-14 02:33:20 78,336 ------w C:\WINDOWS\ServicePackFiles\i386\browsewm.dll
- 2004-08-19 14:09:22 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\bthci.dll
+ 2008-04-14 02:33:20 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\bthci.dll
- 2004-08-03 21:10:40 17,024 ------w C:\WINDOWS\ServicePackFiles\i386\bthenum.sys
+ 2008-04-13 18:46:34 17,024 ------w C:\WINDOWS\ServicePackFiles\i386\bthenum.sys
- 2004-08-03 21:10:40 38,016 ------w C:\WINDOWS\ServicePackFiles\i386\bthmodem.sys
+ 2008-04-13 18:46:34 37,888 ------w C:\WINDOWS\ServicePackFiles\i386\bthmodem.sys
- 2004-08-03 20:58:40 100,992 ------w C:\WINDOWS\ServicePackFiles\i386\bthpan.sys
+ 2008-04-13 18:51:34 101,120 ------w C:\WINDOWS\ServicePackFiles\i386\bthpan.sys
- 2004-08-19 13:55:32 274,944 ------w C:\WINDOWS\ServicePackFiles\i386\bthport.sys
+ 2008-04-14 01:58:00 273,664 ------w C:\WINDOWS\ServicePackFiles\i386\bthport.sys
- 2004-08-03 21:10:38 35,456 ------w C:\WINDOWS\ServicePackFiles\i386\bthprint.sys
+ 2008-04-13 18:46:32 36,480 ------w C:\WINDOWS\ServicePackFiles\i386\bthprint.sys
- 2004-08-19 14:09:22 30,208 ------w C:\WINDOWS\ServicePackFiles\i386\bthserv.dll
+ 2008-04-14 02:33:20 30,208 ------w C:\WINDOWS\ServicePackFiles\i386\bthserv.dll
- 2004-08-03 21:10:36 18,944 ------w C:\WINDOWS\ServicePackFiles\i386\bthusb.sys
+ 2008-04-13 18:46:30 18,944 ------w C:\WINDOWS\ServicePackFiles\i386\bthusb.sys
- 2004-08-19 14:09:22 50,688 ------w C:\WINDOWS\ServicePackFiles\i386\btpanui.dll
+ 2008-04-14 02:33:20 50,688 ------w C:\WINDOWS\ServicePackFiles\i386\btpanui.dll
+ 2008-04-14 02:33:20 218,112 ------w C:\WINDOWS\ServicePackFiles\i386\c_g18030.dll
- 2004-08-19 14:09:22 59,904 ------w C:\WINDOWS\ServicePackFiles\i386\cabinet.dll
+ 2008-04-14 02:33:20 60,416 ------w C:\WINDOWS\ServicePackFiles\i386\cabinet.dll
- 2004-08-19 14:09:22 85,504 ------w C:\WINDOWS\ServicePackFiles\i386\cabview.dll
+ 2008-04-14 02:33:20 85,504 ------w C:\WINDOWS\ServicePackFiles\i386\cabview.dll
+ 2008-04-14 02:33:56 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\cacls.exe
- 2004-08-19 14:09:22 385,024 ------w C:\WINDOWS\ServicePackFiles\i386\callcont.dll
+ 2008-04-14 02:33:20 385,024 ------w C:\WINDOWS\ServicePackFiles\i386\callcont.dll
+ 2008-04-14 02:33:20 121,856 ------w C:\WINDOWS\ServicePackFiles\i386\camext30.dll
- 2004-08-19 14:09:22 50,688 ------w C:\WINDOWS\ServicePackFiles\i386\camocx.dll
+ 2008-04-14 02:33:20 50,688 ------w C:\WINDOWS\ServicePackFiles\i386\camocx.dll
+ 2008-04-14 02:33:20 153,600 ------w C:\WINDOWS\ServicePackFiles\i386\capesnpn.dll
- 2004-08-19 14:09:22 229,888 ------w C:\WINDOWS\ServicePackFiles\i386\catsrv.dll
+ 2008-04-14 02:33:20 226,304 ------w C:\WINDOWS\ServicePackFiles\i386\catsrv.dll
- 2004-08-19 14:09:22 85,504 ------w C:\WINDOWS\ServicePackFiles\i386\catsrvps.dll
+ 2008-04-14 02:33:20 85,504 ------w C:\WINDOWS\ServicePackFiles\i386\catsrvps.dll
- 2004-08-19 14:09:22 628,224 ------w C:\WINDOWS\ServicePackFiles\i386\catsrvut.dll
+ 2008-04-14 02:33:20 625,664 ------w C:\WINDOWS\ServicePackFiles\i386\catsrvut.dll
- 2004-08-03 21:10:18 17,024 ------w C:\WINDOWS\ServicePackFiles\i386\ccdecode.sys
+ 2008-04-13 18:46:24 17,024 ------w C:\WINDOWS\ServicePackFiles\i386\ccdecode.sys
- 2004-08-03 21:14:12 63,744 ------w C:\WINDOWS\ServicePackFiles\i386\cdfs.sys
+ 2008-04-13 19:14:22 63,744 ------w C:\WINDOWS\ServicePackFiles\i386\cdfs.sys
- 2004-08-19 14:09:22 151,552 ------w C:\WINDOWS\ServicePackFiles\i386\cdfview.dll
+ 2008-04-14 02:33:20 152,064 ------w C:\WINDOWS\ServicePackFiles\i386\cdfview.dll
- 2004-08-19 14:09:22 66,560 ------w C:\WINDOWS\ServicePackFiles\i386\cdm.dll
+ 2008-04-14 02:33:20 66,560 ------w C:\WINDOWS\ServicePackFiles\i386\cdm.dll
- 2004-08-19 14:09:22 2,067,968 ------w C:\WINDOWS\ServicePackFiles\i386\cdosys.dll
+ 2008-04-14 02:33:20 2,091,520 ------w C:\WINDOWS\ServicePackFiles\i386\cdosys.dll
- 2004-08-03 20:59:54 49,536 ------w C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
+ 2008-04-13 18:40:46 62,976 ------w C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
- 2004-08-19 14:09:22 200,192 ------w C:\WINDOWS\ServicePackFiles\i386\certcli.dll
+ 2008-04-14 02:33:20 200,192 ------w C:\WINDOWS\ServicePackFiles\i386\certcli.dll
- 2004-08-19 14:09:22 467,968 ------w C:\WINDOWS\ServicePackFiles\i386\certmgr.dll
+ 2008-04-14 02:33:20 467,968 ------w C:\WINDOWS\ServicePackFiles\i386\certmgr.dll
- 2004-08-19 14:09:22 39,424 ------w C:\WINDOWS\ServicePackFiles\i386\cfgbkend.dll
+ 2008-04-14 02:33:20 39,424 ------w C:\WINDOWS\ServicePackFiles\i386\cfgbkend.dll
- 2004-08-19 14:08:04 16,896 ------w C:\WINDOWS\ServicePackFiles\i386\cfgmgr32.dll
+ 2008-04-14 02:31:04 16,896 ------w C:\WINDOWS\ServicePackFiles\i386\cfgmgr32.dll
- 2004-08-19 14:09:52 188,480 ------w C:\WINDOWS\ServicePackFiles\i386\cfgwiz.exe
+ 2008-04-14 02:33:56 188,480 ------w C:\WINDOWS\ServicePackFiles\i386\cfgwiz.exe
- 2004-08-19 14:09:22 15,423 ------w C:\WINDOWS\ServicePackFiles\i386\ch7xxnt5.dll
+ 2008-04-14 02:33:20 15,423 ------w C:\WINDOWS\ServicePackFiles\i386\ch7xxnt5.dll
- 2004-08-03 21:00:14 8,192 ------w C:\WINDOWS\ServicePackFiles\i386\changer.sys
+ 2008-04-13 18:40:58 8,192 ------w C:\WINDOWS\ServicePackFiles\i386\changer.sys
+ 2008-04-14 02:33:20 148,480 ------w C:\WINDOWS\ServicePackFiles\i386\cic.dll
- 2004-08-19 14:09:22 1,352,704 ------w C:\WINDOWS\ServicePackFiles\i386\cimwin32.dll
+ 2008-04-14 02:33:20 1,359,360 ------w C:\WINDOWS\ServicePackFiles\i386\cimwin32.dll
- 2004-08-19 14:09:22 69,120 ------w C:\WINDOWS\ServicePackFiles\i386\ciodm.dll
+ 2008-04-14 02:33:20 69,120 ------w C:\WINDOWS\ServicePackFiles\i386\ciodm.dll
- 2004-08-19 14:09:52 5,632 ------w C:\WINDOWS\ServicePackFiles\i386\cisvc.exe
+ 2008-04-14 02:33:58 5,632 ------w C:\WINDOWS\ServicePackFiles\i386\cisvc.exe
- 2004-08-03 21:14:28 49,664 ------w C:\WINDOWS\ServicePackFiles\i386\classpnp.sys
+ 2008-04-13 19:16:22 49,536 ------w C:\WINDOWS\ServicePackFiles\i386\classpnp.sys
- 2004-08-19 14:09:22 110,080 ------w C:\WINDOWS\ServicePackFiles\i386\clbcatex.dll
+ 2008-04-14 02:33:22 110,592 ------w C:\WINDOWS\ServicePackFiles\i386\clbcatex.dll
- 2004-08-19 14:09:22 501,248 ------w C:\WINDOWS\ServicePackFiles\i386\clbcatq.dll
+ 2008-04-14 02:33:22 498,688 ------w C:\WINDOWS\ServicePackFiles\i386\clbcatq.dll
- 2004-08-19 14:09:52 65,536 ------w C:\WINDOWS\ServicePackFiles\i386\cleanmgr.exe
+ 2008-04-14 02:33:58 65,536 ------w C:\WINDOWS\ServicePackFiles\i386\cleanmgr.exe
- 2004-08-19 14:09:22 77,824 ------w C:\WINDOWS\ServicePackFiles\i386\cliconfg.dll
+ 2008-04-14 02:33:22 77,824 ------w C:\WINDOWS\ServicePackFiles\i386\cliconfg.dll
- 2004-08-19 14:09:52 20,480 ------w C:\WINDOWS\ServicePackFiles\i386\cliconfg.exe
+ 2008-04-14 02:33:58 20,480 ------w C:\WINDOWS\ServicePackFiles\i386\cliconfg.exe
- 2004-08-19 14:09:52 104,448 ------w C:\WINDOWS\ServicePackFiles\i386\clipbrd.exe
+ 2008-04-14 02:33:58 104,448 ------w C:\WINDOWS\ServicePackFiles\i386\clipbrd.exe
- 2004-08-19 14:09:52 33,280 ------w C:\WINDOWS\ServicePackFiles\i386\clipsrv.exe
+ 2008-04-14 02:33:58 33,280 ------w C:\WINDOWS\ServicePackFiles\i386\clipsrv.exe
- 2004-08-19 14:09:22 57,856 ------w C:\WINDOWS\ServicePackFiles\i386\clusapi.dll
+ 2008-04-14 02:33:22 58,368 ------w C:\WINDOWS\ServicePackFiles\i386\clusapi.dll
- 2004-08-03 21:07:40 14,080 ------w C:\WINDOWS\ServicePackFiles\i386\cmbatt.sys
+ 2008-04-13 18:36:38 13,952 ------w C:\WINDOWS\ServicePackFiles\i386\cmbatt.sys
- 2004-08-19 14:09:22 15,872 ------w C:\WINDOWS\ServicePackFiles\i386\cmcfg32.dll
+ 2008-04-14 02:33:22 15,872 ------w C:\WINDOWS\ServicePackFiles\i386\cmcfg32.dll
- 2004-08-19 14:09:52 400,896 ------w C:\WINDOWS\ServicePackFiles\i386\cmd.exe
+ 2008-04-14 02:33:58 401,408 ------w C:\WINDOWS\ServicePackFiles\i386\cmd.exe
- 2004-08-19 14:09:22 352,256 ------w C:\WINDOWS\ServicePackFiles\i386\cmdial32.dll
+ 2008-04-14 02:33:22 353,280 ------w C:\WINDOWS\ServicePackFiles\i386\cmdial32.dll
- 2004-08-19 14:09:52 47,104 ------w C:\WINDOWS\ServicePackFiles\i386\cmdl32.exe
+ 2008-04-14 02:33:58 25,600 ------w C:\WINDOWS\ServicePackFiles\i386\cmdl32.exe
- 2004-08-19 14:09:52 40,448 ------w C:\WINDOWS\ServicePackFiles\i386\cmmon32.exe
+ 2008-04-14 02:33:58 39,936 ------w C:\WINDOWS\ServicePackFiles\i386\cmmon32.exe
- 2004-08-19 14:09:22 191,488 ------w C:\WINDOWS\ServicePackFiles\i386\cmprops.dll
+ 2008-04-14 02:33:22 191,488 ------w C:\WINDOWS\ServicePackFiles\i386\cmprops.dll
- 2004-08-19 14:09:22 13,824 ------w C:\WINDOWS\ServicePackFiles\i386\cmsetacl.dll
+ 2008-04-14 02:33:22 13,312 ------w C:\WINDOWS\ServicePackFiles\i386\cmsetacl.dll
- 2004-08-19 14:09:52 65,536 ------w C:\WINDOWS\ServicePackFiles\i386\cmstp.exe
+ 2008-04-14 02:33:58 65,536 ------w C:\WINDOWS\ServicePackFiles\i386\cmstp.exe
- 2004-08-19 14:09:22 40,960 ------w C:\WINDOWS\ServicePackFiles\i386\cmutil.dll
+ 2008-04-14 02:33:22 40,960 ------w C:\WINDOWS\ServicePackFiles\i386\cmutil.dll
- 2004-08-19 14:09:22 50,688 ------w C:\WINDOWS\ServicePackFiles\i386\cnbjmon.dll
+ 2008-04-14 02:33:22 50,688 ------w C:\WINDOWS\ServicePackFiles\i386\cnbjmon.dll
- 2004-08-19 14:09:22 83,968 ------w C:\WINDOWS\ServicePackFiles\i386\cnbjmon2.dll
+ 2008-04-14 02:33:22 83,968 ------w C:\WINDOWS\ServicePackFiles\i386\cnbjmon2.dll
+ 2008-04-13 16:44:16 17,920 ------w C:\WINDOWS\ServicePackFiles\i386\cobramsg.dll
- 2004-08-19 14:09:22 62,464 ------w C:\WINDOWS\ServicePackFiles\i386\colbact.dll
+ 2008-04-14 02:33:22 60,416 ------w C:\WINDOWS\ServicePackFiles\i386\colbact.dll
+ 2008-04-14 02:33:22 28,160 ------w C:\WINDOWS\ServicePackFiles\i386\comaddin.dll
- 2004-08-19 14:09:22 195,584 ------w C:\WINDOWS\ServicePackFiles\i386\comadmin.dll
+ 2008-04-14 02:33:22 195,072 ------w C:\WINDOWS\ServicePackFiles\i386\comadmin.dll
- 2004-08-19 14:09:22 611,328 ------w C:\WINDOWS\ServicePackFiles\i386\comctl32.dll
+ 2008-04-14 02:33:22 617,472 ------w C:\WINDOWS\ServicePackFiles\i386\comctl32.dll
- 2004-08-19 14:09:22 281,088 ------w C:\WINDOWS\ServicePackFiles\i386\comdlg32.dll
+ 2008-04-14 02:33:22 281,600 ------w C:\WINDOWS\ServicePackFiles\i386\comdlg32.dll
- 2004-08-19 14:09:22 253,440 ------w C:\WINDOWS\ServicePackFiles\i386\compatui.dll
+ 2008-04-14 02:33:22 253,440 ------w C:\WINDOWS\ServicePackFiles\i386\compatui.dll
+ 2008-04-13 18:36:38 10,240 ------w C:\WINDOWS\ServicePackFiles\i386\compbatt.sys
- 2004-08-19 14:09:22 230,912 ------w C:\WINDOWS\ServicePackFiles\i386\compstui.dll
+ 2008-04-14 02:33:22 230,912 ------w C:\WINDOWS\ServicePackFiles\i386\compstui.dll
+ 2008-04-14 02:33:22 97,792 ------w C:\WINDOWS\ServicePackFiles\i386\comrepl.dll
- 2004-08-19 14:09:52 9,728 ------w C:\WINDOWS\ServicePackFiles\i386\comrepl.exe
+ 2008-04-14 02:33:58 9,728 ------w C:\WINDOWS\ServicePackFiles\i386\comrepl.exe
+ 2008-04-14 02:33:58 6,144 ------w C:\WINDOWS\ServicePackFiles\i386\comrereg.exe
- 2004-08-19 14:09:22 851,968 ------w C:\WINDOWS\ServicePackFiles\i386\comres.dll
+ 2008-04-14 02:33:22 851,968 ------w C:\WINDOWS\ServicePackFiles\i386\comres.dll
+ 2008-04-14 02:33:22 274,944 ------w C:\WINDOWS\ServicePackFiles\i386\comsetup.dll
+ 2008-04-14 02:33:22 167,424 ------w C:\WINDOWS\ServicePackFiles\i386\comsnap.dll
- 2004-08-19 14:09:22 1,251,840 ------w C:\WINDOWS\ServicePackFiles\i386\comsvcs.dll
+ 2008-04-14 02:33:22 1,267,200 ------w C:\WINDOWS\ServicePackFiles\i386\comsvcs.dll
- 2004-08-19 14:09:22 540,160 ------w C:\WINDOWS\ServicePackFiles\i386\comuid.dll
+ 2008-04-14 02:33:22 539,648 ------w C:\WINDOWS\ServicePackFiles\i386\comuid.dll
- 2004-08-19 14:09:52 1,044,480 ------w C:\WINDOWS\ServicePackFiles\i386\conf.exe
+ 2008-04-14 02:33:58 1,044,480 ------w C:\WINDOWS\ServicePackFiles\i386\conf.exe
- 2004-08-19 14:09:22 45,056 ------w C:\WINDOWS\ServicePackFiles\i386\confmrsl.dll
+ 2008-04-14 02:33:22 45,056 ------w C:\WINDOWS\ServicePackFiles\i386\confmrsl.dll
+ 2008-04-14 02:33:22 358,400 ------w C:\WINDOWS\ServicePackFiles\i386\confmsp.dll
- 2004-08-19 14:09:52 27,648 ------w C:\WINDOWS\ServicePackFiles\i386\conime.exe
+ 2008-04-14 02:34:00 27,648 ------w C:\WINDOWS\ServicePackFiles\i386\conime.exe
- 2004-08-19 14:09:22 35,328 ------w C:\WINDOWS\ServicePackFiles\i386\corpol.dll
+ 2008-04-14 02:33:22 35,328 ------w C:\WINDOWS\ServicePackFiles\i386\corpol.dll
+ 2008-04-14 02:33:22 12,800 ------w C:\WINDOWS\ServicePackFiles\i386\credssp.dll
- 2004-08-19 14:09:22 165,888 ------w C:\WINDOWS\ServicePackFiles\i386\credui.dll
+ 2008-04-14 02:33:22 165,888 ------w C:\WINDOWS\ServicePackFiles\i386\credui.dll
- 2004-08-19 13:59:26 40,704 ------w C:\WINDOWS\ServicePackFiles\i386\crusoe.sys
+ 2008-04-14 02:02:48 40,960 ------w C:\WINDOWS\ServicePackFiles\i386\crusoe.sys
- 2004-08-19 14:09:22 604,672 ------w C:\WINDOWS\ServicePackFiles\i386\crypt32.dll
+ 2008-04-14 02:33:22 606,208 ------w C:\WINDOWS\ServicePackFiles\i386\crypt32.dll
- 2004-08-19 14:09:22 75,776 ------w C:\WINDOWS\ServicePackFiles\i386\cryptdlg.dll
+ 2008-04-14 02:33:22 75,776 ------w C:\WINDOWS\ServicePackFiles\i386\cryptdlg.dll
- 2004-08-19 14:09:22 33,280 ------w C:\WINDOWS\ServicePackFiles\i386\cryptdll.dll
+ 2008-04-14 02:33:22 33,280 ------w C:\WINDOWS\ServicePackFiles\i386\cryptdll.dll
- 2004-08-19 14:09:22 54,784 ------w C:\WINDOWS\ServicePackFiles\i386\cryptext.dll
+ 2008-04-14 02:33:22 54,784 ------w C:\WINDOWS\ServicePackFiles\i386\cryptext.dll
- 2004-08-19 14:09:22 63,488 ------w C:\WINDOWS\ServicePackFiles\i386\cryptnet.dll
+ 2008-04-14 02:33:22 64,512 ------w C:\WINDOWS\ServicePackFiles\i386\cryptnet.dll
- 2004-08-19 14:09:22 60,416 ------w C:\WINDOWS\ServicePackFiles\i386\cryptsvc.dll
+ 2008-04-14 02:33:22 62,464 ------w C:\WINDOWS\ServicePackFiles\i386\cryptsvc.dll
- 2004-08-19 14:09:22 530,432 ------w C:\WINDOWS\ServicePackFiles\i386\cryptui.dll
+ 2008-04-14 02:33:22 530,432 ------w C:\WINDOWS\ServicePackFiles\i386\cryptui.dll
- 2004-08-19 14:09:22 102,912 ------w C:\WINDOWS\ServicePackFiles\i386\cscdll.dll
+ 2008-04-14 02:33:22 102,912 ------w C:\WINDOWS\ServicePackFiles\i386\cscdll.dll
- 2004-08-19 14:09:52 98,304 ------w C:\WINDOWS\ServicePackFiles\i386\cscript.exe
+ 2008-04-14 02:34:00 139,264 ------w C:\WINDOWS\ServicePackFiles\i386\cscript.exe
- 2004-08-19 14:09:22 337,920 ------w C:\WINDOWS\ServicePackFiles\i386\cscui.dll
+ 2008-04-14 02:33:22 337,920 ------w C:\WINDOWS\ServicePackFiles\i386\cscui.dll
- 2004-08-19 14:09:22 32,768 ------w C:\WINDOWS\ServicePackFiles\i386\csrsrv.dll
+ 2008-04-14 02:33:22 32,256 ------w C:\WINDOWS\ServicePackFiles\i386\csrsrv.dll
- 2004-08-19 14:09:52 6,144 ------w C:\WINDOWS\ServicePackFiles\i386\csrss.exe
+ 2008-04-14 02:34:00 6,144 ------w C:\WINDOWS\ServicePackFiles\i386\csrss.exe
- 2004-08-19 14:09:52 15,360 ------w C:\WINDOWS\ServicePackFiles\i386\ctfmon.exe
+ 2008-04-14 02:34:00 15,360 ------w C:\WINDOWS\ServicePackFiles\i386\ctfmon.exe
- 2004-08-19 14:09:22 252,416 ------w C:\WINDOWS\ServicePackFiles\i386\ctmasetp.dll
+ 2008-04-14 02:33:22 252,416 ------w C:\WINDOWS\ServicePackFiles\i386\ctmasetp.dll
- 2004-08-19 14:09:22 28,672 ------w C:\WINDOWS\ServicePackFiles\i386\custsat.dll
+ 2008-04-14 02:33:22 33,792 ------w C:\WINDOWS\ServicePackFiles\i386\custsat.dll
- 2004-08-19 14:09:22 1,179,648 ------w C:\WINDOWS\ServicePackFiles\i386\d3d8.dll
+ 2008-04-14 02:33:22 1,179,648 ------w C:\WINDOWS\ServicePackFiles\i386\d3d8.dll
- 2004-08-19 14:09:22 8,192 ------w C:\WINDOWS\ServicePackFiles\i386\d3d8thk.dll
+ 2008-04-14 02:33:22 8,192 ------w C:\WINDOWS\ServicePackFiles\i386\d3d8thk.dll
- 2004-08-19 14:09:22 1,689,088 ------w C:\WINDOWS\ServicePackFiles\i386\d3d9.dll
+ 2008-04-14 02:33:22 1,689,088 ------w C:\WINDOWS\ServicePackFiles\i386\d3d9.dll
- 2004-08-19 14:09:24 825,344 ------w C:\WINDOWS\ServicePackFiles\i386\d3dim700.dll
+ 2008-04-14 02:33:22 824,320 ------w C:\WINDOWS\ServicePackFiles\i386\d3dim700.dll
- 2004-08-19 14:09:24 1,056,256 ------w C:\WINDOWS\ServicePackFiles\i386\danim.dll
+ 2008-04-14 02:33:22 1,056,768 ------w C:\WINDOWS\ServicePackFiles\i386\danim.dll
- 2004-08-19 14:09:24 561,179 ------w C:\WINDOWS\ServicePackFiles\i386\dao360.dll
+ 2008-03-25 04:50:26 554,008 ------w C:\WINDOWS\ServicePackFiles\i386\dao360.dll
- 2004-08-19 14:09:24 55,296 ------w C:\WINDOWS\ServicePackFiles\i386\dataclen.dll
+ 2008-04-14 02:33:22 55,296 ------w C:\WINDOWS\ServicePackFiles\i386\dataclen.dll
+ 2008-04-14 02:33:22 165,376 ------w C:\WINDOWS\ServicePackFiles\i386\datime.dll
- 2004-08-19 14:09:24 25,088 ------w C:\WINDOWS\ServicePackFiles\i386\davclnt.dll
+ 2008-04-14 02:33:22 25,600 ------w C:\WINDOWS\ServicePackFiles\i386\davclnt.dll
- 2004-08-19 14:09:24 640,000 ------w C:\WINDOWS\ServicePackFiles\i386\dbghelp.dll
+ 2008-04-14 02:33:22 640,000 ------w C:\WINDOWS\ServicePackFiles\i386\dbghelp.dll
- 2004-08-19 14:09:24 24,576 ------w C:\WINDOWS\ServicePackFiles\i386\dbmsrpcn.dll
+ 2008-04-14 02:33:22 24,576 ------w C:\WINDOWS\ServicePackFiles\i386\dbmsrpcn.dll
- 2004-08-19 14:09:24 110,592 ------w C:\WINDOWS\ServicePackFiles\i386\dbnetlib.dll
+ 2008-04-14 02:33:22 110,592 ------w C:\WINDOWS\ServicePackFiles\i386\dbnetlib.dll
- 2004-08-19 14:09:24 28,672 ------w C:\WINDOWS\ServicePackFiles\i386\dbnmpntw.dll
+ 2008-04-14 02:33:22 28,672 ------w C:\WINDOWS\ServicePackFiles\i386\dbnmpntw.dll
- 2004-08-19 14:23:26 1,788 ------w C:\WINDOWS\ServicePackFiles\i386\dcache.bin
+ 2008-04-14 02:50:20 1,804 ------w C:\WINDOWS\ServicePackFiles\i386\dcache.bin
- 2004-08-19 14:09:24 40,960 ------w C:\WINDOWS\ServicePackFiles\i386\dcap32.dll
+ 2008-04-14 02:33:22 40,960 ------w C:\WINDOWS\ServicePackFiles\i386\dcap32.dll
- 2004-08-19 14:09:24 8,704 ------w C:\WINDOWS\ServicePackFiles\i386\dciman32.dll
+ 2008-04-14 02:33:22 8,704 ------w C:\WINDOWS\ServicePackFiles\i386\dciman32.dll
+ 2008-04-14 02:34:00 6,144 ------w C:\WINDOWS\ServicePackFiles\i386\dcomcnfg.exe
- 2004-08-19 14:09:52 31,744 ------w C:\WINDOWS\ServicePackFiles\i386\ddeshare.exe
+ 2008-04-14 02:34:00 31,744 ------w C:\WINDOWS\ServicePackFiles\i386\ddeshare.exe
- 2004-08-19 14:09:24 266,240 ------w C:\WINDOWS\ServicePackFiles\i386\ddraw.dll
+ 2008-04-14 02:33:22 279,552 ------w C:\WINDOWS\ServicePackFiles\i386\ddraw.dll
- 2004-08-19 14:09:24 27,136 ------w C:\WINDOWS\ServicePackFiles\i386\ddrawex.dll
+ 2008-04-14 02:33:22 27,136 ------w C:\WINDOWS\Serv
Et ca y est j'ai fait la 2ieme procedure donnée mais bon j'aurais voulu savoir ce que cela faisait ?
Avec Combofix, je t'ai fait supprimer des fichiers infectés sur ton ordinateur :
- RavMon qui vient d'une infection par disque amovible (et la deuxième procédure visait à désinfecter tes supports amovibles justement, pour ne pas qu'ils réinfectent ton ordinateur ou un autre...)
- Je t'ai fait supprimer un dossier Boonty (qui s'installent avec les jeux du même nom) parce qu'il recueille des informations personnelles.
Pour Boonty, il faut finir le travail manuellement :
Menu démarrer --> exécuter --> tape services.msc et valide --> fais un clic droit sur le service Boonty Games --> clique sur Arrêter et règle "type de démarrage" sur désactivé, puis valide.
Enfin, redémarre ton ordinateur et poste un dernier rapport hijackthis stp
- RavMon qui vient d'une infection par disque amovible (et la deuxième procédure visait à désinfecter tes supports amovibles justement, pour ne pas qu'ils réinfectent ton ordinateur ou un autre...)
- Je t'ai fait supprimer un dossier Boonty (qui s'installent avec les jeux du même nom) parce qu'il recueille des informations personnelles.
Pour Boonty, il faut finir le travail manuellement :
Menu démarrer --> exécuter --> tape services.msc et valide --> fais un clic droit sur le service Boonty Games --> clique sur Arrêter et règle "type de démarrage" sur désactivé, puis valide.
Enfin, redémarre ton ordinateur et poste un dernier rapport hijackthis stp
Bien alors j'ai suvi tes instructions mais je n'ai aucun fichiers se rapportant à Boonty Games dans le fichiers Service local alors voila quand même le rapport hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:19:52, on 27/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
D:\ipod\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\mmc.exe
C:\Program Files\Trend Micro\jack.exe\jack.exe.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\ipod\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [AnumanLive] C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\moua\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://gamenextfr.oberon-media.com/online/online2/luxor_2/mjolauncher.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://kaliaspace.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {B9907873-6560-4A36-B76B-9DADE84A7F55} (FnacmusicDnl.DnlManager) - http://www.fnacmusic.com/telechargementFnacmusic/FnacmusicDnl.CAB
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MusicManagerPlugin.MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/bejeweled2/Oberongamesloader.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:19:52, on 27/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
D:\ipod\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\mmc.exe
C:\Program Files\Trend Micro\jack.exe\jack.exe.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\ipod\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [AnumanLive] C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\moua\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://gamenextfr.oberon-media.com/online/online2/luxor_2/mjolauncher.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://kaliaspace.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {B9907873-6560-4A36-B76B-9DADE84A7F55} (FnacmusicDnl.DnlManager) - http://www.fnacmusic.com/telechargementFnacmusic/FnacmusicDnl.CAB
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MusicManagerPlugin.MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/bejeweled2/Oberongamesloader.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
Il ne reste qu'une ligne gênante sur le rapport hijackthis, ce sont les traces de EoRezo (qui affiche des fenêtres de publicités intempestives).
# Clique sur Menu démarrer --> Panneau de configuration --> Ajout-Suppression de programmes --> désinstalle tout ce qui a trait a Eorezo, par exemple eorezo, eoWeather, eoEngine... (normalement tu ne devrais rien trouver sur ton ordinateur)
# Redémarre l'ordinateur.
# Menu démarrer --> Panneau de configuration --> Option des dossiers --> affichage --> coche "afficher les fichiers et dossiers cachés" et décoche "masquer les fichiers protégés du système d'exploitation" (tu pourras remettre les réglages comme ils étaient à la fin de cette procédure)
# Supprime les répertoires résiduels :
Menu démarrer --> Poste de travail --> Disque local C --> Program Files --> supprime eoRezo
Menu démarrer --> Poste de travail --> Disque local C --> Documents and Settings --> nom de la session (faire de même pour chaque session) --> Application Data --> supprime EoRezo
# Relance Hijackthis, coche cette ligne et clique sur "Fix Checked"
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
==> Tu es débarrassé de EoRezo (tu peux masquer à nouveau les fichiers cachés si tu veux)
Tu peux ensuite poster un nouveau rapport hijackthis (cette fois c'est le dernier, c'est promis ;) )
# Clique sur Menu démarrer --> Panneau de configuration --> Ajout-Suppression de programmes --> désinstalle tout ce qui a trait a Eorezo, par exemple eorezo, eoWeather, eoEngine... (normalement tu ne devrais rien trouver sur ton ordinateur)
# Redémarre l'ordinateur.
# Menu démarrer --> Panneau de configuration --> Option des dossiers --> affichage --> coche "afficher les fichiers et dossiers cachés" et décoche "masquer les fichiers protégés du système d'exploitation" (tu pourras remettre les réglages comme ils étaient à la fin de cette procédure)
# Supprime les répertoires résiduels :
Menu démarrer --> Poste de travail --> Disque local C --> Program Files --> supprime eoRezo
Menu démarrer --> Poste de travail --> Disque local C --> Documents and Settings --> nom de la session (faire de même pour chaque session) --> Application Data --> supprime EoRezo
# Relance Hijackthis, coche cette ligne et clique sur "Fix Checked"
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
==> Tu es débarrassé de EoRezo (tu peux masquer à nouveau les fichiers cachés si tu veux)
Tu peux ensuite poster un nouveau rapport hijackthis (cette fois c'est le dernier, c'est promis ;) )
J'ai fait comme tu me l'a dit mais j'ai rien trouver sur eorezo par contre j'ai trouvé le fichier boonty que j'ai supprimer et donc voila le rapport de hijackthis après avoir suppimer la ligne à coché...:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:20:05, on 27/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
D:\ipod\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
C:\Program Files\Trend Micro\jack.exe\jack.exe.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\ipod\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [AnumanLive] C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\moua\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://gamenextfr.oberon-media.com/online/online2/luxor_2/mjolauncher.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://kaliaspace.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {B9907873-6560-4A36-B76B-9DADE84A7F55} (FnacmusicDnl.DnlManager) - http://www.fnacmusic.com/telechargementFnacmusic/FnacmusicDnl.CAB
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MusicManagerPlugin.MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/bejeweled2/Oberongamesloader.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:20:05, on 27/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
D:\ipod\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
C:\Program Files\Trend Micro\jack.exe\jack.exe.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\ipod\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [AnumanLive] C:\Documents and Settings\moua\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\moua\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://gamenextfr.oberon-media.com/online/online2/luxor_2/mjolauncher.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://kaliaspace.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {B9907873-6560-4A36-B76B-9DADE84A7F55} (FnacmusicDnl.DnlManager) - http://www.fnacmusic.com/telechargementFnacmusic/FnacmusicDnl.CAB
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MusicManagerPlugin.MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/bejeweled2/Oberongamesloader.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
Désolé pour la réponse tardive...
Ton ordinateur n'est plus infecté, je peux t'aider à le sécuriser si tu le souhaites ?
Par contre, je ne vois pas d'Antivirus sur le rapport, tu n'en as pas ?
Ton ordinateur n'est plus infecté, je peux t'aider à le sécuriser si tu le souhaites ?
Par contre, je ne vois pas d'Antivirus sur le rapport, tu n'en as pas ?
Très bien, ton ordinateur n'est plus infecté !
Avant de retourner surfer sur internet, il y a quelques petites choses que tu dois faire pour finir le nettoyage et améliorer sensiblement la sécurité de ton ordinateur, ça t'évitera peut-être de devoir revenir ici avec une nouvelle infection dans le futur ;) Mais sache qu'aucun logiciel de sécurité ne te protègera à 100%, ce qui fait la différence, c'est ta vigilance lorsque tu télécharges ou installes quelque chose : pour en savoir plus, je t'invite à bien lire la page indiquée tout en bas de ce message (6).
1) Sécurise ton ordinateur
- Anti-virus :
Je te conseille de choisir Antivir, c'est le meilleur antivirus gratuit (il existe également une version gratuite, à toi de voir). Tu peux trouver un tutoriel et un lien pour le télécharger ici.
Note : cette version est en anglais, mais une pré-version en français est disponible en français ici (le lien ne fonctionne pas toujours)
- Pare-feu :
Tu n’as apparemment aucun pare-feu (sauf peut-être celui de Windows, qui est inefficace et ne filtre pas les connections sortantes utilisées par beaucoup d'infections...) : Télécharges-en un vrai. En gratuit, les plus simples sont ZoneAlarm, Kerio et Pc Tools. Tu peux t'aider des tuto suivants pour utiliser celui que tu choisiras :
- Tutoriel PC Tools Firewall
- Tutoriel ZoneAlarm
- Tutoriel Kerio
- Anti-spyware :
* Installe Spyware Blaster : il ne prend pas de mémoire, c'est juste un logiciel qui vaccine ton pc contre certaines infections. Il faut le mettre à jour manuellement, tous les 10 jours environ, et activer toutes les protections (« Enable all protection »)
* En complément, garde AVG Anti-Spyware pour sa protection résidente et MalwareBytes pour son scan de nettoyage performant.
- Pour naviguer sur internet plus en sécurité et à l’abri des publicités, je te conseille d’installer et d'utiliser le navigateur Firefox 3 avec l’extension « AdBlockPlus ». Tu peux trouver des explications ici
- Java n'est pas à jour, c'est une faille de sécurité.
Ouvre le menu démarrer --> panneau de configuration --> ajout/suppression de programmes --> sélectionne toutes les versions de java présentes et désinstalle les. Télécharge et installe la nouvelle version depuis le site officiel de java : https://java.com/fr/
- Adobe Reader n’est pas à jour, c’est une faille de sécurité. Désinstalle le en allant dans menu démarrer --> panneau de configuration --> ajout/suppression de programmes. Puis télécharge et installe la nouvelle version.
2) Relance Hijackthis (pour la dernière fois), fais "scan system only" et coche ces lignes (pas dangereuses mains inutiles) :
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Si tu as bien mis à jour Adobe Reader comme je te l'ai recommandé, cette ligne devrait apparaitre, tu peux la cocher : O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Coche également toutes les lignes commençant par 016
Ensuite, clique sur "Fix checked"
3) Télécharge ToolsCleaner sur ton bureau pour nettoyer l'ordi de tous les outils qu'on a utilisé : ToolsCleaner
Lance le, clique sur Recherche et laisse le scan se finir, puis clique sur Suppression pour nettoyer.
Tu peux aussi supprimer les fichiers temporaires.
Ensuite, supprime manuellement ToolsCleaner (mets le à la corbeille).
S'il ne supprime pas tout (ex : Combofix), supprime toi même ce qui reste.
4) Télécharge et installe CCleaner (attention à l'installation, pense à DECOCHER l'installation de Yahoo toolbar discrètement proposé en plus de CCleaner).
Lance CCleaner
Option --> avancé --> décoche « effacer uniquement les fichiers plus vieux que 48h »
Puis nettoyeur --> Analyse > Lancer le nettoyage, puis sur OK dans la fenêtre qui s' affiche.
Relance le nettoyage une deuxième fois.
Enfin, registre --> corrige toutes les erreurs, et recommence jusqu'à ce qu'il ne trouve plus d'erreurs.
(Tu peux garder ce logiciel et l'utiliser régulièrement).
5) Pour finir le nettoyage, il faut désactiver puis réactiver la restauration système (pour créer un nouveau point de restauration sain et éviter le retour de l'infection).
* Fais un clic droit sur poste de travail (qui est sur ton bureau ou dans le menu démarrer), puis propriétés.
* Sélectionne l'onglet restauration du système
* Coche l'option Désactiver la restauration du système sur tous les lecteurs
* Clique sur OK.
Puis refais la manipulation inverse pour réactiver la restauration système.
6) Je t'invite enfin à visiter cette page qui t'apportera des information de prévention et de protection contre les infections (environ 15 minutes de lecture très instructive et utile):
Prévention et sécurité sur internet
7) Enfin, si tu n as pas d'autres problèmes, tu peux changer le statut du sujet en résolu : Aide
Bonne lecture, bon courage, et n'hésite pas à poser des questions en cas de besoin ;)
Une fois que tu auras fait tout cela, pense à faire un scan avec ton nouvel antivirus pour être certain qu'il ne reste pas quelques traces d'infection.
Avant de retourner surfer sur internet, il y a quelques petites choses que tu dois faire pour finir le nettoyage et améliorer sensiblement la sécurité de ton ordinateur, ça t'évitera peut-être de devoir revenir ici avec une nouvelle infection dans le futur ;) Mais sache qu'aucun logiciel de sécurité ne te protègera à 100%, ce qui fait la différence, c'est ta vigilance lorsque tu télécharges ou installes quelque chose : pour en savoir plus, je t'invite à bien lire la page indiquée tout en bas de ce message (6).
1) Sécurise ton ordinateur
- Anti-virus :
Je te conseille de choisir Antivir, c'est le meilleur antivirus gratuit (il existe également une version gratuite, à toi de voir). Tu peux trouver un tutoriel et un lien pour le télécharger ici.
Note : cette version est en anglais, mais une pré-version en français est disponible en français ici (le lien ne fonctionne pas toujours)
- Pare-feu :
Tu n’as apparemment aucun pare-feu (sauf peut-être celui de Windows, qui est inefficace et ne filtre pas les connections sortantes utilisées par beaucoup d'infections...) : Télécharges-en un vrai. En gratuit, les plus simples sont ZoneAlarm, Kerio et Pc Tools. Tu peux t'aider des tuto suivants pour utiliser celui que tu choisiras :
- Tutoriel PC Tools Firewall
- Tutoriel ZoneAlarm
- Tutoriel Kerio
- Anti-spyware :
* Installe Spyware Blaster : il ne prend pas de mémoire, c'est juste un logiciel qui vaccine ton pc contre certaines infections. Il faut le mettre à jour manuellement, tous les 10 jours environ, et activer toutes les protections (« Enable all protection »)
* En complément, garde AVG Anti-Spyware pour sa protection résidente et MalwareBytes pour son scan de nettoyage performant.
- Pour naviguer sur internet plus en sécurité et à l’abri des publicités, je te conseille d’installer et d'utiliser le navigateur Firefox 3 avec l’extension « AdBlockPlus ». Tu peux trouver des explications ici
- Java n'est pas à jour, c'est une faille de sécurité.
Ouvre le menu démarrer --> panneau de configuration --> ajout/suppression de programmes --> sélectionne toutes les versions de java présentes et désinstalle les. Télécharge et installe la nouvelle version depuis le site officiel de java : https://java.com/fr/
- Adobe Reader n’est pas à jour, c’est une faille de sécurité. Désinstalle le en allant dans menu démarrer --> panneau de configuration --> ajout/suppression de programmes. Puis télécharge et installe la nouvelle version.
2) Relance Hijackthis (pour la dernière fois), fais "scan system only" et coche ces lignes (pas dangereuses mains inutiles) :
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Si tu as bien mis à jour Adobe Reader comme je te l'ai recommandé, cette ligne devrait apparaitre, tu peux la cocher : O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Coche également toutes les lignes commençant par 016
Ensuite, clique sur "Fix checked"
3) Télécharge ToolsCleaner sur ton bureau pour nettoyer l'ordi de tous les outils qu'on a utilisé : ToolsCleaner
Lance le, clique sur Recherche et laisse le scan se finir, puis clique sur Suppression pour nettoyer.
Tu peux aussi supprimer les fichiers temporaires.
Ensuite, supprime manuellement ToolsCleaner (mets le à la corbeille).
S'il ne supprime pas tout (ex : Combofix), supprime toi même ce qui reste.
4) Télécharge et installe CCleaner (attention à l'installation, pense à DECOCHER l'installation de Yahoo toolbar discrètement proposé en plus de CCleaner).
Lance CCleaner
Option --> avancé --> décoche « effacer uniquement les fichiers plus vieux que 48h »
Puis nettoyeur --> Analyse > Lancer le nettoyage, puis sur OK dans la fenêtre qui s' affiche.
Relance le nettoyage une deuxième fois.
Enfin, registre --> corrige toutes les erreurs, et recommence jusqu'à ce qu'il ne trouve plus d'erreurs.
(Tu peux garder ce logiciel et l'utiliser régulièrement).
5) Pour finir le nettoyage, il faut désactiver puis réactiver la restauration système (pour créer un nouveau point de restauration sain et éviter le retour de l'infection).
* Fais un clic droit sur poste de travail (qui est sur ton bureau ou dans le menu démarrer), puis propriétés.
* Sélectionne l'onglet restauration du système
* Coche l'option Désactiver la restauration du système sur tous les lecteurs
* Clique sur OK.
Puis refais la manipulation inverse pour réactiver la restauration système.
6) Je t'invite enfin à visiter cette page qui t'apportera des information de prévention et de protection contre les infections (environ 15 minutes de lecture très instructive et utile):
Prévention et sécurité sur internet
7) Enfin, si tu n as pas d'autres problèmes, tu peux changer le statut du sujet en résolu : Aide
Bonne lecture, bon courage, et n'hésite pas à poser des questions en cas de besoin ;)
Une fois que tu auras fait tout cela, pense à faire un scan avec ton nouvel antivirus pour être certain qu'il ne reste pas quelques traces d'infection.