Redirection automatique de google - Page 2

Viruscan me refait la même chose...
Et voilà pour OAD:
21/12/2008 ---- 18:34:16,90

----------------------------------
§§§§§§ [javan] §§§§§§
----------------------------------
[X] Registre

-------------- [ ] rapide
-- Fichier --- [ ] disque systeme
------------- [X] complete

********************
[Registre]
********************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{11FC12D0-1A72-12D2-992D-5BC14F992BC7}]
"StubPath"="C:\\WINDOWS\\system32\\javan.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D7416EC557D282A45BD280A3096E640E]
"20AC859F04BB700498B452789254E64E"="C:\\Program Files\\QuickTime\\QTSystem\\QTJavaNative.dll"

[HKEY_USERS\S-1-5-21-507921405-926492609-839522115-1004\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="javan.exe"

*******************
[Fichier]
*******************

*********************
[Même date]
*********************

Aucun fichier créé à la même date détecté

Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------

oki ....

fais ceci :

1-Créer un doc texte sur ton bureau :
pointe ta souris sur ton bureau , clique droit : va dans "nouveau" et choisis "document texte" .

Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de créer :

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{11FC12D0-1A72-12D2-992D-5BC14F992BC7}]
"StubPath"=-
[HKEY_USERS\S-1-5-21-507921405-926492609-839522115-1004\Software\Microsoft\Search Assistant\ACMru\5603]
"000"=-

Driver::
ahgq
f9df04d1

Puis va dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi :
CFScript puis valide ...

2-Nettoyage :

!! Déconnecte toi, ferme toutes tes applications et désactive TOUTES TES DEFENSES ( tu les réactiveras après ) !!

--->Sur ton bureau, fais glisser avec ta souris le fichier CFScript sur l'icône de ComboFix.exe .

(Regarde ici : http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif )

Cette manipulation va relancer combofix .
--> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tape 1 puis valide.

Puis patiente le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!)

!! Ne touches à rien tant que le scan n'est pas terminé !!

Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : poste le ainsi qu' un nouveau rapport ZHPDiag pour analyse ...

( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )

Combofix:
ComboFix 08-12-18.03 - Namida no baka 2008-12-21 19:30:33.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.959.609 [GMT 1:00]
Lancé depuis: c:\documents and settings\Namida no baka\Bureau\bug\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Namida no baka\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\1gk8ha.bat
C:\1u0o8bnq.cmd
C:\Autorun.inf
c:\windows\system32\AutoRun.inf
c:\windows\system32\ckvo.exe
c:\windows\system32\ckvo0.dll
c:\windows\system32\hpowiax3.dll
E:\1gk8ha.bat
E:\1u0o8bnq.cmd
E:\Autorun.inf
F:\1gk8ha.bat
F:\1u0o8bnq.cmd
F:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ahgq
-------\Service_f9df04d1

((((((((((((((((((((((((((((( Fichiers créés du 2008-11-21 au 2008-12-21 ))))))))))))))))))))))))))))))))))))
.

2008-12-21 19:03 . 2008-12-21 19:03 63 --a------ c:\windows\wininit.ini
2008-12-21 19:02 . 2008-12-21 19:19 <REP> d-------- c:\program files\PowerStrip
2008-12-21 13:33 . 2008-12-21 13:33 85,504 -r-hs---- c:\windows\system32\vbsdfe1.dll
2008-12-21 06:01 . 2008-12-21 06:01 <REP> d-------- c:\program files\MSXML 4.0
2008-12-21 06:01 . 2004-08-05 13:00 221,184 --a------ c:\windows\system32\wmpns.dll
2008-12-21 03:25 . 2008-12-21 04:03 <REP> d-------- c:\windows\system32\CatRoot_bak
2008-12-21 03:18 . 2008-06-14 18:59 272,768 --------- c:\windows\system32\drivers\bthport.sys
2008-12-21 03:18 . 2008-06-14 18:59 272,768 -----c--- c:\windows\system32\dllcache\bthport.sys
2008-12-21 03:13 . 2008-08-14 14:44 2,182,400 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-12-21 03:13 . 2008-08-14 14:44 2,138,112 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-12-21 03:13 . 2008-08-14 14:44 2,059,776 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-12-21 03:13 . 2008-08-14 14:44 2,017,792 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-12-21 03:09 . 2008-10-24 12:10 453,632 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-12-21 03:00 . 2008-12-21 06:06 <REP> d--h----- c:\windows\$hf_mig$
2008-12-21 02:20 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2008-12-21 02:20 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll
2008-12-21 02:20 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2008-12-20 18:33 . 2008-12-21 13:33 118,267 -r-hs---- c:\windows\system32\vamsoft.exe
2008-12-20 18:33 . 2008-12-21 19:35 85,504 -r-hs---- c:\windows\system32\vbsdfe0.dll
2008-12-20 16:17 . 2008-12-20 16:19 <REP> d-------- C:\Downloads
2008-12-20 16:12 . 2008-12-20 16:19 <REP> d-------- c:\program files\US Downloader
2008-12-20 16:03 . 2008-12-20 16:03 <REP> d-------- C:\winico-xp
2008-12-20 16:03 . 2008-12-20 16:04 <REP> d-------- c:\program files\PhotoFiltre
2008-12-20 16:03 . 2007-01-07 14:26 2,720,768 --a------ C:\PhotoFiltre.exe
2008-12-20 16:03 . 2006-01-20 18:16 749,568 --a------ c:\windows\system32\Extinction.exe
2008-12-20 16:03 . 2007-08-06 14:55 307 --a------ c:\windows\internet.htm
2008-12-20 16:03 . 2007-08-06 14:55 307 --a------ C:\internet.htm
2008-12-20 16:03 . 2007-08-06 13:55 136 --a------ c:\windows\internet.url
2008-12-20 16:03 . 2007-08-06 13:55 136 --a------ C:\internet.url
2008-12-20 15:53 . 2008-12-20 15:53 <REP> d-------- c:\documents and settings\Namida no baka\Application Data\HP
2008-12-20 15:50 . 2008-12-20 15:50 <REP> d-------- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2008-12-20 15:50 . 2007-03-29 17:07 267,864 -ra------ c:\windows\system32\hpzids01.dll
2008-12-20 15:50 . 2007-03-28 14:01 117,760 --a------ c:\windows\system32\hpzll5ha.dll
2008-12-20 15:50 . 2007-03-07 06:20 49,920 -ra------ c:\windows\system32\drivers\HPZid412.sys
2008-12-20 15:50 . 2007-03-07 06:20 21,568 -ra------ c:\windows\system32\drivers\HPZius12.sys
2008-12-20 15:50 . 2007-03-07 06:20 16,496 -ra------ c:\windows\system32\drivers\HPZipr12.sys
2008-12-20 15:49 . 2007-03-16 18:11 569,344 -ra------ c:\windows\system32\hpotscl3.dll
2008-12-20 15:49 . 2007-03-07 06:20 364,544 -ra------ c:\windows\system32\hppldcoi.dll
2008-12-20 15:49 . 2007-03-07 06:20 309,760 -ra------ c:\windows\system32\difxapi.dll
2008-12-20 15:49 . 2007-03-16 18:11 303,104 -ra------ c:\windows\system32\hpovst10.dll
2008-12-20 15:49 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2008-12-20 15:49 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys
2008-12-20 15:46 . 2008-12-20 15:46 <REP> d-------- c:\documents and settings\Namida no baka\Application Data\HPAppData
2008-12-20 15:46 . 2008-12-20 15:46 <REP> d-------- c:\documents and settings\All Users\Application Data\HPSSUPPLY
2008-12-20 15:44 . 2008-12-20 15:44 <REP> d-------- c:\program files\Fichiers communs\HP
2008-12-20 15:44 . 2008-12-20 15:44 <REP> d-------- c:\documents and settings\All Users\Application Data\HP Product Assistant
2008-12-20 15:44 . 2008-12-20 15:44 <REP> d-------- c:\documents and settings\All Users\Application Data\HP
2008-12-20 15:43 . 2008-12-20 15:43 <REP> d-------- c:\program files\Hewlett-Packard
2008-12-20 15:43 . 2008-12-20 15:43 <REP> d-------- c:\program files\Fichiers communs\Hewlett-Packard
2008-12-20 15:41 . 2008-12-20 15:46 <REP> d-------- c:\program files\HP
2008-12-20 15:41 . 2004-08-03 23:01 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2008-12-20 15:41 . 2004-08-03 23:01 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys
2008-12-20 15:40 . 2008-12-20 15:52 162,206 --a------ c:\windows\hpoins14.dat
2008-12-20 15:40 . 2008-04-02 09:01 2,000 --------- c:\windows\hpomdl14.dat
2008-12-20 14:51 . 2008-12-20 14:51 <REP> d-------- c:\program files\iPod
2008-12-20 14:51 . 2008-12-20 14:51 <REP> d-------- c:\documents and settings\Namida no baka\Application Data\Apple Computer
2008-12-20 14:51 . 2008-12-20 14:51 <REP> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-20 14:51 . 2008-04-17 13:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2008-12-20 14:51 . 2008-04-17 13:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2008-12-20 14:50 . 2008-12-20 14:51 <REP> d-------- c:\program files\iTunes
2008-12-20 14:50 . 2008-12-20 14:50 <REP> d-------- c:\program files\Bonjour
2008-12-20 14:49 . 2008-12-20 14:49 <REP> d-------- c:\program files\QuickTime
2008-12-20 14:49 . 2008-12-20 14:50 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-20 14:48 . 2008-12-20 14:48 <REP> d-------- c:\program files\Apple Software Update
2008-12-20 14:47 . 2008-12-20 14:51 <REP> d-------- c:\program files\Fichiers communs\Apple
2008-12-20 14:47 . 2008-12-20 14:47 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple
2008-12-20 13:07 . 2008-12-20 13:07 <REP> d-------- C:\rsit
2008-12-20 12:44 . 2008-12-20 12:44 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-20 12:44 . 2008-12-20 12:44 <REP> d-------- c:\documents and settings\Namida no baka\Application Data\Malwarebytes
2008-12-20 12:44 . 2008-12-20 12:44 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-20 12:44 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-20 12:44 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-20 12:16 . 2008-12-20 12:16 <REP> d-------- c:\program files\Trend Micro
2008-12-20 12:10 . 2008-12-20 12:10 <REP> d-------- c:\program files\CCleaner
2008-12-20 11:47 . 2008-12-20 11:48 <REP> d-------- c:\windows\ERUNT
2008-12-20 11:39 . 2008-12-20 12:05 <REP> d-------- C:\SDFix
2008-12-20 10:25 . 2008-12-20 10:32 <REP> d-------- c:\program files\UsbFix
2008-12-20 09:48 . 2008-12-20 09:57 <REP> d-------- C:\Rooter$
2008-12-20 09:25 . 2008-12-12 00:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe
2008-12-20 08:10 . 2008-12-20 08:10 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Windows Media Audio 10 Codec.bmp
2008-12-20 08:10 . 2008-12-20 08:10 3,365 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Windows Media Audio 10 Codec.dat
2008-12-20 08:09 . 2008-12-20 08:09 <REP> d-------- c:\program files\Illustrate
2008-12-20 08:09 . 2007-09-08 21:22 10,884,472 --a------ c:\windows\system32\SpoonUninstall.exe
2008-12-20 08:09 . 2008-12-20 08:09 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.bmp
2008-12-20 08:09 . 2008-12-20 08:09 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp DSP Effects.bmp
2008-12-20 08:09 . 2008-12-20 08:09 13,281 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2008-12-20 08:09 . 2008-12-20 08:09 8,457 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp DSP Effects.dat
2008-12-20 08:00 . 2004-08-03 22:58 5,504 --a------ c:\windows\system32\drivers\MSTEE.sys
2008-12-20 08:00 . 2004-08-03 22:58 5,504 --a--c--- c:\windows\system32\dllcache\mstee.sys
2008-12-20 07:59 . 2004-08-03 23:10 85,376 --a------ c:\windows\system32\drivers\NABTSFEC.sys
2008-12-20 07:59 . 2004-08-03 23:10 85,376 --a--c--- c:\windows\system32\dllcache\nabtsfec.sys
2008-12-20 07:59 . 2004-08-03 23:10 19,328 --a------ c:\windows\system32\drivers\WSTCODEC.SYS
2008-12-20 07:59 . 2004-08-03 23:10 19,328 --a--c--- c:\windows\system32\dllcache\wstcodec.sys
2008-12-20 07:59 . 2004-08-04 00:55 16,384 --a------ c:\windows\system32\ipsink.ax
2008-12-20 07:59 . 2004-08-04 00:55 16,384 --a--c--- c:\windows\system32\dllcache\ipsink.ax
2008-12-20 07:59 . 2004-08-03 23:10 15,360 --a------ c:\windows\system32\drivers\StreamIP.sys
2008-12-20 07:59 . 2004-08-03 23:10 15,360 --a--c--- c:\windows\system32\dllcache\streamip.sys
2008-12-20 07:59 . 2004-08-03 23:10 11,136 --a------ c:\windows\system32\drivers\SLIP.sys
2008-12-20 07:59 . 2004-08-03 23:10 11,136 --a--c--- c:\windows\system32\dllcache\slip.sys
2008-12-20 07:59 . 2004-08-03 23:10 10,880 --a------ c:\windows\system32\drivers\NdisIP.sys
2008-12-20 07:59 . 2004-08-03 23:10 10,880 --a--c--- c:\windows\system32\dllcache\ndisip.sys
2008-12-20 07:58 . 2004-08-04 00:55 91,648 --a------ c:\windows\system32\kswdmcap.ax
2008-12-20 07:58 . 2004-08-04 00:55 91,648 --a--c--- c:\windows\system32\dllcache\kswdmcap.ax
2008-12-20 07:58 . 2004-08-04 00:55 61,952 --a------ c:\windows\system32\kstvtune.ax
2008-12-20 07:58 . 2004-08-04 00:55 61,952 --a--c--- c:\windows\system32\dllcache\kstvtune.ax
2008-12-20 07:58 . 2004-08-04 00:54 54,784 --a------ c:\windows\system32\vfwwdm32.dll
2008-12-20 07:58 . 2004-08-04 00:54 54,784 --a--c--- c:\windows\system32\dllcache\vfwwdm32.dll
2008-12-20 07:58 . 2004-08-04 00:55 43,008 --a------ c:\windows\system32\ksxbar.ax
2008-12-20 07:58 . 2004-08-04 00:55 43,008 --a--c--- c:\windows\system32\dllcache\ksxbar.ax
2008-12-20 07:58 . 2004-08-04 00:55 28,672 --a------ c:\windows\system32\vidcap.ax
2008-12-20 07:58 . 2004-08-04 00:55 28,672 --a--c--- c:\windows\system32\dllcache\vidcap.ax
2008-12-20 07:58 . 2004-08-03 23:10 17,024 --a------ c:\windows\system32\drivers\CCDECODE.sys
2008-12-20 07:58 . 2004-08-03 23:10 17,024 --a--c--- c:\windows\system32\dllcache\ccdecode.sys
2008-12-20 07:55 . 2006-05-26 15:40 61,440 --a------ c:\windows\vsnpx32.dll
2008-12-20 07:48 . 2008-12-20 07:55 <REP> d-------- c:\program files\Fichiers communs\snpstd3
2008-12-20 07:48 . 2006-06-27 13:50 10,148,480 --a------ c:\windows\system32\drivers\snpstd3.sys
2008-12-20 07:48 . 2006-05-12 11:27 831,488 --a------ c:\windows\vsnpstd3.exe
2008-12-20 07:48 . 2006-06-19 11:43 262,144 --a------ c:\windows\tsnpstd3.exe
2008-12-20 07:48 . 2006-04-12 12:11 147,456 --a------ c:\windows\system32\rsnpstd3.dll
2008-12-20 07:48 . 2004-08-09 17:43 94,208 --a------ c:\windows\amcap.exe
2008-12-20 07:48 . 2006-05-26 15:40 61,440 --a------ c:\windows\vsnpstd3.dll
2008-12-20 07:48 . 2006-05-26 15:40 61,440 --a------ c:\windows\system32\vsnpstd3.dll
2008-12-20 07:48 . 2005-11-23 13:55 53,248 --a------ c:\windows\system32\csnpstd3.dll
2008-12-20 07:48 . 2004-12-08 18:40 20,480 --a------ c:\windows\usnpstd3.exe
2008-12-20 07:48 . 2004-02-27 17:36 15,498 --a------ c:\windows\snpstd3.ini

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-20 06:54 14,336 ----a-w c:\windows\system32\svchost.exe
2008-12-20 06:48 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-20 03:53 --------- d-----w c:\program files\Realtek
2008-12-20 03:49 --------- d-----w c:\program files\VIA
2008-12-20 03:49 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-12-20 03:47 --------- d-----w c:\program files\S3
2008-12-20 03:29 --------- d-----w c:\program files\microsoft frontpage
2008-12-20 03:25 --------- d-----w c:\program files\Services en ligne
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 13:00 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 10:38 663,552 ----a-w c:\windows\system32\wininet.dll
2008-10-03 10:17 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
.

((((((((((((((((((((((((((((( snapshot@2008-12-20_13.37.09.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-06-14 17:59:52 272,768 ------w c:\windows\Driver Cache\i386\bthport.sys
+ 2008-10-24 11:10:42 453,632 ------w c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2008-08-14 13:44:35 2,138,112 ------w c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2008-08-14 13:44:39 2,059,776 ------w c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2008-08-14 13:44:33 2,017,792 ------w c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2008-08-14 13:44:37 2,182,400 ------w c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
- 2006-11-03 08:58:34 317,440 ----a-w c:\windows\inf\unregmp2.exe
+ 2007-06-29 10:59:14 318,976 ----a-w c:\windows\inf\unregmp2.exe
+ 2008-12-20 14:45:40 65,536 ----a-r c:\windows\Installer\{10E1E87C-656C-4D08-86D6-5443D28583BE}\NewShortcut1.A6CC6977_F7B4_4C0B_9510_BCD847D4BDB2.exe
+ 2008-12-20 13:52:05 102,400 ----a-r c:\windows\Installer\{318AB667-3230-41B5-A617-CB3BF748D371}\iTunesIco.exe
+ 2008-12-20 14:46:47 8,854 ----a-r c:\windows\Installer\{415CDA53-9100-476F-A7B2-476691E117C7}\Uninstall_Smart_Web__2DD09EA994C6415885A0C8BB7A14CB08.exe
+ 2008-12-20 14:46:58 25,214 ----a-r c:\windows\Installer\{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}\ARPPRODUCTICON.exe
+ 2008-12-20 14:46:58 25,214 ----a-r c:\windows\Installer\{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}\hpqSSupply.exe
+ 2008-12-20 13:48:49 27,136 ----a-r c:\windows\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe
+ 2008-12-20 14:47:54 25,214 ----a-r c:\windows\Installer\{8389382B-53BA-4A87-8854-91E3D80A5AC7}\ARPPRODUCTICON.exe
+ 2008-12-20 14:47:54 25,214 ----a-r c:\windows\Installer\{8389382B-53BA-4A87-8854-91E3D80A5AC7}\NewShortcut1_8389382B53BA4A87885491E3D80A5AC7.exe
+ 2008-12-20 14:47:54 25,214 ----a-r c:\windows\Installer\{8389382B-53BA-4A87-8854-91E3D80A5AC7}\NewShortcut2_8389382B53BA4A87885491E3D80A5AC7.exe
+ 2008-12-21 05:01:32 32,768 ----a-r c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe
+ 2008-12-20 13:50:33 86,016 ----a-r c:\windows\Installer\{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}\PrntWzrdIco.exe
+ 2008-12-20 14:47:24 65,536 ----a-r c:\windows\Installer\{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}\ARPPRODUCTICON.exe
+ 2008-12-20 14:47:24 689,720 ----a-r c:\windows\Installer\{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}\HPSUShortcut_BB85ED9CAFC943BDB8DC258C3C7DF72E.exe
+ 2008-12-20 14:47:46 25,214 ----a-r c:\windows\Installer\{F72E2DDC-3DB8-4190-A21D-63883D955FE7}\ARPPRODUCTICON.exe
- 2008-12-20 03:27:31 8,738 ----a-w c:\windows\pchealth\helpctr\Config\Cntstore.bin
+ 2008-12-21 18:21:25 8,972 ----a-w c:\windows\pchealth\helpctr\Config\Cntstore.bin
- 2008-12-20 03:27:21 76,507 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
+ 2008-12-21 18:22:57 76,507 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
- 2008-12-20 03:27:31 2,092 ----a-w c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
+ 2008-12-21 18:22:57 2,398 ----a-w c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
+ 2007-04-23 19:11:18 287,256 ----a-r c:\windows\system32\AbaleZip.dll
+ 2003-03-18 18:05:50 89,088 ----a-w c:\windows\system32\atl71.dll
- 2004-08-05 12:00:00 1,017,344 ----a-w c:\windows\system32\browseui.dll
+ 2008-10-16 10:38:30 1,024,000 ----a-w c:\windows\system32\browseui.dll
- 2004-08-05 12:00:00 151,552 ----a-w c:\windows\system32\cdfview.dll
+ 2008-10-16 10:38:27 152,064 ----a-w c:\windows\system32\cdfview.dll
- 2004-08-05 12:00:00 1,056,256 ----a-w c:\windows\system32\danim.dll
+ 2008-10-16 10:38:27 1,056,768 ----a-w c:\windows\system32\danim.dll
- 2004-08-05 12:00:00 138,496 -c--a-w c:\windows\system32\dllcache\afd.sys
+ 2008-08-14 09:51:43 138,368 -c--a-w c:\windows\system32\dllcache\afd.sys
- 2004-08-05 12:00:00 1,017,344 -c--a-w c:\windows\system32\dllcache\browseui.dll
+ 2008-10-16 10:38:30 1,024,000 -c--a-w c:\windows\system32\dllcache\browseui.dll
- 2004-08-05 12:00:00 151,552 -c--a-w c:\windows\system32\dllcache\cdfview.dll
+ 2008-10-16 10:38:27 152,064 -c--a-w c:\windows\system32\dllcache\cdfview.dll
- 2004-08-05 12:00:00 1,056,256 -c--a-w c:\windows\system32\dllcache\danim.dll
+ 2008-10-16 10:38:27 1,056,768 -c--a-w c:\windows\system32\dllcache\danim.dll
- 2004-08-05 12:00:00 357,888 -c--a-w c:\windows\system32\dllcache\dxtmsft.dll
+ 2008-10-16 10:38:27 357,888 -c--a-w c:\windows\system32\dllcache\dxtmsft.dll
- 2004-08-05 12:00:00 201,728 -c--a-w c:\windows\system32\dllcache\dxtrans.dll
+ 2008-10-16 10:38:28 205,312 -c--a-w c:\windows\system32\dllcache\dxtrans.dll
- 2004-08-05 12:00:00 243,200 -c--a-w c:\windows\system32\dllcache\es.dll
+ 2008-07-07 20:31:48 253,952 -c--a-w c:\windows\system32\dllcache\es.dll
- 2004-08-05 12:00:00 55,808 -c--a-w c:\windows\system32\dllcache\extmgr.dll
+ 2008-10-16 10:38:28 55,808 -c--a-w c:\windows\system32\dllcache\extmgr.dll
- 2004-08-05 12:00:00 278,016 -c--a-w c:\windows\system32\dllcache\gdi32.dll
+ 2008-10-23 13:00:15 283,648 -c--a-w c:\windows\system32\dllcache\gdi32.dll
- 2004-08-05 12:00:00 18,432 -c--a-w c:\windows\system32\dllcache\iedw.exe
+ 2008-10-15 09:45:01 18,432 -c--a-w c:\windows\system32\dllcache\iedw.exe
- 2004-08-05 12:00:00 249,344 -c--a-w c:\windows\system32\dllcache\iepeers.dll
+ 2008-10-16 10:38:28 251,392 -c--a-w c:\windows\system32\dllcache\iepeers.dll
- 2004-08-05 12:00:00 678,400 -c--a-w c:\windows\system32\dllcache\inetcomm.dll
+ 2008-04-11 18:51:06 683,520 -c--a-w c:\windows\system32\dllcache\inetcomm.dll
- 2004-08-05 12:00:00 96,768 -c--a-w c:\windows\system32\dllcache\inseng.dll
+ 2008-10-16 10:38:28 96,768 -c--a-w c:\windows\system32\dllcache\inseng.dll
- 2004-08-05 12:00:00 450,560 -c--a-w c:\windows\system32\dllcache\jscript.dll
+ 2007-12-18 14:41:58 450,560 -c--a-w c:\windows\system32\dllcache\jscript.dll
- 2004-08-05 12:00:00 15,872 -c--a-w c:\windows\system32\dllcache\jsproxy.dll
+ 2008-10-16 10:38:29 16,384 -c--a-w c:\windows\system32\dllcache\jsproxy.dll
- 2006-10-18 19:03:58 100,864 -c--a-w c:\windows\system32\dllcache\logagent.exe
+ 2008-06-18 00:09:22 100,864 -c--a-w c:\windows\system32\dllcache\logagent.exe
- 2004-08-05 12:00:00 331,776 -c--a-w c:\windows\system32\dllcache\msadce.dll
+ 2008-05-01 14:31:48 331,776 -c--a-w c:\windows\system32\dllcache\msadce.dll
- 2004-08-05 12:00:00 73,728 -c--a-w c:\windows\system32\dllcache\mscms.dll
+ 2008-06-24 16:23:56 74,240 -c--a-w c:\windows\system32\dllcache\mscms.dll
- 2004-08-05 12:00:00 3,003,392 -c--a-w c:\windows\system32\dllcache\mshtml.dll
+ 2008-12-12 17:35:12 3,081,216 -c--a-w c:\windows\system32\dllcache\mshtml.dll
- 2004-08-05 12:00:00 448,512 -c--a-w c:\windows\system32\dllcache\mshtmled.dll
+ 2008-10-16 10:38:29 449,024 -c--a-w c:\windows\system32\dllcache\mshtmled.dll
- 2004-08-05 12:00:00 28,160 -c--a-w c:\windows\system32\dllcache\msoobe.exe
+ 2001-08-28 15:00:00 28,160 -c--a-w c:\windows\system32\dllcache\msoobe.exe
- 2004-08-05 12:00:00 146,432 -c--a-w c:\windows\system32\dllcache\msrating.dll
+ 2008-10-16 10:38:28 146,432 -c--a-w c:\windows\system32\dllcache\msrating.dll
- 2006-10-18 20:47:16 414,208 -c--a-w c:\windows\system32\dllcache\msscp.dll
+ 2006-12-04 15:21:50 414,720 -c--a-w c:\windows\system32\dllcache\msscp.dll
- 2004-08-05 12:00:00 530,432 -c--a-w c:\windows\system32\dllcache\mstime.dll
+ 2008-10-16 10:38:28 532,480 -c--a-w c:\windows\system32\dllcache\mstime.dll
- 2004-08-05 12:00:00 1,236,480 -c--a-w c:\windows\system32\dllcache\msxml3.dll
+ 2008-09-04 16:45:11 1,106,944 -c--a-w c:\windows\system32\dllcache\msxml3.dll
- 2004-08-05 12:00:00 332,288 -c--a-w c:\windows\system32\dllcache\netapi32.dll
+ 2008-10-15 16:59:28 332,800 -c--a-w c:\windows\system32\dllcache\netapi32.dll
- 2004-08-05 12:00:00 39,424 -c--a-w c:\windows\system32\dllcache\pngfilt.dll
+ 2008-10-16 10:38:28 39,424 -c--a-w c:\windows\system32\dllcache\pngfilt.dll
- 2004-08-05 12:00:00 1,293,824 -c--a-w c:\windows\system32\dllcache\quartz.dll
+ 2008-05-07 05:15:36 1,293,824 -c--a-w c:\windows\system32\dllcache\quartz.dll
- 2004-08-05 12:00:00 200,064 -c--a-w c:\windows\system32\dllcache\rmcast.sys
+ 2008-05-08 12:28:49 202,752 -c--a-w c:\windows\system32\dllcache\rmcast.sys
- 2004-08-05 12:00:00 1,483,776 -c--a-w c:\windows\system32\dllcache\shdocvw.dll
+ 2008-10-16 10:38:29 1,495,040 -c--a-w c:\windows\system32\dllcache\shdocvw.dll
- 2004-08-05 12:00:00 474,112 -c--a-w c:\windows\system32\dllcache\shlwapi.dll
+ 2008-10-16 10:38:29 474,624 -c--a-w c:\windows\system32\dllcache\shlwapi.dll
- 2004-08-05 12:00:00 336,256 -c--a-w c:\windows\system32\dllcache\srv.sys
+ 2008-08-28 10:04:17 333,056 -c--a-w c:\windows\system32\dllcache\srv.sys
- 2004-08-05 12:00:00 246,302 -c--a-w c:\windows\system32\dllcache\strmdll.dll
+ 2008-10-03 10:17:02 247,326 -c--a-w c:\windows\system32\dllcache\strmdll.dll
- 2006-11-03 08:58:34 317,440 -c--a-w c:\windows\system32\dllcache\unregmp2.exe
+ 2007-06-29 10:59:14 318,976 -c--a-w c:\windows\system32\dllcache\unregmp2.exe
- 2004-08-05 12:00:00 603,136 -c--a-w c:\windows\system32\dllcache\urlmon.dll
+ 2008-10-16 10:38:30 617,984 -c--a-w c:\windows\system32\dllcache\urlmon.dll
- 2004-08-05 12:00:00 417,792 -c--a-w c:\windows\system32\dllcache\vbscript.dll
+ 2007-12-18 14:41:59 417,792 -c--a-w c:\windows\system32\dllcache\vbscript.dll
- 2004-08-05 12:00:00 1,836,032 -c--a-w c:\windows\system32\dllcache\win32k.sys
+ 2008-09-15 15:39:16 1,846,144 -c--a-w c:\windows\system32\dllcache\win32k.sys
- 2004-08-05 12:00:00 660,480 -c--a-w c:\windows\system32\dllcache\wininet.dll
+ 2008-10-16 10:38:29 663,552 -c--a-w c:\windows\system32\dllcache\wininet.dll
- 2006-10-18 20:47:18 222,208 -c--a-w c:\windows\system32\dllcache\WMASF.dll
+ 2007-10-25 08:28:30 222,720 -c--a-w c:\windows\system32\dllcache\wmasf.dll
- 2006-10-18 20:47:20 937,984 -c--a-w c:\windows\system32\dllcache\WMNetMgr.dll
+ 2008-06-18 04:03:08 938,496 -c--a-w c:\windows\system32\dllcache\WMNetmgr.dll
- 2006-10-18 20:47:20 10,834,432 -c--a-w c:\windows\system32\dllcache\wmp.dll
+ 2007-06-11 22:51:12 10,834,944 -c--a-w c:\windows\system32\dllcache\wmp.dll
- 2006-10-18 20:47:22 2,450,944 -c--a-w c:\windows\system32\dllcache\wmvcore.dll
+ 2008-06-18 04:03:14 2,458,112 -c--a-w c:\windows\system32\dllcache\WMVCore.dll
+ 2008-08-29 09:18:58 87,336 ----a-w c:\windows\system32\dns-sd.exe
+ 2008-08-29 08:53:50 61,440 ----a-w c:\windows\system32\dnssd.dll
- 2004-08-05 12:00:00 138,496 ----a-w c:\windows\system32\drivers\afd.sys
+ 2008-08-14 09:51:43 138,368 ----a-w c:\windows\system32\drivers\afd.sys
+ 2007-07-15 02:37:04 27,992 ----a-w c:\windows\system32\drivers\pstrip.sys
- 2004-08-05 12:00:00 200,064 ----a-w c:\windows\system32\drivers\RMCast.sys
+ 2008-05-08 12:28:49 202,752 ----a-w c:\windows\system32\drivers\rmcast.sys
- 2004-08-05 12:00:00 336,256 ----a-w c:\windows\system32\drivers\srv.sys
+ 2008-08-28 10:04:17 333,056 ----a-w c:\windows\system32\drivers\srv.sys
+ 2008-04-17 12:12:54 107,368 -c--a-w c:\windows\system32\DRVSTORE\GEARAspiWD_D213663B6381F01E45A131159A9DEFE018321CB3\x86\GEARAspi.dll
+ 2008-04-17 12:12:54 15,464 -c--a-w c:\windows\system32\DRVSTORE\GEARAspiWD_D213663B6381F01E45A131159A9DEFE018321CB3\x86\GEARAspiWDM.sys
+ 2007-03-29 16:07:42 267,864 -c--a-r c:\windows\system32\DRVSTORE\hpodcsla_AA90739FE6CE6410E6FD075E7696EADED8A3F90D\hpzids01.dll
+ 2007-03-07 05:20:45 309,760 -c--a-r c:\windows\system32\DRVSTORE\hposcu10_4FC8229DA1D7F81E72322B6F2DBB249746ABAFD7\drivers\dot4\Win2000\difxapi.dll
+ 2007-03-07 05:20:46 364,544 -c--a-r c:\windows\system32\DRVSTORE\hposcu10_4FC8229DA1D7F81E72322B6F2DBB249746ABAFD7\drivers\dot4\Win2000\hppldcoi.dll
+ 2007-03-16 17:11:12 229,376 -c--a-r c:\windows\system32\DRVSTORE\hposcu10_4FC8229DA1D7F81E72322B6F2DBB249746ABAFD7\drivers\scanner\x32\hpotpusd.dll
+ 2007-03-16 17:11:12 569,344 -c--a-r c:\windows\system32\DRVSTORE\hposcu10_4FC8229DA1D7F81E72322B6F2DBB249746ABAFD7\drivers\scanner\x32\hpotscl3.dll
+ 2007-03-16 17:11:13 303,104 -c--a-r c:\windows\system32\DRVSTORE\hposcu10_4FC8229DA1D7F81E72322B6F2DBB249746ABAFD7\drivers\scanner\x32\hpovst10.dll
+ 2007-03-16 17:11:13 675,840 -c--a-r c:\windows\system32\DRVSTORE\hposcu10_4FC8229DA1D7F81E72322B6F2DBB249746ABAFD7\drivers\scanner\x32\hpowiax3.dll
+ 2007-03-07 05:20:48 49,920 -c--a-r c:\windows\system32\DRVSTORE\hpzid413_F75AD070CF6AC37359152FFE52115AEC89378C94\drivers\dot4\Win2000\HPZid412.sys
+ 2007-03-07 05:20:45 309,760 -c--a-r c:\windows\system32\DRVSTORE\hpzipa13_DB40AE39DB38AD8D2AF2D8E4340ABA1C191DE2CE\drivers\dot4\Win2000\difxapi.dll
+ 2007-03-07 05:20:46 364,544 -c--a-r c:\windows\system32\DRVSTORE\hpzipa13_DB40AE39DB38AD8D2AF2D8E4340ABA1C191DE2CE\drivers\dot4\Win2000\hppldcoi.dll
+ 2007-03-07 05:20:48 49,920 -c--a-r c:\windows\system32\DRVSTORE\hpzipa13_DB40AE39DB38AD8D2AF2D8E4340ABA1C191DE2CE\drivers\dot4\Win2000\HPZid412.sys
+ 2007-03-07 05:20:49 16,496 -c--a-r c:\windows\system32\DRVSTORE\hpzipa13_DB40AE39DB38AD8D2AF2D8E4340ABA1C191DE2CE\drivers\dot4\Win2000\HPzipr12.sys
+ 2007-03-07 05:20:50 21,568 -c--a-r c:\windows\system32\DRVSTORE\hpzipa13_DB40AE39DB38AD8D2AF2D8E4340ABA1C191DE2CE\drivers\dot4\Win2000\HPZius12.sys
+ 2007-03-07 05:20:37 282,624 -c--a-r c:\windows\system32\DRVSTORE\hpzipa13_DB40AE39DB38AD8D2AF2D8E4340ABA1C191DE2CE\HPZc3212.dll
+ 2007-03-07 05:20:49 16,496 -c--a-r c:\windows\system32\DRVSTORE\hpzipr13_9B62D8E7E43E761D5D4A9F1967C0FC868E8BC390\drivers\dot4\Win2000\HPZipr12.sys
+ 2007-03-07 05:20:45 309,760 -c--a-r c:\windows\system32\DRVSTORE\hpzius13_9B9B07948B5298EA9F9D379B539EC8677D74FF6B\drivers\dot4\Win2000\difxapi.dll
+ 2007-03-07 05:20:46 364,544 -c--a-r c:\windows\system32\DRVSTORE\hpzius13_9B9B07948B5298EA9F9D379B539EC8677D74FF6B\drivers\dot4\Win2000\hppldcoi.dll
+ 2007-03-07 05:20:48 49,920 -c--a-r c:\windows\system32\DRVSTORE\hpzius13_9B9B07948B5298EA9F9D379B539EC8677D74FF6B\drivers\dot4\Win2000\hpzid412.sys
+ 2007-03-07 05:20:49 16,496 -c--a-r c:\windows\system32\DRVSTORE\hpzius13_9B9B07948B5298EA9F9D379B539EC8677D74FF6B\drivers\dot4\Win2000\hpzipr12.sys
+ 2007-03-07 05:20:50 21,568 -c--a-r c:\windows\system32\DRVSTORE\hpzius13_9B9B07948B5298EA9F9D379B539EC8677D74FF6B\drivers\dot4\Win2000\HPZius12.sys
+ 2007-03-07 05:20:52 16,800 -c--a-r c:\windows\system32\DRVSTORE\hpzius13_9B9B07948B5298EA9F9D379B539EC8677D74FF6B\drivers\dot4\WinxP\Hppaufd0.sys
+ 2007-03-07 05:20:37 282,624 -c--a-r c:\windows\system32\DRVSTORE\hpzius13_9B9B07948B5298EA9F9D379B539EC8677D74FF6B\HPZc3212.dll
+ 2008-11-07 13:23:30 32,000 -c--a-w c:\windows\system32\DRVSTORE\usbaapl_246F92BBD6449C86FC3F3F28C40D59AC1F69C558\usbaapl.sys
- 2004-08-05 12:00:00 357,888 ----a-w c:\windows\system32\dxtmsft.dll
+ 2008-10-16 10:38:27 357,888 ----a-w c:\windows\system32\dxtmsft.dll
- 2004-08-05 12:00:00 201,728 ----a-w c:\windows\system32\dxtrans.dll
+ 2008-10-16 10:38:28 205,312 ----a-w c:\windows\system32\dxtrans.dll
- 2004-08-05 12:00:00 243,200 ----a-w c:\windows\system32\es.dll
+ 2008-07-07 20:31:48 253,952 ----a-w c:\windows\system32\es.dll
- 2004-08-05 12:00:00 55,808 ----a-w c:\windows\system32\extmgr.dll
+ 2008-10-16 10:38:28 55,808 ----a-w c:\windows\system32\extmgr.dll
- 2008-12-20 04:01:25 157,160 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2008-12-21 18:05:33 157,160 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2007-03-11 20:24:52 1,645,320 ----a-w c:\windows\system32\gdiplus.dll
+ 2006-11-08 15:35:38 49,152 ----a-w c:\windows\system32\HPZidr12.dll
+ 2006-11-08 15:35:36 43,520 ----a-w c:\windows\system32\HPZinw12.dll
+ 2006-11-08 15:35:38 53,248 ----a-w c:\windows\system32\HPZipm12.dll
+ 2006-11-08 15:35:40 33,280 ----a-w c:\windows\system32\HPZipr12.dll
+ 2006-11-08 15:35:40 29,696 ----a-w c:\windows\system32\hpzipt12.dll
+ 2006-11-08 15:35:40 20,480 ----a-w c:\windows\system32\hpzisn12.dll
- 2004-08-05 12:00:00 249,344 ----a-w c:\windows\system32\iepeers.dll
+ 2008-10-16 10:38:28 251,392 ----a-w c:\windows\system32\iepeers.dll
- 2004-08-05 12:00:00 678,400 ----a-w c:\windows\system32\inetcomm.dll
+ 2008-04-11 18:51:06 683,520 ----a-w c:\windows\system32\inetcomm.dll
- 2004-08-05 12:00:00 96,768 ----a-w c:\windows\system32\inseng.dll
+ 2008-10-16 10:38:28 96,768 ----a-w c:\windows\system32\inseng.dll
- 2004-08-05 12:00:00 450,560 ----a-w c:\windows\system32\jscript.dll
+ 2007-12-18 14:41:58 450,560 ----a-w c:\windows\system32\jscript.dll
- 2004-08-05 12:00:00 15,872 ----a-w c:\windows\system32\jsproxy.dll
+ 2008-10-16 10:38:29 16,384 ----a-w c:\windows\system32\jsproxy.dll
- 2006-10-18 19:03:58 100,864 ----a-w c:\windows\system32\logagent.exe
+ 2008-06-18 00:09:22 100,864 ----a-w c:\windows\system32\logagent.exe
+ 2007-03-11 20:24:50 190,072 ----a-r c:\windows\system32\Macromed\Flash\FlashUtil9b.exe
- 2004-08-05 12:00:00 73,728 ----a-w c:\windows\system32\mscms.dll
+ 2008-06-24 16:23:56 74,240 ----a-w c:\windows\system32\mscms.dll
- 2004-08-05 12:00:00 3,003,392 ----a-w c:\windows\system32\mshtml.dll
+ 2008-12-12 17:35:12 3,081,216 ----a-w c:\windows\system32\mshtml.dll
- 2004-08-05 12:00:00 448,512 ----a-w c:\windows\system32\mshtmled.dll
+ 2008-10-16 10:38:29 449,024 ----a-w c:\windows\system32\mshtmled.dll
- 2004-08-05 12:00:00 146,432 ----a-w c:\windows\system32\msrating.dll
+ 2008-10-16 10:38:28 146,432 ----a-w c:\windows\system32\msrating.dll
- 2006-10-18 20:47:16 414,208 ----a-w c:\windows\system32\msscp.dll
+ 2006-12-04 15:21:50 414,720 ----a-w c:\windows\system32\msscp.dll
- 2004-08-05 12:00:00 530,432 ----a-w c:\windows\system32\mstime.dll
+ 2008-10-16 10:38:28 532,480 ----a-w c:\windows\system32\mstime.dll
+ 2002-10-06 12:37:26 487,424 ----a-w c:\windows\system32\MSVCP70.DLL
+ 2007-03-11 20:24:52 499,712 ----a-w c:\windows\system32\msvcp71.dll
+ 2006-03-11 10:00:57 344,064 ----a-w c:\windows\system32\msvcr70.dll
+ 2003-02-21 14:42:22 348,160 ----a-w c:\windows\system32\msvcr71.dll
- 2004-08-05 12:00:00 1,236,480 ----a-w c:\windows\system32\msxml3.dll
+ 2008-09-04 16:45:11 1,106,944 ----a-w c:\windows\system32\msxml3.dll
+ 2007-03-08 19:38:58 82,432 ----a-w c:\windows\system32\msxml4r.dll
- 2004-08-05 12:00:00 332,288 ----a-w c:\windows\system32\netapi32.dll
+ 2008-10-15 16:59:28 332,800 ----a-w c:\windows\system32\netapi32.dll
- 2004-08-05 12:00:00 2,058,880 ----a-w c:\windows\system32\ntkrnlpa.exe
+ 2008-08-14 13:44:39 2,059,776 ----a-w c:\windows\system32\ntkrnlpa.exe
- 2004-08-05 12:00:00 2,183,040 ----a-w c:\windows\system32\ntoskrnl.exe
+ 2008-08-14 13:44:37 2,182,400 ----a-w c:\windows\system32\ntoskrnl.exe
- 2004-08-05 12:00:00 28,160 ----a-w c:\windows\system32\oobe\msoobe.exe
+ 2001-08-28 15:00:00 28,160 ----a-w c:\windows\system32\oobe\msoobe.exe
- 2004-08-05 12:00:00 39,424 ----a-w c:\windows\system32\pngfilt.dll
+ 2008-10-16 10:38:28 39,424 ----a-w c:\windows\system32\pngfilt.dll
- 2004-08-05 12:00:00 1,293,824 ----a-w c:\windows\system32\quartz.dll
+ 2008-05-07 05:15:36 1,293,824 ----a-w c:\windows\system32\quartz.dll
- 2004-08-05 12:00:00 1,483,776 ----a-w c:\windows\system32\shdocvw.dll
+ 2008-10-16 10:38:29 1,495,040 ----a-w c:\windows\system32\shdocvw.dll
- 2004-08-05 12:00:00 474,112 ----a-w c:\windows\system32\shlwapi.dll
+ 2008-10-16 10:38:29 474,624 ----a-w c:\windows\system32\shlwapi.dll
- 2006-09-25 16:58:48 14,640 ------w c:\windows\system32\spmsg.dll
+ 2007-11-30 11:19:06 18,296 ------w c:\windows\system32\spmsg.dll
+ 2007-03-26 09:17:44 2,862,592 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpbcfgre.dll
+ 2006-11-30 10:14:06 671,816 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpcdmc32.dll
+ 2007-02-22 18:35:00 314,880 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpfie5ha.dll
+ 2007-02-20 10:29:02 337,920 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpfig5ha.dll
+ 2006-12-06 15:31:56 113,152 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpfrs5ha.dll
+ 2007-03-28 11:53:28 977,920 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpz3c5ha.dll
+ 2007-03-28 13:01:08 1,739,264 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpz3r5ha.dll
+ 2007-03-28 13:01:28 233,472 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzc35ha.dll
+ 2007-03-28 12:59:04 446,976 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzev5ha.dll
+ 2007-03-28 13:00:22 5,189,120 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzla5ha.dll
+ 2007-03-28 12:57:04 782,848 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzle5ha.dll
+ 2007-03-28 12:59:20 299,520 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzpr5ha.dll
+ 2007-03-28 12:57:18 853,504 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzse5ha.dll
+ 2007-03-28 12:32:56 670,208 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzss5ha.dll
+ 2007-03-28 11:52:24 8,602,112 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzst5ha.dll
+ 2007-03-28 12:58:06 3,291,648 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzui5ha.dll
+ 2007-03-28 11:53:22 3,419,648 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzur5ha.dll
+ 2006-12-20 11:50:04 269,824 ----a-w c:\windows\system32\spool\drivers\w32x86\3\UNIDRV.DLL
+ 2006-12-20 11:48:34 208,384 ----a-w c:\windows\system32\spool\drivers\w32x86\3\UNIDRVUI.DLL
+ 2006-12-20 11:48:32 620,544 ----a-w c:\windows\system32\spool\drivers\w32x86\3\UNIRES.DLL
+ 2007-03-26 09:17:44 2,862,592 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpbcfgre.dll
+ 2006-11-30 10:14:06 671,816 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpcdmc32.dll
+ 2007-02-22 18:35:00 314,880 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpfie5ha.dll
+ 2007-02-20 10:29:02 337,920 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpfig5ha.dll
+ 2006-12-06 15:31:56 113,152 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpfrs5ha.dll
+ 2007-03-28 11:53:28 977,920 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpz3c5ha.dll
+ 2007-03-28 13:01:08 1,739,264 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpz3r5ha.dll
+ 2007-03-28 13:01:28 233,472 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpzc35ha.dll
+ 2007-03-28 12:59:04 446,976 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpzev5ha.dll
+ 2007-03-28 13:00:22 5,189,120 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpzla5ha.dll
+ 2007-03-28 12:57:04 782,848 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpzle5ha.dll
+ 2007-03-28 12:59:20 299,520 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpzpr5ha.dll
+ 2007-03-28 12:57:18 853,504 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpzse5ha.dll
+ 2007-03-28 12:32:56 670,208 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpzss5ha.dll
+ 2007-03-28 11:52:24 8,602,112 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpzst5ha.dll
+ 2007-03-28 12:58:06 3,291,648 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpzui5ha.dll
+ 2007-03-28 11:53:22 3,419,648 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\hpzur5ha.dll
+ 2006-12-20 11:50:04 269,824 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\UNIDRV.DLL
+ 2006-12-20 11:48:34 208,384 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\UNIDRVUI.DLL
+ 2006-12-20 11:48:32 620,544 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_f4100_seri8252\UNIRES.DLL
+ 2007-03-28 12:57:34 274,944 ----a-w c:\windows\system32\spool\prtprocs\w32x86\hpzpp5ha.dll
+ 2008-10-22 09:47:07 62,976 ------w c:\windows\system32\tzchange.exe
- 2004-08-05 12:00:00 603,136 ----a-w c:\windows\system32\urlmon.dll
+ 2008-10-16 10:38:30 617,984 ----a-w c:\windows\system32\urlmon.dll
- 2004-08-05 12:00:00 417,792 ----a-w c:\windows\system32\vbscript.dll
+ 2007-12-18 14:41:59 417,792 ----a-w c:\windows\system32\vbscript.dll
- 2004-08-05 12:00:00 1,836,032 ----a-w c:\windows\system32\win32k.sys
+ 2008-09-15 15:39:16 1,846,144 ----a-w c:\windows\system32\win32k.sys
- 2006-10-18 20:47:18 222,208 ----a-w c:\windows\system32\wmasf.dll
+ 2007-10-25 08:28:30 222,720 ----a-w c:\windows\system32\wmasf.dll
- 2006-10-18 20:47:20 937,984 ----a-w c:\windows\system32\WMNetMgr.dll
+ 2008-06-18 04:03:08 938,496 ----a-w c:\windows\system32\WMNetmgr.dll
- 2006-10-18 20:47:20 10,834,432 ----a-w c:\windows\system32\wmp.dll
+ 2007-06-11 22:51:12 10,834,944 ----a-w c:\windows\system32\wmp.dll
- 2006-10-18 20:47:20 295,936 ------w c:\windows\system32\wmpeffects.dll
+ 2008-06-24 17:12:58 295,936 ------w c:\windows\system32\wmpeffects.dll
- 2006-10-18 20:47:22 2,450,944 ----a-w c:\windows\system32\wmvcore.dll
+ 2008-06-18 04:03:14 2,458,112 ----a-w c:\windows\system32\WMVCore.dll
+ 2008-10-15 19:05:28 370,176 ------w c:\windows\system32\xpsp3res.dll
+ 2006-11-01 08:57:24 1,138,688 ----a-w c:\windows\system32\xvidcore.dll
+ 2006-02-26 09:08:28 585,728 ----a-w c:\windows\system32\xvidvfw.dll
+ 2008-12-21 18:34:40 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_658.dat
+ 2007-03-12 02:35:12 12,288 ----a-r c:\windows\Twunk_16.dll
+ 2007-03-12 02:35:12 12,288 ----a-r c:\windows\Twunk_32.dll
+ 2008-12-20 14:43:48 1,230,336 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.1.0.0_x-ww_b319d8da\msxml4.dll
+ 2008-09-30 15:42:08 1,286,152 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
+ 2008-12-20 14:43:49 82,432 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll
+ 2008-09-30 15:45:12 91,656 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
+ 2007-03-08 19:38:58 96,256 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_6e85597b\ATL80.dll
+ 2006-12-01 21:54:32 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-01 21:54:34 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-01 21:54:32 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2007-06-27 22:16:00 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_0de56c07\msvcm80.dll
+ 2007-06-27 22:16:02 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_0de56c07\msvcp80.dll
+ 2007-06-27 22:16:00 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_0de56c07\msvcr80.dll
+ 2007-03-08 19:38:58 1,093,632 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_decbdf0c\mfc80.dll
+ 2007-03-08 19:38:58 1,079,808 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_decbdf0c\mfc80u.dll
+ 2007-03-08 19:38:58 69,632 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_decbdf0c\mfcm80.dll
+ 2007-03-08 19:38:58 57,344 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_decbdf0c\mfcm80u.dll
+ 2007-03-11 20:32:42 40,960 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_341af80a\mfc80CHS.dll
+ 2007-03-11 20:32:42 45,056 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_341af80a\mfc80CHT.dll
+ 2007-03-11 20:32:42 65,536 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_341af80a\mfc80DEU.dll
+ 2007-03-11 20:32:42 57,344 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_341af80a\mfc80ENU.dll
+ 2007-03-11 20:32:42 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_341af80a\mfc80ESP.dll
+ 2007-03-11 20:32:42 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_341af80a\mfc80FRA.dll
+ 2007-03-11 20:32:42 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_341af80a\mfc80ITA.dll
+ 2007-03-11 20:32:42 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_341af80a\mfc80JPN.dll
+ 2007-03-11 20:32:42 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_341af80a\mfc80KOR.dll
+ 2008-04-15 17:56:59 1,724,416 ----a-w c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll
.
-- Instantané actualisé --
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]
"vamsoft"="c:\windows\system32\vamsoft.exe" [2008-12-21 118267]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-20 136600]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2006-06-19 262144]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-05-12 831488]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"VTTimer"="VTTimer.exe" [2005-03-08 c:\windows\system32\VTTimer.exe]
"S3Trayp"="S3trayp.exe" [2005-04-05 c:\windows\system32\S3Trayp.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-03-04 c:\windows\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 PStrip;PStrip;c:\windows\system32\drivers\pstrip.sys [2007-07-15 27992]
R3 S3G700;S3G700;c:\windows\system32\DRIVERS\S3G700m.sys [2008-12-20 792576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Namida no baka\Application Data\Mozilla\Firefox\Profiles\fm8rwjij.default\
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll

[color=red]ATTENTION: FIREFOX POLICES IS IN FORCE /color
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-21 19:35:16
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Heure de fin: 2008-12-21 19:39:32 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-12-21 18:39:30
ComboFix2.txt 2008-12-20 12:38:37

Avant-CF: 152 131 248 128 octets libres
Après-CF: 152,082,976,768 octets libres

574 --- E O F --- 2008-12-21 05:06:40

ZHPDiag:
Rapport de ZHPDiag v1.16 par Nicolas Coolman
Enregistré le 2008-12-21 19:47:12
Platform : Microsoft Windows XP (5.1.2600) Service Pack 2
MSIE: Internet Explorer v6.0.2900.2180
MFIE: Mozilla Firefox (3.0.5)

---\\ Processus lancés
VTTimer.exe
S3trayp.exe
RTHDCPL.EXE
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\services.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\spoolsv.exe

---\\ Pages de démarrage d'Internet Explorer (R0)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr

---\\ Pages de recherche d'Internet Explorer (R1)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll

---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll

---\\ Applications démarrées automatiquement par le registre (O4)
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [vamsoft] C:\WINDOWS\system32\vamsoft.exe
O4 - HKLM\..\policies\Explorer: [NoDriveAutoRun] Data="67108863"
O4 - HKLM\..\policies\Explorer: [NoDriveTypeAutoRun] Data="323"
O4 - HKLM\..\policies\Explorer: [NoDrives] Data="0"
O4 - Global Startup: HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe,302
O9 - Extra 'Tools' menuitem: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll,208
O9 - Extra 'Tools' menuitem: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll,210
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll,208
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll,210
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe,302

---\\ Protocole additionnel et piratage de protocole (O18)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

---\\ Services NT non Microsoft et non désactivés (O23)
O23 - Service: Apple Mobile Device (Apple Mobile Device) - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - C:\Program Files\Java\jre6\bin\jqs.exe -service -config C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf
O23 - Service: Spouleur d'impression (Spooler) - C:\WINDOWS\system32\spoolsv.exe

---\\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: Microsoft Windows Media Player - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
O40 - ASIC: Internet Explorer - {26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE
O40 - ASIC: Personnalisation du navigateur - {60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
O40 - ASIC: Outlook Express - {881dd1c5-3dcf-431b-b061-f3f88e8be88a} - C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE
O40 - ASIC: Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - (not file)
O40 - ASIC: Rendu VML (Vector Graphics Rendering) - {10072CEC-8CC1-11D1-986E-00A0C955B42F} - (not file)
O40 - ASIC: (no name) - {11FC12D0-1A72-12D2-992D-5BC14F992BC7} - (not file)
O40 - ASIC: Microsoft NetShow Player - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: Microsoft Windows Media Player 6.4 - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: DirectAnimation - {283807B5-2C60-11D0-A31D-00AA00B92C03} - C:\WINDOWS\system32\danim.dll
O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - C:\WINDOWS\system32\regsvr32.exe /s /n /i:/UserInstall C:\WINDOWS\system32\themeui.dll
O40 - ASIC: Liaison de données Dynamic HTML pour Java - {36f8ec70-c29a-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Logiciel de navigation hors connexion - {3af36230-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Uniscribe - {3bf42070-b3b1-11d1-b5c5-0000f8051515} - (not file)
O40 - ASIC: Création avancée - {4278c270-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Microsoft Outlook Express 6 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
O40 - ASIC: DirectShow - {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - (not file)
O40 - ASIC: DirectDrawEx - {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - (not file)
O40 - ASIC: Aide sur Internet Explorer - {45ea75a0-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Classes Java DirectAnimation - {4f216970-c90c-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Microsoft Windows Script 5.6 - {4f645220-306d-11d2-995d-00c04f98bbc9} - (not file)
O40 - ASIC: Windows Messenger 4.7 - {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
O40 - ASIC: (no name) - {5A8D6EE0-3E18-11D0-821E-444553540000} - (not file)
O40 - ASIC: Outils d'installation Internet Explorer - {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Améliorations pour la navigation - {630b1da0-b465-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
O40 - ASIC: Accès au site MSN - {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - (not file)
O40 - ASIC: Carnet d'adresses 6 - {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
O40 - ASIC: Mise à jour du Bureau Windows - {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
O40 - ASIC: Internet Explorer 6 - {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe
O40 - ASIC: Liaison de données Dynamic HTML - {9381D8F2-0288-11D0-9501-00AA00B911A5} - (not file)
O40 - ASIC: (no name) - {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - (not file)
O40 - ASIC: Polices de base Internet Explorer - {C9E9A340-D1F1-11D0-821E-444553540600} - (not file)
O40 - ASIC: Planificateur de tâches - {CC2A9BA0-3BDD-11D0-821E-444553540000} - (not file)
O40 - ASIC: (no name) - {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - (not file)
O40 - ASIC: Macromedia Shockwave Flash - {D27CDB6E-AE6D-11cf-96B8-444553540000} - C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx
O40 - ASIC: Aide HTML - {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Active Directory Service Interface - {E92B03AB-B707-11d2-9CBD-0000F87A369E} - (not file)

---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: Suppresseur d'écho acoustique (Noyau Microsoft) (aec) - C:\WINDOWS\system32\drivers\aec.sys
O41 - Driver: Pilote de média asynchrone RAS (AsyncMac) - C:\WINDOWS\system32\DRIVERS\asyncmac.sys
O41 - Driver: Protocole client ATM ARP (Atmarpc) - C:\WINDOWS\system32\DRIVERS\atmarpc.sys
O41 - Driver: Pilote audio Stub (audstub) - C:\WINDOWS\system32\DRIVERS\audstub.sys
O41 - Driver: Décodeur sous-titre fermé (ccdecode) - C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
O41 - Driver: (no object) (dmboot) - C:\WINDOWS\System32\drivers\dmboot.sys
O41 - Driver: (no object) (dmio) - C:\WINDOWS\System32\drivers\dmio.sys
O41 - Driver: (no object) (dmload) - C:\WINDOWS\System32\drivers\dmload.sys
O41 - Driver: Synthétiseur DLS du noyau Microsoft (DMusic) - C:\WINDOWS\system32\drivers\DMusic.sys
O41 - Driver: Filtre de décodeur DRM (Noyau Microsoft) (drmkaud) - C:\WINDOWS\system32\drivers\drmkaud.sys
O41 - Driver: VIA Rhine-Family Fast Ethernet Adapter Driver Service (FETND5BV) - C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys
O41 - Driver: Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet (FETNDIS) - C:\WINDOWS\system32\DRIVERS\fetnd5.sys
O41 - Driver: FltMgr (FltMgr) - C:\WINDOWS\system32\DRIVERS\fltMgr.sys
O41 - Driver: Filtre AGP version 3.0 générique Microsoft pour plates-formes à base de processeur K8 (gagp30kx) - C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
O41 - Driver: GEAR ASPI Filter Driver (GEARAspiWDM) - C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
O41 - Driver: Classificateur de paquets générique (Gpc) - C:\WINDOWS\system32\DRIVERS\msgpc.sys
O41 - Driver: Microsoft UAA Bus Driver for High Definition Audio (HDAudBus) - C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
O41 - Driver: Pilote de classe HID Microsoft (hidusb) - C:\WINDOWS\system32\DRIVERS\hidusb.sys
O41 - Driver: IEEE-1284.4 Driver HPZid412 (HPZid412) - C:\WINDOWS\system32\DRIVERS\HPZid412.sys
O41 - Driver: Print Class Driver for IEEE-1284.4 HPZipr12 (HPZipr12) - C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
O41 - Driver: USB to IEEE-1284.4 Translation Driver HPZius12 (HPZius12) - C:\WINDOWS\system32\DRIVERS\HPZius12.sys
O41 - Driver: Service for Realtek HD Audio (WDM) (IntcAzAudAddService) - C:\WINDOWS\system32\drivers\RtkHDAud.sys
O41 - Driver: Pilote du pare-feu Windows IPv6 (Ip6Fw) - C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
O41 - Driver: Pilote de filtre de trafic IP (IpFilterDriver) - C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
O41 - Driver: Pilote de tunnelage IP dans IP (IpInIp) - C:\WINDOWS\system32\DRIVERS\ipinip.sys
O41 - Driver: Pilote IPSEC (IPSec) - C:\WINDOWS\system32\DRIVERS\ipsec.sys
O41 - Driver: Servic

bon ....

tu viens de te réinfecté par un support amovible !!!

tu n'as pas mit une clé USB ou autre depuis la dernière manipe que je t'ai donnée ?!

En tout cas il va falloir retraiter !

donc fais ceci :

1- Supprime proprement l'anscienne version de UsbFix que tu as ainsi :

* Va sur " démarrer " / "tous les programmes" / "UsbFix" --> clique sur "Uninstal Usbfix" .

* Ou bien rends toi dans ce dossier > C:\Program Files\UsbFix .
là tu double-cliques sur le fichier " Uninstal.exe " pour désinstaller proprement l'outil ...

2- On reprends avec la dernière version :

Télécharge UsbFix ( de Chiquitine29 et Chimay8 ) sur ton bureau :

http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

! Déconnecte toi d'internet et ferme toutes applications en cours !

--> Double-clique sur l' .exe pour lancer l'installation de l'outil ( ne touche pas aux paramètres d'installe ) .

IMPERATIF:
Branche toutes tes unités externes à ton PC (clé USB, DD externe, flash disk, lecteur MP3, etc...) succeptibles d'avoir été infectés, ainsi que les CD et DVD rom dont tu te sers éventuellement le plus souvent ( mais sans les ouvrir ! ) .

--> Double-clique sur le raccourci "UsbFix" qui est sur ton bureau pour lancer l'outil :

* Tape sur 1 ( option " nettoyage " ) puis sur [entrée] et suis les instructions ...

--> Le pc va redémarrer ... laisse travailler l'outil et ne touche à rien ...
( Note : pour les unités externes non utlisées, clique sur "continuer" lors du message d'avertissement )

--> Une fois de retour à ton bureau , attends le message de fin du nettoyage ,
puis appuie sur une touche pour que le rapport "UsbFix.txt" s'affiche .

Fais un copier/coller de son contenu dans ta prochaine réponse pour analyse et attends la suite ....

( Note : le rapport UsbFix.txt est sauvegardé a la racine du disque dur > C:\UsbFix.txt )

PS : Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier"-> "Nouvelle tâche":
tape explorer.exe et valides .