msn:virus album photo besoin d'aide svp Fermé

Question

Bonjour,jaurais besoin de quelqun pour maider avec le virus album photo je ses tres bien commen faire marcher les programme jai juste besoin de quelqun pour me dire quoi faire merci davance !!! :D

jlpjlp · Answer

slt
Télécharge MSNFix de Laurent

http://sosvirus.changelog.fr/MSNFix.zip

Décompresse-le et double clic sur le fichier MSNFix.bat.
- Exécute l'option R.
--Si l'infection est détectée, exécute l'option N
- Sauvegarde ce rapport puis fais un copier/coller de ce rapport sur le forum.

Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal
Sauvegarder et fermer le rapport pour que Windows termine de se lancer normalement.

gemlees · Answer

ok le scan est en cours merci enfin quelqun qui maide :D

gemlees · Answer

il on pas trouver l'erreur quesque je fai 

MSNFix 1.639-2  
 
D:\Documents and Settings\GUNSHOTS\Bureau\MSNFix 
Fix exécuté le 2008-11-05 - 12:30:31,20 By GUNSHOTS 
mode normal    
    
************************ Recherche les fichiers présents      
    
Aucun Fichier trouvé 
 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
************************ Fichiers suspects 
 
Aucun Fichier trouvé 
 
  
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   --------------------------------------------- 
 
ceci est le rapport

jlpjlp · Answer

Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

gemlees · Answer

numero 1:
Logfile of random's system information tool 1.04 (written by random/random)
Run by GUNSHOTS at 2008-11-05 12:47:56
Microsoft Windows XP Professionnel Service Pack 3
System drive D: has 96 GB (83%) free of 116 GB
Total RAM: 447 MB (15% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:48:14, on 2008-11-05
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
D:\WINDOWS.0\System32\smss.exe
D:\WINDOWS.0\system32\winlogon.exe
D:\WINDOWS.0\system32\services.exe
D:\WINDOWS.0\system32\lsass.exe
D:\WINDOWS.0\system32\svchost.exe
D:\WINDOWS.0\System32\svchost.exe
D:\Program Files\Bell\Gestionnaire de securite\Fws.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
D:\WINDOWS.0\system32\spoolsv.exe
D:\WINDOWS.0\Explorer.EXE
D:\WINDOWS.0\system32\RUNDLL32.EXE
D:\WINDOWS.0\ehome\ehtray.exe
D:\Program Files\Bell\Sympatico Security Advisor\SSA.exe
D:\WINDOWS.0\system32\suvas.exe
D:\WINDOWS.0\system32\ctfmon.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINDOWS.0\eHome\ehRecvr.exe
D:\WINDOWS.0\eHome\ehSched.exe
D:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
D:\Program Files\Microsoft LifeCam\MSCamS32.exe
D:\WINDOWS.0\system32
vsvc32.exe
D:\Program Files\Raxco\PerfectDisk\PDAgent.exe
D:\WINDOWS.0\system32\PnkBstrA.exe
D:\WINDOWS.0\system32\svchost.exe
D:\Program Files\Personal Vault\VaultClientUpgrade.exe
D:\Program Files\TechSmith\SnagIt 9\TSCHelp.exe
D:\WINDOWS.0\eHome\ehmsas.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
D:\Program Files\Bell\Gestionnaire de securitepsupdaterR.exe
D:\WINDOWS.0\system32\dllhost.exe
D:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
D:\Program Files\iTunes\iTunes.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS.0\system32\wuauclt.exe
D:\Documents and Settings\GUNSHOTS\Bureau\RSIT.exe
D:\Program Files	rend micro\GUNSHOTS.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emoticone-gratuit.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PopKill Class - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - D:\Program Files\Bell\Gestionnaire de securite\pkR.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS.0\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS.0\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ehTray] D:\WINDOWS.0\ehome\ehtray.exe
O4 - HKLM\..\Run: [SSA.exe] "D:\Program Files\Bell\Sympatico Security Advisor\SSA.exe" /AUTORUN
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "D:\Program Files\Bell\Gestionnaire de securite\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [VX3000] D:\WINDOWS.0\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "D:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Gestionnaire de sécurité Sympatico] D:\Program Files\Bell\Gestionnaire de securite\RPS.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [cygevu] D:\WINDOWS.0\system32\suvas.exe
O4 - HKLM\..\RunServices: [cygevu] D:\WINDOWS.0\system32\suvas.exe
O4 - HKLM\..\RunOnce: [IndexCleaner] "D:\Program Files\Bell\Gestionnaire de securite\IdxClnR.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunOnce: [IndexCleaner] "D:\Program Files\Bell\Gestionnaire de securite\IdxClnR.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS.0\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS.0\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: SnagIt 9.lnk = D:\Program Files\TechSmith\SnagIt 9\SnagIt32.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - D:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - D:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS.0\system32
vsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS.0\system32\PnkBstrA.exe
O23 - Service: Gestionnaire de sécurité Sympatico (Radialpoint Security Services) - Radialpoint Inc. - D:\Program Files\Bell\Gestionnaire de securite\RpsSecurityAware.exe
O23 - Service: Service de mise-à-jour pour le Gestionnaire de sécurité Sympatico (RPSUpdaterR) - Radialpoint Inc. - D:\Program Files\Bell\Gestionnaire de securitepsupdaterR.exe
O23 - Service: Gestionnaire de sécurité Sympatico Coupe-feu (RP_FWS) - Bell Sympatico - D:\Program Files\Bell\Gestionnaire de securite\Fws.exe
O23 - Service: Personal Vault Upgrade Service (VaultClientUpgrade) - BELL - D:\Program Files\Personal Vault\VaultClientUpgrade.exe
O23 - Service: BCL easyPDF SDK Loader (xuluyapyuxe) - Unknown owner - D:\WINDOWS.0\system32\foku.exe

gemlees · Answer

Logfile of HijackThis v1.99.1
Scan saved at 12:51:46, on 2008-11-05
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Running processes:
D:\WINDOWS.0\System32\smss.exe
D:\WINDOWS.0\system32\winlogon.exe
D:\WINDOWS.0\system32\services.exe
D:\WINDOWS.0\system32\lsass.exe
D:\WINDOWS.0\system32\svchost.exe
D:\WINDOWS.0\System32\svchost.exe
D:\Program Files\Bell\Gestionnaire de securite\Fws.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
D:\WINDOWS.0\system32\spoolsv.exe
D:\WINDOWS.0\Explorer.EXE
D:\WINDOWS.0\system32\RUNDLL32.EXE
D:\WINDOWS.0\ehome\ehtray.exe
D:\Program Files\Bell\Sympatico Security Advisor\SSA.exe
D:\WINDOWS.0\system32\suvas.exe
D:\WINDOWS.0\system32\ctfmon.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINDOWS.0\eHome\ehRecvr.exe
D:\WINDOWS.0\eHome\ehSched.exe
D:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
D:\Program Files\Microsoft LifeCam\MSCamS32.exe
D:\WINDOWS.0\system32
vsvc32.exe
D:\Program Files\Raxco\PerfectDisk\PDAgent.exe
D:\WINDOWS.0\system32\PnkBstrA.exe
D:\WINDOWS.0\system32\svchost.exe
D:\Program Files\Personal Vault\VaultClientUpgrade.exe
D:\Program Files\TechSmith\SnagIt 9\TSCHelp.exe
D:\WINDOWS.0\eHome\ehmsas.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
D:\Program Files\Bell\Gestionnaire de securitepsupdaterR.exe
D:\WINDOWS.0\system32\dllhost.exe
D:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
D:\Program Files\iTunes\iTunes.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS.0\system32\NOTEPAD.EXE
D:\WINDOWS.0\system32\NOTEPAD.EXE
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emoticone-gratuit.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PopKill Class - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - D:\Program Files\Bell\Gestionnaire de securite\pkR.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS.0\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS.0\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ehTray] D:\WINDOWS.0\ehome\ehtray.exe
O4 - HKLM\..\Run: [SSA.exe] "D:\Program Files\Bell\Sympatico Security Advisor\SSA.exe" /AUTORUN
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "D:\Program Files\Bell\Gestionnaire de securite\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [VX3000] D:\WINDOWS.0\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "D:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Gestionnaire de sécurité Sympatico] D:\Program Files\Bell\Gestionnaire de securite\RPS.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [cygevu] D:\WINDOWS.0\system32\suvas.exe
O4 - HKLM\..\RunServices: [cygevu] D:\WINDOWS.0\system32\suvas.exe
O4 - HKLM\..\RunOnce: [IndexCleaner] "D:\Program Files\Bell\Gestionnaire de securite\IdxClnR.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunOnce: [IndexCleaner] "D:\Program Files\Bell\Gestionnaire de securite\IdxClnR.exe"
O4 - Global Startup: SnagIt 9.lnk = D:\Program Files\TechSmith\SnagIt 9\SnagIt32.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS.0\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - D:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - D:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS.0\system32
vsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS.0\system32\PnkBstrA.exe
O23 - Service: Gestionnaire de sécurité Sympatico (Radialpoint Security Services) - Radialpoint Inc. - D:\Program Files\Bell\Gestionnaire de securite\RpsSecurityAware.exe
O23 - Service: Service de mise-à-jour pour le Gestionnaire de sécurité Sympatico (RPSUpdaterR) - Radialpoint Inc. - D:\Program Files\Bell\Gestionnaire de securitepsupdaterR.exe
O23 - Service: Gestionnaire de sécurité Sympatico Coupe-feu (RP_FWS) - Bell Sympatico - D:\Program Files\Bell\Gestionnaire de securite\Fws.exe
O23 - Service: Personal Vault Upgrade Service (VaultClientUpgrade) - BELL - D:\Program Files\Personal Vault\VaultClientUpgrade.exe
O23 - Service: BCL easyPDF SDK Loader (xuluyapyuxe) - Unknown owner - D:\WINDOWS.0\system32\foku.exe

gemlees · Answer

yen a du text omg :O si jfai dkoi de mal dit le moi jvais arranger sa :O jespere jte donne pas trop de bouleau :S

jlpjlp · Answer

internet explorer 7 est sorti , tu en es au 6 ..., java est a la version 1.6.07... AD AWARE a la version 2008 ...





__________________

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
____________________


fait un scan en ligne avec un des suivants: et colle le rapport)


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

kaspersky en ligne :
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

gemlees · Answer

ComboFix 08-11-04.02 - GUNSHOTS 2008-11-05 13:18:16.3 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.56 [GMT -5:00] Lancé depuis: d:\documents and settings\GUNSHOTS\Bureau\ComboFix.exe * Un nouveau point de restauration a été créé * Resident AV is active . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . d:\program files\INSTALL.LOG . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-05 au 2008-11-05 )))))))))))))))))))))))))))))))))))) . 2008-11-05 12:48 . 2008-11-05 12:48 d-------- d:\program files\trend micro 2008-11-05 12:47 . 2008-11-05 12:48 d-------- D:\rsit 2008-11-03 05:15 . 2008-11-03 05:16 d-------- d:\program files\mIRC 2008-11-03 05:15 . 2008-11-03 05:19 d-------- d:\documents and settings\GUNSHOTS\Application Data\mIRC 2008-10-23 15:00 . 2008-10-15 11:35 337,408 -----c--- d:\windows.0\system32\dllcache\netapi32.dll 2008-10-20 14:43 . 2008-10-20 14:43 d-------- d:\program files\StepMania 2008-10-16 00:20 . 2008-07-13 13:58 135,680 --a------ d:\windows.0\system32\suvas.exe 2008-10-16 00:20 . 2008-07-13 13:58 135,680 --a------ d:\windows.0\system32\foku.exe 2008-10-15 02:03 . 2008-10-15 02:03 118 --a------ d:\windows.0\system32\MRT.INI 2008-10-14 14:20 . 2008-08-14 08:23 2,191,232 -----c--- d:\windows.0\system32\dllcache\ntoskrnl.exe 2008-10-14 14:20 . 2008-08-14 08:23 2,147,328 -----c--- d:\windows.0\system32\dllcache\ntkrnlmp.exe 2008-10-14 14:20 . 2008-08-14 08:23 2,068,096 -----c--- d:\windows.0\system32\dllcache\ntkrnlpa.exe 2008-10-14 14:20 . 2008-08-14 08:23 2,025,984 -----c--- d:\windows.0\system32\dllcache\ntkrpamp.exe 2008-10-14 14:20 . 2008-09-15 10:26 1,846,528 -----c--- d:\windows.0\system32\dllcache\win32k.sys 2008-10-14 14:20 . 2008-09-08 05:41 333,824 -----c--- d:\windows.0\system32\dllcache\srv.sys 2008-10-09 16:45 . 2008-10-09 16:45 d-------- d:\program files\Raxco . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-05 17:32 30 ----a-w d:\documents and settings\GUNSHOTS\jagex_runescape_preferences.dat 2008-11-05 10:38 138,280 ----a-w d:\windows.0\system32\drivers\PnkBstrK.sys 2008-11-05 10:38 111,928 ----a-w d:\windows.0\system32\PnkBstrB.exe 2008-11-03 15:43 --------- d-----w d:\documents and settings\GUNSHOTS\Application Data\LimeWire 2008-11-01 23:11 --------- d-----w d:\program files\SwiftKit 2008-10-11 21:13 --------- d-----w d:\documents and settings\All Users.WINDOWS.0\Application Data\Messenger Plus! 2008-10-09 21:43 53,192 ----a-w d:\windows.0\system32\drivers\rp_skt32.sys 2008-09-30 10:22 --------- d-----w d:\program files\Lavasoft 2008-09-30 10:22 --------- d-----w d:\program files\Fichiers communs\Wise Installation Wizard 2008-09-30 10:22 --------- d-----w d:\documents and settings\All Users.WINDOWS.0\Application Data\Lavasoft 2008-09-22 02:03 --------- d-----w d:\program files\Messenger Plus! Live 2008-09-21 23:35 --------- d-----w d:\documents and settings\All Users.WINDOWS.0\Application Data\WLInstaller 2008-09-20 05:20 --------- d-----w d:\documents and settings\GUNSHOTS\Application Data\MSNInstaller 2008-09-20 04:40 --------- d-----w d:\program files\Windows Live 2008-09-20 04:39 --------- d-----w d:\program files\Windows Live Toolbar 2008-09-17 16:30 --------- d-----w d:\program files\BSR Screen Recorder 4 2008-09-17 16:29 585,728 ----a-w d:\windows.0\system32\bsratswf.dll 2008-09-17 16:29 147,456 ----a-w d:\windows.0\system32\bsratwmv.dll 2008-09-15 15:26 1,846,528 ----a-w d:\windows.0\system32\win32k.sys 2008-09-08 10:41 333,824 ----a-w d:\windows.0\system32\drivers\srv.sys 2008-09-08 09:52 --------- d-----w d:\program files\DJ Music Mixer 2008-09-08 09:09 275,412 ----a-w d:\windows.0\DJ Music Mixer Uninstaller.exe 2008-09-08 09:05 --------- d-----w d:\program files\GamingSquared 2008-09-08 09:03 --------- d-----w d:\program files\Yahoo! 2008-09-08 09:02 --------- d-----w d:\program files\Mixxx 2008-09-08 09:01 --------- d-----w d:\program files\Google 2008-09-08 05:35 --------- d-----w d:\documents and settings\GUNSHOTS\Application Data\skypePM 2008-09-07 07:05 --------- d-----w d:\program files\New Folder 1 2008-09-07 06:51 --------- d-----w d:\program files\Free Offers from Freeze.com 2008-09-07 06:30 --------- d-----w d:\program files\HyCam2 2008-09-05 05:40 --------- d-----w d:\program files\TechSmith 2008-09-05 05:40 --------- d-----w d:\documents and settings\All Users.WINDOWS.0\Application Data\TechSmith 2008-09-02 14:05 73,216 ----a-w d:\windows.0\ST6UNST.EXE 2008-08-20 05:10 670,208 ----a-w d:\windows.0\system32\wininet.dll 2008-08-14 13:23 2,147,328 ----a-w d:\windows.0\system32\ntoskrnl.exe 2008-08-14 13:23 2,025,984 ----a-w d:\windows.0\system32\ntkrnlpa.exe 2008-08-11 02:39 66,872 ----a-w d:\windows.0\system32\PnkBstrA.exe 2008-08-10 17:58 155,995 ----a-w d:\windows.0\java\Packages\ZVJTBV9V.ZIP 2008-08-09 13:24 59,728 ----a-w D:\msimg32.dll . ((((((((((((((((((((((((((((( snapshot_2008-09-20_23.46.17.87 ))))))))))))))))))))))))))))))))))))))))) . + 2008-05-07 09:07:23 135,168 ----a-w d:\windows.0\$hf_mig$\KB951978\SP3QFE\cscript.exe + 2008-05-09 10:51:45 512,000 ----a-w d:\windows.0\$hf_mig$\KB951978\SP3QFE\jscript.dll + 2008-05-09 10:51:45 180,224 ----a-w d:\windows.0\$hf_mig$\KB951978\SP3QFE\scrobj.dll + 2008-05-09 10:51:45 172,032 ----a-w d:\windows.0\$hf_mig$\KB951978\SP3QFE\scrrun.dll + 2008-05-09 10:51:45 430,080 ----a-w d:\windows.0\$hf_mig$\KB951978\SP3QFE\vbscript.dll + 2008-05-08 11:24:44 155,648 ----a-w d:\windows.0\$hf_mig$\KB951978\SP3QFE\wscript.exe + 2008-05-09 10:51:45 90,112 ----a-w d:\windows.0\$hf_mig$\KB951978\SP3QFE\wshext.dll + 2007-11-30 12:39:29 18,296 ----a-w d:\windows.0\$hf_mig$\KB951978\spmsg.dll + 2007-11-30 12:39:29 234,872 ----a-w d:\windows.0\$hf_mig$\KB951978\spuninst.exe + 2007-11-30 12:39:29 26,488 ----a-w d:\windows.0\$hf_mig$\KB951978\update\spcustom.dll + 2007-11-30 12:39:26 767,352 ----a-w d:\windows.0\$hf_mig$\KB951978\update\update.exe + 2007-11-30 12:39:29 406,392 ----a-w d:\windows.0\$hf_mig$\KB951978\update\updspapi.dll + 2008-08-20 05:07:31 3,088,896 ----a-w d:\windows.0\$hf_mig$\KB956390\SP3QFE\mshtml.dll + 2008-08-20 05:07:27 1,499,648 ----a-w d:\windows.0\$hf_mig$\KB956390\SP3QFE\shdocvw.dll + 2008-08-20 05:07:28 621,056 ----a-w d:\windows.0\$hf_mig$\KB956390\SP3QFE\urlmon.dll + 2008-08-20 05:07:28 670,720 ----a-w d:\windows.0\$hf_mig$\KB956390\SP3QFE\wininet.dll + 2007-11-30 11:19:06 18,296 ----a-w d:\windows.0\$hf_mig$\KB956390\spmsg.dll + 2007-11-30 11:19:06 234,872 ----a-w d:\windows.0\$hf_mig$\KB956390\spuninst.exe + 2007-11-30 11:19:06 26,488 ----a-w d:\windows.0\$hf_mig$\KB956390\update\spcustom.dll + 2007-11-30 12:39:29 767,352 ----a-w d:\windows.0\$hf_mig$\KB956390\update\update.exe + 2007-11-30 12:39:31 406,392 ----a-w d:\windows.0\$hf_mig$\KB956390\update\updspapi.dll + 2008-04-14 02:33:59 139,264 -c----w d:\windows.0\$NtUninstallKB951978$\cscript.exe + 2008-04-14 02:33:27 512,000 -c----w d:\windows.0\$NtUninstallKB951978$\jscript.dll + 2008-04-14 02:33:40 180,224 -c----w d:\windows.0\$NtUninstallKB951978$\scrobj.dll + 2008-04-14 02:33:40 172,032 -c----w d:\windows.0\$NtUninstallKB951978$\scrrun.dll + 2007-11-30 12:39:29 234,872 -c----w d:\windows.0\$NtUninstallKB951978$\spuninst\spuninst.exe + 2007-11-30 12:39:29 406,392 -c----w d:\windows.0\$NtUninstallKB951978$\spuninst\updspapi.dll + 2008-04-14 02:33:48 434,176 -c----w d:\windows.0\$NtUninstallKB951978$\vbscript.dll + 2008-04-14 02:34:29 155,648 -c----w d:\windows.0\$NtUninstallKB951978$\wscript.exe + 2008-04-14 02:33:50 90,112 -c----w d:\windows.0\$NtUninstallKB951978$\wshext.dll - 2008-08-10 19:03:24 68,608 ----a-w d:\windows.0\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll + 2008-09-22 07:01:31 68,608 ----a-w d:\windows.0\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll - 2008-08-10 19:03:36 72,192 ----a-w d:\windows.0\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll + 2008-09-22 07:01:36 72,192 ----a-w d:\windows.0\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll - 2008-08-10 19:03:37 4,308,992 ----a-w d:\windows.0\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll + 2008-09-22 07:01:36 4,308,992 ----a-w d:\windows.0\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll - 2008-08-10 19:03:37 482,304 ----a-w d:\windows.0\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll + 2008-09-22 07:01:37 482,304 ----a-w d:\windows.0\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll - 2008-08-10 19:03:32 2,878,976 ----a-w d:\windows.0\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll + 2008-09-22 07:01:35 2,902,016 ----a-w d:\windows.0\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll - 2008-08-10 19:03:21 258,048 ----a-w d:\windows.0\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll + 2008-09-22 07:01:28 258,048 ----a-w d:\windows.0\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll - 2008-08-10 19:03:21 114,176 ----a-w d:\windows.0\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll + 2008-09-22 07:01:28 114,176 ----a-w d:\windows.0\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll - 2008-08-10 19:03:40 260,096 ----a-w d:\windows.0\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll + 2008-09-22 07:01:39 260,096 ----a-w d:\windows.0\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll - 2008-08-10 19:03:28 5,025,792 ----a-w d:\windows.0\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll + 2008-09-22 07:01:32 5,156,864 ----a-w d:\windows.0\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll - 2008-08-10 19:03:23 10,752 ----a-w d:\windows.0\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll + 2008-09-22 07:01:31 10,752 ----a-w d:\windows.0\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll - 2008-08-10 19:03:20 503,808 ----a-w d:\windows.0\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll + 2008-09-22 07:01:28 507,904 ----a-w d:\windows.0\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll - 2008-08-10 19:03:21 13,312 ----a-w d:\windows.0\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll + 2008-09-22 07:01:29 13,312 ----a-w d:\windows.0\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll - 2008-08-10 19:03:35 8,192 ----a-w d:\windows.0\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll + 2008-09-22 07:01:35 8,192 ----a-w d:\windows.0\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll - 2008-08-10 19:03:35 36,864 ----a-w d:\windows.0\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll + 2008-09-22 07:01:35 36,864 ----a-w d:\windows.0\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll - 2008-08-10 19:03:36 5,632 ----a-w d:\windows.0\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll + 2008-09-22 07:01:36 5,632 ----a-w d:\windows.0\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll - 2008-08-10 19:03:22 413,696 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll + 2008-09-22 07:01:30 413,696 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll - 2008-08-10 19:03:22 36,864 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll + 2008-09-22 07:01:30 36,864 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll - 2008-08-10 19:03:22 647,168 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll + 2008-09-22 07:01:30 647,168 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll - 2008-08-10 19:03:23 73,728 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll + 2008-09-22 07:01:30 73,728 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll - 2008-08-10 19:03:22 745,472 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll + 2008-09-22 07:01:29 749,568 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll - 2008-08-10 19:03:41 110,592 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll + 2008-09-22 07:01:40 110,592 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll - 2008-08-10 19:03:41 372,736 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll + 2008-09-22 07:01:40 372,736 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll - 2008-08-10 19:03:18 28,672 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll + 2008-09-22 07:01:27 28,672 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll - 2008-08-10 19:03:41 667,648 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll + 2008-09-22 07:01:39 667,648 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll - 2008-08-10 19:03:41 5,632 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll + 2008-09-22 07:01:40 5,632 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll - 2008-08-10 19:03:20 12,800 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll + 2008-09-22 07:01:28 12,800 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll - 2008-08-10 19:03:20 32,768 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll + 2008-09-22 07:01:27 32,768 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll - 2008-08-10 19:03:20 7,168 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll + 2008-09-22 07:01:28 7,168 ----a-w d:\windows.0\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll - 2008-08-10 19:03:39 110,592 ----a-w d:\windows.0\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll + 2008-09-22 07:01:38 110,592 ----a-w d:\windows.0\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll - 2008-08-10 19:03:25 81,920 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll + 2008-09-22 07:01:31 81,920 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll - 2008-08-10 19:03:39 389,120 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll + 2008-09-22 07:01:38 413,696 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll - 2008-08-10 19:03:37 716,800 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll + 2008-09-22 07:01:37 716,800 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll - 2008-08-10 19:03:21 884,736 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll + 2008-09-22 07:01:29 888,832 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll - 2008-08-10 19:03:34 5,050,368 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll + 2008-09-22 07:01:35 5,001,216 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll - 2008-08-10 19:03:26 188,416 ----a-w d:\windows.0\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll + 2008-09-22 07:01:32 188,416 ----a-w d:\windows.0\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll - 2008-08-10 19:03:26 397,312 ----a-w d:\windows.0\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll + 2008-09-22 07:01:31 397,312 ----a-w d:\windows.0\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll - 2008-08-10 19:03:27 81,920 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll + 2008-09-22 07:01:32 81,920 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll - 2008-08-10 19:03:40 700,416 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll + 2008-09-22 07:01:38 577,536 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll - 2008-08-10 19:03:38 368,640 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll + 2008-09-22 07:01:37 372,736 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll - 2008-08-10 19:03:40 258,048 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll + 2008-09-22 07:01:39 258,048 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll - 2008-08-10 19:03:38 299,008 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll + 2008-09-22 07:01:37 299,008 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll - 2008-08-10 19:03:38 131,072 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll + 2008-09-22 07:01:38 131,072 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll - 2008-08-10 19:03:24 258,048 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll + 2008-09-22 07:01:31 258,048 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll - 2008-08-10 19:03:27 114,688 ----a-w d:\windows.0\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll + 2008-09-22 07:01:32 114,688 ----a-w d:\windows.0\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll - 2008-08-10 19:03:41 835,584 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll + 2008-09-22 07:01:39 835,584 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll - 2008-08-10 19:03:29 86,016 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll + 2008-09-22 07:01:33 86,016 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll - 2008-08-10 19:03:30 823,296 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll + 2008-09-22 07:01:33 823,296 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll - 2008-08-10 19:03:31 5,316,608 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll + 2008-09-22 07:01:33 5,152,768 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll - 2008-08-10 19:03:32 2,035,712 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll + 2008-09-22 07:01:34 2,027,520 ----a-w d:\windows.0\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll - 2008-08-10 19:03:39 3,018,752 ----a-w d:\windows.0\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll + 2008-09-22 07:01:38 2,940,928 ----a-w d:\windows.0\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll + 2008-09-22 07:05:25 26,624 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\Accessibility\[u]0/u34a44742647d86bbaa1c8f15b7cb528\Accessibility.ni.dll + 2008-09-22 07:05:26 888,832 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\bb304cec0361eca66b0fa89d1a59e969\AspNetMMCExt.ni.dll + 2008-09-22 07:05:26 237,568 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\a6eea31abed00f52cc062c424092dafd\CustomMarshalers.ni.dll + 2008-09-22 07:05:46 15,360 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\dfsvc\1dd3efadaa530f2449dc13c568ea5164\dfsvc.ni.exe + 2008-09-22 07:05:47 880,640 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\6930d162678847a01f47fed348873e15\Microsoft.Build.Engine.ni.dll + 2008-09-22 07:05:48 81,920 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\a2f7cb74d513ff512c4bec4c300aaa15\Microsoft.Build.Framework.ni.dll + 2008-09-22 07:05:49 1,687,552 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\917a297b2ea5a0f5fbd388a4259c26ba\Microsoft.Build.Tasks.ni.dll + 2008-09-22 07:05:50 163,840 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\c9adde7899f180b78f199267c84fa3a0\Microsoft.Build.Utilities.ni.dll + 2008-09-22 07:05:52 1,720,320 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\[u]0/u44886a99768c9ee6dfae01b295354c9\Microsoft.VisualBasic.ni.dll + 2008-09-22 07:02:57 11,304,960 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\mscorlib\1fb9d8194c139bc9c29600e687c112b6\mscorlib.ni.dll + 2008-09-22 07:05:53 1,003,520 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Configuration\c4ec8ced34ef9ab8954cff5bf5d0fc05\System.Configuration.ni.dll + 2008-09-22 07:03:14 6,676,480 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Data\ab5532e25121f69c1df505c56ed62fab\System.Data.ni.dll + 2008-09-22 07:05:54 1,724,416 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Deployment\600ab411d9ec3bc2df23b85bf663d9f9\System.Deployment.ni.dll + 2008-09-22 07:03:24 10,702,848 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Design\51b0a2ce84b66381e636f67a29179050\System.Design.ni.dll + 2008-09-22 07:05:56 512,000 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\[u]0/ufa46f97e5901f66384d24c91953fca1\System.DirectoryServices.Protocols.ni.dll + 2008-09-22 07:05:55 1,216,512 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\bcb19767b1dd92ea6ead4713747a3f9d\System.DirectoryServices.ni.dll + 2008-09-22 07:03:27 229,376 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\df7ec312ebe9d15ba00294c1e1b3a5c6\System.Drawing.Design.ni.dll + 2008-09-22 07:03:27 1,601,536 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Drawing\171abffae7d81afa0a1f913aa092d753\System.Drawing.ni.dll + 2008-09-22 07:05:57 659,456 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\[u]0/ucb936db5338057a6eefd08d17cf1749\System.EnterpriseServices.ni.dll + 2008-09-22 07:05:57 294,912 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\[u]0/ucb936db5338057a6eefd08d17cf1749\System.EnterpriseServices.Wrapper.dll + 2008-09-22 07:05:58 729,088 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Security\531fdb92069c959eb4c7f6fc87a2c943\System.Security.ni.dll + 2008-09-22 07:05:59 684,032 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Transactions\1f04130d373d41e907397eb57ba046bb\System.Transactions.ni.dll + 2008-09-22 07:06:16 2,306,048 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\830d818643869a46b45df035b39913c0\System.Web.Mobile.ni.dll + 2008-09-22 07:06:17 237,568 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\[u]0/u83e36946f184bd0578406e00584e953\System.Web.RegularExpressions.ni.dll + 2008-09-22 07:06:19 1,941,504 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Web.Services\2861d1fbebc0438e1a199f430e2dec4c\System.Web.Services.ni.dll + 2008-09-22 07:06:13 12,185,600 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Web\d1df715e50f008d994d12ef39606a565\System.Web.ni.dll + 2008-09-22 07:03:40 13,107,200 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\c137809123042cafa5275b677638c165\System.Windows.Forms.ni.dll + 2008-09-22 07:03:47 5,623,808 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System.Xml\8fbebde964c57f779f777a2c19c75919\System.Xml.ni.dll + 2008-09-22 07:03:06 8,130,560 ----a-w d:\windows.0\assembly\NativeImages_v2.0.50727_32\System\30bad1d3e889c7b60f85b092688c76de\System.ni.dll + 2007-09-28 08:41:28 381,960 ----a-w d:\windows.0\Downloaded Program Files\GAME_UNO1.dll + 2007-02-23 03:41:12 304,544 ----a-w d:\windows.0\Downloaded Program Files\MessengerStatsPAClient.dll + 2007-02-28 18:21:04 130,472 ----a-w d:\windows.0\Downloaded Program Files\MineSweeper.dll + 2006-06-20 19:44:04 379,704 ----a-w d:\windows.0\Downloaded Program Files\MsnPUpld.dll + 2006-06-20 19:44:02 117,560 ----a-w d:\windows.0\Downloaded Program Files\PURen-us.dll + 2007-01-09 12:30:14 110,592 ----a-w d:\windows.0\Downloaded Program Files\PURfr-ca.dll + 2008-08-14 13:23:44 2,147,328 ------w d:\windows.0\Driver Cache\i386\ntkrnlmp.exe + 2008-08-14 13:23:49 2,068,096 ------w d:\windows.0\Driver Cache\i386\ntkrnlpa.exe + 2008-08-14 13:23:44 2,025,984 ------w d:\windows.0\Driver Cache\i386\ntkrpamp.exe + 2008-08-14 13:23:49 2,191,232 ------w d:\windows.0\Driver Cache\i386\ntoskrnl.exe - 2005-10-21 00:02:28 163,328 ----a-w d:\windows.0\erdnt\Hiv-backup\ERDNT.EXE + 2005-10-21 01:02:28 163,328 ----a-w d:\windows.0\erdnt\Hiv-backup\ERDNT.EXE - 2008-08-10 18:08:30 26,582 ----a-r d:\windows.0\Installer\{212F5777-1190-4DEF-8E4D-6B2F313B45E7}\PerfectDisk.exe + 2008-10-09 21:45:29 26,582 ----a-r d:\windows.0\Installer\{212F5777-1190-4DEF-8E4D-6B2F313B45E7}\PerfectDisk.exe - 2000-08-31 12:00:00 28,672 ----a-w d:\windows.0\Nircmd.exe + 2000-08-31 13:00:00 28,672 ----a-w d:\windows.0\Nircmd.exe - 2000-08-31 12:00:00 161,792 ----a-w d:\windows.0\swreg.exe + 2000-08-31 13:00:00 161,792 ----a-w d:\windows.0\swreg.exe - 2008-04-14 02:33:59 139,264 ----a-w d:\windows.0\system32\cscript.exe + 2008-05-07 09:07:23 135,168 ----a-w d:\windows.0\system32\cscript.exe - 2008-06-20 11:40:08 138,496 -c----w d:\windows.0\system32\dllcache\afd.sys + 2008-08-14 10:04:36 138,496 -c----w d:\windows.0\system32\dllcache\afd.sys + 2008-05-07 09:07:23 135,168 -c----w d:\windows.0\system32\dllcache\cscript.exe + 2008-05-09 10:55:00 512,000 -c----w d:\windows.0\system32\dllcache\jscript.dll - 2008-06-23 15:10:27 3,088,384 -c----w d:\windows.0\system32\dllcache\mshtml.dll + 2008-08-20 05:10:12 3,088,896 -c----w d:\windows.0\system32\dllcache\mshtml.dll + 2008-05-09 10:55:00 180,224 -c----w d:\windows.0\system32\dllcache\scrobj.dll + 2008-05-09 10:55:00 172,032 -c----w d:\windows.0\system32\dllcache\scrrun.dll - 2008-06-26 08:13:32 1,499,648 -c----w d:\windows.0\system32\dllcache\shdocvw.dll + 2008-08-20 05:10:11 1,499,648 -c----w d:\windows.0\system32\dllcache\shdocvw.dll - 2008-06-26 08:13:32 620,544 -c----w d:\windows.0\system32\dllcache\urlmon.dll + 2008-08-20 05:10:11 620,544 -c----w d:\windows.0\system32\dllcache\urlmon.dll + 2008-05-09 10:55:00 430,080 -c----w d:\windows.0\system32\dllcache\vbscript.dll - 2008-06-23 15:10:27 670,208 -c----w d:\windows.0\system32\dllcache\wininet.dll + 2008-08-20 05:10:11 670,208 -c----w d:\windows.0\system32\dllcache\wininet.dll + 2008-05-08 11:24:44 155,648 -c----w d:\windows.0\system32\dllcache\wscript.exe + 2008-05-09 10:55:00 90,112 -c----w d:\windows.0\system32\dllcache\wshext.dll - 2008-06-20 11:40:08 138,496 ----a-w d:\windows.0\system32\drivers\afd.sys + 2008-08-14 10:04:36 138,496 ----a-w d:\windows.0\system32\drivers\afd.sys + 2007-07-11 17:37:26 6,272 ----a-w d:\windows.0\system32\drivers\AWRTPD.sys + 2007-08-07 16:58:08 8,320 ----a-w d:\windows.0\system32\drivers\AWRTRD.sys - 2007-07-09 16:01:04 834,448 ----a-w d:\windows.0\system32\drivers\Css-Dvp.sys + 2007-11-26 20:33:52 835,792 ----a-w d:\windows.0\system32\drivers\Css-Dvp.sys - 2007-03-02 14:26:18 67,352 ----a-w d:\windows.0\system32\drivers\DefragFs.sys + 2008-04-25 10:38:22 71,184 ----a-w d:\windows.0\system32\drivers\DefragFs.sys + 2007-08-07 16:56:58 9,344 ----a-w d:\windows.0\system32\drivers\NSDriver.sys - 2008-09-20 20:26:43 93,480 ----a-w d:\windows.0\system32\FNTCACHE.DAT + 2008-10-15 07:10:17 93,480 ----a-w d:\windows.0\system32\FNTCACHE.DAT - 2008-04-14 02:33:27 512,000 ----a-w d:\windows.0\system32\jscript.dll + 2008-05-09 10:55:00 512,000 ----a-w d:\windows.0\system32\jscript.dll + 2004-05-14 20:53:08 57,344 ----a-w d:\windows.0\system32\lfbmp13n.dll + 2004-05-14 20:53:08 401,408 ----a-w d:\windows.0\system32\lfcmp13n.dll + 2003-11-04 19:10:40 69,632 ----a-w d:\windows.0\system32\lfgif13n.dll + 2003-11-04 19:11:04 159,744 ----a-w d:\windows.0\system32\lfpng13n.dll + 2007-04-13 18:19:52 7,680 ----a-w d:\windows.0\system32\lsdelete.exe + 2004-05-14 20:53:10 299,008 ----a-w d:\windows.0\system32\ltdis13n.dll + 2004-01-12 06:09:42 206,336 ----a-w d:\windows.0\system32\ltefx13n.dll + 2004-05-14 20:53:10 163,840 ----a-w d:\windows.0\system32\ltfil13n.dll + 2004-05-14 20:53:12 450,560 ----a-w d:\windows.0\system32\ltimg13n.dll + 2004-05-14 20:53:12 462,848 ----a-w d:\windows.0\system32\ltkrn13n.dll + 2008-10-05 03:24:02 3,695,008 ----a-w d:\windows.0\system32\Macromed\Flash\NPSWF32.dll + 2008-10-05 03:24:04 235,936 ----a-w d:\windows.0\system32\Macromed\Flash\NPSWF32_FlashUtil.exe + 2008-10-23 20:04:44 84,661 ----a-w d:\windows.0\system32\Macromed\Flash\uninstall_plugin.exe - 2008-08-26 17:28:14 16,208,504 ----a-w d:\windows.0\system32\MRT.exe + 2008-10-07 19:19:40 16,721,856 ----a-w d:\windows.0\system32\MRT.exe - 2008-06-23 15:10:27 3,088,384 ----a-w d:\windows.0\system32\mshtml.dll + 2008-08-20 05:10:12 3,088,896 ----a-w d:\windows.0\system32\mshtml.dll - 2008-04-14 02:33:34 337,408 ----a-w d:\windows.0\system32\netapi32.dll + 2008-10-15 16:35:43 337,408 ----a-w d:\windows.0\system32\netapi32.dll - 2007-03-02 16:24:44 227,856 ----a-w d:\windows.0\system32\PDBoot.exe + 2008-04-28 11:23:28 230,664 ----a-w d:\windows.0\system32\PDBoot.exe - 2008-09-20 05:13:22 58,654 ----a-w d:\windows.0\system32\perfc009.dat + 2008-11-04 02:45:55 58,654 ----a-w d:\windows.0\system32\perfc009.dat - 2008-09-20 05:13:22 70,818 ----a-w d:\windows.0\system32\perfc00C.dat + 2008-11-04 02:45:55 70,818 ----a-w d:\windows.0\system32\perfc00C.dat - 2008-09-20 05:13:22 392,736 ----a-w d:\windows.0\system32\perfh009.dat + 2008-11-04 02:45:55 392,736 ----a-w d:\windows.0\system32\perfh009.dat - 2008-09-20 05:13:22 458,682 ----a-w d:\windows.0\system32\perfh00C.dat + 2008-11-04 02:45:55 458,682 ----a-w d:\windows.0\system32\perfh00C.dat - 2008-04-14 02:33:40 180,224 ----a-w d:\windows.0\system32\scrobj.dll + 2008-05-09 10:55:00 180,224 ----a-w d:\windows.0\system32\scrobj.dll - 2008-04-14 02:33:40 172,032 ----a-w d:\windows.0\system32\scrrun.dll + 2008-05-09 10:55:00 172,032 ----a-w d:\windows.0\system32\scrrun.dll - 2008-06-26 08:13:32 1,499,648 ----a-w d:\windows.0\system32\shdocvw.dll + 2008-08-20 05:10:11 1,499,648 ----a-w d:\windows.0\system32\shdocvw.dll - 2007-11-30 12:39:29 18,296 ------w d:\windows.0\system32\spmsg.dll + 2007-11-30 11:19:06 18,296 ------w d:\windows.0\system32\spmsg.dll - 2008-06-26 08:13:32 620,544 ----a-w d:\windows.0\system32\urlmon.dll + 2008-08-20 05:10:11 620,544 ----a-w d:\windows.0\system32\urlmon.dll - 2008-04-14 02:33:48 434,176 ----a-w d:\windows.0\system32\vbscript.dll + 2008-05-09 10:55:00 430,080 ----a-w d:\windows.0\system32\vbscript.dll - 2008-04-14 02:34:29 155,648 ----a-w d:\windows.0\system32\wscript.exe + 2008-05-08 11:24:44 155,648 ----a-w d:\windows.0\system32\wscript.exe - 2008-04-14 02:33:50 90,112 ----a-w d:\windows.0\system32\wshext.dll + 2008-05-09 10:55:00 90,112 ----a-w d:\windows.0\system32\wshext.dll - 2008-08-10 19:03:21 258,048 ----a-w d:\windows.0\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll + 2008-09-22 07:01:28 258,048 ----a-w d:\windows.0\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll - 2008-08-10 19:03:21 114,176 ----a-w d:\windows.0\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll + 2008-09-22 07:01:28 114,176 ----a-w d:\windows.0\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll . -- Instantané actualisé -- . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="d:\windows.0\system32\ctfmon.exe" [2008-04-13 15360] "MSMSGS"="d:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232] "MsnMsgr"="d:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "IndexCleaner"="d:\program files\Bell\Gestionnaire de securite\IdxClnR.exe" [2008-03-10 61168] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="d:\windows.0\system32\NvCpl.dll" [2006-08-12 7630848] "NvMediaCenter"="d:\windows.0\system32\NvMcTray.dll" [2006-08-12 86016] "ehTray"="d:\windows.0\ehome\ehtray.exe" [2004-08-10 59392] "SSA.exe"="d:\program files\Bell\Sympatico Security Advisor\SSA.exe" [2007-03-27 2061816] "-FreedomNeedsReboot"="d:\program files\Bell\Gestionnaire de securite\ZkRunOnceR.exe" [2008-03-10 13552] "VX3000"="d:\windows.0\vVX3000.exe" [2006-12-05 707360] "LifeCam"="d:\program files\Microsoft LifeCam\LifeExp.exe" [2007-01-12 275800] "Gestionnaire de sécurité Sympatico"="d:\program files\Bell\Gestionnaire de securite\RPS.exe" [2008-03-10 311024] "iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "cygevu"="d:\windows.0\system32\suvas.exe" [2008-07-13 135680] "SkyTel"="SkyTel.EXE" [2006-05-16 d:\windows.0\SkyTel.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "cygevu"="d:\windows.0\system32\suvas.exe" [2008-07-13 135680] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="d:\windows.0\system32\CTFMON.EXE" [2008-04-13 15360] d:\documents and settings\All Users.WINDOWS.0\Menu D‚marrer\Programmes\D‚marrage\ SnagIt 9.lnk - d:\program files\TechSmith\SnagIt 9\SnagIt32.exe [2008-05-15 6822728] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= d:\windows.0\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= d:\windows.0\Resources\Themes\Royale.theme [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "d:\WINDOWS.0\system32\sessmgr.exe"= "d:\Program Files\Microsoft LifeCam\LifeCam.exe"= "d:\Program Files\Microsoft LifeCam\LifeExp.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "d:\Program Files\Bonjour\mDNSResponder.exe"= "d:\Program Files\iTunes\iTunes.exe"= "d:\Program Files\Messenger\msmsgs.exe"= "d:\Program Files\LimeWire\LimeWire.exe"= "%windir%\system32\sessmgr.exe"= "d:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "d:\Program Files\Windows Live\Messenger\livecall.exe"= R2 MSCamSvc;MSCamSvc;d:\program files\Microsoft LifeCam\MSCamS32.exe [2007-01-04 240408] R2 VaultClientUpgrade;Personal Vault Upgrade Service;d:\program files\Personal Vault\VaultClientUpgrade.exe [2008-03-07 53248] S2 xuluyapyuxe;BCL easyPDF SDK Loader;d:\windows.0\system32\foku.exe [2008-07-13 135680] S3 Radialpoint Security Services;Gestionnaire de sécurité Sympatico;d:\program files\Bell\Gestionnaire de securite\RpsSecurityAware.exe [2008-03-10 67824] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{afc8daed-8151-11dd-b4eb-001921e438d8}] \Shell\AutoRun\command - d:\windows.0\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fofos.exe \Shell\explore\command - J:\fofos.exe \Shell\find\command - J:\fofos.exe \Shell\open\command - J:\fofos.exe . Contenu du dossier 'Tâches planifiées' 2008-11-02 d:\windows.0\Tasks\AppleSoftwareUpdate.job - d:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] 2008-08-10 d:\windows.0\Tasks\Microsoft_Hardware_Launch_setup_exe.job - E:\setup.exe [] . . ------- Examen supplémentaire ------- . FireFox -: Profile - d:\documents and settings\GUNSHOTS\Application Data\Mozilla\Firefox\Profiles\cogak13l.default\ FF -: plugin - d:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - d:\program files\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-05 13:20:32 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-11-05 13:21:42 ComboFix-quarantined-files.txt 2008-11-05 18:21:30 ComboFix2.txt 2008-09-21 03:46:35 ComboFix3.txt 2008-09-21 02:08:26 Avant-CF: 100 965 122 048 octets libres Après-CF: 101,018,980,352 octets libres WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS.0 [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(3)\WINDOWS.0="Windows XP Media Center Edition" /noexecute=optin /fastdetect multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect 428 --- E O F --- 2008-10-24 07:00:30

jlpjlp · Answer

ok si non dispo après le scan en ligne fais ceci et colles les rapports:





Telecharge UsbFix sur ton bureau
http://sd-1.archive-host.com/membres/up/116615172019703188/U­sbFix.exe

--> Lance l installation avec les parametres par default

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir

--> Double clic sur le raccourci UsbFix sur ton bureau

--> Le pc va redémarer

-->Apres redémarrage post le rapport UsbFix.txt

Note : le rapport UsbFix.txt est sauvegardé a la racine du disque
Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides


___________________


scan avec
MalwareByte's Anti-Malware et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

gemlees · Answer

ton premier link de marche pas je croi quil y a une faute a quelque apre

jlpjlp · Answer

http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

gemlees · Answer

-------------- UsbFix V2.395 ---------------

* User : GUNSHOTS - PC-DE-GUNSHOTS
* Outils mis a jours le 03/11/2008 par Chiquitine29 et Chimay8
* Recherche effectuée à 14:12:09 le 2008-11-05
* Windows Xp - Internet Explorer 6.0.2900.5512 
  
  
--------------- [ Processus actifs ] ----------------   
  
 
D:\WINDOWS.0\System32\smss.exe
D:\WINDOWS.0\system32\csrss.exe
D:\WINDOWS.0\system32\winlogon.exe
D:\WINDOWS.0\system32\services.exe
D:\WINDOWS.0\system32\lsass.exe
D:\WINDOWS.0\system32\svchost.exe
D:\WINDOWS.0\system32\svchost.exe
D:\WINDOWS.0\System32\svchost.exe
D:\Program Files\Bell\Gestionnaire de securite\Fws.exe
D:\WINDOWS.0\system32\svchost.exe
D:\WINDOWS.0\system32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
D:\WINDOWS.0\system32\spoolsv.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
D:\WINDOWS.0\eHome\ehRecvr.exe
D:\WINDOWS.0\eHome\ehSched.exe
D:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
D:\WINDOWS.0\eHome\ehRec.exe
D:\Program Files\Microsoft LifeCam\MSCamS32.exe
D:\WINDOWS.0\system32
vsvc32.exe
D:\Program Files\Raxco\PerfectDisk\PDAgent.exe
D:\WINDOWS.0\system32\PnkBstrA.exe
D:\WINDOWS.0\system32\svchost.exe
D:\Program Files\Personal Vault\VaultClientUpgrade.exe
D:\WINDOWS.0\system32\foku.exe
D:\WINDOWS.0\system32\userinit.exe
D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
D:\DOCUME~1\GUNSHOTS\LOCALS~1\Temp\1.tmp\b2e.exe
D:\WINDOWS.0\system32\dllhost.exe
D:\WINDOWS.0\System32\alg.exe
D:\WINDOWS.0\system32undll32.exe
D:\WINDOWS.0\system32\wscntfy.exe
  
--------------- [ Informations lecteurs ] ----------------   
  
C: - Lecteur fixe

D: - Lecteur fixe

J: - Lecteur amovible

  
--------------- [ Registre / Startup ] ----------------   
 

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    NvCplDaemon	REG_SZ	RUNDLL32.EXE D:\WINDOWS.0\system32\NvCpl.dll,NvStartup
    NvMediaCenter	REG_SZ	RUNDLL32.EXE D:\WINDOWS.0\system32\NvMcTray.dll,NvTaskbarInit
    ehTray	REG_SZ	D:\WINDOWS.0\ehome\ehtray.exe
    SSA.exe	REG_SZ	"D:\Program Files\Bell\Sympatico Security Advisor\SSA.exe" /AUTORUN
    -FreedomNeedsReboot	REG_SZ	"D:\Program Files\Bell\Gestionnaire de securite\ZkRunOnceR.exe"
    VX3000	REG_SZ	D:\WINDOWS.0\vVX3000.exe
    LifeCam	REG_SZ	"D:\Program Files\Microsoft LifeCam\LifeExp.exe"
    SkyTel	REG_SZ	SkyTel.EXE
    Gestionnaire de sécurité Sympatico	REG_SZ	D:\Program Files\Bell\Gestionnaire de securite\RPS.exe
    iTunesHelper	REG_SZ	"D:\Program Files\iTunes\iTunesHelper.exe"
    cygevu	REG_SZ	D:\WINDOWS.0\system32\suvas.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    CTFMON.EXE	REG_SZ	D:\WINDOWS.0\system32\ctfmon.exe
    MSMSGS	REG_SZ	"D:\Program Files\Messenger\msmsgs.exe" /background
    MsnMsgr	REG_SZ	"D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  
--------------- [ Registre / Mountpoint2 ] ----------------   
  
 
 -> Recherche négative. 
  
--------------- [ Nettoyage des disques ] ----------------   
   
  
--------------- [ Listing des fichiers présents ] ----------------   
  
 -> /!\ Le resultat doit etre interprété par un spécialiste  /!\   
  
[2008-08-10 12:40][--a------] C:\AUTOEXEC.BAT   
[2004-08-10 08:00][-rahs----] C:\NTDETECT.COM   
[2008-11-05 13:17][-rahs----] C:\boot.ini   
[2008-08-10 11:43][--a------] D:\AUTOEXEC.BAT   
 
--------------- ! Fin du rapport ! ----------------

gemlees · Answer

le scan malware est en cours

gemlees · Answer

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1306
Windows 5.1.2600 Service Pack 3

2008-11-05 14:23:45
mbam-log-2008-11-05 (14-23-45).txt

Type de recherche: Examen rapide
Eléments examinés: 55826
Temps écoulé: 2 minute(s), 53 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cygevu (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
D:\WINDOWS.0\system32\suvas.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
D:\WINDOWS.0\system32\drivers\etc\services (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

jlpjlp · Answer

il faut faire un examen complet avec malwarebyte et pas un rapide!

Msn:virus album photo besoin d'aide svp

16 réponses

Discussions similaires