trojan-gen (other)

Question

Bonjour,
encore une victime du trojan-gen!
voila un log hijackthis
si vs pouvez m'aider c cool


Logfile of HijackThis v1.99.1
Scan saved at 11:51:01, on 28/02/2007
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\ProgramDatauzkfyhm\jcrgnyfi.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Adobe\Reader 9.0\Readereader_sl.exe
C:\Windows\System32undll32.exe
C:\Windows\System32\lphc537j0e7ag.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Users\bobby.PC-de-gobby\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [lphc537j0e7ag] C:\Windows\system32\lphc537j0e7ag.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
laapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
apinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix: 
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O21 - SSODL: aplsmart - {532C41DF-267F-1A1F-C527-034A43CF16B4} - (no file)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

ep44 · Answer

Bonjour sKe69

je me retire et te laisse la main ;)

@+

sKe69 · Answer

Salut,

protocole à suivre pour  Windows Vista :

*Désactiver le contrôle des comptes utilisateurs ou UAC (le réactiver seulement à la fin de la désinfection) :
 
Aller dans "démarrer" puis "panneau de configuration" : 
--->Sur la droite de la fenêtre , cliques sur " affichage classique "
--->Double-Cliquer sur l'icône "Comptes d'utilisateurs" 
--->Cliquer ensuite sur "Activer ou désactiver le contrôle ..." .
--->Décocher la case "utlisiser le contrôle ..." et cliquer sur OK .
Puis redémarrer le PC quand il le vous saura demandé ...

Tuto : https://forum.malekal.com/viewtopic.php?f=59&t=6517 


* Important :
Pour installer ou pour lancer les outils, que tu utiliseras au court de la désinfection, fait toujours ainsi :
cliques DROIT ( sur le setup d'installe ou l'outil )-> choisis " Exécuter entant qu'administrateur " .
Fais ce-ci systématiquement ! ...

*********************************************************
une fois ceci fais et pris en compte , fais ce qui suit :


1- Supprimes ton hijackthis , cette version est obselette et mal installé ...

ensuite :

Télécharges et installes le logiciel HijackThis : 

ici ftp://ftp.commentcamarche.com/download/HJTInstall.exe 
ou ici http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
ou ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html

-> Cliques sur le setup pour lancer l'installe : laisses toi guider et ne modifies pas les paramètres d'installation . 
A la fin de l'installe , le prg ce lance automatiquement : fermes le en cliquant sur la croix rouge . 
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme : 
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .

( ne fais pas de scan pour le moment ) 


2-Télécharges SmitfraudFix (de S!Ri, balltrap34 et moe31 ) :
http://siri.urz.free.fr/Fix/SmitfraudFix.exe

Installes le soft sur ton bureau ( et pas ailleurs! ) .

!! Déconnectes toi, fermes toute tes applications et désactives tes défenses ( anti-virus ,anti-spyware,...) le temps de la manipe !!


Tuto ( aide ) : http://siri.urz.free.fr/Fix/SmitfraudFix.php
 
Utilisation ---> option 1 / Recherche : 
Double cliques sur l'icône "Smitfraudfix.exe" et sélectionnes 1 (et pas sur autre chose sans notre accord !) pour créer un rapport des fichiers responsables de l'infection.
 
Postes le rapport ( "rapport.txt" qui se trouve sous C\: ) et attends la suite ...

(Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool". Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité.)

vivou · Answer

SmitFraudFix v2.354

Scan done at 13:34:33,78, 28/02/2007
Run from C:\Users\bobby.PC-de-gobby\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32
vvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32undll32.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\svchost.exe
C:\ProgramDatauzkfyhm\jcrgnyfi.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\System32undll32.exe
C:\Windows\System32\lphc537j0e7ag.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

hosts file corrupted !

127.0.0.1	www.legal-at-spybot.info
127.0.0.1	legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\bobby.PC-de-gobby


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\bobby.PC-de-gobby\Application Data

C:\Users\bobby.PC-de-gobby\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\BOBBY~1.PC-\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
 
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000000


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\Windows\system32\userinit.exe,"


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{6132981F-30A1-4C06-809E-EB1AD15D3E90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6132981F-30A1-4C06-809E-EB1AD15D3E90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{6132981F-30A1-4C06-809E-EB1AD15D3E90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

pour un fichier AntiXPVSTFix une fenetre s'ouvre et ca me dit que le processus a cessé de fonctionner
je clique fermer et ca repart. C'est normal?

sKe69 · Answer

Ok ...

continuons :

Suite de la manipe ( nettoyage ), fais exactement ce qui suit : 

* Impératif : Redémarrer l'ordinateur en mode sans échec . 
Comment aller en Mode sans échec 
1) Redémarre ton ordi 
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisis la première option : Sans Échec, et valide avec "Entrée" 
5) Choisis ton compte habituel, et non Administrateur (si besoin ... ) 
( ps : n'oublies pas , en mode sans échec , pas de connexion ! Donc copies ou imprimes bien les info ci-dessous ...)

*Double click sur SmitfraudFix.exe 

* Sélectionnes 2 et presses "Entrée" dans le menu pour supprimer les fichiers responsables de l'infection. 

-> Si besion :
* A la question: Voulez-vous nettoyer le registre ? répondre O (oui) et presser Entrée afin de débloquer le fond d'écran et supprimer les clés de registre de l'infection. 

( Le correctif déterminera si le fichier wininet.dll est infecté.)
 
* A la question: "Corriger le fichier infecté ?" répondre O (oui) et presser Entrée 
pour remplacer le fichier corrompu. 

* Un redémarrage sera peut être nécessaire pour terminer la procédure de nettoyage ( sinon fais le manuellement ) 

Le rapport se trouve à la racine de C\: 
(dans le fichier "rapport.txt") 

Postes moi ce dernier rapport ... mais attention, ne me postes pas la listes entière du chapitre " hosts " ( c'est trop long pour le forum ;), justes le début et la fin...  ) .

Postes aussi un nouveau rapport hijackthis ( fais en mode normal ) et attends les instructions ...

vivou · Answer

je viens de faire la manip mais il est tjs la 
rapport smitfraudfix

SmitFraudFix v2.354

Scan done at 17:43:56,81, 28/02/2007
Run from C:\Users\bobby.PC-de-gobby\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\Users\bobby.PC-de-gobby\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix



»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{6132981F-30A1-4C06-809E-EB1AD15D3E90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6132981F-30A1-4C06-809E-EB1AD15D3E90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{6132981F-30A1-4C06-809E-EB1AD15D3E90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
 
Registry Cleaning done. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

vivou · Answer

puis highjack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:52:11, on 28/02/2007
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\ProgramDatauzkfyhm\jcrgnyfi.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Adobe\Reader 9.0\Readereader_sl.exe
C:\Windows\System32undll32.exe
C:\Windows\System32\lphc537j0e7ag.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [lphc537j0e7ag] C:\Windows\system32\lphc537j0e7ag.exe
O4 - HKLM\..\Run: [AutorunReload] Autoload.exe D:\autorun.EXE
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Policies\Explorer\Run: [qCOHaNyWv4] C:\ProgramDatauzkfyhm\jcrgnyfi.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O13 - Gopher Prefix: 
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O21 - SSODL: aplsmart - {532C41DF-267F-1A1F-C527-034A43CF16B4} - (no file)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe

sKe69 · Answer

je viens de faire la manip mais il est tjs la

C'est normale ... ^^ Il y a encore pas mal de boulot ...


Il me faut un nouveau rapport hijackthis comme je te l'ai demander stp ...;)

vivou · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:59:09, on 28/02/2007
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\ProgramDatauzkfyhm\jcrgnyfi.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\System32undll32.exe
C:\Windows\System32\lphc537j0e7ag.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [lphc537j0e7ag] C:\Windows\system32\lphc537j0e7ag.exe
O4 - HKLM\..\Run: [AutorunReload] Autoload.exe D:\autorun.EXE
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Policies\Explorer\Run: [qCOHaNyWv4] C:\ProgramDatauzkfyhm\jcrgnyfi.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O13 - Gopher Prefix: 
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O21 - SSODL: aplsmart - {532C41DF-267F-1A1F-C527-034A43CF16B4} - (no file)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe

sKe69 · Answer

Re, on c'est croisé ...:p

La suite dans l'ordre :


1- Désactives le " tea timer " de Spybot S&D avant de poursuivre .... tu le réactivera en toute fin de désinfection, pas avant ( en tu accepteras à ce moment là , toutes les modifs de registre qu'il te demandera ) .


2- Télécharges : - CCleaner 
https://www.pcastuces.com/logitheque/ccleaner.htm 
Ce logiciel va permettre de supprimer tous les fichiers temporaires et de corrigé ton registre .Lors de l'installation, avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires" sauf les 2 première.
Une fois le prg instalé et lancé, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures"( Par la suite, laisse-le avec ses réglages par défaut. C'est tout ). 

Un tuto ( aide ): 
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm 

---> Utilisation:
! déconnectes toi et fermes toutes applications en cours !
* vas dans "nettoyeur" : fait analyse puis nettoyage 
* vas dans "registre" : fait chercher les erreurs et réparer ( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) . 

( CCleaner : soft à garder sur son PC , super utile pour de bons nettoyages ... )


3- Avant de poursuivre , on va faire quelques vérifes :

Rends toi sur ce site : 

https://www.virustotal.com/gui/ 

Copies ce qui suit et colles le dans l'espace pour la recherche : 
C:\ProgramData\ruzkfyhm\jcrgnyfi.exe 

Cliques sur Send File ( = " Envoyer le fichier " ). 

Un rapport va s'élaborer ligne à ligne. 

Attends bien la fin ... Il doit comprendre la taille du fichier envoyé. 

Sauvegarde le rapport avec le bloc-note. 

Copies le dans ta prochaine réponse ... 

( Si VirusTotal indique que le fichier a déjà été analysé, clique sur le bouton Ré-analyse le fichier maintenant )


Fais de même pour :

D:\autorun.EXE 


postes moi donc ces 2 rapports ( surtout le début avec le listing des AV , et en précisant bien au début de chacuns à quel fichier ils correspondent ) et attends la suite ...

vivou · Answer

jcrgnyfi.exe


Antivirus  	Version  	Dernière mise à jour  	Résultat
AhnLab-V3	2008.9.25.0	2008.09.26	-
AntiVir	7.8.1.34	2008.09.28	TR/Downloader.Gen
Authentium	5.1.0.4	2008.09.28	-
Avast	4.8.1195.0	2008.09.27	Win32:PureMorph
AVG	8.0.0.161	2008.09.28	Generic11.YJD
BitDefender	7.2	2008.09.28	-
CAT-QuickHeal	9.50	2008.09.27	Win32.Trojan.Obfuscated.gx.3
ClamAV	0.93.1	2008.09.28	-
DrWeb	4.44.0.09170	2008.09.28	-
eSafe	7.0.17.0	2008.09.28	Win32.Obfuscated.gx
eTrust-Vet	31.6.6110	2008.09.26	-
Ewido	4.0	2008.09.28	-
F-Prot	4.4.4.56	2008.09.27	-
F-Secure	8.0.14332.0	2008.09.28	Trojan.Win32.Obfuscated.gx
Fortinet	3.113.0.0	2008.09.28	W32/PolySmall.BP!tr
GData	19	2008.09.28	Win32:PureMorph
Ikarus	T3.1.1.34.0	2008.09.28	Trojan.Win32.Obfuscated.gx
K7AntiVirus	7.10.476	2008.09.27	-
Kaspersky	7.0.0.125	2008.09.28	Trojan.Win32.Obfuscated.gx
McAfee	5393	2008.09.27	FakeAlert-BD
Microsoft	1.3903	2008.09.28	Trojan:Win32/Busky.EH
NOD32	3478	2008.09.28	-
Norman	5.80.02	2008.09.26	-
Panda	9.0.0.4	2008.09.28	Adware/Lop
PCTools	4.4.2.0	2008.09.26	-
Prevx1	V2	2008.09.28	Adware
Rising	20.63.62.00	2008.09.28	-
SecureWeb-Gateway	6.7.6	2008.09.28	Trojan.Downloader.Gen
Sophos	4.34.0	2008.09.28	-
Sunbelt	3.1.1675.1	2008.09.27	Trojan.Win32.Obfuscated.gx
Symantec	10	2008.09.28	Packed.Generic.182
TheHacker	6.3.0.9.095	2008.09.27	-
TrendMicro	8.700.0.1004	2008.09.26	-
VBA32	3.12.8.6	2008.09.27	Trojan.Win32.Obfuscated.gx
ViRobot	2008.9.26.1394	2008.09.26	-
VirusBuster	4.5.11.0	2008.09.28	-
Information additionnelle
File size: 73728 bytes
MD5...: 6f4335aecf336388ac267b62fc23c67b
SHA1..: 1aa0eef2d20ce79794b7ad636c0d2105e6965015
SHA256: 393a92df1d15ecba29344d4da491c9ce8f005a7fc2da88ea9f20c9f49fddca72
SHA512: e92ebfff6067f8923012a361081a184d2e35d86d0752e7abe47e3174886daacd
f1b5374b20fc356db626a4d6785f7eb72193652c17a30475d247b3f500ad8f49
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4083c6
timedatestamp.....: 0x48cd722e (Sun Sep 14 20:21:02 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xe52c 0xf000 6.78 15fb3c6b0aeded60eaf238c3d13efb4f
.rdata 0x10000 0x5f4 0x1000 2.54 b8aa6d97ccc323731803ba58c28c0214
.data 0x11000 0x414 0x1000 0.28 ed63e6e30b561d1eb7e4bf0e011af1e4

( 3 imports )
> KERNEL32.dll: WideCharToMultiByte, GetProcAddress, ResumeThread, CancelWaitableTimer, FindResourceExW, SetEndOfFile, GetFileSize, GetSystemTime, WaitForSingleObject, SetFilePointer, MulDiv, GetLocalTime, FindFirstChangeNotificationW, FileTimeToSystemTime, LoadResource, GetLogicalDrives, SetCurrentDirectoryW, GetPrivateProfileStringW, LoadLibraryA, SetThreadPriority, GetUserDefaultLangID, FindNextChangeNotification
> USER32.dll: RegisterClassExW, EnableWindow, GetMessageW, EndDialog, RedrawWindow, LoadImageW, SetCursor, GetWindowDC, SetWindowTextW, DefWindowProcW, SendMessageW, CreateWindowExW, DispatchMessageW, UpdateWindow, RegisterHotKey, GetCursorPos, GetParent, OffsetRect, SystemParametersInfoW, ReleaseCapture
> GDI32.dll: CreateRoundRectRgn, CreateCompatibleBitmap, GetObjectW, SetDIBits, CreateICW, SetBkColor, StretchBlt, CreateBitmap, SetMapMode, MoveToEx, DeleteDC, GetDeviceCaps

( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=E0E8A8730008F8DD2027013B4625F300BD600522

vivou · Answer

par contre qd je fais d: autorun ya mon lecteur dvd qui s'ouvre et il me de mande un cd

vivou · Answer

--------------------\  Lop S&D 4.2.4-4   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6000 ) 
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU          6600  @ 2.40GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : bobby ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 080814-0] 4.8.1229 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total : 74 Go Free : 30 Go
   D:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-09-2008|22:20 )
   Option : [1] ( 28/02/2007|18:37 )

   [ UAC => 0 ]
 
   --------------------\  Listing des dossiers dans Local  

   [10/08/2008|16:36] C:\Users\BOBBY~1.PC-\AppData\Local\Adobe
   [10/08/2008|14:13] C:\Users\BOBBY~1.PC-\AppData\Local\Application Data 
   [16/01/2007|13:01] C:\Users\BOBBY~1.PC-\AppData\Local\ApplicationHistory
   [10/08/2008|14:22] C:\Users\BOBBY~1.PC-\AppData\Local\d3d8caps.dat
   [10/08/2008|15:10] C:\Users\BOBBY~1.PC-\AppData\Local\d3d9caps.dat
   [28/02/2007|10:54] C:\Users\BOBBY~1.PC-\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [10/08/2008|17:30] C:\Users\BOBBY~1.PC-\AppData\Local\eMule
   [15/01/2007|13:12] C:\Users\BOBBY~1.PC-\AppData\Local\fusioncache.dat
   [11/08/2008|08:56] C:\Users\BOBBY~1.PC-\AppData\Local\GDIPFONTCACHEV1.DAT
   [28/01/2007|22:55] C:\Users\BOBBY~1.PC-\AppData\Local\Google
   [10/08/2008|14:13] C:\Users\BOBBY~1.PC-\AppData\Local\Historique 
   [25/01/2007|20:04] C:\Users\BOBBY~1.PC-\AppData\Local\Microsoft
   [09/02/2007|23:46] C:\Users\BOBBY~1.PC-\AppData\Local\Microsoft Games
   [10/08/2008|15:00] C:\Users\BOBBY~1.PC-\AppData\Local\Mozilla
   [10/08/2008|23:43] C:\Users\BOBBY~1.PC-\AppData\Local\PunkBuster
   [28/02/2007|18:37] C:\Users\BOBBY~1.PC-\AppData\Local\Temp
   [10/08/2008|14:13] C:\Users\BOBBY~1.PC-\AppData\Local\Temporary Internet Files 
   [10/08/2008|14:13] C:\Users\BOBBY~1.PC-\AppData\Local\VirtualStore
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [28/02/2007 17:49][--ah-----] C:\Windows	asks\SA.DAT
   [28/02/2007 17:40][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [10/08/2008|16:01] C:\ProgramData\Adobe
   [02/11/2006|14:02] C:\ProgramData\Application Data 
   [10/08/2008|12:08] C:\ProgramData\Bureau 
   [02/11/2006|14:02] C:\ProgramData\Desktop 
   [02/11/2006|14:02] C:\ProgramData\Documents 
   [10/08/2008|17:31] C:\ProgramData\eMule
   [10/08/2008|12:08] C:\ProgramData\Favoris 
   [02/11/2006|14:02] C:\ProgramData\Favorites 
   [10/08/2008|12:08] C:\ProgramData\Menu D‚marrer 
   [12/08/2008|08:49] C:\ProgramData\Microsoft
   [10/08/2008|12:08] C:\ProgramData\ModŠles 
   [15/08/2008|00:08] C:\ProgramData\NVIDIA
   [14/02/2007|22:12] C:\ProgramDatauzkfyhm
   [28/02/2007|18:14] C:\ProgramData\Spybot - Search & Destroy
   [02/11/2006|14:02] C:\ProgramData\Start Menu 
   [21/02/2007|19:37] C:\ProgramData\TEMP
   [02/11/2006|14:02] C:\ProgramData\Templates 
   [13/08/2008|20:04] C:\ProgramData\WLInstaller

   --------------------\  Listing des dossiers dans C:\Program Files

   [10/08/2008|15:58] C:\Program Files\Adobe
   [10/08/2008|15:29] C:\Program Files\Alwil Software
   [21/02/2007|19:34] C:\Program Files\CCleaner
   [10/08/2008|15:58] C:\Program Files\Common Files
   [10/08/2008|20:33] C:\Program Files\DivX
   [10/08/2008|23:26] C:\Program Files\Electronic Arts
   [10/08/2008|17:30] C:\Program Files\eMule
   [10/08/2008|12:08] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [28/01/2007|22:52] C:\Program Files\Google
   [28/02/2007|13:30] C:\Program Files\HijackThis
   [11/08/2008|19:08] C:\Program Files\Illustrate
   [15/08/2008|11:08] C:\Program Files\Image-Line
   [28/02/2007|14:44] C:\Program Files\InstallShield Installation Information
   [15/01/2007|13:06] C:\Program Files\Internet Explorer
   [02/11/2006|13:37] C:\Program Files\Microsoft Games
   [02/11/2006|13:42] C:\Program Files\Movie Maker
   [28/02/2007|18:18] C:\Program Files\Mozilla Firefox
   [02/11/2006|13:37] C:\Program Files\MSBuild
   [02/11/2006|13:37] C:\Program Files\MSN
   [02/11/2006|13:37] C:\Program Files\Reference Assemblies
   [15/08/2008|00:16] C:\Program Files\Rockstar Games
   [27/02/2007|10:51] C:\Program Fileszdwcm
   [14/08/2008|23:55] C:\Program Files\SoundSpectrum
   [21/02/2007|19:41] C:\Program Files\Spybot - Search & Destroy
   [10/08/2008|15:14] C:\Program Files\SystemRequirementsLab
   [28/02/2007|13:30] C:\Program Files\Trend Micro
   [02/11/2006|14:01] C:\Program Files\Uninstall Information
   [10/08/2008|16:30] C:\Program Files\UxTheme Multipatcher Fr
   [15/08/2008|11:08] C:\Program Files\VstPlugins
   [10/08/2008|16:20] C:\Program Files\Windows Calendar
   [02/11/2006|13:42] C:\Program Files\Windows Collaboration
   [10/08/2008|16:20] C:\Program Files\Windows Defender
   [02/11/2006|13:42] C:\Program Files\Windows Journal
   [13/08/2008|20:07] C:\Program Files\Windows Live
   [14/08/2008|02:29] C:\Program Files\Windows Mail
   [10/08/2008|16:20] C:\Program Files\Windows Media Player
   [10/08/2008|12:08] C:\Program Files\Windows NT
   [02/11/2006|13:42] C:\Program Files\Windows Photo Gallery
   [10/08/2008|16:20] C:\Program Files\Windows Sidebar
   [10/08/2008|16:58] C:\Program Files\WinRAR
   [26/02/2007|18:31] C:\Program Files\yugyvxc

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [10/08/2008|15:59] C:\Program Files\Common Files\Adobe
   [10/08/2008|17:09] C:\Program Files\Common Files\InstallShield
   [13/08/2008|20:06] C:\Program Files\Common Files\microsoft shared
   [02/11/2006|12:18] C:\Program Files\Common Files\Services
   [02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
   [10/08/2008|16:20] C:\Program Files\Common Files\System
   [13/08/2008|20:06] C:\Program Files\Common Files\WindowsLiveInstaller

   --------------------\  Process

   ( 49 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2007-02-28 18:37:52
   Windows 6.0.6000  NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections

   --------------------\  ROGUES ..

   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Antivirus XP 2008.lnk

   --------------------\  Cracks & Keygens ..

   C:\Users\BOBBY~1.PC-\Documents\downloads\Nero 8 Ultra Edition v.8.0.3.0 (Multilanguage) + Crack.rar
   C:\Users\BOBBY~1.PC-\Documents\downloads\Nero 8 Ultra Edition v8.0.3.0 ITA + Crack.rar


   [F:3][D:2]-> C:\Users\BOBBY~1.PC-\AppData\Local\Temp
   [F:1][D:1]-> C:\Users\BOBBY~1.PC-\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:2][D:0]-> C:\Users\BOBBY~1.PC-\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:9][D:3]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 28/02/2007|18:38 - Option : [1]

   --------------------\  Fin du rapport a 18:38:58
   [ UAC => 1 ]

sKe69 · Answer

mouais ...

des cracks infectés ...


1- Télécharges OTMoveIt (de Old_Timer) sur ton Bureau. 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
ou http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

Déconnectes toi et fermes toute tes applications en cours .
 
cliques double sur OTMoveIt.exe pour le lancer. 
copies ce qui se trouve en citation ci-dessous,
 
C:\Users\BOBBY~1.PC-\Documents\downloads\Nero 8 Ultra Edition v.8.0.3.0 (Multilanguage) + Crack.rar 
C:\Users\BOBBY~1.PC-\Documents\downloads\Nero 8 Ultra Edition v8.0.3.0 ITA + Crack.rar 


et colles le dans le cadre de gauche de OTMoveIt2 : 
Paste standard List of Files/Folders to be moved.
 
cliques sur MoveIt! pour lancer la suppression. 
le résultat apparaîtra dans le cadre Results.
 
cliques sur Exit pour fermer. 
--->postes le rapport situé dans le dossier " C:\OTMoveIt\MovedFiles."  ( c'est un .log )

Note : il te sera peut-être demandé de redémarrer le pc pour achever la suppression. 
si c'est le cas acceptes par "Yes".


Une fois ce rapport posté , fais ce qui suit :

2- Télécharges MalwareByte's : 
ici ftp://ftp.commentcamarche.com/download/mbam-setup.exe
ou ici : http://www.malwarebytes.org/mbam.php
 
Installes le ( choisis bien "francais" ; ne modifies pas les paramètres d'installe ) et mets le à jour . 

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharges le ici : https://www.malekal.com/tutorial-aboutbuster/ )

Potasses le tuto pour te familiariser avec le prg : https://forum.pcastuces.com/sujet.asp?f=31&s=3 
( cela dis, il est très simple d'utilisation ).

Impératif : redémarres en mode sans échec : 
Comment aller en Mode sans échec 
1) Redémarres ton ordi 
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisis la première option : Sans Échec, et valide avec "Entrée" 
5) Choisis ton compte habituel, et non Administrateur (si besoin ... ) 
(attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreurs ...)
 
Lances Malwarebyte's .

Fais un scan dit "complet" ( sélectionnes bien tous tes disks avant le scan ! )  et supprimes tout ce qu'il peut trouver, c'est à dire :
-->Laisses le scan se terminer,puis à la fin tu cliques sur "résultat" . 
-->Vérifies que tous les objets infectés soient validés, puis cliques sur " suppression " .

Redémarres ton PC ( mode normal ). 

Postes le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date) accompagné d'un nouvel hijackthis ( fait en mode normal ) ...

vivou · Answer

otmoveit

C:\Users\BOBBY~1.PC-\Documents\downloads\Nero 8 Ultra Edition v.8.0.3.0 (Multilanguage) + Crack.rar moved successfully.
C:\Users\BOBBY~1.PC-\Documents\downloads\Nero 8 Ultra Edition v8.0.3.0 ITA + Crack.rar moved successfully.
 
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 02282007_185515

vivou · Answer

la voila

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1220
Windows 6.0.6000 

28/02/2007 19:38:34
mbam-log-2007-02-28 (19-38-34).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 113766
Temps écoulé: 19 minute(s), 12 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 7
Valeur(s) du Registre infectée(s): 8
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 11
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER	ypelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Servicesdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qcohanywv4 (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionhc137j0e7ag (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphc537j0e7ag (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CLASSES_ROOTegfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Users\bobby.PC-de-gobby\AppData\Roaminghc137j0e7ag (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\bobby.PC-de-gobby\AppData\Roaminghc137j0e7ag\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\bobby.PC-de-gobby\AppData\Roaminghc137j0e7ag\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\bobby.PC-de-gobby\AppData\Roaminghc137j0e7ag\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\bobby.PC-de-gobby\AppData\Roaminghc137j0e7ag\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\bobby.PC-de-gobby\AppData\Roaminghc137j0e7ag\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\bobby.PC-de-gobby\AppData\Roaminghc137j0e7ag\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\bobby.PC-de-gobby\AppData\Roaminghc137j0e7ag\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\bobby.PC-de-gobby\AppData\Roaminghc137j0e7ag\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\bobby.PC-de-gobby\AppData\Roaminghc137j0e7ag\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\bobby.PC-de-gobby\AppData\Roaminghc137j0e7ag\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\ProgramDatauzkfyhm\jcrgnyfi.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\Windows\System32\blphc537j0e7ag.scr (Fake.BlueScreenError) -> Quarantined and deleted successfully.
C:\Windows\System32\lphc537j0e7ag.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\phc537j0e7ag.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\pphc537j0e7ag.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008.lnk (Rogue.AntivirusXP) -> Quarantined and deleted successfully.

windows a bloqué certains prg c normal?

sKe69 · Answer

windows a bloqué certains prg c normal?

--> ??? tu peux préciser un puex plus ...


Dans l'ordre :

1- Supprimes tout ce qui ce trouve dans la quarantaine de Malwarebytes .


2- refais un coup de CCleaner ( registre compris ) .


3- Fais exactement ce qui suit :

Télécharges ComboFix (par sUBs) sur ton Bureau (et pas ailleurs !): 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 


--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! Déconnectes toi,fermes tes applications en cours et DESACTIVES TOUTES TES DEFENSES (anti-virus, guardes anti spy-ware, pare-feu) le temps de la manipe : 
en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après  !!
--->Important : si tu rencontres des difficultés à ce niveau là, fais m'en part avant de poursuivre ...
Tuto ( aide ) ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

---------------------------------------------------------------------------------------------------------------------------------

Ensuite :
double-cliques sur l'icône "combofix.exe" pour lancer l'outil . 

Appuyes sur la touche Y (Yes) pour démarrer le scan . 

Notes importantes : 
--> n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi .
--> Il se peut que le PC redémarre de lui même ( pour finaliser le nettoyage ) , laisses le faire . 
--> si un message d'erreur windows apparait à un momment  : clik sur la croix rouge en haut à droite de la fenêtre pour la fermer ( et pas sur autre chose ! sinon pas de rapport ... ) 

Le rapport sera crée dans: C:\Combofix.txt 
 
Postes le rapport Combofix accompagné d'un nouveau rapport hijackthis pour analyse ...

vivou · Answer

ComboFix 08-09-27.05 - bobby 2008-09-28 20:34:24.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6000.0.1252.1.1036.18.1443 [GMT 2:00]
Lancé depuis: C:\Users\bobby.PC-de-gobby\Desktop\ComboFix.exe
 * Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

E:\Autorun.inf

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_sysrest.sys


(((((((((((((((((((((((((((((   Fichiers créés du 2008-08-28 au 2008-09-28  ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans ce laps de temps

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-09 23:04	38,528	----a-w	C:\Windows\system32\drivers\mbamswissarmy.sys
2008-09-09 23:03	17,200	----a-w	C:\Windows\system32\drivers\mbam.sys
2008-08-15 10:08	---------	d-----w	C:\Program Files\VstPlugins
2008-08-15 10:08	---------	d-----w	C:\Program Files\Image-Line
2008-08-14 23:16	---------	d-----w	C:\Program Files\Rockstar Games
2008-08-14 23:08	---------	d-----w	C:\ProgramData\NVIDIA
2008-08-14 22:55	---------	d-----w	C:\Users\bobby.PC-de-gobby\AppData\Roaming\SoundSpectrum
2008-08-14 22:55	---------	d-----w	C:\Program Files\SoundSpectrum
2008-08-14 01:29	---------	d-----w	C:\Program Files\Windows Mail
2008-08-13 19:07	---------	d-----w	C:\Program Files\Windows Live
2008-08-13 19:06	---------	dcsh--w	C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-13 19:04	---------	d-----w	C:\ProgramData\WLInstaller
2008-08-11 18:08	---------	d-----w	C:\Program Files\Illustrate
2008-08-10 22:26	---------	d-----w	C:\Program Files\Electronic Arts
2008-08-10 19:34	---------	d-----w	C:\Users\bobby.PC-de-gobby\AppData\Roaming\DivX
2008-08-10 19:33	---------	d-----w	C:\Program Files\DivX
2008-08-10 16:31	---------	d-----w	C:\ProgramData\eMule
2008-08-10 16:30	---------	d-----w	C:\Program Files\eMule
2008-08-10 16:09	---------	d-----w	C:\Program Files\Common Files\InstallShield
2008-08-10 15:30	---------	d-----w	C:\Program Files\UxTheme Multipatcher Fr
2008-08-10 15:26	174	--sha-w	C:\Program Files\desktop.ini
2008-08-10 15:20	---------	d-----w	C:\Program Files\Windows Sidebar
2008-08-10 15:20	---------	d-----w	C:\Program Files\Windows Defender
2008-08-10 15:20	---------	d-----w	C:\Program Files\Windows Calendar
2008-08-10 15:18	70,144	----a-w	C:\Windows\system32\drivers\pacer.sys
2008-08-10 15:18	619,008	----a-w	C:\Windows\system32\drivers\dxgkrnl.sys
2008-08-10 15:18	61,952	----a-w	C:\Windows\system32\drivers\wanarp.sys
2008-08-10 15:18	48,640	----a-w	C:\Windows\system32\drivers
dproxy.sys
2008-08-10 15:18	20,480	----a-w	C:\Windows\system32\drivers
distapi.sys
2008-08-10 15:16	258,232	----a-w	C:\Windows\system32\drivers\acpi.sys
2008-08-10 15:16	2,923,520	----a-w	C:\Windows\explorer.exe
2008-08-10 15:16	110,080	----a-w	C:\Windows\system32\drivers\mrxdav.sys
2008-08-10 15:12	41,984	----a-w	C:\Windows\system32\drivers\monitor.sys
2008-08-10 15:12	1,060,920	----a-w	C:\Windows\system32\drivers
tfs.sys
2008-08-10 15:10	63,488	----a-w	C:\Windows\system32\drivers\mpsdrv.sys
2008-08-10 15:10	23,040	----a-w	C:\Windows\system32\drivers	unnel.sys
2008-08-10 15:10	15,360	----a-w	C:\Windows\system32\drivers\TUNMP.SYS
2008-08-10 15:09	45,112	----a-w	C:\Windows\system32\drivers\pciidex.sys
2008-08-10 15:09	211,000	----a-w	C:\Windows\system32\drivers\volsnap.sys
2008-08-10 15:09	21,560	----a-w	C:\Windows\system32\drivers\atapi.sys
2008-08-10 15:09	17,464	----a-w	C:\Windows\system32\drivers\intelide.sys
2008-08-10 15:09	154,624	----a-w	C:\Windows\system32\drivers
wifi.sys
2008-08-10 15:09	109,624	----a-w	C:\Windows\system32\drivers\ataport.sys
2008-08-10 15:08	73,216	----a-w	C:\Windows\system32\drivers\usbccgp.sys
2008-08-10 15:08	5,888	----a-w	C:\Windows\system32\drivers\usbd.sys
2008-08-10 15:08	38,400	----a-w	C:\Windows\system32\drivers\usbehci.sys
2008-08-10 15:08	23,040	----a-w	C:\Windows\system32\drivers\usbuhci.sys
2008-08-10 15:08	224,768	----a-w	C:\Windows\system32\drivers\usbport.sys
2008-08-10 15:08	192,000	----a-w	C:\Windows\system32\drivers\usbhub.sys
2008-08-10 15:07	803,328	----a-w	C:\Windows\system32\drivers	cpip.sys
2008-08-10 15:07	216,632	----a-w	C:\Windows\system32\drivers
etio.sys
2008-08-10 15:02	54,784	----a-w	C:\Windows\system32\drivers\i8042prt.sys
2008-08-10 15:02	495,160	----a-w	C:\Windows\system32\drivers\Wdf01000.sys
2008-08-10 15:02	35,384	----a-w	C:\Windows\system32\drivers\WdfLdr.sys
2008-08-10 15:02	35,384	----a-w	C:\Windows\system32\drivers\kbdclass.sys
2008-08-10 15:02	34,360	----a-w	C:\Windows\system32\drivers\mouclass.sys
2008-08-10 15:02	19,968	----a-w	C:\Windows\system32\drivers\sermouse.sys
2008-08-10 15:02	15,872	----a-w	C:\Windows\system32\drivers\mouhid.sys
2008-08-10 15:02	15,872	----a-w	C:\Windows\system32\drivers\kbdhid.sys
2008-08-10 14:59	---------	d-----w	C:\Program Files\Common Files\Adobe
2008-08-10 14:54	113,664	----a-w	C:\Windows\system32\driversmcast.sys
2008-08-10 14:53	53,760	----a-w	C:\Windows\system32\drivers\hdaudbus.sys
2008-08-10 14:52	84,992	----a-w	C:\Windows\system32\drivers\srvnet.sys
2008-08-10 14:52	58,368	----a-w	C:\Windows\system32\drivers\mrxsmb20.sys
2008-08-10 14:52	130,048	----a-w	C:\Windows\system32\drivers\srv2.sys
2008-08-10 14:52	101,888	----a-w	C:\Windows\system32\drivers\mrxsmb.sys
2008-08-10 14:51	12,800	----a-w	C:\Windows\system32\drivers\fs_rec.sys
2008-08-10 14:29	---------	d-----w	C:\Program Files\Alwil Software
2008-08-10 14:14	---------	d-----w	C:\Program Files\SystemRequirementsLab
2008-08-10 11:47	---------	d-----w	C:\Users\bobby\AppData\Roaming\Talkback
2008-08-10 11:08	---------	d-sh--w	C:\ProgramData\Modèles
2008-08-10 11:08	---------	d-sh--w	C:\ProgramData\Menu Démarrer
2008-08-10 11:08	---------	d-sh--w	C:\ProgramData\Favoris
2008-08-10 11:08	---------	d-sh--w	C:\ProgramData\Bureau
2008-08-10 11:08	---------	d-sh--w	C:\Program Files\Fichiers communs
2007-02-28 16:44	691	----a-w	C:\Users\bobby.PC-de-gobby\AppData\Roaming\GetValue.vbs
2007-02-28 16:44	35	----a-w	C:\Users\bobby.PC-de-gobby\AppData\Roaming\SetValue.bat
2007-02-28 18:40	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-02-28 18:40	32,768	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-02-28 18:40	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-16 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-16 92704]
"Malwarebytes Anti-Malware (reboot)"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [2008-09-10 1253040]
"AutorunReload"="Autoload.exe" [2007-02-28 C:\Windows\autoload.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{657AAF3E-E356-4DF5-92FC-1FAAB1E1B53F}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{D1A163E3-1C3A-4891-B4EB-5EA9AA45544C}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{CE78C7B8-FCD2-49FA-A2F9-2CBCFE60DB50}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{DC892D53-CF22-4822-A708-924FB5B45D2A}"= UDP:C:\Users\bobby.PC-de-gobby\AppData\Local\Temp\.ttACE8.tmp:enable
"{0F31C959-65BC-4480-B41B-79C39CC5AC81}"= TCP:C:\Users\bobby.PC-de-gobby\AppData\Local\Temp\.ttACE8.tmp:enable
"{C3D25C3B-E11D-4360-84C0-DCD3CD9CCA78}"= UDP:C:\Windows\System32\sysrest32.exe:enable
"{479ECE61-7679-401D-9CE6-D3B2879EA0BD}"= TCP:C:\Windows\System32\sysrest32.exe:enable

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 51280]
S3 yukonwlh;Pilote miniport NDIS6.0 pour contrôleur Ethernet Marvell Yukon;C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 194048]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\shell\AutoRun\command - E:\wd_windows_tools\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c30ad5e-66ca-11dd-afc5-00301b4522f2}]
\shell\AutoRun\command - E:\wd_windows_tools\setup.exe
.
- - - - ORPHELINS SUPPRIMES - - - -

SSODL-aplsmart-{532C41DF-267F-1A1F-C527-034A43CF16B4} - (no file)


.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Users\bobby.PC-de-gobby\AppData\Roaming\Mozilla\Firefox\Profiles\3buryu3v.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr/
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-28 20:38:48
Windows 6.0.6000  NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\Windows\System32
vvsvc.exe
C:\Windows\System32\audiodg.exe
C:\Windows\System32undll32.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\System32\conime.exe
C:\Windows\System32undll32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Windows\System32\dllhost.exe
.
**************************************************************************
.
Heure de fin: 2008-09-28 20:41:48 - La machine a redémarré
ComboFix-quarantined-files.txt  2008-09-28 18:41:39

Avant-CF: Le texte du message associ‚ au num‚ro 0x2379 est introuvable dans le fichier de messages pour Application.
Après-CF: 35,907,592,192 octets libres

180	--- E O F ---	2007-02-28 08:59:46

vivou · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:59:09, on 28/02/2007
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\ProgramDatauzkfyhm\jcrgnyfi.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\System32undll32.exe
C:\Windows\System32\lphc537j0e7ag.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [lphc537j0e7ag] C:\Windows\system32\lphc537j0e7ag.exe
O4 - HKLM\..\Run: [AutorunReload] Autoload.exe D:\autorun.EXE
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Policies\Explorer\Run: [qCOHaNyWv4] C:\ProgramDatauzkfyhm\jcrgnyfi.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O13 - Gopher Prefix: 
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O21 - SSODL: aplsmart - {532C41DF-267F-1A1F-C527-034A43CF16B4} - (no file)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe

vivou · Answer

par contre je peux tjs pas personnaliser mon bureau

sKe69 · Answer

Re,

On recommences ...^^

1-Refais ceci car l'outil Lop S&D l'a réactivé :

Désactiver le contrôle des comptes utilisateurs ou UAC (le réactiver seulement à la fin de la désinfection) :
 
Aller dans "démarrer" puis "panneau de configuration" : 
--->Sur la droite de la fenêtre , cliques sur " affichage classique "
--->Double-Cliquer sur l'icône "Comptes d'utilisateurs" 
--->Cliquer ensuite sur "Activer ou désactiver le contrôle ..." .
--->Décocher la case "utlisiser le contrôle ..." et cliquer sur OK .
Puis redémarrer le PC quand il le vous saura demandé ...

Tuto : https://forum.malekal.com/viewtopic.php?f=59&t=6517


2- Ensuite reprends la manipe avec Combofix stp ...

postes moi le rapport obtenu ... 

Puis refais un nouveau scan hijackthis et postes le nouveau rapport pour analyse ...

vivou · Answer

ComboFix 08-09-27.05 - bobby 2008-09-29 18:45:27.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6000.0.1252.1.1036.18.1435 [GMT 2:00]
Lancé depuis: C:\Users\bobby.PC-de-gobby\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((((((   Fichiers créés du 2008-08-28 au 2008-09-29  ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans ce laps de temps

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-28 19:18	---------	d-----w	C:\ProgramData\Spybot - Search & Destroy
2008-09-28 19:17	---------	d-----w	C:\Program Files\Microsoft Silverlight
2008-09-19 11:26	82,944	----a-w	C:\Windows\System32\o4Patch.exe
2008-09-19 11:26	82,944	----a-w	C:\Windows\System32\IEDFix.C.exe
2008-09-09 23:04	38,528	----a-w	C:\Windows\system32\drivers\mbamswissarmy.sys
2008-09-09 23:03	17,200	----a-w	C:\Windows\system32\drivers\mbam.sys
2008-09-08 22:38	88,576	----a-w	C:\Windows\System32\AntiXPVSTFix.exe
2008-09-02 15:51	86,528	----a-w	C:\Windows\System32\VACFix.exe
2008-08-18 11:19	82,432	----a-w	C:\Windows\System32\404Fix.exe
2008-08-15 10:08	---------	d-----w	C:\Program Files\VstPlugins
2008-08-15 10:08	---------	d-----w	C:\Program Files\Image-Line
2008-08-14 23:16	---------	d-----w	C:\Program Files\Rockstar Games
2008-08-14 23:08	---------	d-----w	C:\ProgramData\NVIDIA
2008-08-14 22:55	---------	d-----w	C:\Users\bobby.PC-de-gobby\AppData\Roaming\SoundSpectrum
2008-08-14 22:55	---------	d-----w	C:\Program Files\SoundSpectrum
2008-08-14 01:29	---------	d-----w	C:\Program Files\Windows Mail
2008-08-13 19:07	---------	d-----w	C:\Program Files\Windows Live
2008-08-13 19:06	---------	dcsh--w	C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-13 19:04	---------	d-----w	C:\ProgramData\WLInstaller
2008-08-12 07:55	167,424	----a-w	C:\Windows\System32\SpoonUninstall.exe
2008-08-11 18:08	---------	d-----w	C:\Program Files\Illustrate
2008-08-11 08:25	615,424	----a-w	C:\Windows\System32	hemeui.dll
2008-08-11 08:25	240,640	----a-w	C:\Windows\System32\uxtheme.dll
2008-08-10 22:26	---------	d-----w	C:\Program Files\Electronic Arts
2008-08-10 19:34	---------	d-----w	C:\Users\bobby.PC-de-gobby\AppData\Roaming\DivX
2008-08-10 19:33	---------	d-----w	C:\Program Files\DivX
2008-08-10 16:31	---------	d-----w	C:\ProgramData\eMule
2008-08-10 16:30	---------	d-----w	C:\Program Files\eMule
2008-08-10 16:09	---------	d-----w	C:\Program Files\Common Files\InstallShield
2008-08-10 15:30	---------	d-----w	C:\Program Files\UxTheme Multipatcher Fr
2008-08-10 15:26	174	--sha-w	C:\Program Files\desktop.ini
2008-08-10 15:20	---------	d-----w	C:\Program Files\Windows Sidebar
2008-08-10 15:20	---------	d-----w	C:\Program Files\Windows Defender
2008-08-10 15:20	---------	d-----w	C:\Program Files\Windows Calendar
2008-08-10 15:17	87,040	----a-w	C:\Windows\System32\msoert2.dll
2008-08-10 15:17	39,424	----a-w	C:\Windows\System32\ACCTRES.dll
2008-08-10 15:17	205,824	----a-w	C:\Windows\System32\msoeacct.dll
2008-08-10 15:16	704,000	----a-w	C:\Windows\System32\PhotoScreensaver.scr
2008-08-10 15:16	67,584	----a-w	C:\Windows\System32\wlanhlp.dll
2008-08-10 15:16	542,720	----a-w	C:\Windows\System32\sysmain.dll
2008-08-10 15:16	502,784	----a-w	C:\Windows\System32\wlansvc.dll
2008-08-10 15:16	47,104	----a-w	C:\Windows\System32\wlanapi.dll
2008-08-10 15:16	297,984	----a-w	C:\Windows\System32\wlansec.dll
2008-08-10 15:16	290,816	----a-w	C:\Windows\System32\wlanmsm.dll
2008-08-10 15:16	258,232	----a-w	C:\Windows\system32\drivers\acpi.sys
2008-08-10 15:16	24,064	----a-w	C:\Windows\System32\wtsapi32.dll
2008-08-10 15:16	2,923,520	----a-w	C:\Windows\explorer.exe
2008-08-10 15:16	194,560	----a-w	C:\Windows\System32\WebClnt.dll
2008-08-10 15:16	110,080	----a-w	C:\Windows\system32\drivers\mrxdav.sys
2008-08-10 15:15	49,664	----a-w	C:\Windows\System32\csrsrv.dll
2008-08-10 15:15	376,320	----a-w	C:\Windows\System32\winsrv.dll
2008-08-10 15:12	41,984	----a-w	C:\Windows\system32\drivers\monitor.sys
2008-08-10 15:12	374,456	----a-w	C:\Windows\System32\mcupdate_GenuineIntel.dll
2008-08-10 15:12	1,060,920	----a-w	C:\Windows\system32\drivers
tfs.sys
2008-08-10 15:11	8,147,968	----a-w	C:\Windows\System32\wmploc.DLL
2008-08-10 15:11	7,680	----a-w	C:\Windows\System32\spwmp.dll
2008-08-10 15:11	414,208	----a-w	C:\Windows\System32\msscp.dll
2008-08-10 15:11	4,096	----a-w	C:\Windows\System32\dxmasf.dll
2008-08-10 15:11	356,864	----a-w	C:\Windows\System32\MediaMetadataHandler.dll
2008-08-10 15:10	86,016	----a-w	C:\Windows\System32\icfupgd.dll
2008-08-10 15:10	63,488	----a-w	C:\Windows\system32\drivers\mpsdrv.sys
2008-08-10 15:10	61,952	----a-w	C:\Windows\System32\cmifw.dll
2008-08-10 15:10	396,800	----a-w	C:\Windows\System32\MPSSVC.dll
2008-08-10 15:10	392,192	----a-w	C:\Windows\System32\FirewallAPI.dll
2008-08-10 15:10	23,040	----a-w	C:\Windows\system32\drivers	unnel.sys
2008-08-10 15:10	178,688	----a-w	C:\Windows\System32\iphlpsvc.dll
2008-08-10 15:10	16,896	----a-w	C:\Windows\System32\wfapigp.dll
2008-08-10 15:10	15,360	----a-w	C:\Windows\system32\drivers\TUNMP.SYS
2008-08-10 15:09	45,112	----a-w	C:\Windows\system32\drivers\pciidex.sys
2008-08-10 15:09	3,504,696	----a-w	C:\Windows\System32
tkrnlpa.exe
2008-08-10 15:09	3,470,392	----a-w	C:\Windows\System32
toskrnl.exe
2008-08-10 15:09	211,000	----a-w	C:\Windows\system32\drivers\volsnap.sys
2008-08-10 15:09	21,560	----a-w	C:\Windows\system32\drivers\atapi.sys
2008-08-10 15:09	17,464	----a-w	C:\Windows\system32\drivers\intelide.sys
2008-08-10 15:09	154,624	----a-w	C:\Windows\system32\drivers
wifi.sys
2008-08-10 15:09	109,624	----a-w	C:\Windows\system32\drivers\ataport.sys
2008-08-10 15:08	8,704	----a-w	C:\Windows\System32\hcrstco.dll
2008-08-10 15:08	8,704	----a-w	C:\Windows\System32\hccoin.dll
2008-08-10 15:08	73,216	----a-w	C:\Windows\system32\drivers\usbccgp.sys
2008-08-10 15:08	5,888	----a-w	C:\Windows\system32\drivers\usbd.sys
2008-08-10 15:08	38,400	----a-w	C:\Windows\system32\drivers\usbehci.sys
2008-08-10 15:08	23,040	----a-w	C:\Windows\system32\drivers\usbuhci.sys
2008-08-10 15:08	224,768	----a-w	C:\Windows\system32\drivers\usbport.sys
2008-08-10 15:08	2,048	----a-w	C:\Windows\System32\msxml3r.dll
2008-08-10 15:08	192,000	----a-w	C:\Windows\system32\drivers\usbhub.sys
2008-08-10 15:08	104,448	----a-w	C:\Windows\System32\DWWIN.EXE
2008-08-10 15:08	1,191,936	----a-w	C:\Windows\System32\msxml3.dll
2008-08-10 15:07	803,328	----a-w	C:\Windows\system32\drivers	cpip.sys
2008-08-10 15:07	24,064	----a-w	C:\Windows\System32
etcfg.exe
2008-08-10 15:07	22,016	----a-w	C:\Windows\System32
etiougc.exe
2008-08-10 15:07	216,632	----a-w	C:\Windows\system32\drivers
etio.sys
2008-08-10 15:07	167,424	----a-w	C:\Windows\System32	cpipcfg.dll
2008-08-10 15:02	944,184	----a-w	C:\Windows\System32\winload.exe
2008-08-10 15:00	2,027,008	----a-w	C:\Windows\System32\win32k.sys
2008-08-10 14:59	---------	d-----w	C:\Program Files\Common Files\Adobe
2008-08-10 14:58	9,728	----a-w	C:\Windows\System32\LAPRXY.DLL
2008-08-10 14:58	223,232	----a-w	C:\Windows\System32\WMASF.DLL
2008-08-10 14:58	2,048	----a-w	C:\Windows\System32\asferror.dll
2008-08-10 14:57	57,856	----a-w	C:\Windows\System32\SLUINotify.dll
2008-08-10 14:57	566,784	----a-w	C:\Windows\System32\SLCommDlg.dll
.

(((((((((((((((((((((((((((((   snapshot@2008-09-28_20.41.19.01   )))))))))))))))))))))))))))))))))))))))))
.
- 2006-11-02 09:46:02	2,143,232	----a-w	C:\Windows\AppPatch\AcGenral.dll
+ 2008-07-31 03:34:58	2,144,256	----a-w	C:\Windows\AppPatch\AcGenral.dll
- 2008-06-12 06:54:28	537,600	----a-w	C:\Windows\AppPatch\AcLayers.dll
+ 2008-07-31 03:34:58	537,600	----a-w	C:\Windows\AppPatch\AcLayers.dll
- 2008-06-12 01:21:33	2,560	----a-w	C:\Windows\AppPatch\AcRes.dll
+ 2008-07-30 23:32:41	2,560	----a-w	C:\Windows\AppPatch\AcRes.dll
- 2006-11-02 09:46:02	445,952	----a-w	C:\Windows\AppPatch\AcSpecfc.dll
+ 2008-07-31 03:34:58	449,536	----a-w	C:\Windows\AppPatch\AcSpecfc.dll
- 2008-06-12 06:54:28	173,056	----a-w	C:\Windows\AppPatch\AcXtrnal.dll
+ 2008-07-31 03:34:58	173,056	----a-w	C:\Windows\AppPatch\AcXtrnal.dll
- 2007-01-15 12:06:15	7,168	----a-w	C:\Windows\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2008-09-28 19:19:49	8,192	----a-w	C:\Windows\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2007-01-15 12:06:07	32,768	----a-w	C:\Windows\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll
+ 2008-09-28 19:19:51	32,768	----a-w	C:\Windows\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll
- 2007-01-15 12:06:03	716,800	----a-w	C:\Windows\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2008-09-28 19:20:03	720,896	----a-w	C:\Windows\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2007-01-15 12:06:04	299,008	----a-w	C:\Windows\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2008-09-28 19:19:52	299,008	----a-w	C:\Windows\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2007-01-15 12:06:15	32,768	----a-w	C:\Windows\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll
+ 2008-09-28 19:19:59	32,768	----a-w	C:\Windows\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll
- 2007-01-15 12:06:17	299,008	----a-w	C:\Windows\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2008-09-28 19:19:57	303,104	----a-w	C:\Windows\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2007-01-15 12:06:08	1,290,240	----a-w	C:\Windows\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll
+ 2008-09-28 19:20:00	1,294,336	----a-w	C:\Windows\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll
- 2007-01-15 12:06:09	1,699,840	----a-w	C:\Windows\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll
+ 2008-09-28 19:19:50	1,703,936	----a-w	C:\Windows\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll
- 2007-01-15 12:06:09	86,016	----a-w	C:\Windows\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2008-09-28 19:20:02	90,112	----a-w	C:\Windows\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2007-01-15 12:06:11	466,944	----a-w	C:\Windows\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2008-09-28 19:19:56	466,944	----a-w	C:\Windows\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2007-01-15 12:06:10	241,664	----a-w	C:\Windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2008-09-28 19:19:53	241,664	----a-w	C:\Windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2007-01-15 12:06:10	64,000	----a-w	C:\Windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
+ 2008-09-28 19:19:53	66,560	----a-w	C:\Windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
- 2007-01-15 12:06:11	368,640	----a-w	C:\Windows\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll
+ 2008-09-28 19:19:59	372,736	----a-w	C:\Windows\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll
- 2007-01-15 12:06:12	241,664	----a-w	C:\Windows\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2008-09-28 19:20:04	241,664	----a-w	C:\Windows\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2007-01-15 12:06:12	323,584	----a-w	C:\Windows\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2008-09-28 19:19:57	323,584	----a-w	C:\Windows\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2007-01-15 12:06:12	131,072	----a-w	C:\Windows\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2008-09-28 19:19:53	131,072	----a-w	C:\Windows\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2007-01-15 12:06:12	77,824	----a-w	C:\Windows\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
+ 2008-09-28 19:19:55	77,824	----a-w	C:\Windows\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
- 2007-01-15 12:06:12	126,976	----a-w	C:\Windows\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2008-09-28 19:20:01	126,976	----a-w	C:\Windows\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2007-01-15 12:06:15	819,200	----a-w	C:\Windows\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2008-09-28 19:19:48	819,200	----a-w	C:\Windows\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2007-01-15 12:06:13	57,344	----a-w	C:\Windows\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2008-09-28 19:19:52	57,344	----a-w	C:\Windows\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2007-01-15 12:06:13	569,344	----a-w	C:\Windows\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2008-09-28 19:19:51	573,440	----a-w	C:\Windows\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2007-01-15 12:06:13	1,245,184	----a-w	C:\Windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2008-09-28 19:20:01	1,257,472	----a-w	C:\Windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
- 2007-01-15 12:06:14	2,039,808	----a-w	C:\Windows\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2008-09-28 19:19:54	2,052,096	----a-w	C:\Windows\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
- 2007-01-15 12:06:14	1,335,296	----a-w	C:\Windows\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.Xml.dll
+ 2008-09-28 19:19:58	1,339,392	----a-w	C:\Windows\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.XML.dll
- 2007-01-15 12:06:11	1,216,512	----a-w	C:\Windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2008-09-28 19:20:05	1,224,704	----a-w	C:\Windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2008-09-28 19:20:44	118,784	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_5a752f12\CustomMarshalers.dll
+ 2008-09-28 19:20:21	61,440	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_ece95754\CustomMarshalers.dll
+ 2008-09-28 19:20:39	3,379,200	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_3c9f848b\mscorlib.dll
+ 2008-09-28 19:20:57	8,880,128	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_fe2d2b02\mscorlib.dll
+ 2008-09-28 19:20:52	3,395,584	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_7ddc32c8\System.Design.dll
+ 2008-09-28 19:20:35	1,470,464	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_fac7e304\System.Design.dll
+ 2008-09-28 19:20:44	192,512	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_0786acb1\System.Drawing.Design.dll
+ 2008-09-28 19:20:23	90,112	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_2de33db3\System.Drawing.Design.dll
+ 2008-09-28 19:20:54	2,244,608	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_4a0d6094\System.Drawing.dll
+ 2008-09-28 19:20:36	835,584	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_5d4d7ba2\System.Drawing.dll
+ 2008-09-28 19:20:27	3,014,656	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_398cb3a6\System.Windows.Forms.dll
+ 2008-09-28 19:20:47	7,880,704	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_50967c04\System.Windows.Forms.dll
+ 2008-09-28 19:20:50	5,505,024	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_b40f3bd3\System.Xml.dll
+ 2008-09-28 19:20:31	2,088,960	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_eab869e3\System.Xml.dll
+ 2008-09-28 19:20:20	1,953,792	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_063b280f\System.dll
+ 2008-09-28 19:20:43	4,763,648	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_46e98e2f\System.dll
+ 2008-09-29 16:45:22	6,123,520	----a-w	C:\Windows\erdnt\Hiv-backup\SCHEMA.DAT
- 2003-02-20 18:19:32	253,952	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2004-07-14 23:49:16	258,048	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
- 2003-02-20 18:19:34	20,480	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
+ 2004-07-14 23:49:18	20,480	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
- 2003-02-20 18:19:38	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
+ 2004-07-14 23:49:26	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
- 2003-02-20 18:19:36	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2004-07-14 23:49:22	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
- 2003-02-20 18:09:08	77,824	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2004-07-14 22:32:22	81,920	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
- 2003-02-21 09:20:44	49,152	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\csc.exe
+ 2004-07-15 09:23:28	49,152	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\csc.exe
- 2003-02-21 09:21:00	626,688	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\cscomp.dll
+ 2004-07-15 09:23:44	626,688	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\cscomp.dll
- 2003-02-20 18:06:20	282,624	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\fusion.dll
+ 2004-07-14 22:24:30	282,624	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\fusion.dll
+ 2003-10-08 12:30:14	81,920	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe
- 2003-02-21 06:24:38	7,168	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll
+ 2004-07-15 12:31:00	8,192	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll
- 2003-02-21 06:24:40	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEHost.dll
+ 2004-07-15 12:31:04	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEHost.dll
- 2003-02-20 18:09:40	196,608	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
+ 2004-07-14 22:35:30	196,608	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
- 2003-02-21 06:26:36	716,800	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll
+ 2004-07-15 12:28:58	720,896	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll
- 2003-02-21 06:26:38	299,008	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll
+ 2004-07-15 12:28:56	299,008	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll
- 2003-02-21 06:25:04	49,152	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
+ 2004-07-15 12:28:50	49,152	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
- 2003-02-21 06:25:04	49,152	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
+ 2004-07-15 12:28:50	49,152	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
- 2003-02-20 18:09:12	77,824	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscordbc.dll
+ 2004-07-14 22:32:44	86,016	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscordbc.dll
- 2003-02-20 18:09:12	233,472	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscordbi.dll
+ 2004-07-14 22:32:46	233,472	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscordbi.dll
- 2003-02-20 18:06:32	311,296	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
+ 2004-07-14 22:25:06	315,392	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
- 2003-02-20 18:09:16	98,304	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2004-07-14 22:33:04	102,400	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
- 2003-02-21 06:26:34	2,088,960	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2004-07-15 12:29:02	2,138,112	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
- 2003-02-20 18:09:18	143,360	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorrc.dll
+ 2004-07-14 22:33:22	143,360	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorrc.dll
- 2003-02-20 18:09:18	81,920	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll
+ 2004-07-14 22:33:24	81,920	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll
- 2003-02-20 18:07:34	2,494,464	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
+ 2004-07-14 22:26:52	2,510,848	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
- 2003-02-20 18:08:32	2,482,176	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2004-07-14 22:28:34	2,502,656	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2004-08-10 14:20:00	106,496	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322
etfxupdate.exe
- 2003-02-20 18:09:30	90,112	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\PerfCounter.dll
+ 2004-07-14 22:34:50	94,208	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\PerfCounter.dll
- 2003-02-21 06:26:46	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\RegCode.dll
+ 2004-07-15 12:28:48	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\RegCode.dll
- 2003-02-20 18:09:34	319,488	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SOS.dll
+ 2004-07-14 22:35:04	319,488	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SOS.dll
- 2003-02-21 06:26:38	1,290,240	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Data.dll
+ 2004-07-15 12:32:00	1,294,336	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Data.dll
- 2003-02-21 06:25:42	299,008	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll
+ 2004-07-15 12:31:14	303,104	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll
- 2003-02-21 06:26:42	1,699,840	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Design.dll
+ 2004-07-15 12:29:02	1,703,936	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Design.dll
- 2003-02-21 06:26:44	86,016	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll
+ 2004-07-15 12:28:54	90,112	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll
- 2003-02-21 06:26:46	1,216,512	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.dll
+ 2004-07-15 12:31:16	1,224,704	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.dll
- 2003-02-21 06:26:50	466,944	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll
+ 2004-07-15 12:28:58	466,944	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll
- 2003-02-21 06:26:50	241,664	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll
+ 2004-07-15 12:28:56	241,664	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll
- 2003-02-20 18:09:36	64,000	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.Thunk.dll
+ 2004-07-14 22:35:12	66,560	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.Thunk.dll
- 2003-02-21 06:26:52	368,640	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Management.dll
+ 2004-07-15 12:31:58	372,736	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Management.dll
- 2003-02-21 06:26:54	241,664	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll
+ 2004-07-15 12:31:12	241,664	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll
- 2003-02-21 06:26:56	323,584	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll
+ 2004-07-15 12:28:58	323,584	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll
- 2003-02-21 06:26:56	131,072	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll
+ 2004-07-15 12:31:54	131,072	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll
- 2003-02-21 06:26:58	77,824	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Security.dll
+ 2004-07-15 12:28:52	77,824	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Security.dll
- 2003-02-21 06:27:00	126,976	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll
+ 2004-07-15 12:28:54	126,976	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll
- 2003-02-21 06:27:02	1,245,184	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
+ 2004-07-15 12:29:00	1,257,472	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
- 2003-02-21 06:27:06	819,200	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll
+ 2004-07-15 12:28:58	819,200	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll
- 2003-02-21 06:24:18	57,344	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll
+ 2004-07-15 12:28:52	57,344	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll
- 2003-02-21 06:27:06	569,344	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll
+ 2004-07-15 12:31:16	573,440	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll
- 2003-02-21 06:27:08	2,039,808	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll
+ 2004-07-15 12:32:02	2,052,096	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll
- 2003-02-21 06:27:10	1,335,296	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.XML.dll
+ 2004-07-15 12:29:00	1,339,392	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.XML.dll
+ 2004-06-22 11:51:38	53,248	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe
- 2003-02-21 09:20:38	737,280	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\vbc.exe
+ 2004-07-15 09:23:20	737,280	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\vbc.exe
- 2003-02-21 04:04:18	1,032,192	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll
+ 2004-07-15 06:15:14	1,032,192	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll
- 2003-02-20 19:10:40	31,744	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll
+ 2004-07-15 00:11:56	31,744	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll
+ 2008-09-29 16:38:49	2,048	--sha-w	C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-09-29 16:38:49	2,048	--sha-w	C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-09-28 18:38:44	262,144	--sha-w	C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-09-29 16:39:37	262,144	--sha-w	C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-09-29 16:39:37	262,144	---ha-w	C:\Windows\ServiceProfiles\LocalService
tuser.dat.LOG1
- 2008-09-28 18:38:44	262,144	--sha-w	C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-09-29 16:39:32	262,144	--sha-w	C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-09-29 16:39:32	262,144	---ha-w	C:\Windows\ServiceProfiles\NetworkService
tuser.dat.LOG1
+ 2008-09-29 16:44:22	4,056	----a-w	C:\Windows\SoftwareDistribution\EventCache\{81CD1C07-3E2D-4CB5-B3B1-6F37B8223E53}.bin
- 2006-11-02 09:46:02	28,160	----a-w	C:\Windows\System32\Apphlpdm.dll
+ 2008-07-31 03:34:58	28,160	----a-w	C:\Windows\System32\Apphlpdm.dll
- 2007-02-28 18:40:03	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-09-29 16:40:19	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-02-28 18:40:03	32,768	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-09-29 16:40:19	32,768	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-02-28 18:40:03	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-09-29 16:40:19	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2006-11-02 12:34:42	1,686,528	----a-w	C:\Windows\System32\gameux.dll
+ 2008-07-31 03:34:59	1,686,528	----a-w	C:\Windows\System32\gameux.dll
- 2006-11-02 12:34:42	3,953,152	----a-w	C:\Windows\System32\GameUXLegacyGDFs.dll
+ 2008-07-30 23:47:04	4,247,552	----a-w	C:\Windows\System32\GameUXLegacyGDFs.dll
- 2008-08-05 18:11:02	15,888,504	----a-w	C:\Windows\System32\mrt.exe
+ 2008-08-26 20:28:12	16,208,504	----a-w	C:\Windows\System32\mrt.exe
- 2006-11-02 09:46:10	215,552	----a-w	C:\Windows\System32\msshsq.dll
+ 2006-12-20 06:03:44	229,888	----a-w	C:\Windows\System32\msshsq.dll
- 2007-02-21 19:18:30	107,416	----a-w	C:\Windows\System32\perfc009.dat
+ 2008-09-29 16:45:17	107,416	----a-w	C:\Windows\System32\perfc009.dat
- 2007-02-21 19:18:30	121,814	----a-w	C:\Windows\System32\perfc00C.dat
+ 2008-09-29 16:45:17	121,814	----a-w	C:\Windows\System32\perfc00C.dat
- 2007-02-21 19:18:30	618,272	----a-w	C:\Windows\System32\perfh009.dat
+ 2008-09-29 16:45:17	618,272	----a-w	C:\Windows\System32\perfh009.dat
- 2007-02-21 19:18:30	699,984	----a-w	C:\Windows\System32\perfh00C.dat
+ 2008-09-29 16:45:17	699,984	----a-w	C:\Windows\System32\perfh00C.dat
- 2007-01-30 00:16:50	6,291,456	----a-w	C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2008-09-29 16:39:42	6,291,456	----a-w	C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
- 2007-02-28 18:41:58	5,994	----a-w	C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3231008829-2089630883-3644617952-1000_UserData.bin
+ 2008-09-29 16:40:58	6,296	----a-w	C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3231008829-2089630883-3644617952-1000_UserData.bin
- 2007-02-28 18:41:58	41,274	----a-w	C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-09-29 16:40:58	41,416	----a-w	C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2007-02-28 18:41:57	27,026	----a-w	C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-09-29 16:40:57	28,010	----a-w	C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2006-11-02 12:35:54	303,616	----a-w	C:\Windows\System32\wmpeffects.dll
+ 2008-06-26 03:22:35	303,616	----a-w	C:\Windows\System32\wmpeffects.dll
- 2007-02-28 10:36:37	115,016,352	----a-w	C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-09-28 18:57:08	116,157,530	----a-w	C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-07-31 03:34:58	28,160	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6000.16721_none_8006fd7863ac1387\Apphlpdm.dll
+ 2008-07-30 03:11:12	28,160	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6000.20885_none_8053bbe37cf6c053\Apphlpdm.dll
+ 2008-07-31 03:32:38	28,160	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6001.18112_none_81f90c5460c9a1de\Apphlpdm.dll
+ 2008-07-31 03:23:27	28,160	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6001.22233_none_826e099179f692e1\Apphlpdm.dll
+ 2008-07-30 23:32:41	2,560	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6000.16721_none_0a275bdbf535293c\AcRes.dll
+ 2008-07-29 23:16:45	2,560	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6000.20885_none_0a741a470e7fd608\AcRes.dll
+ 2008-03-08 01:58:43	2,560	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6001.18112_none_0c196ab7f252b793\AcRes.dll
+ 2008-07-31 01:03:24	2,560	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6001.22233_none_0c8e67f50b7fa896\AcRes.dll
+ 2008-07-31 03:34:58	2,144,256	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6000.16721_none_0a295c6ff5335bea\AcGenral.dll
+ 2008-07-30 03:11:10	2,144,768	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6000.20885_none_0a761adb0e7e08b6\AcGenral.dll
+ 2008-07-31 03:32:38	2,154,496	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6001.18112_none_0c1b6b4bf250ea41\AcGenral.dll
+ 2008-07-31 03:23:20	2,153,984	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6001.22233_none_0c9068890b7ddb44\AcGenral.dll
+ 2008-07-31 03:34:58	449,536	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6000.16721_none_0a2a5cb9f5327541\AcSpecfc.dll
+ 2008-07-30 03:11:10	450,560	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6000.20885_none_0a771b250e7d220d\AcSpecfc.dll
+ 2008-07-31 03:32:38	460,288	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6001.18112_none_0c1c6b95f2500398\AcSpecfc.dll
+ 2008-07-31 03:23:21	459,776	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6001.22233_none_0c9168d30b7cf49b\AcSpecfc.dll
+ 2008-07-31 03:34:58	537,600	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.16721_none_0a2b5d03f5318e98\AcLayers.dll
+ 2008-07-31 03:34:58	173,056	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.16721_none_0a2b5d03f5318e98\AcXtrnal.dll
+ 2008-07-30 03:11:10	537,600	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.20885_none_0a781b6f0e7c3b64\AcLayers.dll
+ 2008-07-30 03:11:10	173,056	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.20885_none_0a781b6f0e7c3b64\AcXtrnal.dll
+ 2008-06-12 05:28:53	541,696	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6001.18112_none_0c1d6bdff24f1cef\AcLayers.dll
+ 2008-07-31 03:32:38	173,056	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6001.18112_none_0c1d6bdff24f1cef\AcXtrnal.dll
+ 2008-07-31 03:23:21	541,696	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6001.22233_none_0c92691d0b7c0df2\AcLayers.dll
+ 2008-07-31 03:23:22	173,056	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6001.22233_none_0c92691d0b7c0df2\AcXtrnal.dll
+ 2008-07-31 03:34:59	1,686,528	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.16721_none_400572c0c425beea\gameux.dll
+ 2008-07-30 23:47:04	4,247,552	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.16721_none_400572c0c425beea\GameUXLegacyGDFs.dll
+ 2008-07-30 03:11:51	1,686,528	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.20885_none_4052312bdd706bb6\gameux.dll
+ 2008-07-29 23:31:23	4,247,552	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.20885_none_4052312bdd706bb6\GameUXLegacyGDFs.dll
+ 2008-03-08 04:21:55	1,695,744	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6001.18112_none_41f7819cc1434d41\gameux.dll
+ 2008-07-31 01:13:15	4,240,384	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6001.18112_none_41f7819cc1434d41\GameUXLegacyGDFs.dll
+ 2008-07-31 03:25:45	1,695,744	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6001.22233_none_426c7ed9da703e44\gameux.dll
+ 2008-07-31 01:15:32	4,240,384	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6001.22233_none_426c7ed9da703e44\GameUXLegacyGDFs.dll
+ 2008-06-26 03:22:35	303,616	----a-w	C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpeffects_31bf3856ad364e35_6.0.6000.16710_none_f75cda9b92533b4f\wmpeffects.dll
+ 2008-06-26 03:20:37	303,616	----a-w	C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpeffects_31bf3856ad364e35_6.0.6000.20867_none_f7b769d0ab93182f\wmpeffects.dll
+ 2008-06-26 03:29:09	303,616	----a-w	C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpeffects_31bf3856ad364e35_6.0.6001.18098_none_f8f49a4b8fb37959\wmpeffects.dll
+ 2008-06-26 03:21:15	303,616	----a-w	C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpeffects_31bf3856ad364e35_6.0.6001.22211_none_f9cdb656a8968561\wmpeffects.dll
+ 2008-06-30 23:00:26	2,413,032	----a-w	C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.16730_none_f0816da06e6c1330\OESpamFilter.dat
+ 2008-06-30 23:00:26	2,413,032	----a-w	C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.20895_none_f0cf2c5587b5d953\OESpamFilter.dat
+ 2008-06-30 23:00:26	2,413,032	----a-w	C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.18121_none_f2737c7c6b89a187\OESpamFilter.dat
+ 2008-06-30 23:00:26	2,413,032	----a-w	C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.22243_none_f2e97a0384b5abe1\OESpamFilter.dat
+ 2008-04-30 05:24:09	1,744,896	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e2537\GdiPlus.dll
+ 2008-05-01 03:16:12	1,744,896	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.20826_none_87cd0392e31b3a67\GdiPlus.dll
+ 2008-04-30 05:27:35	1,748,992	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\GdiPlus.dll
+ 2008-05-01 03:22:16	1,748,992	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.22170_none_87ae89a0e3672b5a\GdiPlus.dll
+ 2008-04-30 05:24:10	1,823,232	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6000.16683_none_8df25f6f6273fede\GdiPlus.dll
+ 2008-05-01 03:16:13	1,823,232	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6000.20826_none_771e72777c21140e\GdiPlus.dll
+ 2008-04-30 05:27:40	1,823,232	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6001.18065_none_8dcc2d1362c70bc9\GdiPlus.dll
+ 2008-05-01 03:22:16	1,823,232	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6001.22170_none_76fff8857c6d0501\GdiPlus.dll
+ 2006-12-20 06:03:44	229,888	----a-w	C:\Windows\winsxs\x86_windowssearchengine-structuredquery_31bf3856ad364e35_6.0.6000.16404_none_a5026e9e71025fcb\msshsq.dll
+ 2006-12-20 07:11:39	229,888	----a-w	C:\Windows\winsxs\x86_windowssearchengine-structuredquery_31bf3856ad364e35_6.0.6000.20500_none_a5880a418a239a39\msshsq.dll
.
-- Instantané actualisé --
.
(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-16 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-16 92704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"FilterAdministratorToken"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{657AAF3E-E356-4DF5-92FC-1FAAB1E1B53F}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{D1A163E3-1C3A-4891-B4EB-5EA9AA45544C}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{CE78C7B8-FCD2-49FA-A2F9-2CBCFE60DB50}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{DC892D53-CF22-4822-A708-924FB5B45D2A}"= UDP:C:\Users\bobby.PC-de-gobby\AppData\Local\Temp\.ttACE8.tmp:enable
"{0F31C959-65BC-4480-B41B-79C39CC5AC81}"= TCP:C:\Users\bobby.PC-de-gobby\AppData\Local\Temp\.ttACE8.tmp:enable
"{C3D25C3B-E11D-4360-84C0-DCD3CD9CCA78}"= UDP:C:\Windows\System32\sysrest32.exe:enable
"{479ECE61-7679-401D-9CE6-D3B2879EA0BD}"= TCP:C:\Windows\System32\sysrest32.exe:enable

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 51280]
R3 yukonwlh;Pilote miniport NDIS6.0 pour contrôleur Ethernet Marvell Yukon;C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 194048]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\shell\AutoRun\command - E:\wd_windows_tools\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c30ad5e-66ca-11dd-afc5-00301b4522f2}]
\shell\AutoRun\command - E:\wd_windows_tools\setup.exe
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Users\bobby.PC-de-gobby\AppData\Roaming\Mozilla\Firefox\Profiles\3buryu3v.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr/
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-29 18:46:33
Windows 6.0.6000  NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2008-09-29 18:47:50
ComboFix-quarantined-files.txt  2008-09-29 16:47:47
ComboFix2.txt  2008-09-28 18:41:49

Avant-CF: Le texte du message associ‚ au num‚ro 0x2379 est introuvable dans le fichier de messages pour Application.
Après-CF: 35,015,524,352 octets libres

453	--- E O F ---	2008-09-28 19:21:32

vivou · Answer

ComboFix 08-09-27.05 - bobby 2008-09-29 18:45:27.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6000.0.1252.1.1036.18.1435 [GMT 2:00]
Lancé depuis: C:\Users\bobby.PC-de-gobby\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((((((   Fichiers créés du 2008-08-28 au 2008-09-29  ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans ce laps de temps

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-28 19:18	---------	d-----w	C:\ProgramData\Spybot - Search & Destroy
2008-09-28 19:17	---------	d-----w	C:\Program Files\Microsoft Silverlight
2008-09-19 11:26	82,944	----a-w	C:\Windows\System32\o4Patch.exe
2008-09-19 11:26	82,944	----a-w	C:\Windows\System32\IEDFix.C.exe
2008-09-09 23:04	38,528	----a-w	C:\Windows\system32\drivers\mbamswissarmy.sys
2008-09-09 23:03	17,200	----a-w	C:\Windows\system32\drivers\mbam.sys
2008-09-08 22:38	88,576	----a-w	C:\Windows\System32\AntiXPVSTFix.exe
2008-09-02 15:51	86,528	----a-w	C:\Windows\System32\VACFix.exe
2008-08-18 11:19	82,432	----a-w	C:\Windows\System32\404Fix.exe
2008-08-15 10:08	---------	d-----w	C:\Program Files\VstPlugins
2008-08-15 10:08	---------	d-----w	C:\Program Files\Image-Line
2008-08-14 23:16	---------	d-----w	C:\Program Files\Rockstar Games
2008-08-14 23:08	---------	d-----w	C:\ProgramData\NVIDIA
2008-08-14 22:55	---------	d-----w	C:\Users\bobby.PC-de-gobby\AppData\Roaming\SoundSpectrum
2008-08-14 22:55	---------	d-----w	C:\Program Files\SoundSpectrum
2008-08-14 01:29	---------	d-----w	C:\Program Files\Windows Mail
2008-08-13 19:07	---------	d-----w	C:\Program Files\Windows Live
2008-08-13 19:06	---------	dcsh--w	C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-13 19:04	---------	d-----w	C:\ProgramData\WLInstaller
2008-08-12 07:55	167,424	----a-w	C:\Windows\System32\SpoonUninstall.exe
2008-08-11 18:08	---------	d-----w	C:\Program Files\Illustrate
2008-08-11 08:25	615,424	----a-w	C:\Windows\System32	hemeui.dll
2008-08-11 08:25	240,640	----a-w	C:\Windows\System32\uxtheme.dll
2008-08-10 22:26	---------	d-----w	C:\Program Files\Electronic Arts
2008-08-10 19:34	---------	d-----w	C:\Users\bobby.PC-de-gobby\AppData\Roaming\DivX
2008-08-10 19:33	---------	d-----w	C:\Program Files\DivX
2008-08-10 16:31	---------	d-----w	C:\ProgramData\eMule
2008-08-10 16:30	---------	d-----w	C:\Program Files\eMule
2008-08-10 16:09	---------	d-----w	C:\Program Files\Common Files\InstallShield
2008-08-10 15:30	---------	d-----w	C:\Program Files\UxTheme Multipatcher Fr
2008-08-10 15:26	174	--sha-w	C:\Program Files\desktop.ini
2008-08-10 15:20	---------	d-----w	C:\Program Files\Windows Sidebar
2008-08-10 15:20	---------	d-----w	C:\Program Files\Windows Defender
2008-08-10 15:20	---------	d-----w	C:\Program Files\Windows Calendar
2008-08-10 15:17	87,040	----a-w	C:\Windows\System32\msoert2.dll
2008-08-10 15:17	39,424	----a-w	C:\Windows\System32\ACCTRES.dll
2008-08-10 15:17	205,824	----a-w	C:\Windows\System32\msoeacct.dll
2008-08-10 15:16	704,000	----a-w	C:\Windows\System32\PhotoScreensaver.scr
2008-08-10 15:16	67,584	----a-w	C:\Windows\System32\wlanhlp.dll
2008-08-10 15:16	542,720	----a-w	C:\Windows\System32\sysmain.dll
2008-08-10 15:16	502,784	----a-w	C:\Windows\System32\wlansvc.dll
2008-08-10 15:16	47,104	----a-w	C:\Windows\System32\wlanapi.dll
2008-08-10 15:16	297,984	----a-w	C:\Windows\System32\wlansec.dll
2008-08-10 15:16	290,816	----a-w	C:\Windows\System32\wlanmsm.dll
2008-08-10 15:16	258,232	----a-w	C:\Windows\system32\drivers\acpi.sys
2008-08-10 15:16	24,064	----a-w	C:\Windows\System32\wtsapi32.dll
2008-08-10 15:16	2,923,520	----a-w	C:\Windows\explorer.exe
2008-08-10 15:16	194,560	----a-w	C:\Windows\System32\WebClnt.dll
2008-08-10 15:16	110,080	----a-w	C:\Windows\system32\drivers\mrxdav.sys
2008-08-10 15:15	49,664	----a-w	C:\Windows\System32\csrsrv.dll
2008-08-10 15:15	376,320	----a-w	C:\Windows\System32\winsrv.dll
2008-08-10 15:12	41,984	----a-w	C:\Windows\system32\drivers\monitor.sys
2008-08-10 15:12	374,456	----a-w	C:\Windows\System32\mcupdate_GenuineIntel.dll
2008-08-10 15:12	1,060,920	----a-w	C:\Windows\system32\drivers
tfs.sys
2008-08-10 15:11	8,147,968	----a-w	C:\Windows\System32\wmploc.DLL
2008-08-10 15:11	7,680	----a-w	C:\Windows\System32\spwmp.dll
2008-08-10 15:11	414,208	----a-w	C:\Windows\System32\msscp.dll
2008-08-10 15:11	4,096	----a-w	C:\Windows\System32\dxmasf.dll
2008-08-10 15:11	356,864	----a-w	C:\Windows\System32\MediaMetadataHandler.dll
2008-08-10 15:10	86,016	----a-w	C:\Windows\System32\icfupgd.dll
2008-08-10 15:10	63,488	----a-w	C:\Windows\system32\drivers\mpsdrv.sys
2008-08-10 15:10	61,952	----a-w	C:\Windows\System32\cmifw.dll
2008-08-10 15:10	396,800	----a-w	C:\Windows\System32\MPSSVC.dll
2008-08-10 15:10	392,192	----a-w	C:\Windows\System32\FirewallAPI.dll
2008-08-10 15:10	23,040	----a-w	C:\Windows\system32\drivers	unnel.sys
2008-08-10 15:10	178,688	----a-w	C:\Windows\System32\iphlpsvc.dll
2008-08-10 15:10	16,896	----a-w	C:\Windows\System32\wfapigp.dll
2008-08-10 15:10	15,360	----a-w	C:\Windows\system32\drivers\TUNMP.SYS
2008-08-10 15:09	45,112	----a-w	C:\Windows\system32\drivers\pciidex.sys
2008-08-10 15:09	3,504,696	----a-w	C:\Windows\System32
tkrnlpa.exe
2008-08-10 15:09	3,470,392	----a-w	C:\Windows\System32
toskrnl.exe
2008-08-10 15:09	211,000	----a-w	C:\Windows\system32\drivers\volsnap.sys
2008-08-10 15:09	21,560	----a-w	C:\Windows\system32\drivers\atapi.sys
2008-08-10 15:09	17,464	----a-w	C:\Windows\system32\drivers\intelide.sys
2008-08-10 15:09	154,624	----a-w	C:\Windows\system32\drivers
wifi.sys
2008-08-10 15:09	109,624	----a-w	C:\Windows\system32\drivers\ataport.sys
2008-08-10 15:08	8,704	----a-w	C:\Windows\System32\hcrstco.dll
2008-08-10 15:08	8,704	----a-w	C:\Windows\System32\hccoin.dll
2008-08-10 15:08	73,216	----a-w	C:\Windows\system32\drivers\usbccgp.sys
2008-08-10 15:08	5,888	----a-w	C:\Windows\system32\drivers\usbd.sys
2008-08-10 15:08	38,400	----a-w	C:\Windows\system32\drivers\usbehci.sys
2008-08-10 15:08	23,040	----a-w	C:\Windows\system32\drivers\usbuhci.sys
2008-08-10 15:08	224,768	----a-w	C:\Windows\system32\drivers\usbport.sys
2008-08-10 15:08	2,048	----a-w	C:\Windows\System32\msxml3r.dll
2008-08-10 15:08	192,000	----a-w	C:\Windows\system32\drivers\usbhub.sys
2008-08-10 15:08	104,448	----a-w	C:\Windows\System32\DWWIN.EXE
2008-08-10 15:08	1,191,936	----a-w	C:\Windows\System32\msxml3.dll
2008-08-10 15:07	803,328	----a-w	C:\Windows\system32\drivers	cpip.sys
2008-08-10 15:07	24,064	----a-w	C:\Windows\System32
etcfg.exe
2008-08-10 15:07	22,016	----a-w	C:\Windows\System32
etiougc.exe
2008-08-10 15:07	216,632	----a-w	C:\Windows\system32\drivers
etio.sys
2008-08-10 15:07	167,424	----a-w	C:\Windows\System32	cpipcfg.dll
2008-08-10 15:02	944,184	----a-w	C:\Windows\System32\winload.exe
2008-08-10 15:00	2,027,008	----a-w	C:\Windows\System32\win32k.sys
2008-08-10 14:59	---------	d-----w	C:\Program Files\Common Files\Adobe
2008-08-10 14:58	9,728	----a-w	C:\Windows\System32\LAPRXY.DLL
2008-08-10 14:58	223,232	----a-w	C:\Windows\System32\WMASF.DLL
2008-08-10 14:58	2,048	----a-w	C:\Windows\System32\asferror.dll
2008-08-10 14:57	57,856	----a-w	C:\Windows\System32\SLUINotify.dll
2008-08-10 14:57	566,784	----a-w	C:\Windows\System32\SLCommDlg.dll
.

(((((((((((((((((((((((((((((   snapshot@2008-09-28_20.41.19.01   )))))))))))))))))))))))))))))))))))))))))
.
- 2006-11-02 09:46:02	2,143,232	----a-w	C:\Windows\AppPatch\AcGenral.dll
+ 2008-07-31 03:34:58	2,144,256	----a-w	C:\Windows\AppPatch\AcGenral.dll
- 2008-06-12 06:54:28	537,600	----a-w	C:\Windows\AppPatch\AcLayers.dll
+ 2008-07-31 03:34:58	537,600	----a-w	C:\Windows\AppPatch\AcLayers.dll
- 2008-06-12 01:21:33	2,560	----a-w	C:\Windows\AppPatch\AcRes.dll
+ 2008-07-30 23:32:41	2,560	----a-w	C:\Windows\AppPatch\AcRes.dll
- 2006-11-02 09:46:02	445,952	----a-w	C:\Windows\AppPatch\AcSpecfc.dll
+ 2008-07-31 03:34:58	449,536	----a-w	C:\Windows\AppPatch\AcSpecfc.dll
- 2008-06-12 06:54:28	173,056	----a-w	C:\Windows\AppPatch\AcXtrnal.dll
+ 2008-07-31 03:34:58	173,056	----a-w	C:\Windows\AppPatch\AcXtrnal.dll
- 2007-01-15 12:06:15	7,168	----a-w	C:\Windows\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2008-09-28 19:19:49	8,192	----a-w	C:\Windows\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2007-01-15 12:06:07	32,768	----a-w	C:\Windows\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll
+ 2008-09-28 19:19:51	32,768	----a-w	C:\Windows\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll
- 2007-01-15 12:06:03	716,800	----a-w	C:\Windows\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2008-09-28 19:20:03	720,896	----a-w	C:\Windows\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2007-01-15 12:06:04	299,008	----a-w	C:\Windows\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2008-09-28 19:19:52	299,008	----a-w	C:\Windows\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2007-01-15 12:06:15	32,768	----a-w	C:\Windows\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll
+ 2008-09-28 19:19:59	32,768	----a-w	C:\Windows\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll
- 2007-01-15 12:06:17	299,008	----a-w	C:\Windows\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2008-09-28 19:19:57	303,104	----a-w	C:\Windows\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2007-01-15 12:06:08	1,290,240	----a-w	C:\Windows\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll
+ 2008-09-28 19:20:00	1,294,336	----a-w	C:\Windows\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll
- 2007-01-15 12:06:09	1,699,840	----a-w	C:\Windows\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll
+ 2008-09-28 19:19:50	1,703,936	----a-w	C:\Windows\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll
- 2007-01-15 12:06:09	86,016	----a-w	C:\Windows\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2008-09-28 19:20:02	90,112	----a-w	C:\Windows\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2007-01-15 12:06:11	466,944	----a-w	C:\Windows\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2008-09-28 19:19:56	466,944	----a-w	C:\Windows\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2007-01-15 12:06:10	241,664	----a-w	C:\Windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2008-09-28 19:19:53	241,664	----a-w	C:\Windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2007-01-15 12:06:10	64,000	----a-w	C:\Windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
+ 2008-09-28 19:19:53	66,560	----a-w	C:\Windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
- 2007-01-15 12:06:11	368,640	----a-w	C:\Windows\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll
+ 2008-09-28 19:19:59	372,736	----a-w	C:\Windows\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll
- 2007-01-15 12:06:12	241,664	----a-w	C:\Windows\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2008-09-28 19:20:04	241,664	----a-w	C:\Windows\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2007-01-15 12:06:12	323,584	----a-w	C:\Windows\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2008-09-28 19:19:57	323,584	----a-w	C:\Windows\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2007-01-15 12:06:12	131,072	----a-w	C:\Windows\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2008-09-28 19:19:53	131,072	----a-w	C:\Windows\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2007-01-15 12:06:12	77,824	----a-w	C:\Windows\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
+ 2008-09-28 19:19:55	77,824	----a-w	C:\Windows\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
- 2007-01-15 12:06:12	126,976	----a-w	C:\Windows\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2008-09-28 19:20:01	126,976	----a-w	C:\Windows\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2007-01-15 12:06:15	819,200	----a-w	C:\Windows\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2008-09-28 19:19:48	819,200	----a-w	C:\Windows\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2007-01-15 12:06:13	57,344	----a-w	C:\Windows\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2008-09-28 19:19:52	57,344	----a-w	C:\Windows\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2007-01-15 12:06:13	569,344	----a-w	C:\Windows\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2008-09-28 19:19:51	573,440	----a-w	C:\Windows\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2007-01-15 12:06:13	1,245,184	----a-w	C:\Windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2008-09-28 19:20:01	1,257,472	----a-w	C:\Windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
- 2007-01-15 12:06:14	2,039,808	----a-w	C:\Windows\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2008-09-28 19:19:54	2,052,096	----a-w	C:\Windows\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
- 2007-01-15 12:06:14	1,335,296	----a-w	C:\Windows\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.Xml.dll
+ 2008-09-28 19:19:58	1,339,392	----a-w	C:\Windows\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.XML.dll
- 2007-01-15 12:06:11	1,216,512	----a-w	C:\Windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2008-09-28 19:20:05	1,224,704	----a-w	C:\Windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2008-09-28 19:20:44	118,784	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_5a752f12\CustomMarshalers.dll
+ 2008-09-28 19:20:21	61,440	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_ece95754\CustomMarshalers.dll
+ 2008-09-28 19:20:39	3,379,200	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_3c9f848b\mscorlib.dll
+ 2008-09-28 19:20:57	8,880,128	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_fe2d2b02\mscorlib.dll
+ 2008-09-28 19:20:52	3,395,584	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_7ddc32c8\System.Design.dll
+ 2008-09-28 19:20:35	1,470,464	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_fac7e304\System.Design.dll
+ 2008-09-28 19:20:44	192,512	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_0786acb1\System.Drawing.Design.dll
+ 2008-09-28 19:20:23	90,112	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_2de33db3\System.Drawing.Design.dll
+ 2008-09-28 19:20:54	2,244,608	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_4a0d6094\System.Drawing.dll
+ 2008-09-28 19:20:36	835,584	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_5d4d7ba2\System.Drawing.dll
+ 2008-09-28 19:20:27	3,014,656	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_398cb3a6\System.Windows.Forms.dll
+ 2008-09-28 19:20:47	7,880,704	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_50967c04\System.Windows.Forms.dll
+ 2008-09-28 19:20:50	5,505,024	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_b40f3bd3\System.Xml.dll
+ 2008-09-28 19:20:31	2,088,960	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_eab869e3\System.Xml.dll
+ 2008-09-28 19:20:20	1,953,792	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_063b280f\System.dll
+ 2008-09-28 19:20:43	4,763,648	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_46e98e2f\System.dll
+ 2008-09-29 16:45:22	6,123,520	----a-w	C:\Windows\erdnt\Hiv-backup\SCHEMA.DAT
- 2003-02-20 18:19:32	253,952	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2004-07-14 23:49:16	258,048	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
- 2003-02-20 18:19:34	20,480	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
+ 2004-07-14 23:49:18	20,480	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
- 2003-02-20 18:19:38	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
+ 2004-07-14 23:49:26	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
- 2003-02-20 18:19:36	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2004-07-14 23:49:22	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
- 2003-02-20 18:09:08	77,824	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2004-07-14 22:32:22	81,920	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
- 2003-02-21 09:20:44	49,152	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\csc.exe
+ 2004-07-15 09:23:28	49,152	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\csc.exe
- 2003-02-21 09:21:00	626,688	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\cscomp.dll
+ 2004-07-15 09:23:44	626,688	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\cscomp.dll
- 2003-02-20 18:06:20	282,624	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\fusion.dll
+ 2004-07-14 22:24:30	282,624	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\fusion.dll
+ 2003-10-08 12:30:14	81,920	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe
- 2003-02-21 06:24:38	7,168	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll
+ 2004-07-15 12:31:00	8,192	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll
- 2003-02-21 06:24:40	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEHost.dll
+ 2004-07-15 12:31:04	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEHost.dll
- 2003-02-20 18:09:40	196,608	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
+ 2004-07-14 22:35:30	196,608	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
- 2003-02-21 06:26:36	716,800	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll
+ 2004-07-15 12:28:58	720,896	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll
- 2003-02-21 06:26:38	299,008	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll
+ 2004-07-15 12:28:56	299,008	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll
- 2003-02-21 06:25:04	49,152	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
+ 2004-07-15 12:28:50	49,152	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
- 2003-02-21 06:25:04	49,152	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
+ 2004-07-15 12:28:50	49,152	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
- 2003-02-20 18:09:12	77,824	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscordbc.dll
+ 2004-07-14 22:32:44	86,016	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscordbc.dll
- 2003-02-20 18:09:12	233,472	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscordbi.dll
+ 2004-07-14 22:32:46	233,472	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscordbi.dll
- 2003-02-20 18:06:32	311,296	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
+ 2004-07-14 22:25:06	315,392	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
- 2003-02-20 18:09:16	98,304	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2004-07-14 22:33:04	102,400	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
- 2003-02-21 06:26:34	2,088,960	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2004-07-15 12:29:02	2,138,112	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
- 2003-02-20 18:09:18	143,360	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorrc.dll
+ 2004-07-14 22:33:22	143,360	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorrc.dll
- 2003-02-20 18:09:18	81,920	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll
+ 2004-07-14 22:33:24	81,920	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll
- 2003-02-20 18:07:34	2,494,464	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
+ 2004-07-14 22:26:52	2,510,848	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
- 2003-02-20 18:08:32	2,482,176	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2004-07-14 22:28:34	2,502,656	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2004-08-10 14:20:00	106,496	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322
etfxupdate.exe
- 2003-02-20 18:09:30	90,112	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\PerfCounter.dll
+ 2004-07-14 22:34:50	94,208	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\PerfCounter.dll
- 2003-02-21 06:26:46	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\RegCode.dll
+ 2004-07-15 12:28:48	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\RegCode.dll
- 2003-02-20 18:09:34	319,488	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SOS.dll
+ 2004-07-14 22:35:04	319,488	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SOS.dll
- 2003-02-21 06:26:38	1,290,240	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Data.dll
+ 2004-07-15 12:32:00	1,294,336	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Data.dll
- 2003-02-21 06:25:42	299,008	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll
+ 2004-07-15 12:31:14	303,104	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll
- 2003-02-21 06:26:42	1,699,840	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Design.dll
+ 2004-07-15 12:29:02	1,703,936	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Design.dll
- 2003-02-21 06:26:44	86,016	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll
+ 2004-07-15 12:28:54	90,112	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll
- 2003-02-21 06:26:46	1,216,512	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.dll
+ 2004-07-15 12:31:16	1,224,704	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.dll
- 2003-02-21 06:26:50	466,944	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll
+ 2004-07-15 12:28:58	466,944	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll
- 2003-02-21 06:26:50	241,664	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll
+ 2004-07-15 12:28:56	241,664	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll
- 2003-02-20 18:09:36	64,000	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.Thunk.dll
+ 2004-07-14 22:35:12	66,560	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.Thunk.dll
- 2003-02-21 06:26:52	368,640	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Management.dll
+ 2004-07-15 12:31:58	372,736	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Management.dll
- 2003-02-21 06:26:54	241,664	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll
+ 2004-07-15 12:31:12	241,664	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll
- 2003-02-21 06:26:56	323,584	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll
+ 2004-07-15 12:28:58	323,584	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll
- 2003-02-21 06:26:56	131,072	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll
+ 2004-07-15 12:31:54	131,072	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll
- 2003-02-21 06:26:58	77,824	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Security.dll
+ 2004-07-15 12:28:52	77,824	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Security.dll
- 2003-02-21 06:27:00	126,976	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll
+ 2004-07-15 12:28:54	126,976	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll
- 2003-02-21 06:27:02	1,245,184	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
+ 2004-07-15 12:29:00	1,257,472	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
- 2003-02-21 06:27:06	819,200	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll
+ 2004-07-15 12:28:58	819,200	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll
- 2003-02-21 06:24:18	57,344	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll
+ 2004-07-15 12:28:52	57,344	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll
- 2003-02-21 06:27:06	569,344	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll
+ 2004-07-15 12:31:16	573,440	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll
- 2003-02-21 06:27:08	2,039,808	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll
+ 2004-07-15 12:32:02	2,052,096	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll
- 2003-02-21 06:27:10	1,335,296	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.XML.dll
+ 2004-07-15 12:29:00	1,339,392	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.XML.dll
+ 2004-06-22 11:51:38	53,248	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe
- 2003-02-21 09:20:38	737,280	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\vbc.exe
+ 2004-07-15 09:23:20	737,280	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\vbc.exe
- 2003-02-21 04:04:18	1,032,192	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll
+ 2004-07-15 06:15:14	1,032,192	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll
- 2003-02-20 19:10:40	31,744	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll
+ 2004-07-15 00:11:56	31,744	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll
+ 2008-09-29 16:38:49	2,048	--sha-w	C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-09-29 16:38:49	2,048	--sha-w	C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-09-28 18:38:44	262,144	--sha-w	C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-09-29 16:39:37	262,144	--sha-w	C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-09-29 16:39:37	262,144	---ha-w	C:\Windows\ServiceProfiles\LocalService
tuser.dat.LOG1
- 2008-09-28 18:38:44	262,144	--sha-w	C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-09-29 16:39:32	262,144	--sha-w	C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-09-29 16:39:32	262,144	---ha-w	C:\Windows\ServiceProfiles\NetworkService
tuser.dat.LOG1
+ 2008-09-29 16:44:22	4,056	----a-w	C:\Windows\SoftwareDistribution\EventCache\{81CD1C07-3E2D-4CB5-B3B1-6F37B8223E53}.bin
- 2006-11-02 09:46:02	28,160	----a-w	C:\Windows\System32\Apphlpdm.dll
+ 2008-07-31 03:34:58	28,160	----a-w	C:\Windows\System32\Apphlpdm.dll
- 2007-02-28 18:40:03	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-09-29 16:40:19	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-02-28 18:40:03	32,768	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-09-29 16:40:19	32,768	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-02-28 18:40:03	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-09-29 16:40:19	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2006-11-02 12:34:42	1,686,528	----a-w	C:\Windows\System32\gameux.dll
+ 2008-07-31 03:34:59	1,686,528	----a-w	C:\Windows\System32\gameux.dll
- 2006-11-02 12:34:42	3,953,152	----a-w	C:\Windows\System32\GameUXLegacyGDFs.dll
+ 2008-07-30 23:47:04	4,247,552	----a-w	C:\Windows\System32\GameUXLegacyGDFs.dll
- 2008-08-05 18:11:02	15,888,504	----a-w	C:\Windows\System32\mrt.exe
+ 2008-08-26 20:28:12	16,208,504	----a-w	C:\Windows\System32\mrt.exe
- 2006-11-02 09:46:10	215,552	----a-w	C:\Windows\System32\msshsq.dll
+ 2006-12-20 06:03:44	229,888	----a-w	C:\Windows\System32\msshsq.dll
- 2007-02-21 19:18:30	107,416	----a-w	C:\Windows\System32\perfc009.dat
+ 2008-09-29 16:45:17	107,416	----a-w	C:\Windows\System32\perfc009.dat
- 2007-02-21 19:18:30	121,814	----a-w	C:\Windows\System32\perfc00C.dat
+ 2008-09-29 16:45:17	121,814	----a-w	C:\Windows\System32\perfc00C.dat
- 2007-02-21 19:18:30	618,272	----a-w	C:\Windows\System32\perfh009.dat
+ 2008-09-29 16:45:17	618,272	----a-w	C:\Windows\System32\perfh009.dat
- 2007-02-21 19:18:30	699,984	----a-w	C:\Windows\System32\perfh00C.dat
+ 2008-09-29 16:45:17	699,984	----a-w	C:\Windows\System32\perfh00C.dat
- 2007-01-30 00:16:50	6,291,456	----a-w	C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2008-09-29 16:39:42	6,291,456	----a-w	C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
- 2007-02-28 18:41:58	5,994	----a-w	C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3231008829-2089630883-3644617952-1000_UserData.bin
+ 2008-09-29 16:40:58	6,296	----a-w	C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3231008829-2089630883-3644617952-1000_UserData.bin
- 2007-02-28 18:41:58	41,274	----a-w	C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-09-29 16:40:58	41,416	----a-w	C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2007-02-28 18:41:57	27,026	----a-w	C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-09-29 16:40:57	28,010	----a-w	C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2006-11-02 12:35:54	303,616	----a-w	C:\Windows\System32\wmpeffects.dll
+ 2008-06-26 03:22:35	303,616	----a-w	C:\Windows\System32\wmpeffects.dll
- 2007-02-28 10:36:37	115,016,352	----a-w	C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-09-28 18:57:08	116,157,530	----a-w	C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-07-31 03:34:58	28,160	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6000.16721_none_8006fd7863ac1387\Apphlpdm.dll
+ 2008-07-30 03:11:12	28,160	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6000.20885_none_8053bbe37cf6c053\Apphlpdm.dll
+ 2008-07-31 03:32:38	28,160	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6001.18112_none_81f90c5460c9a1de\Apphlpdm.dll
+ 2008-07-31 03:23:27	28,160	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6001.22233_none_826e099179f692e1\Apphlpdm.dll
+ 2008-07-30 23:32:41	2,560	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6000.16721_none_0a275bdbf535293c\AcRes.dll
+ 2008-07-29 23:16:45	2,560	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6000.20885_none_0a741a470e7fd608\AcRes.dll
+ 2008-03-08 01:58:43	2,560	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6001.18112_none_0c196ab7f252b793\AcRes.dll
+ 2008-07-31 01:03:24	2,560	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6001.22233_none_0c8e67f50b7fa896\AcRes.dll
+ 2008-07-31 03:34:58	2,144,256	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6000.16721_none_0a295c6ff5335bea\AcGenral.dll
+ 2008-07-30 03:11:10	2,144,768	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6000.20885_none_0a761adb0e7e08b6\AcGenral.dll
+ 2008-07-31 03:32:38	2,154,496	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6001.18112_none_0c1b6b4bf250ea41\AcGenral.dll
+ 2008-07-31 03:23:20	2,153,984	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6001.22233_none_0c9068890b7ddb44\AcGenral.dll
+ 2008-07-31 03:34:58	449,536	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6000.16721_none_0a2a5cb9f5327541\AcSpecfc.dll
+ 2008-07-30 03:11:10	450,560	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6000.20885_none_0a771b250e7d220d\AcSpecfc.dll
+ 2008-07-31 03:32:38	460,288	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6001.18112_none_0c1c6b95f2500398\AcSpecfc.dll
+ 2008-07-31 03:23:21	459,776	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6001.22233_none_0c9168d30b7cf49b\AcSpecfc.dll
+ 2008-07-31 03:34:58	537,600	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.16721_none_0a2b5d03f5318e98\AcLayers.dll
+ 2008-07-31 03:34:58	173,056	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.16721_none_0a2b5d03f5318e98\AcXtrnal.dll
+ 2008-07-30 03:11:10	537,600	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.20885_none_0a781b6f0e7c3b64\AcLayers.dll
+ 2008-07-30 03:11:10	173,056	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.20885_none_0a781b6f0e7c3b64\AcXtrnal.dll
+ 2008-06-12 05:28:53	541,696	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6001.18112_none_0c1d6bdff24f1cef\AcLayers.dll
+ 2008-07-31 03:32:38	173,056	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6001.18112_none_0c1d6bdff24f1cef\AcXtrnal.dll
+ 2008-07-31 03:23:21	541,696	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6001.22233_none_0c92691d0b7c0df2\AcLayers.dll
+ 2008-07-31 03:23:22	173,056	----a-w	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6001.22233_none_0c92691d0b7c0df2\AcXtrnal.dll
+ 2008-07-31 03:34:59	1,686,528	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.16721_none_400572c0c425beea\gameux.dll
+ 2008-07-30 23:47:04	4,247,552	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.16721_none_400572c0c425beea\GameUXLegacyGDFs.dll
+ 2008-07-30 03:11:51	1,686,528	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.20885_none_4052312bdd706bb6\gameux.dll
+ 2008-07-29 23:31:23	4,247,552	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.20885_none_4052312bdd706bb6\GameUXLegacyGDFs.dll
+ 2008-03-08 04:21:55	1,695,744	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6001.18112_none_41f7819cc1434d41\gameux.dll
+ 2008-07-31 01:13:15	4,240,384	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6001.18112_none_41f7819cc1434d41\GameUXLegacyGDFs.dll
+ 2008-07-31 03:25:45	1,695,744	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6001.22233_none_426c7ed9da703e44\gameux.dll
+ 2008-07-31 01:15:32	4,240,384	----a-w	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6001.22233_none_426c7ed9da703e44\GameUXLegacyGDFs.dll
+ 2008-06-26 03:22:35	303,616	----a-w	C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpeffects_31bf3856ad364e35_6.0.6000.16710_none_f75cda9b92533b4f\wmpeffects.dll
+ 2008-06-26 03:20:37	303,616	----a-w	C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpeffects_31bf3856ad364e35_6.0.6000.20867_none_f7b769d0ab93182f\wmpeffects.dll
+ 2008-06-26 03:29:09	303,616	----a-w	C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpeffects_31bf3856ad364e35_6.0.6001.18098_none_f8f49a4b8fb37959\wmpeffects.dll
+ 2008-06-26 03:21:15	303,616	----a-w	C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpeffects_31bf3856ad364e35_6.0.6001.22211_none_f9cdb656a8968561\wmpeffects.dll
+ 2008-06-30 23:00:26	2,413,032	----a-w	C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.16730_none_f0816da06e6c1330\OESpamFilter.dat
+ 2008-06-30 23:00:26	2,413,032	----a-w	C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.20895_none_f0cf2c5587b5d953\OESpamFilter.dat
+ 2008-06-30 23:00:26	2,413,032	----a-w	C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.18121_none_f2737c7c6b89a187\OESpamFilter.dat
+ 2008-06-30 23:00:26	2,413,032	----a-w	C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.22243_none_f2e97a0384b5abe1\OESpamFilter.dat
+ 2008-04-30 05:24:09	1,744,896	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e2537\GdiPlus.dll
+ 2008-05-01 03:16:12	1,744,896	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.20826_none_87cd0392e31b3a67\GdiPlus.dll
+ 2008-04-30 05:27:35	1,748,992	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\GdiPlus.dll
+ 2008-05-01 03:22:16	1,748,992	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.22170_none_87ae89a0e3672b5a\GdiPlus.dll
+ 2008-04-30 05:24:10	1,823,232	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6000.16683_none_8df25f6f6273fede\GdiPlus.dll
+ 2008-05-01 03:16:13	1,823,232	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6000.20826_none_771e72777c21140e\GdiPlus.dll
+ 2008-04-30 05:27:40	1,823,232	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6001.18065_none_8dcc2d1362c70bc9\GdiPlus.dll
+ 2008-05-01 03:22:16	1,823,232	----a-w	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.6001.22170_none_76fff8857c6d0501\GdiPlus.dll
+ 2006-12-20 06:03:44	229,888	----a-w	C:\Windows\winsxs\x86_windowssearchengine-structuredquery_31bf3856ad364e35_6.0.6000.16404_none_a5026e9e71025fcb\msshsq.dll
+ 2006-12-20 07:11:39	229,888	----a-w	C:\Windows\winsxs\x86_windowssearchengine-structuredquery_31bf3856ad364e35_6.0.6000.20500_none_a5880a418a239a39\msshsq.dll
.
-- Instantané actualisé --
.
(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-16 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-16 92704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"FilterAdministratorToken"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{657AAF3E-E356-4DF5-92FC-1FAAB1E1B53F}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{D1A163E3-1C3A-4891-B4EB-5EA9AA45544C}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{CE78C7B8-FCD2-49FA-A2F9-2CBCFE60DB50}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{DC892D53-CF22-4822-A708-924FB5B45D2A}"= UDP:C:\Users\bobby.PC-de-gobby\AppData\Local\Temp\.ttACE8.tmp:enable
"{0F31C959-65BC-4480-B41B-79C39CC5AC81}"= TCP:C:\Users\bobby.PC-de-gobby\AppData\Local\Temp\.ttACE8.tmp:enable
"{C3D25C3B-E11D-4360-84C0-DCD3CD9CCA78}"= UDP:C:\Windows\System32\sysrest32.exe:enable
"{479ECE61-7679-401D-9CE6-D3B2879EA0BD}"= TCP:C:\Windows\System32\sysrest32.exe:enable

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 51280]
R3 yukonwlh;Pilote miniport NDIS6.0 pour contrôleur Ethernet Marvell Yukon;C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 194048]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\shell\AutoRun\command - E:\wd_windows_tools\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c30ad5e-66ca-11dd-afc5-00301b4522f2}]
\shell\AutoRun\command - E:\wd_windows_tools\setup.exe
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Users\bobby.PC-de-gobby\AppData\Roaming\Mozilla\Firefox\Profiles\3buryu3v.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr/
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-29 18:46:33
Windows 6.0.6000  NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2008-09-29 18:47:50
ComboFix-quarantined-files.txt  2008-09-29 16:47:47
ComboFix2.txt  2008-09-28 18:41:49

Avant-CF: Le texte du message associ‚ au num‚ro 0x2379 est introuvable dans le fichier de messages pour Application.
Après-CF: 35,015,524,352 octets libres

453	--- E O F ---	2008-09-28 19:21:32

vivou · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:53:33, on 29/09/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\System32undll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\conime.exe
C:\Windows\Explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32
otepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O13 - Gopher Prefix: 
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe

sKe69 · Answer

Salut,

1-Crées un doc texte sur ton bureau : 
pointes ta souris sur ton bureau , cliques droit : vas dans "nouveau" et choisis "document texte" . 

Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de créer : 

Registry:: 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] 
"{C3D25C3B-E11D-4360-84C0-DCD3CD9CCA78}"=-
"{479ECE61-7679-401D-9CE6-D3B2879EA0BD}"=-

File::
C:\Windows\System32\sysrest32.exe


Puis vas dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi : 
CFScript puis valides ...
 

2-Nettoyage :

!! Déconnectes toi, fermes toutes tes applications et désactives TOUTES TES DEFENSES ( tu les réactiveras après )  !! 

--->Sur ton bureau, fais un glissé avec ta souris le fichier CFScript sur l'icône de ComboFix.exe . 

(Regarde ici : http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif )

Cette manipulation va relancer combofix .
--> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tapes 1 puis valide. 

Puis patientes le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!) 

!! Ne touches à rien tant que le scan n'est pas terminé !! 

Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisses-le faire. 

Une fois le scan achevé, un rapport va s'afficher : Postes le accompagné d' un nouveau rapport HijackThis pour analyse ...

( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )

vivou · Answer

rapport combofix

ComboFix 08-09-27.05 - bobby 2008-09-30 19:36:10.3 - NTFSx86
Lancé depuis: C:\Users\bobby.PC-de-gobby\Desktop\ComboFix.exe
Commutateurs utilisés :: C:\Users\bobby.PC-de-gobby\Desktop\CFScript.txt

FILE ::
C:\Windows\System32\sysrest32.exe
.

(((((((((((((((((((((((((((((   Fichiers créés du 2008-08-28 au 2008-09-30  ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans ce laps de temps

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-29 17:51	---------	d-----w	C:\ProgramData\Spybot - Search & Destroy
2008-09-28 19:17	---------	d-----w	C:\Program Files\Microsoft Silverlight
2008-09-19 11:26	82,944	----a-w	C:\Windows\System32\o4Patch.exe
2008-09-19 11:26	82,944	----a-w	C:\Windows\System32\IEDFix.C.exe
2008-09-09 23:04	38,528	----a-w	C:\Windows\system32\drivers\mbamswissarmy.sys
2008-09-09 23:03	17,200	----a-w	C:\Windows\system32\drivers\mbam.sys
2008-09-08 22:38	88,576	----a-w	C:\Windows\System32\AntiXPVSTFix.exe
2008-09-02 15:51	86,528	----a-w	C:\Windows\System32\VACFix.exe
2008-08-18 11:19	82,432	----a-w	C:\Windows\System32\404Fix.exe
2008-08-15 10:08	---------	d-----w	C:\Program Files\VstPlugins
2008-08-15 10:08	---------	d-----w	C:\Program Files\Image-Line
2008-08-14 23:16	---------	d-----w	C:\Program Files\Rockstar Games
2008-08-14 23:08	---------	d-----w	C:\ProgramData\NVIDIA
2008-08-14 22:55	---------	d-----w	C:\Users\bobby.PC-de-gobby\AppData\Roaming\SoundSpectrum
2008-08-14 22:55	---------	d-----w	C:\Program Files\SoundSpectrum
2008-08-14 01:29	---------	d-----w	C:\Program Files\Windows Mail
2008-08-13 19:07	---------	d-----w	C:\Program Files\Windows Live
2008-08-13 19:06	---------	dcsh--w	C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-13 19:04	---------	d-----w	C:\ProgramData\WLInstaller
2008-08-12 07:55	167,424	----a-w	C:\Windows\System32\SpoonUninstall.exe
2008-08-11 18:08	---------	d-----w	C:\Program Files\Illustrate
2008-08-11 08:25	615,424	----a-w	C:\Windows\System32	hemeui.dll
2008-08-11 08:25	240,640	----a-w	C:\Windows\System32\uxtheme.dll
2008-08-10 22:26	---------	d-----w	C:\Program Files\Electronic Arts
2008-08-10 19:34	---------	d-----w	C:\Users\bobby.PC-de-gobby\AppData\Roaming\DivX
2008-08-10 19:33	---------	d-----w	C:\Program Files\DivX
2008-08-10 16:31	---------	d-----w	C:\ProgramData\eMule
2008-08-10 16:30	---------	d-----w	C:\Program Files\eMule
2008-08-10 16:09	---------	d-----w	C:\Program Files\Common Files\InstallShield
2008-08-10 15:30	---------	d-----w	C:\Program Files\UxTheme Multipatcher Fr
2008-08-10 15:26	174	--sha-w	C:\Program Files\desktop.ini
2008-08-10 15:20	---------	d-----w	C:\Program Files\Windows Sidebar
2008-08-10 15:20	---------	d-----w	C:\Program Files\Windows Defender
2008-08-10 15:20	---------	d-----w	C:\Program Files\Windows Calendar
2008-08-10 15:17	87,040	----a-w	C:\Windows\System32\msoert2.dll
2008-08-10 15:17	39,424	----a-w	C:\Windows\System32\ACCTRES.dll
2008-08-10 15:17	205,824	----a-w	C:\Windows\System32\msoeacct.dll
2008-08-10 15:16	704,000	----a-w	C:\Windows\System32\PhotoScreensaver.scr
2008-08-10 15:16	67,584	----a-w	C:\Windows\System32\wlanhlp.dll
2008-08-10 15:16	542,720	----a-w	C:\Windows\System32\sysmain.dll
2008-08-10 15:16	502,784	----a-w	C:\Windows\System32\wlansvc.dll
2008-08-10 15:16	47,104	----a-w	C:\Windows\System32\wlanapi.dll
2008-08-10 15:16	297,984	----a-w	C:\Windows\System32\wlansec.dll
2008-08-10 15:16	290,816	----a-w	C:\Windows\System32\wlanmsm.dll
2008-08-10 15:16	258,232	----a-w	C:\Windows\system32\drivers\acpi.sys
2008-08-10 15:16	24,064	----a-w	C:\Windows\System32\wtsapi32.dll
2008-08-10 15:16	2,923,520	----a-w	C:\Windows\explorer.exe
2008-08-10 15:16	194,560	----a-w	C:\Windows\System32\WebClnt.dll
2008-08-10 15:16	110,080	----a-w	C:\Windows\system32\drivers\mrxdav.sys
2008-08-10 15:15	49,664	----a-w	C:\Windows\System32\csrsrv.dll
2008-08-10 15:15	376,320	----a-w	C:\Windows\System32\winsrv.dll
2008-08-10 15:12	41,984	----a-w	C:\Windows\system32\drivers\monitor.sys
2008-08-10 15:12	374,456	----a-w	C:\Windows\System32\mcupdate_GenuineIntel.dll
2008-08-10 15:12	1,060,920	----a-w	C:\Windows\system32\drivers
tfs.sys
2008-08-10 15:11	8,147,968	----a-w	C:\Windows\System32\wmploc.DLL
2008-08-10 15:11	7,680	----a-w	C:\Windows\System32\spwmp.dll
2008-08-10 15:11	414,208	----a-w	C:\Windows\System32\msscp.dll
2008-08-10 15:11	4,096	----a-w	C:\Windows\System32\dxmasf.dll
2008-08-10 15:11	356,864	----a-w	C:\Windows\System32\MediaMetadataHandler.dll
2008-08-10 15:10	86,016	----a-w	C:\Windows\System32\icfupgd.dll
2008-08-10 15:10	63,488	----a-w	C:\Windows\system32\drivers\mpsdrv.sys
2008-08-10 15:10	61,952	----a-w	C:\Windows\System32\cmifw.dll
2008-08-10 15:10	396,800	----a-w	C:\Windows\System32\MPSSVC.dll
2008-08-10 15:10	392,192	----a-w	C:\Windows\System32\FirewallAPI.dll
2008-08-10 15:10	23,040	----a-w	C:\Windows\system32\drivers	unnel.sys
2008-08-10 15:10	178,688	----a-w	C:\Windows\System32\iphlpsvc.dll
2008-08-10 15:10	16,896	----a-w	C:\Windows\System32\wfapigp.dll
2008-08-10 15:10	15,360	----a-w	C:\Windows\system32\drivers\TUNMP.SYS
2008-08-10 15:09	45,112	----a-w	C:\Windows\system32\drivers\pciidex.sys
2008-08-10 15:09	3,504,696	----a-w	C:\Windows\System32
tkrnlpa.exe
2008-08-10 15:09	3,470,392	----a-w	C:\Windows\System32
toskrnl.exe
2008-08-10 15:09	211,000	----a-w	C:\Windows\system32\drivers\volsnap.sys
2008-08-10 15:09	21,560	----a-w	C:\Windows\system32\drivers\atapi.sys
2008-08-10 15:09	17,464	----a-w	C:\Windows\system32\drivers\intelide.sys
2008-08-10 15:09	154,624	----a-w	C:\Windows\system32\drivers
wifi.sys
2008-08-10 15:09	109,624	----a-w	C:\Windows\system32\drivers\ataport.sys
2008-08-10 15:08	8,704	----a-w	C:\Windows\System32\hcrstco.dll
2008-08-10 15:08	8,704	----a-w	C:\Windows\System32\hccoin.dll
2008-08-10 15:08	73,216	----a-w	C:\Windows\system32\drivers\usbccgp.sys
2008-08-10 15:08	5,888	----a-w	C:\Windows\system32\drivers\usbd.sys
2008-08-10 15:08	38,400	----a-w	C:\Windows\system32\drivers\usbehci.sys
2008-08-10 15:08	23,040	----a-w	C:\Windows\system32\drivers\usbuhci.sys
2008-08-10 15:08	224,768	----a-w	C:\Windows\system32\drivers\usbport.sys
2008-08-10 15:08	2,048	----a-w	C:\Windows\System32\msxml3r.dll
2008-08-10 15:08	192,000	----a-w	C:\Windows\system32\drivers\usbhub.sys
2008-08-10 15:08	104,448	----a-w	C:\Windows\System32\DWWIN.EXE
2008-08-10 15:08	1,191,936	----a-w	C:\Windows\System32\msxml3.dll
2008-08-10 15:07	803,328	----a-w	C:\Windows\system32\drivers	cpip.sys
2008-08-10 15:07	24,064	----a-w	C:\Windows\System32
etcfg.exe
2008-08-10 15:07	22,016	----a-w	C:\Windows\System32
etiougc.exe
2008-08-10 15:07	216,632	----a-w	C:\Windows\system32\drivers
etio.sys
2008-08-10 15:07	167,424	----a-w	C:\Windows\System32	cpipcfg.dll
2008-08-10 15:02	944,184	----a-w	C:\Windows\System32\winload.exe
2008-08-10 15:00	2,027,008	----a-w	C:\Windows\System32\win32k.sys
2008-08-10 14:59	---------	d-----w	C:\Program Files\Common Files\Adobe
2008-08-10 14:58	9,728	----a-w	C:\Windows\System32\LAPRXY.DLL
2008-08-10 14:58	223,232	----a-w	C:\Windows\System32\WMASF.DLL
2008-08-10 14:58	2,048	----a-w	C:\Windows\System32\asferror.dll
2008-08-10 14:57	57,856	----a-w	C:\Windows\System32\SLUINotify.dll
2008-08-10 14:57	566,784	----a-w	C:\Windows\System32\SLCommDlg.dll
.

(((((((((((((((((((((((((((((   snapshot_2008-09-29_18.47.06.96   )))))))))))))))))))))))))))))))))))))))))
.
- 2008-09-28 19:20:01	1,257,472	----a-w	C:\Windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2008-09-30 17:26:09	1,265,664	----a-w	C:\Windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
- 2008-09-28 19:20:05	1,224,704	----a-w	C:\Windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2008-09-30 17:26:10	1,232,896	----a-w	C:\Windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2008-09-30 17:26:20	61,440	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_cb652a3f\CustomMarshalers.dll
+ 2008-09-30 17:26:41	118,784	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_f5fc7709\CustomMarshalers.dll
+ 2008-09-30 17:26:54	8,908,800	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_6c92f9ee\mscorlib.dll
+ 2008-09-30 17:26:37	3,391,488	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_f744a8d6\mscorlib.dll
+ 2008-09-30 17:26:50	3,395,584	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_4a57a7da\System.Design.dll
+ 2008-09-30 17:26:32	1,470,464	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_a0733e11\System.Design.dll
+ 2008-09-30 17:26:42	192,512	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_b4d72df6\System.Drawing.Design.dll
+ 2008-09-30 17:26:21	90,112	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_d7414fb2\System.Drawing.Design.dll
+ 2008-09-30 17:26:52	2,244,608	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_4ef7e80d\System.Drawing.dll
+ 2008-09-30 17:26:34	835,584	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_90912f86\System.Drawing.dll
+ 2008-09-30 17:26:26	3,018,752	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_4d8aff99\System.Windows.Forms.dll
+ 2008-09-30 17:26:45	7,884,800	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_79508402\System.Windows.Forms.dll
+ 2008-09-30 17:26:47	5,513,216	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_6d93f561\System.Xml.dll
+ 2008-09-30 17:26:29	2,088,960	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_c9f827fb\System.Xml.dll
+ 2008-09-30 17:26:41	4,788,224	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_0dbe07d2\System.dll
+ 2008-09-30 17:26:19	1,966,080	----a-w	C:\Windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_4d29b4b7\System.dll
- 2004-07-14 23:49:16	258,048	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2007-04-13 19:30:52	258,048	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
- 2004-07-14 23:49:22	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2007-04-13 19:30:52	32,768	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
- 2004-07-14 22:32:22	81,920	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2007-04-13 18:57:52	81,920	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
- 2003-02-20 18:09:14	86,016	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
+ 2007-04-13 18:57:58	86,016	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
- 2004-07-14 22:25:06	315,392	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
+ 2007-04-13 18:56:30	315,392	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
- 2004-07-14 22:33:04	102,400	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2007-04-13 18:58:00	102,400	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
- 2004-07-15 12:29:02	2,138,112	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2007-04-13 18:50:46	2,142,208	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
- 2003-02-20 18:09:18	77,824	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
+ 2007-04-13 18:58:02	77,824	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
- 2004-07-14 22:26:52	2,510,848	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
+ 2007-04-13 18:57:00	2,523,136	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
- 2004-07-14 22:28:34	2,502,656	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2007-04-13 18:57:28	2,514,944	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
- 2004-08-10 14:20:00	106,496	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322
etfxupdate.exe
+ 2007-01-15 14:11:26	73,728	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322
etfxupdate.exe
+ 2004-07-14 23:49:16	258,048	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SHADOW2976\_aspnet_isapi.dll
+ 2004-07-14 22:32:22	81,920	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SHADOW2976\_CORPerfMonExt.dll
+ 2004-07-14 22:24:30	282,624	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SHADOW2976\_fusion.dll
+ 2004-07-14 22:25:06	315,392	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SHADOW2976\_mscorjit.dll
+ 2004-07-15 12:29:02	2,138,112	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SHADOW2976\_mscorlib.dll
+ 2003-02-20 18:09:18	77,824	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SHADOW2976\_mscorsn.dll
+ 2004-07-14 22:26:52	2,510,848	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SHADOW2976\_mscorsvr.dll
+ 2004-07-14 22:28:34	2,502,656	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SHADOW2976\_mscorwks.dll
+ 2003-02-21 03:42:22	348,160	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SHADOW2976\_msvcr71.dll
+ 2004-07-14 22:34:50	94,208	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\SHADOW2976\_PerfCounter.dll
- 2004-07-15 12:31:16	1,224,704	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.dll
+ 2007-04-13 19:35:38	1,232,896	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.dll
- 2004-07-15 12:29:00	1,257,472	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
+ 2007-04-13 19:35:46	1,265,664	----a-w	C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
- 2008-09-29 16:38:49	2,048	--sha-w	C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-09-30 17:19:51	2,048	--sha-w	C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-09-29 16:38:49	2,048	--sha-w	C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-09-30 17:19:51	2,048	--sha-w	C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-09-29 16:39:37	262,144	--sha-w	C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-09-30 17:22:01	262,144	--sha-w	C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-09-30 17:22:01	262,144	---ha-w	C:\Windows\ServiceProfiles\LocalService
tuser.dat.LOG1
- 2008-09-29 16:39:32	262,144	--sha-w	C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-09-30 17:21:56	262,144	--sha-w	C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-09-30 17:21:56	262,144	---ha-w	C:\Windows\ServiceProfiles\NetworkService
tuser.dat.LOG1
- 2008-09-29 16:40:19	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-09-30 17:25:50	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-09-29 16:40:19	32,768	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-09-30 17:25:50	32,768	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-09-29 16:40:19	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-09-30 17:25:50	16,384	--sha-w	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-09-29 16:45:17	107,416	----a-w	C:\Windows\System32\perfc009.dat
+ 2008-09-30 17:27:09	107,416	----a-w	C:\Windows\System32\perfc009.dat
- 2008-09-29 16:45:17	121,814	----a-w	C:\Windows\System32\perfc00C.dat
+ 2008-09-30 17:27:09	121,814	----a-w	C:\Windows\System32\perfc00C.dat
- 2008-09-29 16:45:17	618,272	----a-w	C:\Windows\System32\perfh009.dat
+ 2008-09-30 17:27:09	618,272	----a-w	C:\Windows\System32\perfh009.dat
- 2008-09-29 16:45:17	699,984	----a-w	C:\Windows\System32\perfh00C.dat
+ 2008-09-30 17:27:09	699,984	----a-w	C:\Windows\System32\perfh00C.dat
- 2008-09-29 16:39:42	6,291,456	----a-w	C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2008-09-29 17:51:50	6,291,456	----a-w	C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
- 2008-09-29 16:40:58	6,296	----a-w	C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3231008829-2089630883-3644617952-1000_UserData.bin
+ 2008-09-30 17:22:20	6,336	----a-w	C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3231008829-2089630883-3644617952-1000_UserData.bin
- 2008-09-29 16:40:58	41,416	----a-w	C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-09-30 17:22:20	41,448	----a-w	C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-09-29 16:40:57	28,010	----a-w	C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-09-30 17:22:19	28,026	----a-w	C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-09-28 18:57:08	116,157,530	----a-w	C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-09-30 17:37:33	117,896,162	----a-w	C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
.
-- Instantané actualisé --
.
(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-16 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-16 92704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"FilterAdministratorToken"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{657AAF3E-E356-4DF5-92FC-1FAAB1E1B53F}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{D1A163E3-1C3A-4891-B4EB-5EA9AA45544C}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{CE78C7B8-FCD2-49FA-A2F9-2CBCFE60DB50}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{DC892D53-CF22-4822-A708-924FB5B45D2A}"= UDP:C:\Users\bobby.PC-de-gobby\AppData\Local\Temp\.ttACE8.tmp:enable
"{0F31C959-65BC-4480-B41B-79C39CC5AC81}"= TCP:C:\Users\bobby.PC-de-gobby\AppData\Local\Temp\.ttACE8.tmp:enable
"{C3D25C3B-E11D-4360-84C0-DCD3CD9CCA78}"= UDP:C:\Windows\System32\sysrest32.exe:enable
"{479ECE61-7679-401D-9CE6-D3B2879EA0BD}"= TCP:C:\Windows\System32\sysrest32.exe:enable

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 51280]
S3 yukonwlh;Pilote miniport NDIS6.0 pour contrôleur Ethernet Marvell Yukon;C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 194048]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\shell\AutoRun\command - E:\wd_windows_tools\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c30ad5e-66ca-11dd-afc5-00301b4522f2}]
\shell\AutoRun\command - E:\wd_windows_tools\setup.exe
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-30 19:38:20
Windows 6.0.6000  NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2008-09-30 19:39:25
ComboFix-quarantined-files.txt  2008-09-30 17:39:22
ComboFix2.txt  2008-09-29 16:47:51
ComboFix3.txt  2008-09-28 18:41:49

Avant-CF: Le texte du message associ‚ au num‚ro 0x2379 est introuvable dans le fichier de messages pour Application.
Après-CF: 35,793,420,288 octets libres

265	--- E O F ---	2008-09-30 17:26:32

vivou · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:44:23, on 30/09/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\System32undll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\conime.exe
C:\Windows\Explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32
otepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O13 - Gopher Prefix: 
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe

sKe69 · Answer

Salut,

Dans l'ordre :

1- Vas dans panneau de config./ pare-feu windows :
Dans l'onglet " exception " , supprimes toute autorisation qui concerneraient ce fichier "sysrest32.exe" ...


2-Télécharges Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable  sur ton Bureau.

-> http://images.malwareremoval.com/random/RSIT.exe

! Déconnecte toi et fermes toutes tes applications en cours !

Double-clique sur " RSIT.exe " pour le lancer .

-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " . 

* Devant l'option "List files/folders created ..." , tu choisis : 3 months 

* cliques ensuite sur " Continue " pour lancer l'analyse ...


( Note : Si la dernière version de HijackThis n'est pas détectée sur ton PC, RSIT le téléchargera et te demandera d'accepter la licence.)


-> laisses faire le scan et ne touche pas au PC ...


Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-note). 

Postes le contenu de " log.txt " (c'est celui qui apparait à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ...

( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit )

vivou · Answer

Logfile of random's system information tool 1.04 (written by random/random)
Run by bobby at 2008-09-30 20:13:06
Microsoft® Windows Vista™ Édition Familiale Premium  
System drive C: has 32 GB (43%) free of 76 GB
Total RAM: 2046 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:13:10, on 30/09/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\System32undll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\conime.exe
C:\Windows\Explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Users\bobby.PC-de-gobby\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\bobby.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O13 - Gopher Prefix: 
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe

vivou · Answer

info.txt logfile of random's system information tool 1.04 2008-09-30 20:13:12

======Uninstall list======

Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
dBpowerAMP Monkeys Audio Codec-->"C:\Windows\system32\SpoonUninstall.exe" <uninstall>C:\Windows\system32\SpoonUninstall-dBpowerAMP Monkeys Audio Codec.dat
dBpowerAMP mp3PRO Input Codec-->"C:\Windows\system32\SpoonUninstall.exe" <uninstall>C:\Windows\system32\SpoonUninstall-dBpowerAMP mp3PRO Input Codec.dat
dBpowerAMP Musepack Codec-->"C:\Windows\system32\SpoonUninstall.exe" <uninstall>C:\Windows\system32\SpoonUninstall-dBpowerAMP Musepack Codec.dat
dBpowerAMP Music Converter-->"C:\Windows\system32\SpoonUninstall.exe" <uninstall>C:\Windows\system32\SpoonUninstall-dBpowerAMP Music Converter.dat
dBpowerAMP Ogg Vorbis Codec-->"C:\Windows\system32\SpoonUninstall.exe" <uninstall>C:\Windows\system32\SpoonUninstall-dBpowerAMP Ogg Vorbis Codec.dat
dBpowerAMP WMA V9 Codec-->"C:\Windows\system32\SpoonUninstall.exe" <uninstall>C:\Windows\system32\SpoonUninstall-dBpowerAMP WMA V9 Codec.dat
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
dMC mp3PRO (CLI) Encoder-->"C:\Windows\system32\SpoonUninstall.exe" <uninstall>C:\Windows\system32\SpoonUninstall-dMC mp3PRO (CLI) Encoder.dat
eMule-->"C:\Program Files\eMule\Uninstall.exe"
FL Studio 7-->C:\Program Files\Image-Line\FL Studio 7\uninstall.exe
Google Earth-->MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
IL Download Manager-->C:\Program Files\Image-Line\Downloader\uninstall.exe
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Mozilla Firefox (3.0.1)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCP60-->"C:\Windows\system32\SpoonUninstall.exe" <uninstall>C:\Windows\system32\SpoonUninstall-MSVCP60.dat
Need for Speed™ ProStreet-->MsiExec.exe /X{2E1A71D5-7897-4F3F-B0E3-B412C86A646D}
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}

======Security center information======

AV: avast! antivirus 4.8.1229 [VPS 080930-0]
AS: Spyware Doctor (disabled)
AS: Windows Defender (disabled)
AS: avast! antivirus 4.8.1229 [VPS 080930-0]

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=0f06
"NUMBER_OF_PROCESSORS"=2
"XPCDrive"=D:\

-----------------EOF-----------------

sKe69 · Answer

bon ... rien de spécial sur ce log ...

Encore des soucis ? ... Si oui, précises ( au max. ) de quoi il s'agit ...


Fait ceci :

Télécharges GenProc  (de Jean-Chretien1 et Narco4) sur ton bureau (et pas ailleur !) :
http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip 

!!Déconnectes toi et fermes tes application en cours !!

Dézippes (=extraire tout) le contenu de ce que tu viens de télécharger sur ton bureau . 

Ouvres le dossier Genproc :
-> cliques droit / " executer entant qu'admin..." sur GenProc.bat et laisses faire...

Une fois terminé, postes le contenu du rapport qui s'ouvre ... 

Aide en images ici : http://www.alt-shift-return.org/Info/GenProc-HowTo.html
 
IMPORTANT : postes le rapport et ne fait rien d'autre pour l'instant ( souvant il faut ajouter des consignes à la manipe indiquée pour que cela fonctionne parfaitement ) .

viivou · Answer

merci pour ton aide et pr la rapidité de tes réponses et surement a bientot!

sKe69 · Answer

Re, 

on as pas finis !!! Si tu n'as plus de soucis , fais ce qui suit dans l'ordre :


1- Télécharges ToolsCleaner (de A.Rothstein) sur ton Bureau. 
http://pc-system.fr/

Déconnectes toi et fermes bien toutes tes applications en cours .

Cliques droit sur le prg et choisis "éxécuter en tant que Administrateur"
 
*Cliques sur Recherche et laisses le scan se terminer (cela peut être long). 
*Cliques sur Suppression pour finaliser. 
(Tu peux, si tu le souhaites, te servir des Options facultatives)
*Cliques sur "quitter" pour générer un rapport ( et pas sur la croix rouge !) :
---> Postes ce rapport : il se trouve à la racine de ton disque dur -> C:\TCleaner.txt . 


Ce petit soft va te nettoyer tout les trucs dont on c'est servi pour la désinfection ( tu n'en as plus besion ! ) . 
Supprimes tout les outils , dossiers ou rapports consernant la désinfection que Toolsclaener2 n'a pas supprimé . 

Puis enfin supprimes Toolscleaner2 ... 


2- Supprimes combofix ainsi :

-->Cliques sur " Démarrer "( ou combine la touche Windows + R ) -> " Executer " -> copie/colles cette ligne : 

ComboFix /u 

( laisses l'espace entre Combofix et /u ) 

-->Valides . 


3- Refais un coup de CCleaner ( registre compris ) .


4- Purge de la restauration système 
--->Désactives ta restauration :
Dans démarrer, cliques droit sur ordinateur/propriétés/protection du système : décoches la case devant ton disk dur maitre ( pour toi -> C )  , valides, appliques et OK 
Redémarres ton PC 
--->Réactives ta restauration :
Cliques droit sur ordinateur/propriétés/protection du système : coches la case devant ton disk dur maitre , valides, appliques et OK 
Redémarres ton PC
( tuto : http://www.commentcamarche.net/faq/sujet 13214 desactiver reactiver la restauration systeme de vista ) 


5- tu peux réactivé l'UAC ....


--> une fois terminé, dis moi ce que cela a donné ... =)

Trojan-gen (other)

32 réponses

Votre réponse

Discussions similaires

Newsletters