Virus/rapport hijackthis

Salut , voici les rapports que tu ma demander :

query.dll:

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.10.20 -
AhnLab-V3 5.0.0.2 2009.10.20 -
AntiVir 7.9.1.35 2009.10.20 -
Antiy-AVL 2.0.3.7 2009.10.21 -
Authentium 5.1.2.4 2009.10.21 -
Avast 4.8.1351.0 2009.10.20 -
AVG 8.5.0.420 2009.10.20 -
BitDefender 7.2 2009.10.21 -
CAT-QuickHeal 10.00 2009.10.20 -
ClamAV 0.94.1 2009.10.21 -
Comodo 2675 2009.10.21 -
DrWeb 5.0.0.12182 2009.10.21 -
eSafe 7.0.17.0 2009.10.19 -
eTrust-Vet 35.1.7075 2009.10.19 -
F-Prot 4.5.1.85 2009.10.20 -
F-Secure 9.0.15300.0 2009.10.20 -
Fortinet 3.120.0.0 2009.10.21 -
GData 19 2009.10.21 -
Ikarus T3.1.1.72.0 2009.10.21 -
Jiangmin 11.0.800 2009.10.20 -
K7AntiVirus 7.10.875 2009.10.20 -
Kaspersky 7.0.0.125 2009.10.21 -
McAfee 5777 2009.10.20 -
McAfee+Artemis 5777 2009.10.20 -
McAfee-GW-Edition 6.8.5 2009.10.21 -
Microsoft 1.5101 2009.10.20 -
NOD32 4527 2009.10.20 -
Norman 6.03.02 2009.10.20 -
nProtect 2009.1.8.0 2009.10.20 -
Panda 10.0.2.2 2009.10.20 -
PCTools 4.4.2.0 2009.10.19 -
Prevx 3.0 2009.10.21 -
Rising 21.52.20.00 2009.10.21 -
Sophos 4.46.0 2009.10.21 -
Sunbelt 3.2.1858.2 2009.10.20 -
Symantec 1.4.4.12 2009.10.21 -
TheHacker 6.5.0.2.049 2009.10.20 -
TrendMicro 8.950.0.1094 2009.10.21 -
VBA32 3.12.10.11 2009.10.20 -
ViRobot 2009.10.21.1997 2009.10.21 -
VirusBuster 4.6.5.0 2009.10.20 -
Information additionnelle
File size: 1440768 bytes
MD5...: 93249c0ccee363056b06d8e7094bee4d
SHA1..: 38bc59008991d82728ec445c033294388af43a79
SHA256: 1e3beab65ce3bef481fe255dd7436aec4968a6f379d89114f8c1f5972a44ab76
ssdeep: 24576:8NYLh980E3yiF2XjYmt1T/reWHWaWSp9A9cTpSeYqqe2RrB29+S:8CLhXH
PjYE1T/rYaWSo9cdSe9qea09+S

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xf3799
timedatestamp.....: 0x4a60a3f3 (Fri Jul 17 16:16:51 2009)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x13f0ff 0x13f200 6.49 0e5a2a8436fffae8a5a897d8a8454192
.orpc 0x141000 0x33 0x200 0.84 ac63cc8d495b3762bb7a9a0cb6ac8222
.data 0x142000 0xa73c 0x7a00 3.46 f35852a808dca498d69f94151d089f17
.rsrc 0x14d000 0x81e4 0x8200 3.51 92b77ce30d25f4c43209c9c22a546ae3
.reloc 0x156000 0x1062a 0x10800 6.11 75bbdfdda92f7a3c07b4ddb40c4156d2

( 10 imports )
> msvcrt.dll: _terminate@@YAXXZ, _onexit, __dllonexit, __1type_info@@UAE@XZ, __3@YAXPAX@Z, _adjust_fdiv, _initterm, sprintf, _except_handler3, strcspn, wcsncmp, _ultow, mbstowcs, free, realloc, malloc, _wcslwr, bsearch, iswalpha, _errno, _itow, _wfopen, wcsspn, isalpha, strtoul, strchr, strncpy, toupper, towupper, _wcsupr, towlower, iswdigit, wcstod, swscanf, iswspace, fgets, fclose, qsort, _strnicmp, _stricmp, wcscspn, isdigit, _ftol, _wcsnicmp, wcsncpy, wcsstr, memmove, wcsrchr, wcstoul, wcstombs, _wsplitpath, _wcsicmp, isxdigit, wcstol, wcschr, wcscat, wcscmp, _CxxThrowException, wcscpy, __CxxFrameHandler, swprintf, wcslen, __set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
> ntdll.dll: RtlCaptureStackBackTrace, NtQuerySystemInformation, NtQuerySystemTime, NtSetInformationFile, NtCreateEvent, NtWaitForSingleObject, NtQueryInformationProcess, NtQuerySecurityObject, NtNotifyChangeDirectoryFile, NtCancelIoFile, NtQueryDirectoryFile, NtQueryInformationFile, NtOpenFile, NtQueryVolumeInformationFile, NtOpenProcessToken, NtOpenThreadToken, NtQueryInformationToken, NtDuplicateToken, RtlInitAnsiString, RtlUpcaseUnicodeChar, RtlQueryRegistryValues, NtNotifyChangeKey, NtOpenKey, RtlDosPathNameToNtPathName_U, NtCreateFile, RtlFreeHeap, NtFsControlFile, NtDeviceIoControlFile, RtlInitUnicodeString, RtlOemStringToUnicodeString, RtlUnicodeStringToOemString, NtClose, RtlNtStatusToDosError
> USER32.dll: GetLastInputInfo, PeekMessageW, MsgWaitForMultipleObjects, TranslateMessage, DispatchMessageW, RegisterDeviceNotificationW, UnregisterDeviceNotification, wsprintfW
> RPCRT4.dll: CStdStubBuffer_CountRefs, NdrCStdStubBuffer_Release, NdrDllRegisterProxy, UuidFromStringW, NdrDllGetClassObject, NdrOleAllocate, NdrOleFree, IUnknown_QueryInterface_Proxy, IUnknown_AddRef_Proxy, IUnknown_Release_Proxy, CStdStubBuffer_QueryInterface, CStdStubBuffer_AddRef, CStdStubBuffer_Connect, CStdStubBuffer_Disconnect, CStdStubBuffer_Invoke, CStdStubBuffer_IsIIDSupported, NdrDllUnregisterProxy, CStdStubBuffer_DebugServerQueryInterface, CStdStubBuffer_DebugServerRelease
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> SHELL32.dll: SHGetDesktopFolder, SHBindToParent
> SHLWAPI.dll: -
> KERNEL32.dll: ReadFileEx, WriteFileEx, WaitForMultipleObjectsEx, OpenEventW, TryEnterCriticalSection, GlobalLock, DisconnectNamedPipe, CancelIo, CreateNamedPipeW, ConnectNamedPipe, PeekNamedPipe, QueueUserAPC, GetVersionExW, SetPriorityClass, OpenProcess, DuplicateHandle, ReadProcessMemory, GetThreadTimes, LocalFileTimeToFileTime, GetLocalTime, GetSystemPowerStatus, GetStringTypeW, CreateProcessW, SwitchToThread, IsDBCSLeadByteEx, GetCPInfo, SetNamedPipeHandleState, WaitNamedPipeW, TransactNamedPipe, InitializeCriticalSectionAndSpinCount, HeapAlloc, HeapFree, HeapSize, IsBadWritePtr, HeapDestroy, HeapCreate, GetExitCodeProcess, GlobalUnlock, LoadLibraryExW, GetThreadPriority, WaitForMultipleObjects, SetThreadPriority, GetLogicalDrives, GetSystemDirectoryW, CompareFileTime, SetProcessWorkingSetSize, GetComputerNameW, OpenFileMappingW, VirtualUnlock, MoveFileW, CopyFileW, SleepEx, ResumeThread, SetErrorMode, InterlockedCompareExchange, GetSystemInfo, ReleaseMutex, CreateMutexW, InterlockedExchange, lstrlenA, GetCurrentThread, SearchPathW, GetCalendarInfoW, GetSystemTime, GetFileAttributesExW, SetCurrentDirectoryW, GetCurrentDirectoryW, CompareStringW, FoldStringW, FileTimeToSystemTime, SystemTimeToFileTime, CreateThread, VirtualAlloc, VirtualFree, GetThreadLocale, SetThreadLocale, GetModuleHandleW, FormatMessageW, GetUserDefaultLCID, IsValidLocale, GetSystemDefaultLCID, WaitForSingleObject, GetACP, MultiByteToWideChar, WideCharToMultiByte, SetEvent, DisableThreadLibraryCalls, LoadLibraryW, GetLocaleInfoW, ExpandEnvironmentStringsW, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, InterlockedDecrement, InterlockedIncrement, SetLastError, GetModuleFileNameW, FreeLibrary, GetProcAddress, LoadLibraryA, Sleep, RemoveDirectoryW, FindClose, FindNextFileW, DeleteFileW, FindFirstFileW, LocalFree, GetLastError, LCMapStringW, GetFileAttributesW, SetFileAttributesW, CreateDirectoryW, DeviceIoControl, CreateFileW, QueryDosDeviceW, GetDriveTypeW, GetLongPathNameW, LocalAlloc, GlobalFree, GlobalAlloc, GetVolumeInformationW, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetDiskFreeSpaceW, GetDiskFreeSpaceExW, CloseHandle, CreateFileMappingW, WriteFile, UnmapViewOfFile, FlushViewOfFile, FlushFileBuffers, CreateEventW, ResetEvent, WaitForSingleObjectEx, SetEndOfFile, SetFilePointer, GetOverlappedResult, ReadFile, GetFileSize, MapViewOfFile
> ADVAPI32.dll: SetFileSecurityW, LsaNtStatusToWinError, LsaRetrievePrivateData, LsaFreeMemory, LsaOpenPolicy, LsaCreateSecret, LsaOpenSecret, LsaClose, LsaSetSecret, QueryServiceConfigW, RegConnectRegistryW, ChangeServiceConfigW, ControlService, StartServiceW, RegEnumValueW, RegOpenKeyExW, OpenSCManagerW, OpenServiceW, RegEnumKeyExW, RegDeleteValueW, RegQueryValueExW, QueryServiceStatus, CloseServiceHandle, RegOpenKeyW, RegCreateKeyExW, RegSetValueExW, RegCloseKey, RegDeleteKeyW, AddAce, InitializeSecurityDescriptor, InitializeAcl, FreeSid, AllocateAndInitializeSid, CopySid, GetLengthSid, RegEnumKeyW, RegOpenKeyA, ImpersonateLoggedOnUser, RevertToSelf, RegisterEventSourceW, DeregisterEventSource, ReportEventW, SetNamedSecurityInfoW, GetNamedSecurityInfoW, AccessCheck, LogonUserW, OpenThreadToken, SetServiceStatus, RegisterServiceCtrlHandlerExW, SetSecurityDescriptorDacl, GetSecurityDescriptorLength, ImpersonateNamedPipeClient, SetSecurityDescriptorSacl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, RegQueryInfoKeyW, AddAccessAllowedAce, GetUserNameW
> ole32.dll: CoGetClassObject, CoCreateInstance, PropSysFreeString, PropSysAllocString, StringFromGUID2, StgConvertPropertyToVariant, StgOpenStorage, PropVariantClear, PropVariantCopy, CoFileTimeNow, CoSetProxyBlanket, CreateBindCtx, FreePropVariantArray, StgConvertVariantToProperty, StgPropertyLengthAsVariant, CoUninitialize, CoInitializeEx, CoFreeUnusedLibraries, CreateStreamOnHGlobal, CLSIDFromString, CoTaskMemAlloc, CoTaskMemFree, GetClassFile

( 823 exports )
__0CAllocStorageVariant@@QAE@AAUtagPROPVARIANT@@AAVPMemoryAllocator@@@Z, __0CAllocStorageVariant@@QAE@AAVPDeSerStream@@AAVPMemoryAllocator@@@Z, __0CAllocStorageVariant@@QAE@PBDAAVPMemoryAllocator@@@Z, __0CAllocStorageVariant@@QAE@PBGAAVPMemoryAllocator@@@Z, __0CAllocStorageVariant@@QAE@PBU_GUID@@AAVPMemoryAllocator@@@Z, __0CAllocStorageVariant@@QAE@W4VARENUM@@KAAVPMemoryAllocator@@@Z, __0CCatState@@QAE@XZ, __0CCategorizationSet@@QAE@ABV0@@Z, __0CCategorizationSet@@QAE@I@Z, __0CCiAdminParams@@QAE@PAVCLangList@@@Z, __0CCiRegParams@@QAE@PBG@Z, __0CColumnSet@@QAE@I@Z, __0CColumns@@QAE@ABV0@@Z, __0CColumns@@QAE@I@Z, __0CDFA@@QAE@PBGAAVCTimeLimit@@E@Z, __0CDbColId@@QAE@ABU_GUID@@PBG@Z, __0CDbColId@@QAE@ABUtagDBID@@@Z, __0CDbColId@@QAE@ABV0@@Z, __0CDbColId@@QAE@XZ, __0CDbColumnNode@@QAE@ABUtagDBID@@H@Z, __0CDbColumns@@QAE@I@Z, __0CDbContentRestriction@@QAE@PBGABUtagDBID@@KK@Z, __0CDbContentRestriction@@QAE@PBGABVCDbColumnNode@@KK@Z, __0CDbNatLangRestriction@@QAE@PBGABUtagDBID@@K@Z, __0CDbNatLangRestriction@@QAE@PBGABVCDbColumnNode@@K@Z, __0CDbPropIDSet@@QAE@XZ, __0CDbQueryResults@@QAE@XZ, __0CDbSelectNode@@QAE@XZ, __0CDbSortSet@@QAE@I@Z, __0CDefColumnRegEntry@@QAE@XZ, __0CDriveInfo@@QAE@PBGK@Z, __0CDynStream@@QAE@PAVPMmStream@@@Z, __0CEventItem@@QAE@GGKGKPBX@Z, __0CEventLog@@QAE@PBG0@Z, __0CException@@QAE@XZ, __0CFileBuffer@@QAE@AAVCFileMapView@@I@Z, __0CFileMapView@@QAE@PBG@Z, __0CFilterDaemon@@QAE@AAVCiProxy@@AAVCCiFrameworkParams@@AAVCLangList@@PAEKPAUICiCFilterClient@@@Z, __0CFullPath@@QAE@PBG@Z, __0CFullPath@@QAE@PBGI@Z, __0CFullPropSpec@@QAE@AAVPDeSerStream@@@Z, __0CFullPropSpec@@QAE@ABV0@@Z, __0CFwAsyncWorkItem@@QAE@AAVCWorkManager@@AAVCWorkQueue@@@Z, __0CFwEventItem@@QAE@GKGKPAX@Z, __0CGenericCiProxy@@QAE@AAVCSharedNameGen@@KK@Z, __0CGetDbProps@@QAE@XZ, __0CImpersonateRemoteAccess@@QAE@PAVCImpersonationTokenCache@@@Z, __0CImpersonationTokenCache@@QAE@PBG@Z, __0CIndexTable@@QAE@AAVCiStorage@@AAVCTransaction@@@Z, __0CInternalPropertyRestriction@@QAE@KKABVCStorageVariant@@PAVCRestriction@@@Z, __0CKeyArray@@QAE@HH@Z, __0CLangList@@QAE@PAUICiCLangRes@@K@Z, __0CLocalGlobalPropertyList@@QAE@K@Z, __0CLocalGlobalPropertyList@@QAE@PAVCEmptyPropertyList@@HPBGK@Z, __0CMachineAdmin@@QAE@PBGH@Z, __0CMemSerStream@@QAE@I@Z, __0CMemSerStream@@QAE@PAEK@Z, __0CMetaDataMgr@@QAE@HW4CiVRootTypeEnum@@KPBG@Z, __0CMmStream@@QAE@KH@Z, __0CMmStreamConsecBuf@@QAE@XZ, __0CNatLanguageRestriction@@QAE@PBGABVCFullPropSpec@@K@Z, __0CNodeRestriction@@QAE@KI@Z, __0CNormalizer@@QAE@AAVPNoiseList@@@Z, __0CPathParser@@QAE@PBGK@Z, __0CPerfMon@@QAE@PBG@Z, __0CPersDeComp@@QAE@AAVPDirectory@@KAAVCPhysIndex@@KHH@Z, __0CPhysStorage@@IAE@AAVPStorage@@AAVPStorageObject@@KIPAVPMmStream@@HIH@Z, __0CPhysStorage@@IAE@AAVPStorage@@AAVPStorageObject@@KPAVPMmStream@@W4EOpenMode@1@HIH@Z, __0CPidLookupTable@@QAE@XZ, __0CPidRemapper@@QAE@ABVCPidMapper@@AAV_$XInterface@UIPropertyMapper@@@@PAVCRestriction@@PAVCColumnSet@@PAVCSortSet@@@Z, __0CPropListFile@@QAE@PAVCEmptyPropertyList@@HPBGK@Z, __0CPropNameArray@@QAE@AAVPDeSerStream@@@Z, __0CPropNameArray@@QAE@I@Z, __0CPropStoreManager@@QAE@K@Z, __0CPropertyRestriction@@QAE@KABVCFullPropSpec@@ABVCStorageVariant@@@Z, __0CPropertyRestriction@@QAE@XZ, __0CPropertyStoreWids@@QAE@AAVCPropStoreManager@@@Z, __0CPropertyValueParser@@QAE@AAVCQueryScanner@@GK@Z, __0CQMemSerStream@@QAE@I@Z, __0CQueryScanner@@QAE@PBGHKH@Z, __0CRangeKeyRepository@@QAE@XZ, __0CRangeRestriction@@QAE@XZ, __0CRcovStrmAppendTrans@@QAE@AAVPRcovStorageObj@@@Z, __0CRcovStrmMDTrans@@QAE@AAVPRcovStorageObj@@W4MDOp@0@K@Z, __0CRcovStrmTrans@@IAE@AAVPRcovStorageObj@@W4RcovOpType@@@Z, __0CRegAccess@@QAE@KPBG@Z, __0CRegChangeEvent@@QAE@PBGH@Z, __0CRegNotify@@QAE@PBG@Z, __0CRequestClient@@QAE@PBGPAUIDBProperties@@@Z, __0CRequestQueue@@QAE@IIIHIIABU_GUID@@@Z, __0CScopeRestriction@@QAE@PBGHH@Z, __0CSdidLookupTable@@QAE@XZ, __0CSizeSerStream@@QAE@XZ, __0CSort@@QAE@I@Z, __0CSortSet@@QAE@I@Z, __0CStandardPropMapper@@QAE@XZ, __0CSvcQuery@@QAE@PBGPAUIDBProperties@@@Z, __0CSynRestriction@@QAE@ABVCKey@@KKKH@Z, __0CTimeLimit@@QAE@KK@Z, __0CTransaction@@QAE@XZ, __0CUnfilteredRestriction@@QAE@XZ, __0CValueNormalizer@@QAE@AAVPKeyRepository@@@Z, __0CVirtualString@@QAE@I@Z, __0CWin32RegAccess@@QAE@PAUHKEY__@@PBG@Z, __0CWordRestriction@@QAE@ABVCKeyBuf@@KKKH@Z, __0CWorkQueue@@QAE@IW4WorkQueueType@0@@Z, __0CiStorage@@QAE@PBGAAUICiCAdviseStatus@@KKH@Z, __0SStorageObject@@QAE@PAVPStorageObject@@@Z, __1_$XPtr@VCDbCmdTreeNode@@@@QAE@XZ, __1_$XPtr@VCDbColumnNode@@@@QAE@XZ, __1_$XPtr@VCDbProjectListAnchor@@@@QAE@XZ, __1_$XPtr@VCDbProjectListElement@@@@QAE@XZ, __1CAllocStorageVariant@@IAE@XZ, __1CCatState@@QAE@XZ, __1CCatalogAdmin@@QAE@XZ, __1CCatalogEnum@@QAE@XZ, __1CColumns@@QAE@XZ, __1CContentRestriction@@QAE@XZ, __1CDFA@@QAE@XZ, __1CDbCmdTreeNode@@QAE@XZ, __1CDbColumns@@QAE@XZ, __1CDbContentBaseRestriction@@QAE@XZ, __1CDbProp@@QAE@XZ, __1CDbPropBaseRestriction@@QAE@XZ, __1CDbPropIDSet@@QAE@XZ, __1CDbPropSet@@QAE@XZ, __1CDbQueryResults@@QAE@XZ, __1CDbSortKey@@QAE@XZ, __1CDbSortSet@@QAE@XZ, __1CDynStream@@QAE@XZ, __1CEventItem@@QAE@XZ, __1CEventLog@@QAE@XZ, __1CFileMapView@@QAE@XZ, __1CFilterDaemon@@QAE@XZ, __1CFullPropSpec@@QAE@XZ, __1CFwAsyncWorkItem@@UAE@XZ, __1CFwEventItem@@QAE@XZ, __1CGenericCiProxy@@UAE@XZ, __1CImpersonateClient@@QAE@XZ, __1CImpersonateSystem@@QAE@XZ, __1CImpersonationTokenCache@@QAE@XZ, __1CInternalPropertyRestriction@@QAE@XZ, __1CKeyArray@@QAE@XZ, __1CLangList@@QAE@XZ, __1CMachineAdmin@@QAE@XZ, __1CMemSerStream@@UAE@XZ, __1CMetaDataMgr@@QAE@XZ, __1CMmStream@@UAE@XZ, __1CNatLanguageRestriction@@QAE@XZ, __1CNodeRestriction@@QAE@XZ, __1CNotRestriction@@QAE@XZ, __1COccRestriction@@QAE@XZ, __1CParseCommandTree@@QAE@XZ, __1CPerfMon@@QAE@XZ, __1CPhraseRestriction@@QAE@XZ, __1CPhysStorage@@UAE@XZ, __1CPidLookupTable@@QAE@XZ, __1CPidRemapper@@QAE@XZ, __1CProcess@@QAE@XZ, __1CPropStoreManager@@QAE@XZ, __1CPropertyList@@UAE@XZ, __1CPropertyRestriction@@QAE@XZ, __1CPropertyStore@@QAE@XZ, __1CPropertyStoreWids@@QAE@XZ, __1CQMemSerStream@@UAE@XZ, __1CQueryUnknown@@QAE@XZ, __1CRangeKeyRepository@@UAE@XZ, __1CRangeRestriction@@QAE@XZ, __1CRegChangeEvent@@QAE@XZ, __1CRegNotify@@MAE@XZ, __1CRestriction@@QAE@XZ, __1CScopeAdmin@@QAE@XZ, __1CScopeEnum@@QAE@XZ, __1CScopeRestriction@@QAE@XZ, __1CSdidLookupTable@@QAE@XZ, __1CSizeSerStream@@UAE@XZ, __1CSort@@QAE@XZ, __1CSynRestriction@@QAE@XZ, __1CVirtualString@@QAE@XZ, __1CWin32RegAccess@@QAE@XZ, __1CWordRestriction@@QAE@XZ, __1CWorkManager@@QAE@XZ, __1CWorkQueue@@QAE@XZ, __1SStorageObject@@QAE@XZ, __3CDbCmdTreeNode@@SGXPAX@Z, __3CDbColId@@SGXPAX@Z, __3CDbContent@@SGXPAX@Z, __3CDbParameter@@SGXPAX@Z, __3CDbPropSet@@SGXPAX@Z, __4CDbByGuid@@QAEAAV0@ABV0@@Z, __4CDbColId@@QAEAAV0@ABV0@@Z, __8CDbColId@@QBEHABV0@@Z, _AbortWorkItems@CWorkManager@@QAEXXZ, _Accept@CQueryScanner@@QAEXXZ, _AcceptCommand@CQueryScanner@@QAEXXZ, _AcceptWord@CQueryScanner@@QAEXXZ, _AccessCheck@CSdidLookupTable@@QAEHKPAXKAAH@Z, _AcqBuf@CQMemSerStream@@QAEPAEXZ, _AcqLine@CQueryScanner@@QAEPAGH@Z, _AcqPath@CQueryScanner@@QAEPAGXZ, _AcqPhrase@CQueryScanner@@QAEPAGXZ, _AcqRst@CRangeKeyRepository@@QAEPAVCRangeRestriction@@XZ, _AcqWord@CQueryScanner@@QAEPAGXZ, _AcquireRead@CPropertyStore@@AAEXAAVCReadWriteLockRecord@@@Z, _Add@CDbColumns@@QAEHABVCDbColId@@I@Z, _Add@CDbQueryResults@@QAEXPAGK@Z, _Add@CDbSortSet@@QAEHABVCDbColId@@KI@Z, _Add@CDbSortSet@@QAEHABVCDbSortKey@@I@Z, _Add@CKeyArray@@QAEHHABVCKey@@@Z, _Add@CKeyArray@@QAEHHABVCKeyBuf@@@Z, _Add@CWorkQueue@@QAEXPAVPWorkItem@@@Z, _AddArg@CEventItem@@QAEXK@Z, _AddArg@CEventItem@@QAEXPBD@Z, _AddArg@CEventItem@@QAEXPBG@Z, _AddArg@CFwEventItem@@QAEXK@Z, _AddArg@CFwEventItem@@QAEXPBG@Z, _AddCachedProperty@CCatalogAdmin@@QAEXABVCFullPropSpec@@KKKH@Z, _AddCatalog@CCatState@@QAEXAAV_$XPtrST@G@@@Z, _AddCatalog@CMachineAdmin@@QAEXPBG0@Z, _AddChild@CNodeRestriction@@QAEXPAVCRestriction@@AAI@Z, _AddDir@CCatState@@QAEXAAV_$XPtrST@G@@@Z, _AddEntry@CCombinedPropertyList@@UAEXPAVCPropEntry@@H@Z, _AddEntry@CPropertyList@@UAEXPAVCPropEntry@@H@Z, _AddError@CEventItem@@QAEXK@Z, _AddKey@CSynRestriction@@QAEXABVCKeyBuf@@@Z, _AddMachine@CCatState@@QAEXAAV_$XPtrST@G@@@Z, _AddRef@CDbProperties@@UAGKXZ, _AddRef@CEmptyPropertyList@@UAGKXZ, _AddRef@CEnumString@@UAGKXZ, _AddRef@CEnumWorkid@@UAGKXZ, _AddRef@CFwPropertyMapper@@UAGKXZ, _AddRef@CQueryUnknown@@UAGKXZ, _AddRefWorkThreads@CWorkQueue@@QAEXXZ, _AddScope@CCatalogAdmin@@QAEXPBG0H00@Z, _AddSortColumn@CDbSortNode@@QAEHABUtagDBID@@HK@Z, _AddTable@CDbNestingNode@@QAEHPAVCDbCmdTreeNode@@@Z, _AddToWorkList@CWorkManager@@QAEXPAVCFwAsyncWorkItem@@@Z, _AddToWorkQueue@CFwAsyncWorkItem@@QAEXXZ, _AllocAndCopyWString@CDbCmdTreeNode@@SGPAGPBG@Z, _AllocHeapAndCopy@@YGPAGPBGAAK@Z, _AllocHeapAndGetWString@@YGPAGAAVPDeSerStream@@@Z, _Append@CEnumString@@QAEXPBG@Z, _Append@CEnumWorkid@@QAEXK@Z, _AppendChild@CDbCmdTreeNode@@IAEXPAV1@@Z, _AppendListElement@CDbListAnchor@@IAEHGABUtagDBID@@@Z, _AppendListElement@CDbListAnchor@@IAEHPAVCDbCmdTreeNode@@@Z, _AppendListElement@CDbProjectListAnchor@@QAEHABUtagDBID@@PAG@Z, _BeginTransaction@CPropStoreManager@@QAEKXZ, _BindIFilter@CCiOle@@SGJPBGPAUIUnknown@@PAPAUIFilter@@H@Z, _BorrowBuffer@CPhysStorage@@QAEPAKKHH@Z, _BorrowNewBuffer@CPhysStorage@@QAEPAKK@Z, _BuildRegistryPropertiesKey@@YGXAAV_$XArray@G@@PBG@Z, _BuildRegistryScopesKey@@YGXAAV_$XArray@G@@PBG@Z, _CIShutdown@@YGXXZ, _ChangeCurrentCatalog@CCatState@@QAEXPBG@Z, _ChangeCurrentDepth@CCatState@@QAEXH@Z, _ChangeCurrentMachine@CCatState@@QAEXPBG@Z, _ChangeCurrentScope@CCatState@@QAEXPBG@Z, _ChangeDirty@CPropStoreInfo@@AAEXH@Z, _CheckError@CLocalGlobalPropertyList@@QAEJAAKPAPAG@Z, _CheckError@CPropListFile@@QAEJAAKPAPAG@Z, _CheckHasIndexTable@CiStorage@@SGHPBG@Z, _CiGetPassword@@YGHPBG0PAG@Z, _CiNtOpen@@YGPAXPBGKKK@Z, _CiNtOpenNoThrow@@YGJAAPAXPBGKKK@Z, _Cleanup@CDbColId@@QAEXXZ, _Cleanup@CDbProp@@QAEXXZ, _CleanupDataValue@CDbCmdTreeNode@@IAEXXZ, _ClearList@CCombinedPropertyList@@QAEXXZ, _ClearList@CPropertyList@@QAEXXZ, _Clone@CDbCmdTreeNode@@QBEPAV1@H@Z, _Clone@CEnumString@@UAGJPAPAUIEnumString@@@Z, _Clone@CNodeRestriction@@QBEPAV1@XZ, _Clone@COccRestriction@@QBEPAV1@XZ, _Clone@CRestriction@@QBEPAV1@XZ, _Close@CPhysStorage@@QAEXXZ, _Close@CPipeClient@@IAEXXZ, _Close@CPropSetMap@COLEPropManager@@QAEXXZ, _CloseRecord@CPropStoreManager@@QAEXPAVCCompositePropRecord@@@Z, _CloseRecord@CPropStoreManager@@QAEXPAVCCompositePropRecordForWrites@@@Z, _CoTaskAllocator@@3VCCoTaskAllocator@@A, _Commit@CRcovStrmAppendTrans@@QAEXXZ, _Commit@CRcovStrmMDTrans@@QAEXXZ, _Commit@CRcovStrmWriteTrans@@QAEXXZ, _ContainsDrive@CDriveInfo@@SGHPBG@Z, _Copy@CDbParameter@@QAEHABUtagDBPARAMETER@@@Z, _Copy@CDbProp@@QAEHABUtagDBPROP@@@Z, _Copy@CDbPropSet@@QAEHABUtagDBPROPSET@@@Z, _CreateSubdirs@CMachineAdmin@@QAEXPBG@Z, _DataWriteRead@CRequestClient@@QAEXPAXK0KAAK@Z, _DecodeEscapes@@YGXPAGAAK0@Z, _DecodeHtmlNumeric@@YGXPAG@Z, _DecodeURLEscapes@@YGXPAEAAKPAGK@Z, _DeleteRecord@CPropStoreManager@@QAEXK@Z, _DeleteRegistryParamNoThrow@CCatalogAdmin@@QAEXPBG@Z, _DetermineDriveType@CiStorage@@SGIPBG@Z, _DisableCI@CMachineAdmin@@QAEHXZ, _DisableNotification@CRegNotify@@QAEXXZ, _DisableVPathNotify@CMetaDataMgr@@QAEXXZ, _Disconnect@CRequestClient@@QAEXXZ, _DoFailTest@@YGXJ@Z, _DoIt@CCopyRcovObject@@QAEJXZ, _DoUpdates@CFilterDaemon@@QAEJXZ, _Done@CFwAsyncWorkItem@@QAEXXZ, _DumpWorkId@@YGJPBGKPAEAAK00K@Z, _Empty@CPidLookupTable@@QAEXXZ, _Empty@CPropStoreManager@@QAEXXZ, _Empty@CRcovStrmWriteTrans@@QAEXXZ, _Empty@CSdidLookupTable@@QAEXXZ, _EnableCI@CMachineAdmin@@QAEHXZ, _EnableVPathNotify@CMetaDataMgr@@QAEXPAVCMetaDataVPathChangeCallBack@@@Z, _EndTransaction@CPropStoreManager@@QAEXKHKK@Z, _Enum@CWin32RegAccess@@QAEHPAGK@Z, _EnumPropInfo@CEmptyPropertyList@@UAGJKPAPBGPAPAUtagDBID@@PAGPAI@Z, _EnumVPaths@CMetaDataMgr@@QAEXAAVCMetaDataCallBack@@@Z, _EnumVServers@CMetaDataMgr@@QAEXAAVCMetaDataVirtualServerCallBack@@@Z, _EnumerateFilesInDir@CiStorage@@SGXPBGAAVCEnumString@@@Z, _EnumerateProperty@CPidLookupTable@@QAEHAAVCFullPropSpec@@AAI@Z, _EnumerateValues@CRegAccess@@QAEXPAGAAVCRegCallBack@@@Z, _Eof@CMmStreamConsecBuf@@QAEHXZ, _ExtensionHasScriptMap@CMetaDataMgr@@QAEHPBG@Z, _FPSToPROPID@CPidConverter@@UAEJABVCFullPropSpec@@AAK@Z, _FastInit@CPropStoreManager@@QAEXPAVCiStorage@@@Z, _FetchProperty@COLEPropManager@@QAEXABU_GUID@@ABUtagPROPSPEC@@PAUtagPROPVARIANT@@PAI@Z, _FillMax@CKeyArray@@QAEHH@Z, _Find@CCombinedPropertyList@@UAEPBVCPropEntry@@PBG@Z, _Find@CEmptyPropertyList@@QAEPBVCPropEntry@@ABVCDbColId@@@Z, _Find@CPropertyList@@UAEPBVCPropEntry@@ABVCDbColId@@@Z, _Find@CPropertyList@@UAEPBVCPropEntry@@PBG@Z, _Find@CStaticPropertyList@@UAEPBVCPropEntry@@PBG@Z, _FindPropid@CPidLookupTable@@QAEHABVCFullPropSpec@@AAKH@Z, _Flush@CDynStream@@QAEXXZ, _Flush@CPhysStorage@@QAEXH@Z, _Flush@CPropStoreManager@@QAEXXZ, _FlushIdle@CCiOle@@SGXXZ, _FormFullTree@CTextToTree@@QAEPAUtagDBCOMMANDTREE@@XZ, _FormQueryTree@@YGPAVCDbCmdTreeNode@@AAV1@AAVCCatState@@PAUIColumnMapper@@HH@Z, _Get@CRegAccess@@QAEKPBG@Z, _Get@CRegAccess@@QAEXPBGPAGI@Z, _Get@CWin32RegAccess@@QAEHPBGAAK@Z, _Get@CWin32RegAccess@@QAEHPBGPAGIH@Z, _GetAllEntries@CPropertyList@@UAEJPAPAVCPropEntry@@K@Z, _GetBOOL@CAllocStorageVariant@@QBEFI@Z, _GetBackupSize@CPropStoreManager@@QAEKK@Z, _GetBlob@CMemDeSerStream@@UAEXPAEK@Z, _GetBlob@CQMemDeSerStream@@UAEXPAEK@Z, _GetBrowserCodepage@@YGKAAVCWebServer@@K@Z, _GetByte@CMemDeSerStream@@UAEEXZ, _GetByte@CQMemDeSerStream@@UAEEXZ, _GetCD@CCatState@@QAEPBGXZ, _GetCGIVariable@CWebServer@@QAEHPBDAAV_$XArray@G@@AAK@Z, _GetCGIVariableW@CWebServer@@QAEHPBGAAV_$XArray@G@@AAK@Z, _GetCLSID@CAllocStorageVariant@@QBE_AU_GUID@@I@Z, _GetCY@CAllocStorageVariant@@QBE_ATtagCY@@I@Z, _GetCategory@CCatState@@QBEPBGI@Z, _GetChar@CMemDeSerStream@@UAEXPADK@Z, _GetChar@CQMemDeSerStream@@UAEXPADK@Z, _GetColumn@CCatState@@QBEPBGI@Z, _GetCommandChar@CQueryScanner@@QAEGXZ, _GetDATE@CAllocStorageVariant@@QBENI@Z, _GetDWORDParam@CCatalogAdmin@@QAEHPBGAAK@Z, _GetDWORDParam@CMachineAdmin@@QAEHPBGAAK@Z, _GetDiskSpace@CDriveInfo@@QAEXAA_J0@Z, _GetDouble@CMemDeSerStream@@UAENXZ, _GetDouble@CQMemDeSerStream@@UAENXZ, _GetDrive@CDriveInfo@@SGXPBGPAG@Z, _GetEntryBuffer@CGenericCiProxy@@QAEPAEAAK@Z, _GetFILETIME@CAllocStorageVariant@@QBE_AU_FILETIME@@I@Z, _GetFileName@CPathParser@@QBEHPAGAAK@Z, _GetFileSystem@CDriveInfo@@QAE_AW4eFileSystem@1@H@Z, _GetFloat@CMemDeSerStream@@UAEMXZ, _GetFloat@CQMemDeSerStream@@UAEMXZ, _GetGUID@CMemDeSerStream@@UAEXAAU_GUID@@@Z, _GetGUID@CQMemDeSerStream@@UAEXAAU_GUID@@@Z, _GetGlobalPropListFile@@YGPAVCPropListFile@@XZ, _GetGlobalStaticPropertyList@@YGPAVCStaticPropertyList@@XZ, _GetI2@CAllocStorageVariant@@QBEFI@Z, _GetI4@CAllocStorageVariant@@QBEJI@Z, _GetI8@CAllocStorageVariant@@QBE_AT_LARGE_INTEGER@@I@Z, _GetLCIDFromString@@YGKPAG@Z, _GetLPSTR@CAllocStorageVariant@@QBEPADI@Z, _GetLPWSTR@CAllocStorageVariant@@QBEPAGI@Z, _GetLocation@CCatalogAdmin@@QAEPBGXZ, _GetLong@CMemDeSerStream@@UAEJXZ, _GetLong@CQMemDeSerStream@@UAEJXZ, _GetNumber@CQueryScanner@@QAEHAAJAAH@Z, _GetNumber@CQueryScanner@@QAEHAAKAAH@Z, _GetNumber@CQueryScanner@@QAEHAA_JAAH@Z, _GetNumber@CQueryScanner@@QAEHAA_KAAH@Z, _GetOffset@CKeyDeComp@@QAEXAAUBitOffset@@@Z, _GetOleDBErrorInfo@@YGJPAUIUnknown@@ABU_GUID@@KIPAUtagERRORINFO@@PAPAUIErrorInfo@@@Z, _GetOleError@@YGJAAVCException@@@Z, _GetPhysicalPath@CWebServer@@QAEKPBGPAGKK@Z, _GetPropInfo@CEmptyPropertyList@@QAEHABVCDbColId@@PAPBGPAGPAI@Z, _GetPropInfo@CEmptyPropertyList@@QAEHPBGPAPAVCDbColId@@PAGPAI@Z, _GetPropInfoFromId@CEmptyPropertyList@@UAGJPBUtagDBID@@PAPAGPAGPAI@Z, _GetPropInfoFromName@CEmptyPropertyList@@UAGJPBGPAPAUtagDBID@@PAGPAI@Z, _GetPropType@CEmptyPropertyList@@SGGI@Z, _GetPropTypeCount@CEmptyPropertyList@@SGIXZ, _GetPropTypeName@CEmptyPropertyList@@SGPBGI@Z, _GetProperties@CDbProperties@@UAGJKQBUtagDBPROPIDSET@@PAKPAPAUtagDBPROPSET@@@Z, _GetProperties@CGetDbProps@@QAEXPAUIDBProperties@@K@Z, _GetPropertyInfo@CDbProperties@@UAGJKQBUtagDBPROPIDSET@@PAKPAPAUtagDBPROPINFOSET@@PAPAG@Z, _GetR4@CAllocStorageVariant@@QBEMI@Z, _GetR8@CAllocStorageVariant@@QBENI@Z, _GetSZParam@CMachineAdmin@@QAEHPBGPAGK@Z, _GetScodeError@@YGJAAVCException@@@Z, _GetSecret@@YGHPBG0PAPAGPAK@Z, _GetSectorSize@CDriveInfo@@QAEKXZ, _GetSortProp@CCatState@@QBEXIPAPBGPAW4SORTDIR@@@Z, _GetStackTrace@@YGXPADK@Z, _GetStartupData@CGenericCiProxy@@QAEPBEAAU_GUID@@AAK@Z, _GetStorage@CPropStoreManager@@QAEAAVPStorage@@K@Z, _GetStr@CKey@@QBEPAGXZ, _GetStr@CKeyBuf@@QBEPAGXZ, _GetString@CMemDeSerStream@@UAEPADXZ, _GetString@CQMemDeSerStream@@UAEPADXZ, _GetStringDbRestriction@@YGPAVCDbRestriction@@PBGKPAUIColumnMapper@@K@Z, _GetStringFromLCID@@YGPBGK@Z, _GetStringFromLCID@@YGXKPAG@Z, _GetTotalSizeInKB@CPropStoreManager@@QAEKXZ, _GetTotalSizeInKB@CPropertyStore@@QAEKXZ, _GetULong@CMemDeSerStream@@UAEKXZ, _GetULong@CQMemDeSerStream@@UAEKXZ, _GetUShort@CMemDeSerStream@@UAEGXZ, _GetUShort@CQMemDeSerStream@@UAEGXZ, _GetUserHdrInfo@CIndexTable@@QAEXAAIAAH@Z, _GetVPathAccess@CMetaDataMgr@@QAEKPBG@Z, _GetVPathAuthorization@CMetaDataMgr@@QAEKPBG@Z, _GetVPathSSLAccess@CMetaDataMgr@@QAEKPBG@Z, _GetVolumeName@CDriveInfo@@QAEPBGH@Z, _GetWChar@CMemDeSerStream@@UAEXPAGK@Z, _GetWChar@CQMemDeSerStream@@UAEXPAGK@Z, _GetWString@CMemDeSerStream@@UAEPAGXZ, _GetWString@CQMemDeSerStream@@UAEPAGXZ, _GetWeight@CDbCmdTreeNode@@QBEJXZ, _Grow@CDynStream@@QAEXAAVPStorage@@K@Z, _GrowBuffer@CVirtualString@@AAEXK@Z, _HTMLEscapeW@@YGXPBGAAVCVirtualString@@K@Z, _Impersonate@CImpersonateClient@@AAEXXZ, _Init@CFileMapView@@QAEXXZ, _Init@CMmStreamConsecBuf@@QAEXPAVPMmStream@@@Z, _Init@CPidLookupTable@@QAEHPAVPRcovStorageObj@@@Z, _Init@CRcovStorageHdr@@QAEXK@Z, _Init@CRegChangeEvent@@QAEXXZ, _Init@CSdidLookupTable@@QAEHPAVCiStorage@@@Z, _InitIterator@CCombinedPropertyList@@UAEXXZ, _InitIterator@CPropertyList@@UAEXXZ, _InitIterator@CStaticPropertyList@@UAEXXZ, _Initialize@CImpersonationTokenCache@@QAEXPBGHHHKKK@Z, _InitializeForRead@CDynStream@@QAEXXZ, _InitializeForWrite@CDynStream@@QAEXK@Z, _InsertChild@CDbCmdTreeNode@@IAEXPAV1@@Z, _IsCIDialect@CDbPropertyRestriction@@QAEHXZ, _IsCIEnabled@CMachineAdmin@@QAEHXZ, _IsCIPaused@CMachineAdmin@@QAEHXZ, _IsCIStarted@CMachineAdmin@@QAEHXZ, _IsCIStopped@CMachineAdmin@@QAEHXZ, _IsCatalogInactive@CCatalogAdmin@@QAEHXZ, _IsDirectoryWritable@@YGHPBG@Z, _IsIISAdminUp@CMetaDataMgr@@SGHAAH@Z, _IsImpersonated@CImpersonateSystem@@SGHXZ, _IsLeaf@CRestriction@@QBEHXZ, _IsNullPointerVariant@@YGHPAUtagPROPVARIANT@@@Z, _IsPaused@CCatalogAdmin@@QAEHXZ, _IsRunningAsSystem@CImpersonateSystem@@SGHXZ, _IsSameDrive@CDriveInfo@@QAEHPBG@Z, _IsScopeValid@@YGJPBGIH@Z, _IsStarted@CCatalogAdmin@@QAEHXZ, _IsStopped@CCatalogAdmin@@QAEHXZ, _IsValid@CAllocStorageVariant@@QBEHXZ, _IsValid@CNodeRestriction@@QBEHXZ, _IsValid@COccRestriction@@QBEHXZ, _IsValid@CRestriction@@QBEHXZ, _IsWaitingForDocument@CFilterDaemon@@QAEHXZ, _IsWriteProtected@CDriveInfo@@QAEHXZ, _Load@CLocalGlobalPropertyList@@QAEXQBG@Z, _LocaleToCodepage@@YGKK@Z, _LokNewWorkId@CPropertyStore@@AAEKKHH@Z, _LokUpdate@CCatStateInfo@@QAEHXZ, _LongInit@CPropStoreManager@@QAEXAAHAAKP6GXKHPBX@Z2@Z, _Lookup@CPropStoreInfo@@AAEIK@Z, _LookupSDID@CSdidLookupTable@@QAEKPAXK@Z, _MakeBackupCopy@CPhysStorage@@QAEXAAV1@AAVPSaveProgressTracker@@@Z, _MakeBackupCopy@CPidLookupTable@@QAEXAAVPRcovStorageObj@@AAVPSaveProgressTracker@@@Z, _MakeBackupCopy@CPropStoreManager@@QAEXPAUIProgressNotify@@AAHAAVCiStorage@@PAUICiEnumWorkids@@PAPAUIEnumString@@@Z, _MakeICommand@@YGJPAPAUIUnknown@@PBG1PAU1@@Z, _MakeISearch@@YGJPAPAUISearchQueryHits@@PAVCDbRestriction@@PBG@Z, _MakeLocalICommand@@YGJPAPAUIUnknown@@PAUICiCDocStore@@PAU1@@Z, _MakeMetadataICommand@@YGJPAPAUIUnknown@@W4CiMetaData@@PBG2PAU1@@Z, _MakePath@CFullPath@@QAEXPBG@Z, _MakePath@CFullPath@@QAEXPBGI@Z, _MakePrivileged@CImpersonateSystem@@AAEXXZ, _Map@CMmStreamConsecBuf@@QAEXK@Z, _MarkDirty@CDynStream@@QAEHXZ, _Marshall@CBaseStorageVariant@@QBEXAAVPSerStream@@@Z, _Marshall@CContentRestriction@@QBEXAAVPSerStream@@@Z, _Marshall@CDbByGuid@@QBEXAAVPSerStream@@@Z, _Marshall@CDbCmdTreeNode@@QBEXAAVPSerStream@@@Z, _Marshall@CDbColId@@QBEXAAVPSerStream@@@Z, _Marshall@CDbContentVector@@QBEXAAVPSerStream@@@Z, _Marshall@CDbNumeric@@QBEXAAVPSerStream@@@Z, _Marshall@CDbParameter@@QBEXAAVPSerStream@@@Z, _Marshall@CDbProp@@QBEXAAVPSerStream@@@Z, _Marshall@CDbPropSet@@QBEXAAVPSerStream@@@Z, _Marshall@CFullPropSpec@@QBEXAAVPSerStream@@@Z, _Marshall@CNatLanguageRestriction@@QBEXAAVPSerStream@@@Z, _Marshall@CNodeRestriction@@QBEXAAVPSerStream@@@Z, _Marshall@CNotRestriction@@QBEXAAVPSerStream@@@Z, _Marshall@CPropNameArray@@QBEXAAVPSerStream@@@Z, _Marshall@CPropertyRestriction@@QBEXAAVPSerStream@@@Z, _Marshall@CRestriction@@QBEXAAVPSerStream@@@Z, _Marshall@CVectorRestriction@@QBEXAAVPSerStream@@@Z, _MinPageInUse@CBufferCache@@QAEHAAK@Z, _MinPageInUse@CPhysStorage@@QAEHAAK@Z, _MultiByteToXArrayWideChar@@YGKPBEKIAAV_$XArray@G@@@Z, _My_wcstoui64@@YA_KPBGPAPAGH@Z, _NameToReal@CPidRemapper@@QAEKPBVCFullPropSpec@@@Z, _NewStemmer@CCiOle@@SGPAUIStemmer@@ABU_GUID@@@Z, _NewWordBreaker@CCiOle@@SGPAUIWordBreaker@@ABU_GUID@@@Z, _Next@CCatalogEnum@@QAEHXZ, _Next@CCombinedPropertyList@@UAEPBVCPropEntry@@XZ, _Next@CEnumString@@UAGJKPAPAGPAK@Z, _Next@CEnumWorkid@@UAGJKPAK0@Z, _Next@CPropertyList@@UAEPBVCPropEntry@@XZ, _Next@CScopeEnum@@QAEHXZ, _Next@CStaticPropertyList@@UAEPBVCPropEntry@@XZ, _NextWorkId@CPropertyStoreWids@@QAEKXZ, _NotifyWriteRead@CRequestClient@@QAEHPAX0K0KAAK@Z, _NumberOfColumns@CCatState@@QBEIXZ, _NumberOfSortProps@CCatState@@QBEIXZ, _Open@CMmStream@@QAEXPBGKKKKH@Z, _Open@COLEPropManager@@QAEHABVCFunnyPath@@@Z, _OpenExclusive@CMmStream@@QAEXPAGH@Z, _OpenFileFromPath@@YGPAU_iobuf@@PBG@Z, _OpenRecord@CPropStoreManager@@QAEPAVCCompositePropRecord@@KPAE@Z, _OpenRecordForWrites@CPropStoreManager@@QAEPAVCCompositePropRecordForWrites@@KPAE@Z, _ParseCatalogURL@@YGJPBGAAV_$XPtrST@G@@1@Z, _ParseExpression@CParseCommandTree@@QAEPAVCRestriction@@PAVCDbCmdTreeNode@@@Z, _ParseOneLine@CPropertyList@@SGXAAVCQueryScanner@@HAAV_$XPtr@VCPropEntry@@@@@Z, _ParseQueryPhrase@CQueryParser@@QAEPAVCDbRestriction@@XZ, _ParseStringColumns@@YGPAVCDbColumns@@PBGPAUIColumnMapper@@KPAVPVariableSet@@PAV_$CDynArray@G@@@Z, _ParseTree@CParseCommandTree@@QAEXPAVCDbCmdTreeNode@@@Z, _Pause@CCatalogAdmin@@QAEHXZ, _PauseCI@CMachineAdmin@@QAEHXZ, _PeekULong@CMemDeSerStream@@UAEKXZ, _PeekULong@CQMemDeSerStream@@UAEKXZ, _PidToRealPid@CPidMapper@@QAEKK@Z, _PropertyToPropId@CStandardPropMapper@@QAEKABVCFullPropSpec@@H@Z, _PropertyToPropid@CFwPropertyMapper@@UAGJPBUtagFULLPROPSPEC@@HPAK@Z, _PutByte@CQMemSerStream@@UAEXE@Z, _PutMaxValue@CValueNormalizer@@QAEXKAAKW4VARENUM@@@Z, _PutMinValue@CValueNormalizer@@QAEXKAAKW4VARENUM@@@Z, _PutValue@CValueNormalizer@@QAEXKAAKABVCStorageVariant@@@Z, _PutWString@@YGXAAVPSerStream@@PBG@Z, _PutWString@CDbCmdTreeNode@@SGXAAVPSerStream@@PBG@Z, _Query@CQueryParser@@AAEPAVCDbRestriction@@PAVCDbNodeRestriction@@@Z, _QueryCatalogAdmin@CCatalogEnum@@QAEPAVCCatalogAdmin@@XZ, _QueryCatalogAdmin@CMachineAdmin@@QAEPAVCCatalogAdmin@@PBG@Z, _QueryCatalogEnum@CMachineAdmin@@QAEPAVCCatalogEnum@@XZ, _QueryInterface@CDbProperties@@UAGJABU_GUID@@PAPAX@Z, _QueryInterface@CEmptyPropertyList@@UAGJABU_GUID@@PAPAX@Z, _QueryInterface@CEnumString@@UAGJABU_GUID@@PAPAX@Z, _QueryInterface@CEnumWorkid@@UAGJABU_GUID@@PAPAX@Z, _QueryInterface@CFwPropertyMapper@@UAGJABU_GUID@@PAPAX@Z, _QueryInterface@CQueryUnknown@@UAGJABU_GUID@@PAPAX@Z, _QueryPidLookupTable@CiStorage@@QAEPAVPRcovStorageObj@@K@Z, _QueryScopeAdmin@CCatalogAdmin@@QAEPAVCScopeAdmin@@PBG@Z, _QueryScopeAdmin@CScopeEnum@@QAEPAVCScopeAdmin@@XZ, _QueryScopeEnum@CCatalogAdmin@@QAEPAVCScopeEnum@@XZ, _QueryScopeList@CiStorage@@QAEPAVPRcovStorageObj@@K@Z, _QuerySdidLookupTable@CiStorage@@QAEPAVPRcovStorageObj@@K@Z, _QueryVirtualScopeList@CiStorage@@QAEPAVPRcovStorageObj@@K@Z, _ReBuild@CPidRemapper@@QAEXABVCPidMapper@@@Z, _ReInit@CQueryUnknown@@QAEXKPAPAVCRowset@@@Z, _ReInitializeIISScopes@CImpersonationTokenCache@@QAEXXZ, _ReOpenStream@CPhysIndex@@EAEXXZ, _Read@CDynStream@@QAEKPAXK@Z, _Read@CRcovStrmTrans@@QAEKPAXK@Z, _Read@CRegAccess@@QAEKPBGK@Z, _Read@CRegAccess@@QAEPAGPBG0@Z, _ReadPrimaryProperty@CPropStoreManager@@QAEHKKAAUtagPROPVARIANT@@@Z, _ReadProperty@COLEPropManager@@QAEHABVCFullPropSpec@@AAUtagPROPVARIANT@@@Z, _ReadProperty@CPropStoreManager@@QAEHAAVCCompositePropRecord@@KAAUtagPROPVARIANT@@@Z, _ReadProperty@CPropStoreManager@@QAEHAAVCCompositePropRecord@@KAAUtagPROPVARIANT@@PAEPAI@Z, _ReadProperty@CPropStoreManager@@QAEHAAVCCompositePropRecord@@KPAUtagPROPVARIANT@@PAI@Z, _ReadProperty@CPropStoreManager@@QAEHKKAAUtagPROPVARIANT@@@Z, _ReadProperty@CPropStoreManager@@QAEHKKAAUtagPROPVARIANT@@PAEPAI@Z, _ReadProperty@CPropStoreManager@@QAEHKKPAUtagPROPVARIANT@@PAI@Z, _ReadProperty@CPropertyStore@@QAEHAAVCPropRecordNoLock@@KPAUtagPROPVARIANT@@PAI@Z, _ReadProperty@CPropertyStore@@QAEHKKAAUtagPROPVARIANT@@@Z, _Recognize@CDFA@@QAEEPBG@Z, _Refresh@CCiRegParams@@QAEXPAUICiAdminParams@@H@Z, _Refresh@CDefColumnRegEntry@@QAEXH@Z, _RefreshParams@CWorkQueue@@QAEXKK@Z, _Release@CDbProperties@@UAGKXZ, _Release@CEmptyPropertyList@@UAGKXZ, _Release@CEnumString@@UAGKXZ, _Release@CEnumWorkid@@UAGKXZ, _Release@CFwPropertyMapper@@UAGKXZ, _Release@CImpersonateRemoteAccess@@QAEXXZ, _Release@CQueryUnknown@@UAGKXZ, _Release@CWorkQueue@@QAEXPAVCWorkThread@@@Z, _ReleaseRead@CPropertyStore@@AAEXAAVCReadWriteLockRecord@@@Z, _ReleaseWorkThreads@CWorkQueue@@QAEXXZ, _Remove@CColumns@@QAEXI@Z, _Remove@CDbSortSet@@QAEXI@Z, _Remove@CSort@@QAEXI@Z, _Remove@CWorkQueue@@QAEXPAVPWorkItem@@@Z, _RemoveCatalog@CMachineAdmin@@QAEXPBGH@Z, _RemoveCatalogFiles@CMachineAdmin@@QAEXPBG@Z, _RemoveChild@CNodeRestriction@@QAEPAVCRestriction@@I@Z, _RemoveFirstChild@CDbCmdTreeNode@@IAEPAV1@XZ, _RemoveScope@CCatalogAdmin@@QAEXPBG@Z, _Reopen@CPhysStorage@@QAEXH@Z, _ReportEventW@CEventLog@@QAEXAAVCEventItem@@@Z, _ReportEventW@CFwEventItem@@QAEXAAUICiCAdviseStatus@@@Z, _RequiresFlush@CPhysStorage@@QAEHK@Z, _Reset@CRegChangeEvent@@QAEXXZ, _ResetBuffer@CQueryScanner@@QAEXPBG@Z, _ResetType@CAllocStorageVariant@@IAEXAAVPMemoryAllocator@@@Z, _Resume@CProcess@@QAEXXZ, _ReturnBuffer@CPhysStorage@@QAEXKHH@Z, _Rewind@CMmStreamConsecBuf@@QAEXXZ, _SaComputeSize@@YGKGAAUtagSAFEARRAY@@@Z, _SaCreateAndCopy@@YGHAAVPMemoryAllocator@@PAUtagSAFEARRAY@@PAPAU2@@Z, _SaCreateData@@YGHAAVPVarAllocator@@GAAUtagSAFEARRAY@@1H@Z, _Seek@CRcovStrmTrans@@QAEHK@Z, _Serialize@CDbQueryResults@@QBEXAAVPSerStream@@@Z, _Set@CPidRemapper@@QAEXAAV_$XArray@K@@@Z, _SetAlias@CScopeAdmin@@QAEXPBG@Z, _SetBOOL@CStorageVariant@@QAEXFI@Z, _SetBSTR@CAllocStorageVariant@@QAEXPAGAAVPMemoryAllocator@@@Z, _SetBSTR@CStorageVariant@@QAEXPAGI@Z, _SetBackupSize@CPropStoreManager@@QAEXKK@Z, _SetCD@CCatState@@QAEXPBG@Z, _SetCLSID@CStorageVariant@@QAEXU_GUID@@I@Z, _SetCY@CStorageVariant@@QAEXTtagCY@@I@Z, _SetCatalog@CCatState@@QAEXPBG@Z, _SetColumn@CCatState@@QAEXPBGI@Z, _SetCurrentProperty@CQueryParser@@AAEXPBGW4PropertyType@@@Z, _SetDATE@CStorageVariant@@QAEXNI@Z, _SetDWORDParam@CCatalogAdmin@@QAEXPBGK@Z, _SetDWORDParam@CMachineAdmin@@QAEXPBGK@Z, _SetDefaultProperty@CCatState@@QAEXPBG@Z, _SetEndKey@CRangeRestriction@@QAEXABVCKeyBuf@@@Z, _SetExclude@CScopeAdmin@@QAEXH@Z, _SetFILETIME@CStorageVariant@@QAEXU_FILETIME@@I@Z, _SetI2@CStorageVariant@@QAEXFI@Z, _SetI4@CStorageVariant@@QAEXJI@Z, _SetI8@CStorageVariant@@QAEXT_LARGE_INTEGER@@I@Z, _SetLPSTR@CStorageVariant@@QAEXPBDI@Z, _SetLPWSTR@CStorageVariant@@QAEXPBGI@Z, _SetLocale@CCatState@@QAEXPBG@Z, _SetLogonInfo@CScopeAdmin@@QAEXPBG0AAVCCatalogAdmin@@@Z, _SetMappedCacheSize@CPropStoreManager@@QAEXKK@Z, _SetNumberOfColumns@CCatState@@QAEXI@Z, _SetNumberOfSortProps@CCatState@@QAEXI@Z, _SetPath@CScopeAdmin@@QAEXPBG@Z, _SetPhrase@CContentRestriction@@QAEXPBG@Z, _SetPhrase@CNatLanguageRestriction@@QAEXPBG@Z, _SetPriority@CGenericCiProxy@@QAEXKK@Z, _SetProperties@CDbProperties@@UAGJKQAUtagDBPROPSET@@@Z, _SetProperty@CDbColId@@QAEHPBG@Z, _SetProperty@CDbPropBaseRestriction@@QAEHABUtagDBID@@@Z, _SetProperty@CDbPropBaseRestriction@@QAEHABVCDbColumnNode@@@Z, _SetProperty@CFullPropSpec@@QAEHPBG@Z, _SetProperty@CFullPropSpec@@QAEXK@Z, _SetR4@CStorageVariant@@QAEXMI@Z, _SetR8@CStorageVariant@@QAEXNI@Z, _SetRestriction@CDbSelectNode@@QAEHPAVCDbCmdTreeNode@@@Z, _SetRunningAsSystem@CImpersonateSystem@@SGXXZ, _SetSZParam@CMachineAdmin@@QAEXPBG0K@Z, _SetScopeProperties@@YGXPAUICommand@@IPBQBGPBK11@Z, _SetScopePropertiesNoThrow@@YGJPAUICommand@@IPBQBGPBK11@Z, _SetSecret@@YGXPBG00K@Z, _SetSortProp@CCatState@@QAEXPBGW4SORTDIR@@I@Z, _SetStartKey@CRangeRestriction@@QAEXABVCKeyBuf@@@Z, _SetUI1@CStorageVariant@@QAEXEI@Z, _SetUI2@CStorageVariant@@QAEXGI@Z, _SetUI4@CStorageVariant@@QAEXKI@Z, _SetUI8@CStorageVariant@@QAEXT_ULARGE_INTEGER@@I@Z, _SetValue@CPropertyRestriction@@QAEXAAUtagBLOB@@@Z, _SetValue@CPropertyRestriction@@QAEXPAG@Z, _SetValue@CPropertyRestriction@@QAEXPAU_GUID@@@Z, _SetWeight@CDbCmdTreeNode@@QAEXJ@Z, _Setup@CPropStoreManager@@QAEXKKKKHK@Z, _Shrink@CDynStream@@QAEXAAVPStorage@@K@Z, _ShrinkFromFront@CPhysStorage@@QAEKKK@Z, _ShrinkToFit@CPhysStorage@@QAEXXZ, _Shutdown@CCiOle@@SGXXZ, _Shutdown@CPropStoreManager@@QAEXXZ, _Shutdown@CShtOle@@QAEXXZ, _Shutdown@CWorkQueue@@QAEXXZ, _Size@CDbQueryResults@@QAEKXZ, _Skip@CEnumString@@UAGJK@Z, _Skip@CEnumWorkid@@UAGJK@Z, _SkipBlob@CMemDeSerStream@@UAEXK@Z, _SkipBlob@CQMemDeSerStream@@UAEXK@Z, _SkipByte@CMemDeSerStream@@UAEXXZ, _SkipByte@CQMemDeSerStream@@UAEXXZ, _SkipChar@CMemDeSerStream@@UAEXK@Z, _SkipChar@CQMemDeSerStream@@UAEXK@Z, _SkipDouble@CMemDeSerStream@@UAEXXZ, _SkipDouble@CQMemDeSerStream@@UAEXXZ, _SkipFloat@CMemDeSerStream@@UAEXXZ, _SkipFloat@CQMemDeSerStream@@UAEXXZ, _SkipGUID@CMemDeSerStream@@UAEXXZ, _SkipGUID@CQMemDeSerStream@@UAEXXZ, _SkipLong@CMemDeSerStream@@UAEXXZ, _SkipLong@CQMemDeSerStream@@UAEXXZ, _SkipULong@CMemDeSerStream@@UAEXXZ, _SkipULong@CQMemDeSerStream@@UAEXXZ, _SkipUShort@CMemDeSerStream@@UAEXXZ, _SkipUShort@CQMemDeSerStream@@UAEXXZ, _SkipWChar@CMemDeSerStream@@UAEXK@Z, _SkipWChar@CQMemDeSerStream@@UAEXK@Z, _Start@CCatalogAdmin@@QAEHXZ, _StartCI@CMachineAdmin@@QAEHXZ, _Stop@CCatalogAdmin@@QAEHXZ, _StopCI@CMachineAdmin@@QAEHXZ, _StopFiltering@CFilterDaemon@@QAEXXZ, _StrLen@CKey@@QBEIXZ, _StrLen@CKeyBuf@@QBEIXZ, _SystemExceptionTranslator@@YAXIPAU_EXCEPTION_POINTERS@@@Z, _TransferNode@CDbCmdTreeNode@@QAEXPAV1@@Z, _TreeCount@CRestriction@@QBEKXZ, _TunePerformance@CMachineAdmin@@QAEXHGG@Z, _URLEscapeW@@YGXPBGAAVCVirtualString@@KH@Z, _UnMarshall@CDbByGuid@@QAEHAAVPDeSerStream@@@Z, _UnMarshall@CDbCmdTreeNode@@QAEHAAVPDeSerStream@@@Z, _UnMarshall@CDbColId@@QAEHAAVPDeSerStream@@@Z, _UnMarshall@CDbContentVector@@QAEHAAVPDeSerStream@@@Z, _UnMarshall@CDbNumeric@@QAEHAAVPDeSerStream@@@Z, _UnMarshall@CDbParameter@@QAEHAAVPDeSerStream@@@Z, _UnMarshall@CDbProp@@QAEHAAVPDeSerStream@@@Z, _UnMarshall@CDbPropSet@@QAEHAAVPDeSerStream@@@Z, _UnMarshall@CDbProperties@@QAEHAAVPDeSerStream@@@Z, _UnMarshall@CRestriction@@SGPAV1@AAVPDeSerStream@@@Z, _UnMarshallTree@CDbCmdTreeNode@@SGPAV1@AAVPDeSerStream@@@Z, _UnPickle@@YGXHAAV_$XPtr@VCColumnSet@@@@AAV_$XPtr@VCRestriction@@@@AAV_$XPtr@VCSortSet@@@@AAV_$XPtr@VCCategorizationSet@@@@AAVCRowsetProperties@@AAV_$XPtr@VCPidMapper@@@@PAEK@Z, _Unmap@CRcovStrmTrans@@IAEXW4DataCopyNum@CRcovStorageHdr@@@Z, _UpdateContentIndex@@YGKPBG00H@Z, _UpdateDiskLowInfo@CDiskFreeStatus@@QAEXXZ, _VT_VARIANT_EQ@@YGHABUtagPROPVARIANT@@0@Z, _VT_VARIANT_GE@@YGHABUtagPROPVARIANT@@0@Z, _VT_VARIANT_GT@@YGHABUtagPROPVARIANT@@0@Z, _VT_VARIANT_LE@@YGHABUtagPROPVARIANT@@0@Z, _VT_VARIANT_LT@@YGHABUtagPROPVARIANT@@0@Z, _VT_VARIANT_NE@@YGHABUtagPROPVARIANT@@0@Z, _ValidateScopeRestriction@@YGHPAVCRestriction@@@Z, _Value@CDbScalarValue@@QAEXAAVCStorageVariant@@@Z, _VerifyConsistency@PRcovStorageObj@@QAEXXZ, _VerifyThreadHasAdminPrivilege@@YGXXZ, _WideCharToXArrayMultiByte@@YGKPBGKIAAV_$XArray@E@@@Z, _Write@CDynStream@@QAEXPAXK@Z, _Write@CRcovStrmTrans@@IAEXPBXK@Z, _WritePrimaryProperty@CPropStoreManager@@QAEJAAVCCompositePropRecordForWrites@@KABVCStorageVariant@@@Z, _WritePrimaryProperty@CPropStoreManager@@QAEJKKABVCStorageVariant@@@Z, _WriteProperty@CPropStoreManager@@QAEJAAVCCompositePropRecordForWrites@@KABVCStorageVariant@@@Z, _WriteProperty@CPropStoreManager@@QAEJKKABVCStorageVariant@@@Z, _WritePropertyInNewRecord@CPropStoreManager@@QAEKKABVCStorageVariant@@@Z, __FindGroupListAnchor@CDbNestingNode@@AAEPAVCDbProjectListAnchor@@XZ, __FindOrAddAnchor@CDbProjectNode@@AAEPAVCDbProjectListAnchor@@XZ, __FindOrAddAnchor@CDbSortNode@@AAEPAVCDbSortListAnchor@@XZ, __FindOrAddValueNode@CDbPropertyRestriction@@AAEPAVCDbScalarValue@@XZ, __ImpersonateIf@CImpersonateRemoteAccess@@AAEHPBG0K@Z, __dwLastCheckMoment@CGlobalPropFileRefresher@@0KA, __ftFile@CGlobalPropFileRefresher@@0U_FILETIME@@A, __pGlobalPropListFile@CLocalGlobalPropertyList@@0PAVCPropListFile@@A, __wcsFileName@CGlobalPropFileRefresher@@0PAGA, __wcstoui64@@YA_KPBGPAPAGH@Z, _ciDelete@@YGXPAX@Z, _ciIsValidPointer@@YGHPBX@Z, _ciNew@@YGPAXI@Z, _fgetsw@CFileBuffer@@QAEKAAV_$XGrowable@G$0BAE@@@@Z, _wcsipattern@@YGPAGPAGPBG@Z, BeginCacheTransaction, BindIFilterFromStorage, BindIFilterFromStream, CIBuildQueryNode, CIBuildQueryTree, CICreateCommand, CIGetGlobalPropertyList, CIMakeICommand, CIRestrictionToFullTree, CIState, CITextToFullTree, CITextToFullTreeEx, CITextToSelectTree, CITextToSelectTreeEx, CiCreateSecurityDescriptor, CiSvcMain, CollectCIISAPIPerformanceData, CollectCIPerformanceData, CollectFILTERPerformanceData, DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer, DoneCIISAPIPerformanceData, DoneCIPerformanceData, DoneFILTERPerformanceData, EndCacheTransaction, FsCiShutdown, InitializeCIISAPIPerformanceData, InitializeCIPerformanceData, InitializeFILTERPerformanceData, LoadBinaryFilter, LoadIFilter, LoadTextFilter, LocateCatalogs, LocateCatalogsA, LocateCatalogsW, SetCatalogState, SetupCache, SetupCacheEx, SvcEntry_CiSvc, _AbortMerges@16, _ForceMasterMerge@16, _LoadBHIFilter@16, _StartFWCiSvcWork@12, _StopFWCiSvcWork@16

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: DirectShow filter (47.4%)
Windows OCX File (29.1%)
Win32 EXE PECompact compressed (generic) (9.7%)
Win32 Executable MS Visual C++ (generic) (8.8%)
Win32 Executable Generic (2.0%)
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. Tous droits r_serv_s.
product......: Syst_me d_exploitation Microsoft_ Windows_
description..: Biblioth_que de requ_te et d_indexation de Index Server
original name: query.dll
internal name: query.dll
file version.: 5.1.2600.5847 (xpsp_sp3_gdr.090717-1358)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

msasn1.dll:

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.10.20 -
AhnLab-V3 5.0.0.2 2009.10.20 -
AntiVir 7.9.1.35 2009.10.20 -
Antiy-AVL 2.0.3.7 2009.10.21 -
Authentium 5.1.2.4 2009.10.21 -
Avast 4.8.1351.0 2009.10.20 -
AVG 8.5.0.420 2009.10.20 -
BitDefender 7.2 2009.10.21 -
CAT-QuickHeal 10.00 2009.10.20 -
ClamAV 0.94.1 2009.10.21 -
Comodo 2675 2009.10.21 -
DrWeb 5.0.0.12182 2009.10.21 -
eSafe 7.0.17.0 2009.10.19 -
eTrust-Vet 35.1.7075 2009.10.19 -
F-Prot 4.5.1.85 2009.10.20 -
F-Secure 9.0.15300.0 2009.10.20 -
Fortinet 3.120.0.0 2009.10.21 -
GData 19 2009.10.21 -
Ikarus T3.1.1.72.0 2009.10.21 -
Jiangmin 11.0.800 2009.10.20 -
K7AntiVirus 7.10.875 2009.10.20 -
Kaspersky 7.0.0.125 2009.10.21 -
McAfee 5777 2009.10.20 -
McAfee+Artemis 5777 2009.10.20 -
McAfee-GW-Edition 6.8.5 2009.10.21 -
Microsoft 1.5101 2009.10.20 -
NOD32 4527 2009.10.20 -
Norman 6.03.02 2009.10.20 -
nProtect 2009.1.8.0 2009.10.20 -
Panda 10.0.2.2 2009.10.20 -
PCTools 4.4.2.0 2009.10.19 -
Prevx 3.0 2009.10.21 -
Rising 21.52.20.00 2009.10.21 -
Sophos 4.46.0 2009.10.21 -
Sunbelt 3.2.1858.2 2009.10.20 -
Symantec 1.4.4.12 2009.10.21 -
TheHacker 6.5.0.2.049 2009.10.20 -
TrendMicro 8.950.0.1094 2009.10.21 -
VBA32 3.12.10.11 2009.10.20 -
ViRobot 2009.10.21.1997 2009.10.21 -
VirusBuster 4.6.5.0 2009.10.20 -
Information additionnelle
File size: 58880 bytes
MD5...: 6bf05fb48e745e5ee0abf9c029453e84
SHA1..: 1d978d6d5517886a3990bf444f2d7abb0983809e
SHA256: f9772b5d24b4892e2403d02b2adfec2df01ee15f3b2b6e483a6821d26cf92ccf
ssdeep: 1536:0Vu3fbmRY6qb9cyiYLwmkRHotM4H7jvY9SIWB7Ox3lA/:0Q3fbmRY6qb9cy
i7RRHot3IwIWlU3q/

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x33a1
timedatestamp.....: 0x4aa180e6 (Fri Sep 04 21:04:38 2009)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xd623 0xd800 6.63 fdee2bc0b8a132e6ff7b5834ca220069
.data 0xf000 0x38 0x200 0.28 dd17253f931693a8867aad45d3087ecb
.rsrc 0x10000 0x3f0 0x400 3.39 e76e2c1c681c351cd241cf05e9ee49d4
.reloc 0x11000 0x294 0x400 4.58 0ae2daf5cf2a4de723bdd7fc74f72fa7

( 3 imports )
> KERNEL32.dll: LocalReAlloc, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, MultiByteToWideChar, SetLastError, DisableThreadLibraryCalls, lstrcpyA, LoadLibraryA, GetProcAddress, CloseHandle, LocalFree, LocalAlloc, lstrlenA, lstrcmpA, FreeLibrary
> msvcrt.dll: _adjust_fdiv, malloc, _initterm, free, _ultoa, _ui64toa, _atoi64, memmove, _fpclass, _ftol, _finite, frexp, memchr, ldexp, strchr, strtod
> USER32.dll: wsprintfA

( 266 exports )
ASN1BERDecBitString, ASN1BERDecBitString2, ASN1BERDecBool, ASN1BERDecChar16String, ASN1BERDecChar32String, ASN1BERDecCharString, ASN1BERDecCheck, ASN1BERDecDouble, ASN1BERDecEndOfContents, ASN1BERDecEoid, ASN1BERDecExplicitTag, ASN1BERDecFlush, ASN1BERDecGeneralizedTime, ASN1BERDecLength, ASN1BERDecMultibyteString, ASN1BERDecNotEndOfContents, ASN1BERDecNull, ASN1BERDecObjectIdentifier, ASN1BERDecObjectIdentifier2, ASN1BERDecOctetString, ASN1BERDecOctetString2, ASN1BERDecOpenType, ASN1BERDecOpenType2, ASN1BERDecPeekTag, ASN1BERDecS16Val, ASN1BERDecS32Val, ASN1BERDecS8Val, ASN1BERDecSXVal, ASN1BERDecSkip, ASN1BERDecTag, ASN1BERDecU16Val, ASN1BERDecU32Val, ASN1BERDecU8Val, ASN1BERDecUTCTime, ASN1BERDecUTF8String, ASN1BERDecZeroChar16String, ASN1BERDecZeroChar32String, ASN1BERDecZeroCharString, ASN1BERDecZeroMultibyteString, ASN1BERDotVal2Eoid, ASN1BEREncBitString, ASN1BEREncBool, ASN1BEREncChar16String, ASN1BEREncChar32String, ASN1BEREncCharString, ASN1BEREncCheck, ASN1BEREncDouble, ASN1BEREncEndOfContents, ASN1BEREncEoid, ASN1BEREncExplicitTag, ASN1BEREncFlush, ASN1BEREncGeneralizedTime, ASN1BEREncLength, ASN1BEREncMultibyteString, ASN1BEREncNull, ASN1BEREncObjectIdentifier, ASN1BEREncObjectIdentifier2, ASN1BEREncOctetString, ASN1BEREncOpenType, ASN1BEREncRemoveZeroBits, ASN1BEREncS32, ASN1BEREncSX, ASN1BEREncTag, ASN1BEREncU32, ASN1BEREncUTCTime, ASN1BEREncUTF8String, ASN1BEREncZeroMultibyteString, ASN1BEREoid2DotVal, ASN1BEREoid_free, ASN1CEREncBeginBlk, ASN1CEREncBitString, ASN1CEREncChar16String, ASN1CEREncChar32String, ASN1CEREncCharString, ASN1CEREncEndBlk, ASN1CEREncFlushBlkElement, ASN1CEREncGeneralizedTime, ASN1CEREncMultibyteString, ASN1CEREncNewBlkElement, ASN1CEREncOctetString, ASN1CEREncUTCTime, ASN1CEREncZeroMultibyteString, ASN1DecAbort, ASN1DecAlloc, ASN1DecDone, ASN1DecRealloc, ASN1DecSetError, ASN1EncAbort, ASN1EncDone, ASN1EncSetError, ASN1Free, ASN1PERDecAlignment, ASN1PERDecBit, ASN1PERDecBits, ASN1PERDecBoolean, ASN1PERDecChar16String, ASN1PERDecChar32String, ASN1PERDecCharString, ASN1PERDecCharStringNoAlloc, ASN1PERDecComplexChoice, ASN1PERDecDouble, ASN1PERDecExtension, ASN1PERDecFlush, ASN1PERDecFragmented, ASN1PERDecFragmentedChar16String, ASN1PERDecFragmentedChar32String, ASN1PERDecFragmentedCharString, ASN1PERDecFragmentedExtension, ASN1PERDecFragmentedIntx, ASN1PERDecFragmentedLength, ASN1PERDecFragmentedTableChar16String, ASN1PERDecFragmentedTableChar32String, ASN1PERDecFragmentedTableCharString, ASN1PERDecFragmentedUIntx, ASN1PERDecFragmentedZeroChar16String, ASN1PERDecFragmentedZeroChar32String, ASN1PERDecFragmentedZeroCharString, ASN1PERDecFragmentedZeroTableChar16String, ASN1PERDecFragmentedZeroTableChar32String, ASN1PERDecFragmentedZeroTableCharString, ASN1PERDecGeneralizedTime, ASN1PERDecInteger, ASN1PERDecMultibyteString, ASN1PERDecN16Val, ASN1PERDecN32Val, ASN1PERDecN8Val, ASN1PERDecNormallySmallExtension, ASN1PERDecObjectIdentifier, ASN1PERDecObjectIdentifier2, ASN1PERDecOctetString_FixedSize, ASN1PERDecOctetString_FixedSizeEx, ASN1PERDecOctetString_NoSize, ASN1PERDecOctetString_VarSize, ASN1PERDecOctetString_VarSizeEx, ASN1PERDecS16Val, ASN1PERDecS32Val, ASN1PERDecS8Val, ASN1PERDecSXVal, ASN1PERDecSeqOf_NoSize, ASN1PERDecSeqOf_VarSize, ASN1PERDecSimpleChoice, ASN1PERDecSimpleChoiceEx, ASN1PERDecSkipBits, ASN1PERDecSkipFragmented, ASN1PERDecSkipNormallySmall, ASN1PERDecSkipNormallySmallExtension, ASN1PERDecSkipNormallySmallExtensionFragmented, ASN1PERDecTableChar16String, ASN1PERDecTableChar32String, ASN1PERDecTableCharString, ASN1PERDecTableCharStringNoAlloc, ASN1PERDecU16Val, ASN1PERDecU32Val, ASN1PERDecU8Val, ASN1PERDecUTCTime, ASN1PERDecUXVal, ASN1PERDecUnsignedInteger, ASN1PERDecUnsignedShort, ASN1PERDecZeroChar16String, ASN1PERDecZeroChar32String, ASN1PERDecZeroCharString, ASN1PERDecZeroCharStringNoAlloc, ASN1PERDecZeroTableChar16String, ASN1PERDecZeroTableChar32String, ASN1PERDecZeroTableCharString, ASN1PERDecZeroTableCharStringNoAlloc, ASN1PEREncAlignment, ASN1PEREncBit, ASN1PEREncBitIntx, ASN1PEREncBitVal, ASN1PEREncBits, ASN1PEREncBoolean, ASN1PEREncChar16String, ASN1PEREncChar32String, ASN1PEREncCharString, ASN1PEREncCheckExtensions, ASN1PEREncComplexChoice, ASN1PEREncDouble, ASN1PEREncExtensionBitClear, ASN1PEREncExtensionBitSet, ASN1PEREncFlush, ASN1PEREncFlushFragmentedToParent, ASN1PEREncFragmented, ASN1PEREncFragmentedChar16String, ASN1PEREncFragmentedChar32String, ASN1PEREncFragmentedCharString, ASN1PEREncFragmentedIntx, ASN1PEREncFragmentedLength, ASN1PEREncFragmentedTableChar16String, ASN1PEREncFragmentedTableChar32String, ASN1PEREncFragmentedTableCharString, ASN1PEREncFragmentedUIntx, ASN1PEREncGeneralizedTime, ASN1PEREncInteger, ASN1PEREncMultibyteString, ASN1PEREncNormallySmall, ASN1PEREncNormallySmallBits, ASN1PEREncObjectIdentifier, ASN1PEREncObjectIdentifier2, ASN1PEREncOctetString_FixedSize, ASN1PEREncOctetString_FixedSizeEx, ASN1PEREncOctetString_NoSize, ASN1PEREncOctetString_VarSize, ASN1PEREncOctetString_VarSizeEx, ASN1PEREncOctets, ASN1PEREncRemoveZeroBits, ASN1PEREncSeqOf_NoSize, ASN1PEREncSeqOf_VarSize, ASN1PEREncSimpleChoice, ASN1PEREncSimpleChoiceEx, ASN1PEREncTableChar16String, ASN1PEREncTableChar32String, ASN1PEREncTableCharString, ASN1PEREncUTCTime, ASN1PEREncUnsignedInteger, ASN1PEREncUnsignedShort, ASN1PEREncZero, ASN1PERFreeSeqOf, ASN1_CloseDecoder, ASN1_CloseEncoder, ASN1_CloseEncoder2, ASN1_CloseModule, ASN1_CreateDecoder, ASN1_CreateDecoderEx, ASN1_CreateEncoder, ASN1_CreateModule, ASN1_Decode, ASN1_Encode, ASN1_FreeDecoded, ASN1_FreeEncoded, ASN1_GetDecoderOption, ASN1_GetEncoderOption, ASN1_SetDecoderOption, ASN1_SetEncoderOption, ASN1bitstring_cmp, ASN1bitstring_free, ASN1char16string_cmp, ASN1char16string_free, ASN1char32string_cmp, ASN1char32string_free, ASN1charstring_cmp, ASN1charstring_free, ASN1generalizedtime_cmp, ASN1intx2int32, ASN1intx2uint32, ASN1intx_add, ASN1intx_free, ASN1intx_setuint32, ASN1intx_sub, ASN1intx_uoctets, ASN1intxisuint32, ASN1objectidentifier2_cmp, ASN1objectidentifier_cmp, ASN1objectidentifier_free, ASN1octetstring_cmp, ASN1octetstring_free, ASN1open_cmp, ASN1open_free, ASN1uint32_uoctets, ASN1utctime_cmp, ASN1utf8string_free, ASN1ztchar16string_cmp, ASN1ztchar16string_free, ASN1ztchar32string_free, ASN1ztcharstring_cmp, ASN1ztcharstring_free

RDS...: NSRL Reference Data Set
-
pdfid.: -
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: ASN.1 Runtime APIs
original name: msasn1.dll
internal name: msasn1.dll
file version.: 5.1.2600.5875 (xpsp_sp3_gdr.090904-1413)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

trid..: Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

atapi.sys:

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.10.20 -
AhnLab-V3 5.0.0.2 2009.10.20 -
AntiVir 7.9.1.35 2009.10.20 -
Antiy-AVL 2.0.3.7 2009.10.21 -
Authentium 5.1.2.4 2009.10.21 -
Avast 4.8.1351.0 2009.10.20 -
AVG 8.5.0.420 2009.10.20 -
BitDefender 7.2 2009.10.21 -
CAT-QuickHeal 10.00 2009.10.20 -
ClamAV 0.94.1 2009.10.21 -
Comodo 2675 2009.10.21 -
DrWeb 5.0.0.12182 2009.10.21 -
eSafe 7.0.17.0 2009.10.19 Win32.Rootkit
eTrust-Vet 35.1.7075 2009.10.19 -
F-Prot 4.5.1.85 2009.10.20 -
F-Secure 9.0.15300.0 2009.10.20 -
Fortinet 3.120.0.0 2009.10.21 -
GData 19 2009.10.21 -
Ikarus T3.1.1.72.0 2009.10.21 -
Jiangmin 11.0.800 2009.10.20 -
K7AntiVirus 7.10.875 2009.10.20 -
Kaspersky 7.0.0.125 2009.10.21 -
McAfee 5777 2009.10.20 -
McAfee+Artemis 5777 2009.10.20 -
McAfee-GW-Edition 6.8.5 2009.10.21 -
Microsoft 1.5101 2009.10.20 -
NOD32 4527 2009.10.20 -
Norman 6.03.02 2009.10.20 -
nProtect 2009.1.8.0 2009.10.20 -
Panda 10.0.2.2 2009.10.20 -
PCTools 4.4.2.0 2009.10.19 -
Prevx 3.0 2009.10.21 -
Rising 21.52.20.00 2009.10.21 -
Sophos 4.46.0 2009.10.21 -
Sunbelt 3.2.1858.2 2009.10.20 -
Symantec 1.4.4.12 2009.10.21 -
TheHacker 6.5.0.2.049 2009.10.20 -
TrendMicro 8.950.0.1094 2009.10.21 -
VBA32 3.12.10.11 2009.10.20 -
ViRobot 2009.10.21.1997 2009.10.21 -
VirusBuster 4.6.5.0 2009.10.20 -
Information additionnelle
File size: 96512 bytes
MD5...: 9f3a2f5aa6875c72bf062c712cfa2674
SHA1..: a719156e8ad67456556a02c34e762944234e7a44
SHA256: b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9
ssdeep: 1536:MwXpkfV74F1D7yNEZIHRRJMohmus27G1j/XBoDQi7oaRMJfYHFktprll1Kb
DD0uu:MQ+N74vkEZIxMohjsimBoDTRMBwFktZu

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x159f7
timedatestamp.....: 0x4802539d (Sun Apr 13 18:40:29 2008)
machinetype.......: 0x14c (I386)

( 9 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x380 0x97ba 0x9800 6.45 0d7d81391f33c6450a81be1e3ac8c7b7
NONPAGE 0x9b80 0x18e8 0x1900 6.48 c74a833abd81cc5d037de168e055ad29
.rdata 0xb480 0xa64 0xa80 4.31 8523651899e28819a14bf9415af25708
.data 0xbf00 0xd94 0xe00 0.45 3575b51634ae7a56f55f1ee0a6213834
PAGESCAN 0xcd00 0x157f 0x1580 6.20 dc4c309c4db9576daa752fdd125fccf9
PAGE 0xe280 0x61da 0x6200 6.46 40b83d4d552384e58a03517a98eb4863
INIT 0x14480 0x22be 0x2300 6.47 906462abc478368424ea462d5868d2e3
.rsrc 0x16780 0x3e0 0x400 3.36 8fd2d82e745b289c28bc056d3a0d62ab
.reloc 0x16b80 0xd20 0xd80 6.39 ce2b0898cc0e40b618e5df9099f6be45

( 3 imports )
> ntoskrnl.exe: RtlInitUnicodeString, swprintf, KeSetEvent, IoCreateSymbolicLink, IoGetConfigurationInformation, IoDeleteSymbolicLink, MmFreeMappingAddress, IoFreeErrorLogEntry, IoDisconnectInterrupt, MmUnmapIoSpace, ObReferenceObjectByPointer, IofCompleteRequest, RtlCompareUnicodeString, IofCallDriver, MmAllocateMappingAddress, IoAllocateErrorLogEntry, IoConnectInterrupt, IoDetachDevice, KeWaitForSingleObject, KeInitializeEvent, KeCancelTimer, RtlAnsiStringToUnicodeString, RtlInitAnsiString, IoBuildDeviceIoControlRequest, IoQueueWorkItem, MmMapIoSpace, IoInvalidateDeviceRelations, IoReportDetectedDevice, IoReportResourceForDetection, RtlxAnsiStringToUnicodeSize, NlsMbCodePageTag, PoRequestPowerIrp, KeInsertByKeyDeviceQueue, PoRegisterDeviceForIdleDetection, sprintf, MmMapLockedPagesSpecifyCache, ObfDereferenceObject, IoGetAttachedDeviceReference, IoInvalidateDeviceState, ZwClose, ObReferenceObjectByHandle, ZwCreateDirectoryObject, IoBuildSynchronousFsdRequest, PoStartNextPowerIrp, IoCreateDevice, RtlCopyUnicodeString, IoAllocateDriverObjectExtension, RtlQueryRegistryValues, ZwOpenKey, RtlFreeUnicodeString, IoStartTimer, KeInitializeTimer, IoInitializeTimer, KeInitializeDpc, KeInitializeSpinLock, IoInitializeIrp, ZwCreateKey, RtlAppendUnicodeStringToString, RtlIntegerToUnicodeString, ZwSetValueKey, KeInsertQueueDpc, KefAcquireSpinLockAtDpcLevel, IoStartPacket, KefReleaseSpinLockFromDpcLevel, IoBuildAsynchronousFsdRequest, IoFreeMdl, MmUnlockPages, IoWriteErrorLogEntry, KeRemoveByKeyDeviceQueue, MmMapLockedPagesWithReservedMapping, MmUnmapReservedMapping, KeSynchronizeExecution, IoStartNextPacket, KeBugCheckEx, KeRemoveDeviceQueue, KeSetTimer, _allmul, MmProbeAndLockPages, _except_handler3, PoSetPowerState, IoOpenDeviceRegistryKey, RtlWriteRegistryValue, RtlDeleteRegistryValue, _aulldiv, strstr, _strupr, KeQuerySystemTime, IoWMIRegistrationControl, KeTickCount, IoAttachDeviceToDeviceStack, IoDeleteDevice, ExAllocatePoolWithTag, IoAllocateWorkItem, IoAllocateIrp, IoAllocateMdl, MmBuildMdlForNonPagedPool, MmLockPagableDataSection, IoGetDriverObjectExtension, MmUnlockPagableImageSection, ExFreePoolWithTag, IoFreeIrp, IoFreeWorkItem, InitSafeBootMode, RtlCompareMemory, PoCallDriver, memmove, MmHighestUserAddress
> HAL.dll: KfAcquireSpinLock, READ_PORT_UCHAR, KeGetCurrentIrql, KfRaiseIrql, KfLowerIrql, HalGetInterruptVector, HalTranslateBusAddress, KeStallExecutionProcessor, KfReleaseSpinLock, READ_PORT_BUFFER_USHORT, READ_PORT_USHORT, WRITE_PORT_BUFFER_USHORT, WRITE_PORT_UCHAR
> WMILIB.SYS: WmiSystemControl, WmiCompleteRequest

( 0 exports )

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: IDE/ATAPI Port Driver
original name: atapi.sys
internal name: atapi.sys
file version.: 5.1.2600.5512 (xpsp.080413-2108)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=9f3a2f5aa6875c72bf062c712cfa2674' target='_blank'>https://www.symantec.com?md5=9f3a2f5aa6875c72bf062c712cfa2674</a>
packers (Kaspersky): PE_Patch

drivers-atapi.sys:

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.10.20 -
AhnLab-V3 5.0.0.2 2009.10.20 -
AntiVir 7.9.1.35 2009.10.20 -
Antiy-AVL 2.0.3.7 2009.10.21 -
Authentium 5.1.2.4 2009.10.21 -
Avast 4.8.1351.0 2009.10.20 -
AVG 8.5.0.420 2009.10.20 -
BitDefender 7.2 2009.10.21 -
CAT-QuickHeal 10.00 2009.10.20 -
ClamAV 0.94.1 2009.10.21 -
Comodo 2675 2009.10.21 -
DrWeb 5.0.0.12182 2009.10.21 -
eSafe 7.0.17.0 2009.10.19 Win32.Rootkit
eTrust-Vet 35.1.7075 2009.10.19 -
F-Prot 4.5.1.85 2009.10.20 -
F-Secure 9.0.15300.0 2009.10.20 -
Fortinet 3.120.0.0 2009.10.21 -
GData 19 2009.10.21 -
Ikarus T3.1.1.72.0 2009.10.21 -
Jiangmin 11.0.800 2009.10.20 -
K7AntiVirus 7.10.875 2009.10.20 -
Kaspersky 7.0.0.125 2009.10.21 -
McAfee 5777 2009.10.20 -
McAfee+Artemis 5777 2009.10.20 -
McAfee-GW-Edition 6.8.5 2009.10.21 -
Microsoft 1.5101 2009.10.20 -
NOD32 4527 2009.10.20 -
Norman 6.03.02 2009.10.20 -
nProtect 2009.1.8.0 2009.10.20 -
Panda 10.0.2.2 2009.10.20 -
PCTools 4.4.2.0 2009.10.19 -
Prevx 3.0 2009.10.21 -
Rising 21.52.20.00 2009.10.21 -
Sophos 4.46.0 2009.10.21 -
Sunbelt 3.2.1858.2 2009.10.20 -
Symantec 1.4.4.12 2009.10.21 -
TheHacker 6.5.0.2.049 2009.10.20 -
TrendMicro 8.950.0.1094 2009.10.21 -
VBA32 3.12.10.11 2009.10.20 -
ViRobot 2009.10.21.1997 2009.10.21 -
VirusBuster 4.6.5.0 2009.10.20 -
Information additionnelle
File size: 96512 bytes
MD5...: 9f3a2f5aa6875c72bf062c712cfa2674
SHA1..: a719156e8ad67456556a02c34e762944234e7a44
SHA256: b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9
ssdeep: 1536:MwXpkfV74F1D7yNEZIHRRJMohmus27G1j/XBoDQi7oaRMJfYHFktprll1Kb
DD0uu:MQ+N74vkEZIxMohjsimBoDTRMBwFktZu

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x159f7
timedatestamp.....: 0x4802539d (Sun Apr 13 18:40:29 2008)
machinetype.......: 0x14c (I386)

( 9 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x380 0x97ba 0x9800 6.45 0d7d81391f33c6450a81be1e3ac8c7b7
NONPAGE 0x9b80 0x18e8 0x1900 6.48 c74a833abd81cc5d037de168e055ad29
.rdata 0xb480 0xa64 0xa80 4.31 8523651899e28819a14bf9415af25708
.data 0xbf00 0xd94 0xe00 0.45 3575b51634ae7a56f55f1ee0a6213834
PAGESCAN 0xcd00 0x157f 0x1580 6.20 dc4c309c4db9576daa752fdd125fccf9
PAGE 0xe280 0x61da 0x6200 6.46 40b83d4d552384e58a03517a98eb4863
INIT 0x14480 0x22be 0x2300 6.47 906462abc478368424ea462d5868d2e3
.rsrc 0x16780 0x3e0 0x400 3.36 8fd2d82e745b289c28bc056d3a0d62ab
.reloc 0x16b80 0xd20 0xd80 6.39 ce2b0898cc0e40b618e5df9099f6be45

( 3 imports )
> ntoskrnl.exe: RtlInitUnicodeString, swprintf, KeSetEvent, IoCreateSymbolicLink, IoGetConfigurationInformation, IoDeleteSymbolicLink, MmFreeMappingAddress, IoFreeErrorLogEntry, IoDisconnectInterrupt, MmUnmapIoSpace, ObReferenceObjectByPointer, IofCompleteRequest, RtlCompareUnicodeString, IofCallDriver, MmAllocateMappingAddress, IoAllocateErrorLogEntry, IoConnectInterrupt, IoDetachDevice, KeWaitForSingleObject, KeInitializeEvent, KeCancelTimer, RtlAnsiStringToUnicodeString, RtlInitAnsiString, IoBuildDeviceIoControlRequest, IoQueueWorkItem, MmMapIoSpace, IoInvalidateDeviceRelations, IoReportDetectedDevice, IoReportResourceForDetection, RtlxAnsiStringToUnicodeSize, NlsMbCodePageTag, PoRequestPowerIrp, KeInsertByKeyDeviceQueue, PoRegisterDeviceForIdleDetection, sprintf, MmMapLockedPagesSpecifyCache, ObfDereferenceObject, IoGetAttachedDeviceReference, IoInvalidateDeviceState, ZwClose, ObReferenceObjectByHandle, ZwCreateDirectoryObject, IoBuildSynchronousFsdRequest, PoStartNextPowerIrp, IoCreateDevice, RtlCopyUnicodeString, IoAllocateDriverObjectExtension, RtlQueryRegistryValues, ZwOpenKey, RtlFreeUnicodeString, IoStartTimer, KeInitializeTimer, IoInitializeTimer, KeInitializeDpc, KeInitializeSpinLock, IoInitializeIrp, ZwCreateKey, RtlAppendUnicodeStringToString, RtlIntegerToUnicodeString, ZwSetValueKey, KeInsertQueueDpc, KefAcquireSpinLockAtDpcLevel, IoStartPacket, KefReleaseSpinLockFromDpcLevel, IoBuildAsynchronousFsdRequest, IoFreeMdl, MmUnlockPages, IoWriteErrorLogEntry, KeRemoveByKeyDeviceQueue, MmMapLockedPagesWithReservedMapping, MmUnmapReservedMapping, KeSynchronizeExecution, IoStartNextPacket, KeBugCheckEx, KeRemoveDeviceQueue, KeSetTimer, _allmul, MmProbeAndLockPages, _except_handler3, PoSetPowerState, IoOpenDeviceRegistryKey, RtlWriteRegistryValue, RtlDeleteRegistryValue, _aulldiv, strstr, _strupr, KeQuerySystemTime, IoWMIRegistrationControl, KeTickCount, IoAttachDeviceToDeviceStack, IoDeleteDevice, ExAllocatePoolWithTag, IoAllocateWorkItem, IoAllocateIrp, IoAllocateMdl, MmBuildMdlForNonPagedPool, MmLockPagableDataSection, IoGetDriverObjectExtension, MmUnlockPagableImageSection, ExFreePoolWithTag, IoFreeIrp, IoFreeWorkItem, InitSafeBootMode, RtlCompareMemory, PoCallDriver, memmove, MmHighestUserAddress
> HAL.dll: KfAcquireSpinLock, READ_PORT_UCHAR, KeGetCurrentIrql, KfRaiseIrql, KfLowerIrql, HalGetInterruptVector, HalTranslateBusAddress, KeStallExecutionProcessor, KfReleaseSpinLock, READ_PORT_BUFFER_USHORT, READ_PORT_USHORT, WRITE_PORT_BUFFER_USHORT, WRITE_PORT_UCHAR
> WMILIB.SYS: WmiSystemControl, WmiCompleteRequest

( 0 exports )

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: IDE/ATAPI Port Driver
original name: atapi.sys
internal name: atapi.sys
file version.: 5.1.2600.5512 (xpsp.080413-2108)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=9f3a2f5aa6875c72bf062c712cfa2674' target='_blank'>https://www.symantec.com?md5=9f3a2f5aa6875c72bf062c712cfa2674</a>
packers (Kaspersky): PE_Patch

ComboFix 09-10-16.08 - Administrateur 26/08/2004 1:44.1.1 - NTFSx86
Lancé depuis: c:\documents and settings\Administrateur\Bureau\CFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091016-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\axaltocm.dll
c:\windows\system32\msconfig.exe
c:\windows\system32\Plugins
c:\windows\system32\Plugins\APIs\c.api
c:\windows\system32\Plugins\APIs\cpp.api
c:\windows\system32\Plugins\APIs\cs.api
c:\windows\system32\Plugins\APIs\css.api
c:\windows\system32\Plugins\APIs\flash.api
c:\windows\system32\Plugins\APIs\java.api
c:\windows\system32\Plugins\APIs\javascript.api
c:\windows\system32\Plugins\APIs\lisp.api
c:\windows\system32\Plugins\APIs\nsis.api
c:\windows\system32\Plugins\APIs\perl.api
c:\windows\system32\Plugins\APIs\php.api
c:\windows\system32\Plugins\APIs\python.api
c:\windows\system32\Plugins\APIs\tex.api
c:\windows\system32\Plugins\APIs\vb.api
c:\windows\system32\Plugins\APIs\vhdl.api
c:\windows\system32\Plugins\APIs\xml.api
c:\windows\system32\Plugins\Config\NppExec.ini
c:\windows\system32\Plugins\ConvertExt.dll
c:\windows\system32\Plugins\doc\NppExec.txt
c:\windows\system32\Plugins\doc\NppExec_TechInfo.txt
c:\windows\system32\Plugins\doc\quickText_README.txt
c:\windows\system32\Plugins\FunctionList.dll
c:\windows\system32\Plugins\HexEditor.dll
c:\windows\system32\Plugins\LightExplorer.dll
c:\windows\system32\Plugins\NppExec.dll
c:\windows\system32\Plugins\NPPTextFX.dll
c:\windows\system32\Plugins\NPPTextFX\AsciiToEBCDIC.bin
c:\windows\system32\Plugins\NPPTextFX\libTidy.dll
c:\windows\system32\Plugins\NPPTextFX\NPPTextFXdemo.TXT
c:\windows\system32\Plugins\NPPTextFX\W3C-CSSValidator.htm
c:\windows\system32\Plugins\NPPTextFX\W3C-HTMLValidator.htm
c:\windows\system32\Plugins\QuickText.dll
c:\windows\system32\Plugins\SpellChecker.dll
c:\windows\system32\uninstall.exe

Une copie infectée de c:\windows\system32\mqbkup.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\windows\ServicePackFiles\i386\mqbkup.exe

Une copie infectée de c:\windows\system32\mqsvc.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\windows\ServicePackFiles\i386\mqsvc.exe

Une copie infectée de c:\windows\system32\mqtgsvc.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\windows\ServicePackFiles\i386\mqtgsvc.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NWCWORKSTATION
-------\Service_NWCWorkstation

((((((((((((((((((((((((((((( Fichiers créés du 2004-07-26 au 2004-08-26 ))))))))))))))))))))))))))))))))))))
.

2009-10-16 04:19 . 2009-10-16 04:19 -------- d-----w- c:\program files\Trend Micro
2009-10-16 03:50 . 2008-04-13 18:40 96512 -c--a-w- c:\windows\system32\dllcache\atapi.sys
2009-10-16 03:50 . 2008-04-13 18:40 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-10-16 03:44 . 2009-10-16 03:44 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Malwarebytes
2009-10-16 03:44 . 2009-09-10 17:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-16 03:43 . 2009-10-16 03:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-16 03:43 . 2009-10-16 03:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-16 03:43 . 2009-09-10 17:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-15 16:19 . 2009-07-17 16:16 1440768 -c----w- c:\windows\system32\dllcache\query.dll
2009-10-15 16:18 . 2009-09-04 21:04 58880 -c----w- c:\windows\system32\dllcache\msasn1.dll
2009-10-15 04:04 . 2009-10-15 04:04 -------- dc----w- C:\_OTM
2009-10-14 13:58 . 2009-10-14 13:58 -------- d-----w- c:\windows\ERUNT
2009-10-14 13:52 . 2008-11-06 05:03 -------- dc----w- C:\SDFix
2009-10-14 12:57 . 2009-10-16 17:31 -------- d-----w- c:\program files\ZHPDiag
2009-10-14 12:02 . 2009-10-14 12:02 -------- dc----w- C:\rsit
2009-10-14 11:25 . 2009-10-14 11:25 -------- d-----w- c:\program files\Microsoft Works
2009-10-14 11:23 . 2009-10-14 11:23 -------- d-----w- c:\program files\Microsoft.NET
2009-10-14 11:19 . 2009-10-14 11:19 -------- dc----r- C:\MSOCache
2009-10-14 07:00 . 2009-10-14 07:03 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-14 07:00 . 2009-10-14 07:00 -------- d-----w- c:\program files\Oberon Media
2009-10-14 07:00 . 2009-10-14 07:04 -------- d-----w- c:\program files\MSN Games
2009-10-14 06:06 . 2009-10-14 06:13 -------- dc----w- C:\ToolBar SD
2009-10-14 03:22 . 2009-10-14 03:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Zone.com Deluxe Games
2009-10-14 03:22 . 2009-10-14 03:22 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Zone.com Deluxe Games
2009-10-14 02:16 . 2009-10-14 04:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-13 22:10 . 2009-10-15 20:33 -------- d-----w- c:\program files\Microsoft Silverlight
2009-10-13 22:07 . 2009-08-06 01:48 54752 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-10-13 21:56 . 2009-10-13 21:56 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-10-13 21:51 . 2009-10-13 21:51 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\PCHealth
2009-10-13 21:42 . 2009-10-13 21:47 -------- d-----w- c:\documents and settings\Administrateur\Contacts
2009-10-13 21:36 . 2009-10-13 21:38 -------- dcsh--w- c:\program files\Fichiers communs\WindowsLiveInstaller
2009-10-13 21:36 . 2009-10-13 22:08 -------- d-----w- c:\program files\Windows Live
2009-10-13 19:09 . 2009-10-13 21:42 -------- d-----w- c:\program files\Lavasoft
2009-10-13 19:09 . 2009-10-13 21:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-10-13 18:34 . 2009-10-13 18:34 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-10-13 17:33 . 2009-10-13 17:33 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
2009-10-13 17:27 . 2009-10-13 17:27 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2009-10-13 13:35 . 2009-10-13 13:50 29184 ----a-w- c:\windows\lssas.exe
2009-10-13 11:02 . 2008-10-16 17:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-10-13 11:02 . 2008-10-16 17:06 208744 ----a-w- c:\windows\system32\muweb.dll
2009-10-13 02:49 . 2009-10-13 21:37 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
2009-10-13 02:13 . 2009-09-15 10:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-10-13 02:13 . 2009-09-15 10:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-10-13 02:13 . 2009-09-15 10:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-10-13 02:13 . 2009-09-15 10:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-10-13 02:13 . 2009-09-15 10:56 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-10-13 02:13 . 2009-09-15 10:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-10-13 02:13 . 2009-09-15 10:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-10-13 02:13 . 2009-09-15 10:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-10-13 02:13 . 2009-09-15 10:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-10-13 02:12 . 2009-10-16 17:28 -------- d-----w- c:\program files\CCleaner
2009-10-13 01:24 . 2009-10-13 01:24 -------- d-----w- c:\program files\Alwil Software
2009-10-12 17:05 . 2009-09-11 14:18 136192 -c----w- c:\windows\system32\dllcache\msv1_0.dll
2009-10-12 17:05 . 2009-06-25 08:26 54272 -c----w- c:\windows\system32\dllcache\wdigest.dll
2009-10-12 17:05 . 2009-06-25 08:26 301568 -c----w- c:\windows\system32\dllcache\kerberos.dll
2009-10-12 17:05 . 2009-06-24 11:18 92928 -c----w- c:\windows\system32\dllcache\ksecdd.sys
2009-09-30 10:48 . 2008-05-09 10:55 180224 -c----w- c:\windows\system32\dllcache\scrobj.dll
2009-09-30 10:48 . 2008-05-09 10:55 90112 -c----w- c:\windows\system32\dllcache\wshext.dll
2009-09-30 10:48 . 2008-05-09 10:55 172032 -c----w- c:\windows\system32\dllcache\scrrun.dll
2009-09-30 10:48 . 2008-05-09 08:45 135168 -c----w- c:\windows\system32\dllcache\cscript.exe
2009-09-30 10:48 . 2008-05-08 11:24 155648 -c----w- c:\windows\system32\dllcache\wscript.exe
2009-09-30 05:45 . 2009-09-30 05:45 -------- d-----w- c:\windows\system32\xircom
2009-09-30 05:45 . 2009-09-30 05:45 -------- d-----w- c:\windows\srchasst
2009-09-30 04:00 . 2009-09-30 05:45 -------- d-----w- c:\windows\system32\wbem\Repository.001
2009-09-30 04:00 . 2009-10-15 20:25 -------- d-----w- c:\windows\system32\wbem\AutoRecover
2009-09-30 03:59 . 2009-09-30 03:59 -------- d-----w- c:\windows\system32\bits
2009-09-28 16:25 . 2009-09-28 16:25 -------- d-----w- c:\windows\system32\KB905474
2009-09-28 16:25 . 2009-03-11 01:26 1438080 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-09-28 16:25 . 2009-03-11 01:18 454024 ----a-w- c:\windows\system32\KB905474\wgasetup.exe
2009-09-28 16:18 . 2009-09-28 16:18 -------- dc----w- C:\68ba37850f967a7b09
2009-09-28 16:14 . 2009-09-28 16:14 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-09-28 16:13 . 2009-09-28 16:13 -------- d-----w- c:\program files\MSXML 6.0
2009-09-28 16:12 . 2004-08-19 10:09 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-09-28 16:07 . 2009-09-30 03:56 -------- d-----w- c:\windows\ServicePackFiles
2009-09-28 16:06 . 2009-10-15 20:22 -------- d-----w- c:\windows\ie8updates
2009-09-28 16:02 . 2009-09-28 16:02 -------- d-----w- c:\program files\MSXML 4.0
2009-09-27 16:18 . 2008-04-14 02:34 13824 ------w- c:\windows\system32\wscntfy.exe
2009-09-27 16:18 . 2008-04-14 02:33 80896 ------w- c:\windows\system32\wscsvc.dll
2009-09-27 16:18 . 2008-04-13 16:34 25471 ------w- c:\windows\system32\drivers\watv10nt.sys
2009-09-27 16:18 . 2008-04-13 16:34 22271 ------w- c:\windows\system32\drivers\watv06nt.sys
2009-09-27 16:18 . 2008-04-13 16:34 11935 ------w- c:\windows\system32\drivers\wadv11nt.sys
2009-09-27 16:18 . 2008-04-13 16:34 11871 ------w- c:\windows\system32\drivers\wadv09nt.sys
2009-09-27 16:18 . 2008-04-13 16:34 11807 ------w- c:\windows\system32\drivers\wadv07nt.sys
2009-09-27 16:18 . 2008-04-13 16:34 11295 ------w- c:\windows\system32\drivers\wadv08nt.sys
2009-09-27 16:18 . 2008-04-13 18:43 14208 ------w- c:\windows\system32\drivers\wacompen.sys
2009-09-27 16:16 . 2008-04-14 02:33 554496 ------w- c:\windows\system32\p2psvc.dll
2009-09-27 16:15 . 2008-04-14 02:33 37376 ------w- c:\windows\system32\l2gpstore.dll
2009-09-27 16:14 . 2008-04-14 02:33 136192 ------w- c:\windows\system32\aaclient.dll
2009-09-27 15:54 . 2009-06-21 21:47 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-09-27 15:53 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2009-09-27 15:53 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-09-27 15:53 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2009-09-27 15:53 . 2008-05-01 14:36 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2009-09-27 15:53 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-09-27 15:53 . 2009-08-29 07:56 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-09-27 15:53 . 2009-08-29 07:56 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-09-27 15:53 . 2009-08-29 07:56 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-09-27 15:53 . 2009-08-29 07:56 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-09-27 15:53 . 2009-08-29 07:56 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-09-27 15:52 . 2008-04-11 19:05 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2009-09-27 15:52 . 2009-06-10 12:21 2066432 -c----w- c:\windows\system32\dllcache\mstscax.dll
2009-09-27 15:52 . 2008-12-16 12:31 354304 -c----w- c:\windows\system32\dllcache\winhttp.dll
2009-09-27 15:52 . 2009-08-26 08:01 247326 -c----w- c:\windows\system32\dllcache\strmdll.dll
2009-09-27 15:52 . 2008-10-15 16:35 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2009-09-27 15:52 . 2008-09-04 17:16 1106944 -c----w- c:\windows\system32\dllcache\msxml3.dll
2009-09-27 15:51 . 2008-04-21 21:15 219136 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-09-24 02:34 . 2003-03-18 19:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2009-09-24 02:34 . 2003-02-21 03:42 348160 ----a-w- c:\windows\system32\MSVCR71.dll
2009-09-21 17:44 . 2009-09-21 17:44 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Microsoft Help
2009-09-21 17:44 . 2009-10-15 20:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-14 11:39 . 2009-09-14 11:39 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Help
2009-09-01 17:24 . 2009-09-01 17:24 -------- d-----w- c:\program files\MSBuild
2009-09-01 17:14 . 2009-09-28 16:18 -------- d-----w- c:\windows\system32\XPSViewer
2009-09-01 17:13 . 2009-09-01 17:13 -------- d-----w- c:\program files\Reference Assemblies
2009-09-01 17:12 . 2006-06-29 16:07 14048 ------w- c:\windows\system32\spmsg2.dll
2009-09-01 17:11 . 2007-10-22 06:39 267272 ----a-w- c:\windows\system32\xactengine2_10.dll
2009-09-01 17:11 . 2007-10-12 18:14 1374232 ----a-w- c:\windows\system32\D3DCompiler_36.dll
2009-09-01 17:11 . 2007-10-02 12:56 444776 ----a-w- c:\windows\system32\d3dx10_36.dll
2009-09-01 17:11 . 2007-10-12 18:14 3734536 ----a-w- c:\windows\system32\d3dx9_36.dll
2009-09-01 17:08 . 2008-04-13 18:39 5504 ----a-w- c:\windows\system32\drivers\mstee.sys
2009-09-01 17:08 . 2008-04-13 18:46 10880 ----a-w- c:\windows\system32\drivers\ndisip.sys
2009-09-01 17:08 . 2008-04-13 18:46 15232 ----a-w- c:\windows\system32\drivers\streamip.sys
2009-09-01 17:08 . 2008-04-13 18:46 11136 ----a-w- c:\windows\system32\drivers\slip.sys
2009-09-01 17:08 . 2008-04-13 18:46 19200 ----a-w- c:\windows\system32\drivers\wstcodec.sys
2009-09-01 17:08 . 2008-04-13 18:46 85248 ----a-w- c:\windows\system32\drivers\nabtsfec.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-15 20:26 . 2001-08-28 07:00 76684 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-15 20:26 . 2001-08-28 07:00 485782 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-11 14:18 . 2004-08-19 10:09 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:04 . 2004-08-19 10:09 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-04 20:23 . 2003-11-10 00:33 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-28 14:53 . 2009-08-28 14:53 -------- d-----w- c:\program files\Free Audio Pack
2009-08-26 08:01 . 2007-10-13 12:53 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-05 09:00 . 2004-08-19 10:09 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 17:27 . 2007-10-13 12:53 2147328 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-07-29 04:35 . 2007-10-13 12:53 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-07-29 04:35 . 2007-10-13 12:52 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-07-17 19:03 . 2004-08-19 10:09 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-17 16:16 . 2007-10-13 12:53 1440768 ----a-w- c:\windows\system32\query.dll
2009-07-14 02:43 . 2007-10-13 12:55 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-06-25 18:36 . 2004-08-19 10:09 527360 ----a-w- c:\windows\system32\mqutil.dll
2009-06-25 18:36 . 2004-08-19 10:09 517120 ----a-w- c:\windows\system32\mqsnap.dll
2009-06-25 18:36 . 2004-08-19 10:09 48640 ----a-w- c:\windows\system32\mqupgrd.dll
2009-06-25 18:36 . 2004-08-19 10:09 186880 ----a-w- c:\windows\system32\mqtrig.dll
2009-06-25 18:36 . 2004-08-19 10:09 95744 ----a-w- c:\windows\system32\mqsec.dll
2009-06-25 18:36 . 2004-08-19 10:09 661504 ----a-w- c:\windows\system32\mqqm.dll
2009-06-25 18:36 . 2004-08-19 10:09 177152 ----a-w- c:\windows\system32\mqrt.dll
2009-06-25 18:36 . 2004-08-19 10:09 123392 ----a-w- c:\windows\system32\mqrtdep.dll
2009-06-25 18:36 . 2004-08-19 10:09 47104 ----a-w- c:\windows\system32\mqdscli.dll
2009-06-25 18:36 . 2004-08-19 10:09 225280 ----a-w- c:\windows\system32\mqoa.dll
2009-06-25 18:36 . 2004-08-19 10:09 16896 ----a-w- c:\windows\system32\mqise.dll
2009-06-25 18:36 . 2004-08-19 10:09 138240 ----a-w- c:\windows\system32\mqad.dll
2009-06-25 08:26 . 2007-10-13 12:53 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2007-10-13 12:53 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2007-10-13 12:52 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2004-08-19 10:09 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2007-10-13 12:52 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-15 11:09 . 2004-08-19 10:10 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-10 14:14 . 2004-08-19 10:09 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 12:21 . 2003-11-10 00:18 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2007-10-13 12:54 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-07 01:02 . 2003-11-10 00:20 -------- d-----w- c:\program files\Foxit
2009-06-03 19:10 . 2007-10-13 12:53 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-05-07 15:33 . 2004-08-19 10:09 348672 ----a-w- c:\windows\system32\localspl.dll
2009-04-02 02:02 . 2007-10-13 12:55 604160 ----a-w- c:\windows\system32\wmspdmod.dll
2009-03-08 07:34 . 2007-10-13 12:54 43008 ----a-w- c:\windows\system32\licmgr10.dll
2009-03-08 07:33 . 2007-10-13 12:54 18944 ----a-w- c:\windows\system32\corpol.dll
2009-03-08 07:33 . 2007-10-13 12:54 420352 ----a-w- c:\windows\system32\vbscript.dll
2009-03-08 07:32 . 2007-10-13 12:54 72704 ----a-w- c:\windows\system32\admparse.dll
2009-03-08 07:32 . 2007-10-13 12:54 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-03-08 07:31 . 2004-08-19 10:09 34816 ----a-w- c:\windows\system32\imgutil.dll
2009-03-08 07:31 . 2007-10-13 12:54 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-03-08 07:31 . 2007-10-13 12:54 45568 ----a-w- c:\windows\system32\mshta.exe
2009-03-08 07:22 . 2007-10-13 12:54 156160 ----a-w- c:\windows\system32\msls31.dll
2009-03-06 14:20 . 2004-08-19 10:09 286720 ----a-w- c:\windows\system32\pdh.dll
2009-02-09 11:23 . 2004-08-19 10:10 111104 ----a-w- c:\windows\system32\services.exe
2009-02-09 10:53 . 2007-10-13 12:53 401408 ----a-w- c:\windows\system32\rpcss.dll
2009-02-09 10:53 . 2004-08-19 10:09 685568 ----a-w- c:\windows\system32\advapi32.dll
2009-02-09 10:53 . 2004-08-19 10:09 739840 ----a-w- c:\windows\system32\ntdll.dll
2009-02-09 10:53 . 2003-11-10 00:18 453120 ----a-w- c:\windows\system32\wbem\wmiprvsd.dll
2009-02-09 10:53 . 2003-11-10 00:18 473600 ----a-w- c:\windows\system32\wbem\fastprox.dll
2009-02-06 10:39 . 2001-08-28 07:00 35328 ----a-w- c:\windows\system32\sc.exe
2009-02-06 10:10 . 2003-11-10 00:18 227840 ----a-w- c:\windows\system32\wbem\wmiprvse.exe
2009-01-07 21:20 . 2007-10-13 12:55 24576 ----a-w- c:\windows\system32\nlsdl.dll
2009-01-07 21:20 . 2007-10-13 12:55 23552 ----a-w- c:\windows\system32\normaliz.dll
2008-12-16 12:31 . 2004-08-19 10:09 354304 ----a-w- c:\windows\system32\winhttp.dll
2008-12-11 10:57 . 2007-10-13 12:53 333952 ----a-w- c:\windows\system32\drivers\srv.sys
2008-11-26 19:18 . 2003-11-10 00:33 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2008-10-24 11:21 . 2007-10-13 12:52 455296 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:36 . 2007-10-13 12:52 286720 ----a-w- c:\windows\system32\gdi32.dll
2008-10-16 17:13 . 2003-11-10 00:18 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2008-10-16 17:12 . 2003-11-10 00:18 202776 ----a-w- c:\windows\system32\wuweb.dll
2008-10-16 17:12 . 2003-11-10 00:18 323608 ----a-w- c:\windows\system32\wucltui.dll
2008-10-16 17:12 . 2003-11-10 00:18 561688 ----a-w- c:\windows\system32\wuapi.dll
2008-10-16 17:09 . 2007-10-13 12:54 43544 ----a-w- c:\windows\system32\wups2.dll
2008-10-16 17:09 . 2007-10-13 12:52 92696 ----a-w- c:\windows\system32\cdm.dll
2008-10-16 17:09 . 2003-11-10 00:18 51224 ----a-w- c:\windows\system32\wuauclt.exe
2008-10-16 17:08 . 2003-11-10 00:18 34328 ----a-w- c:\windows\system32\wups.dll
2008-09-25 00:33 . 2009-08-28 14:53 484352 ----a-w- c:\windows\system32\lame_enc.dll
2008-09-04 17:16 . 2007-10-13 12:53 1106944 ----a-w- c:\windows\system32\msxml3.dll
2008-07-07 20:28 . 2007-10-13 12:52 253952 ----a-w- c:\windows\system32\es.dll
2008-06-24 21:12 . 2001-08-28 07:00 295936 ----a-w- c:\windows\system32\wmpeffects.dll
2008-06-24 16:44 . 2007-10-13 12:52 74240 ----a-w- c:\windows\system32\mscms.dll
2008-06-20 17:47 . 2004-08-19 10:09 247808 ----a-w- c:\windows\system32\mswsock.dll
2008-06-20 11:08 . 2007-10-13 12:53 225856 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2008-06-18 08:03 . 2007-10-13 12:55 938496 ----a-w- c:\windows\system32\WMNetmgr.dll
2008-06-18 04:09 . 2007-10-13 12:55 100864 ----a-w- c:\windows\system32\logagent.exe
2008-06-14 17:33 . 2009-09-27 15:27 272768 ------w- c:\windows\system32\drivers\bthport.sys
2008-06-12 22:52 . 2003-11-10 00:18 428032 ----a-w- c:\windows\system32\msdtcprx.dll
2008-06-12 14:22 . 2007-10-13 12:53 66560 ----a-w- c:\windows\system32\mtxclu.dll
2008-06-12 14:22 . 2003-11-10 00:18 956928 ----a-w- c:\windows\system32\msdtctm.dll
2008-06-12 14:22 . 2003-11-10 00:18 91648 ----a-w- c:\windows\system32\mtxoci.dll
2008-06-12 14:22 . 2003-11-10 00:18 161792 ----a-w- c:\windows\system32\msdtcuiu.dll
2008-06-12 14:22 . 2003-11-10 00:18 58880 ----a-w- c:\windows\system32\msdtclog.dll
2008-05-09 10:55 . 2007-10-13 12:54 90112 ----a-w- c:\windows\system32\wshext.dll
2008-05-09 10:55 . 2007-10-13 12:54 180224 ----a-w- c:\windows\system32\scrobj.dll
2008-05-09 10:55 . 2007-10-13 12:54 172032 ----a-w- c:\windows\system32\scrrun.dll
2008-05-09 08:45 . 2007-10-13 12:54 135168 ----a-w- c:\windows\system32\cscript.exe
2008-05-08 14:02 . 2007-10-13 12:53 203136 ----a-w- c:\windows\system32\drivers\rmcast.sys
2008-05-08 11:24 . 2007-10-13 12:54 155648 ----a-w- c:\windows\system32\wscript.exe
2008-04-14 02:33 . 2004-08-19 10:09 82944 ----a-w- c:\windows\system32\dfrgfat.exe
2008-04-14 02:32 . 2004-08-19 10:09 5632 ----a-w- c:\windows\system32\wmi.dll
2008-04-14 02:32 . 2004-08-19 10:08 103424 ----a-w- c:\windows\system32\dpcdll.dll
2008-04-14 02:32 . 2004-08-19 10:08 61471 ----a-w- c:\windows\system32\odbcji32.dll
2008-04-14 02:10 . 2003-11-10 00:18 73600 ----a-w- c:\windows\system32\drivers\sr.sys
2008-04-14 02:06 . 2004-08-19 10:08 4096 ----a-w- c:\windows\system32\dsprpres.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-02-10 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-02-10 118784]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
NETGEAR WG111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v2\WG111v2.exe [2006-5-17 2297856]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)
"NoWelcomeScreen"= 1 (0x1)
"NoStrCmpLogical"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"DisablePagingExecutive"=dword:00000001
"SecondLevelDataCache"=dword:00000200

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-08-06 704864]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys [x]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]
S2 fssfltr;fssfltr;c:\windows\system32\DRIVERS\fssfltr_tdi.sys [2009-08-06 54752]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - HELPSVC
.
Contenu du dossier 'Tâches planifiées'

2009-06-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 15:34]

2009-10-12 c:\windows\Tasks\User_Feed_Synchronization-{84E066EA-F48E-4AB5-A431-938306811DE6}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 07:31]

2009-10-13 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-09-28 01:18]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.ca/
mWindow Title =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s
Trusted Zone: tagged.com\www
DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - hxxp://imikimi.com/download/imikimi_plugin_0.5.1.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2004-08-26 01:50
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-329068152-1454471165-1177238915-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,17,3c,d5,3d,72,05,ba,4c,8f,0f,54,\
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,17,3c,d5,3d,72,05,ba,4c,8f,0f,54,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,94,1f,8c,07,4f,e8,ea,42,b8,78,f3,\

[HKEY_USERS\S-1-5-21-329068152-1454471165-1177238915-500\Software\Sony Creative Software\M*e*d*i*a* *M*a*n*a*g*e*r* *f*o*r* *P*S*P*"!\3.0]
"FRT"="9fsecyfEi5yImizoRtlsXWUyp0l2UTw1zimWQ08/Kv8q9SFXzxhF3A=="
"PLCK"="Vjo48wdF1eUHDPW3E/aaheg18p0NqFGw"
"Percents"="0 0.0976 0.2437 0.5643 0.7988 0.8626 0.8757 "
"Increment"=".002475"
"PHSH"=""
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(640)
c:\windows\system32\RtlGina2.dll

- - - - - - - > 'explorer.exe'(4044)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Heure de fin: 2004-08-26 1:56 - La machine a redémarré
ComboFix-quarantined-files.txt 2004-08-26 04:56

Avant-CF: 61 582 565 376 octets libres
Après-CF: 61 512 462 336 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /fastdetect /noexecute=optin

420 --- E O F --- 2009-10-15 20:27

J'ai une erreure qui m'apparet aussitot que j'essaie d'aller sur un site qui est securisé !!!

Le certificat de sécurité de ce site Web présente un problème.

oublis mon dernier message ... j'avais oublier de regler la date et l'heure

Non ... je me demandais si ca avais rapport ou non ....

Salut ... Encore une foix sa me donne la meme erreur indice de liste hors limites (1) Est ce que ca serais a cause de Avast ? Désolé de te donner autant de misere :S

Salut

Petit probleme (je crois) lors de la verification de Malwarebytes , Avast ma sortie une erreur comme quoi j'avais un virus ... alors je les suprimer ... quand Malwarebytes a terminer sont scan jai effacer les infections qu'il avait trouver et redemarre ... Lors du Boot ; une page bleu ma apparue .... jai rebooter et encore pareille alors jai essayer mode sans echec sans resultat et maintenant je suis sur le mode ( Derniere version Correct connu) je connais pas les termes exact dsl ... et j'ai refais un scan Malwarebytes... alors je t'envoie les 2 rapport des foix que tu en aurais de besoin ... et au fais le virus que avast as detecter etais ds le Systeme32 et commencais par atipi quelque chose comme ca ... je les pas retenu dsl ...

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2970
Windows 5.1.2600 Service Pack 3

16/10/2009 00:53:10
mbam-log-2009-10-16 (00-53-05).txt

Type de recherche: Examen rapide
Eléments examinés: 91698
Temps écoulé: 6 minute(s), 31 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 4
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
C:\Documents and Settings\Administrateur\Local Settings\Application Data\DoubleD (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\DoubleD\JuicyAccess Toolbar (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\DoubleD\JuicyAccess Toolbar\4.2.4.23050 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\DoubleD\JuicyAccess Toolbar\4.2.4.23050\bin (Adware.DoubleD) -> No action taken.

Fichier(s) infecté(s):
C:\WINDOWS\msa.exe (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\DoubleD\JuicyAccess Toolbar\4.2.4.23050\bin\stbup.exe (Adware.DoubleD) -> No action taken.

2 ieme Rapport

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2970
Windows 5.1.2600 Service Pack 3

16/10/2009 01:06:49
mbam-log-2009-10-16 (01-06-49).txt

Type de recherche: Examen rapide
Eléments examinés: 91625
Temps écoulé: 4 minute(s), 39 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Voici le rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:19:35, on 16/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WG111v2\WG111v2.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ca.msn.com/?lang=fr-ca
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-329068152-1454471165-1177238915-500\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v2\WG111v2.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: https://secure.tagged.com/
O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - http://imikimi.com/download/imikimi_plugin_0.5.1.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

All processes killed
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Winsock2

driver not found.
========== FILES ==========
File/Folder C:\WINDOWS\system32\avrugad.exe not found.
C:\WINDOWS\livemessenger.com moved successfully.
C:\WINDOWS\msnsmgr.exe moved successfully.
C:\WINDOWS\system32\ahivouj.exe moved successfully.
C:\WINDOWS\system32\edyeejl.exe moved successfully.
C:\WINDOWS\system32\eyfytti.exe moved successfully.
C:\WINDOWS\system32\icjtdgu.exe moved successfully.
C:\WINDOWS\system32\wgdajdr.exe moved successfully.
C:\WINDOWS\system32\wubgkht.exe moved successfully.
C:\WINDOWS\system32\xtoehbv.exe moved successfully.
C:\WINDOWS\system32\ylftrsb.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 21524832 bytes
->Temporary Internet Files folder emptied: 5327000 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 3349642 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet

Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
C:\WINDOWS\msdownld.tmp folder deleted successfully.
%systemroot% .tmp files removed: 2299763 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on

reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_598.dat scheduled to be deleted on

reboot.
Windows Temp folder emptied: 114688 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 31,20 mb

OTM by OldTimer - Version 3.0.0.6 log created on 10152009_010404

Files moved on Reboot...
File C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!
File move failed. C:\WINDOWS\temp\Perflib_Perfdata_598.dat scheduled to be moved on reboot.

Registry entries deleted on Reboot...

DDS (Ver_09-10-13.01) - NTFSx86
Run by Administrateur at 1:10:19,84 on 15/10/2009
Internet Explorer: 8.0.6001.18702
AV: avast! antivirus 4.8.1356 [VPS 091014-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ca/
uSearch Page =
mWindow Title =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s
mSearchAssistant =
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\fichiers

communs\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows Live Family Safety Browser Helper Class: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - c:\program files\windows

live\family safety\fssbho.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search

helper\SearchHelper.dll
BHO: Programme d'aide de l'Assistant de connexion Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program

files\fichiers communs\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program

files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\menudm~1\progra~1\dmarra~1\netgea~1.lnk - c:\program files\netgear\wg111v2\WG111v2.exe
uPolicies-explorer: NoSMHelp = 1 (0x1)
uPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
uPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1)
uPolicies-explorer: NoSMBalloonTip = 0 (0x0)
uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
uPolicies-explorer: NoWelcomeScreen = 1 (0x1)
uPolicies-explorer: NoStrCmpLogical = 0 (0x0)
uPolicies-explorer: NoInstrumentation = 0 (0x0)
dPolicies-explorer: NoSMHelp = 1 (0x1)
dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
dPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
dPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1)
dPolicies-explorer: NoSMBalloonTip = 0 (0x0)
dPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
dPolicies-explorer: NoWelcomeScreen = 1 (0x1)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows

live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} -

c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
Trusted Zone: tagged.com\www
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - hxxp://imikimi.com/download/imikimi_plugin_0.5.1.cab
DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} - hxxp://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Authentication Packages = msv1_0 nwprovau

============= SERVICES / DRIVERS ===============

=============== Created Last 30 ================

2009-10-15 01:04 <DIR> -cd----- C:\_OTM
2009-10-14 10:58 <DIR> --d----- c:\windows\ERUNT
2009-10-14 10:52 <DIR> -cd----- C:\SDFix
2009-10-14 09:57 <DIR> --d----- c:\program files\ZHPDiag
2009-10-14 04:00 <DIR> --d----- c:\program files\Oberon Media
2009-10-14 04:00 <DIR> --d----- c:\program files\MSN Games
2009-10-14 03:06 <DIR> -cd----- C:\ToolBar SD
2009-10-14 00:22 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Zone.com Deluxe Games
2009-10-14 00:22 <DIR> --d----- c:\docume~1\admini~1\applic~1\Zone.com Deluxe Games
2009-10-13 23:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-10-13 19:07 54,752 a------- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-10-13 18:56 <DIR> --d----- c:\program files\Windows Live SkyDrive
2009-10-13 18:42 <DIR> --d----- c:\documents and settings\administrateur\Contacts
2009-10-13 18:36 <DIR> -cdsh--- c:\program files\fichiers communs\WindowsLiveInstaller
2009-10-13 16:09 <DIR> --d----- c:\program files\Lavasoft
2009-10-13 10:35 29,184 a------- c:\windows\lssas.exe
2009-10-13 08:02 268,648 a------- c:\windows\system32\mucltui.dll
2009-10-13 08:02 208,744 a------- c:\windows\system32\muweb.dll
2009-10-13 08:02 27,496 a------- c:\windows\system32\mucltui.dll.mui
2009-10-12 23:12 <DIR> --d----- c:\program files\CCleaner
2009-10-12 15:37 157,696 a------- c:\windows\msa.exe
2009-10-12 14:05 301,568 -c------ c:\windows\system32\dllcache\kerberos.dll
2009-10-12 14:05 136,192 -c------ c:\windows\system32\dllcache\msv1_0.dll
2009-10-12 14:05 92,928 -c------ c:\windows\system32\dllcache\ksecdd.sys
2009-10-12 14:05 54,272 -c------ c:\windows\system32\dllcache\wdigest.dll
2009-09-30 07:48 180,224 -c------ c:\windows\system32\dllcache\scrobj.dll
2009-09-30 07:48 172,032 -c------ c:\windows\system32\dllcache\scrrun.dll
2009-09-30 07:48 90,112 -c------ c:\windows\system32\dllcache\wshext.dll
2009-09-30 07:48 155,648 -c------ c:\windows\system32\dllcache\wscript.exe
2009-09-30 07:48 135,168 -c------ c:\windows\system32\dllcache\cscript.exe
2009-09-30 02:45 <DIR> --d----- c:\windows\system32\xircom
2009-09-30 02:45 <DIR> --d----- c:\windows\srchasst
2009-09-30 02:45 <DIR> --d----- c:\program files\msn gaming zone
2009-09-30 01:00 <DIR> --d----- c:\windows\system32\wbem\Repository.001
2009-09-30 01:00 <DIR> --d----- c:\windows\system32\wbem\AutoRecover
2009-09-30 00:59 <DIR> --d----- c:\program files\Messenger
2009-09-30 00:59 <DIR> --d----- c:\windows\system32\bits
2009-09-29 08:41 1,089,883 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-09-28 13:25 <DIR> --d----- c:\windows\system32\KB905474
2009-09-28 13:18 <DIR> -cd----- C:\68ba37850f967a7b09
2009-09-28 13:13 <DIR> --d----- c:\program files\MSXML 6.0
2009-09-28 13:12 221,184 a------- c:\windows\system32\wmpns.dll
2009-09-28 13:07 <DIR> --d----- c:\windows\ServicePackFiles
2009-09-28 13:06 <DIR> --d----- c:\windows\ie8updates
2009-09-28 13:02 <DIR> --d----- c:\program files\MSXML 4.0
2009-09-27 13:18 148,480 -------- c:\windows\system32\wscui.cpl
2009-09-27 13:18 80,896 -------- c:\windows\system32\wscsvc.dll
2009-09-27 13:18 13,824 -------- c:\windows\system32\wscntfy.exe
2009-09-27 13:18 2,460 -------- c:\windows\system32\wbem\wscenter.mof
2009-09-27 13:18 25,471 -------- c:\windows\system32\drivers\watv10nt.sys
2009-09-27 13:18 22,271 -------- c:\windows\system32\drivers\watv06nt.sys
2009-09-27 13:18 11,935 -------- c:\windows\system32\drivers\wadv11nt.sys
2009-09-27 13:18 11,871 -------- c:\windows\system32\drivers\wadv09nt.sys
2009-09-27 13:18 11,807 -------- c:\windows\system32\drivers\wadv07nt.sys
2009-09-27 13:18 11,295 -------- c:\windows\system32\drivers\wadv08nt.sys
2009-09-27 13:18 14,208 -------- c:\windows\system32\drivers\wacompen.sys
2009-09-27 13:16 554,496 -------- c:\windows\system32\p2psvc.dll
2009-09-27 13:15 37,376 -------- c:\windows\system32\l2gpstore.dll
2009-09-27 13:14 136,192 -------- c:\windows\system32\aaclient.dll
2009-09-27 12:54 153,088 -c------ c:\windows\system32\dllcache\triedit.dll
2009-09-27 12:53 128,512 -c------ c:\windows\system32\dllcache\dhtmled.ocx
2009-09-27 12:53 203,136 -c------ c:\windows\system32\dllcache\rmcast.sys
2009-09-27 12:53 455,296 -c------ c:\windows\system32\dllcache\mrxsmb.sys
2009-09-27 12:53 333,952 -c------ c:\windows\system32\dllcache\srv.sys
2009-09-27 12:53 331,776 -c------ c:\windows\system32\dllcache\msadce.dll
2009-09-27 12:53 1,315,328 -c------ c:\windows\system32\dllcache\msoe.dll
2009-09-27 12:53 55,296 -c------ c:\windows\system32\dllcache\msfeedsbs.dll
2009-09-27 12:53 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll
2009-09-27 12:53 1,985,536 -c------ c:\windows\system32\dllcache\iertutil.dll
2009-09-27 12:53 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll
2009-09-27 12:53 594,432 -c------ c:\windows\system32\dllcache\msfeeds.dll
2009-09-27 12:52 691,712 -c------ c:\windows\system32\dllcache\inetcomm.dll
2009-09-27 12:52 2,066,432 -c------ c:\windows\system32\dllcache\mstscax.dll
2009-09-27 12:52 354,304 -c------ c:\windows\system32\dllcache\winhttp.dll
2009-09-27 12:52 247,326 -c------ c:\windows\system32\dllcache\strmdll.dll
2009-09-27 12:52 337,408 -c------ c:\windows\system32\dllcache\netapi32.dll
2009-09-27 12:52 1,106,944 -c------ c:\windows\system32\dllcache\msxml3.dll
2009-09-27 12:51 219,136 -c------ c:\windows\system32\dllcache\wordpad.exe
2009-09-27 12:24 27,672 a------- c:\windows\system32\wuapi.dll.mui
2009-09-27 12:24 <DIR> --d----- c:\windows\system32\SoftwareDistribution
2009-09-23 23:34 499,712 a------- c:\windows\system32\MSVCP71.dll
2009-09-23 23:34 348,160 a------- c:\windows\system32\MSVCR71.dll
2009-09-23 23:29 <DIR> --d----- c:\windows\pss

==================== Find3M ====================

2009-09-28 13:22 485,782 a------- c:\windows\system32\perfh00C.dat
2009-09-28 13:22 76,684 a------- c:\windows\system32\perfc00C.dat
2009-08-05 06:00 205,312 a------- c:\windows\system32\mswebdvd.dll
2009-07-29 01:35 119,808 a------- c:\windows\system32\t2embed.dll
2009-07-29 01:35 81,920 a------- c:\windows\system32\fontsub.dll
2009-07-26 16:44 48,448 a------- c:\windows\system32\sirenacm.dll
2009-07-25 05:23 411,368 a------- c:\windows\system32\deploytk.dll
2009-07-17 16:03 58,880 a------- c:\windows\system32\atl.dll
2007-10-13 10:28 1,006,080 a------- c:\windows\inf\syssbck.dll

============= FINISH: 1:12:10,56 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-10-13.01)

==== Disk Partitions =========================

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 13/10/2009 15:25:25 - Point de vérification système
RP2: 13/10/2009 16:28:28 - Supprimé Assistant de connexion Windows Live
RP3: 13/10/2009 18:36:00 - Installé Windows Live installer
RP4: 13/10/2009 23:56:03 - Removed PlayStation(R)Network Downloader.
RP5: 14/10/2009 03:08:23 - Removed Hexic Deluxe
RP6: 14/10/2009 08:18:48 - Installed Microsoft Office Standard 2007 Trial

==== Installed Programs ======================

Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.1.1 - Français
Apple Mobile Device Support
Apple Software Update
Assistant de connexion Windows Live
avast! Antivirus
Bonjour
CCleaner (remove only)
Free Mp3 Wma Converter V 1.81
Galerie de photos Windows Live
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB954550-v5)
Installation Windows Live
Intel(R) Extreme Graphics 2 Driver
Intel(R) PRO Network Adapters and Drivers
iTunes
Java(TM) 6 Update 15
Lecteur Windows Media 11
LimeWire 5.2.13
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 French Language Pack
Microsoft .NET Framework 2.0 Language Pack - FRA
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Excel MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Standard 2007
Microsoft Office Standard 2007 Trial
Microsoft Office Word MUI (English) 2007
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mise à jour de logiciel pour les Dossiers Web
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB971961)
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB972260)
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 6 Service Pack 2 (KB954459)
NETGEAR WG111v2 wireless USB 2.0 adapter
Outil de téléchargement Windows Live
QuickTime
Segoe UI
Sony Media Manager for PSP 3.0
SoundMAX
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Contrôle parental
Windows Live FolderShare
Windows Live Messenger
Windows Live Toolbar
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Player 11
Windows Presentation Foundation
Windows XP Service Pack 3
WinRAR archiver
XML Paper Specification Shared Components Pack 1.0
ZHPDiag 1.24

==== End Of File ===========================

Bon le fichier C:\WINDOWS\system32\avrugad.exe je ne le trouve pas ....

Voici le rapport pour edyeejl.exe :

Antivirus Version Dernière mise à jour Résultat

a-squared 4.5.0.41 2009.10.14 -
AhnLab-V3 5.0.0.2 2009.10.13 -
AntiVir 7.9.1.35 2009.10.14 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2009.10.14 -
Authentium 5.1.2.4 2009.10.14 -
Avast 4.8.1351.0 2009.10.13 -
AVG 8.5.0.420 2009.10.14 -
BitDefender 7.2 2009.10.14 -
CAT-QuickHeal 10.00 2009.10.14 -
ClamAV 0.94.1 2009.10.14 -
Comodo 2599 2009.10.13 -
DrWeb 5.0.0.12182 2009.10.14 Win32.HLLW.SpyBot
eSafe 7.0.17.0 2009.10.14 Win32.TRCrypt.ZPACK
eTrust-Vet 35.1.7067 2009.10.14 -
F-Prot 4.5.1.85 2009.10.14 -
F-Secure 8.0.14470.0 2009.10.14 -
Fortinet 3.120.0.0 2009.10.14 -
GData 19 2009.10.14 -
Ikarus T3.1.1.72.0 2009.10.14 -
Jiangmin 11.0.800 2009.10.08 -
K7AntiVirus 7.10.870 2009.10.14 -
Kaspersky 7.0.0.125 2009.10.14 -
McAfee 5770 2009.10.13 -
McAfee+Artemis 5770 2009.10.13 Artemis!77DC3ACC2119
McAfee-GW-Edition 6.8.5 2009.10.14 Trojan.Crypt.ZPACK.Gen
Microsoft 1.5101 2009.10.14 VirTool:Win32/Obfuscator.FL
NOD32 4507 2009.10.14 a variant of Win32/Kryptik.AOK
Norman 6.01.09 2009.10.14 -
nProtect 2009.1.8.0 2009.10.14 -
Panda 10.0.2.2 2009.10.14 Trj/CI.A
PCTools 4.4.2.0 2009.10.14 -
Prevx 3.0 2009.10.14 Medium Risk Malware
Rising 21.51.24.00 2009.10.14 -
Sophos 4.46.0 2009.10.14 Mal/Generic-A
Sunbelt 3.2.1858.2 2009.10.14 Packer.Malicious.gen (v)
Symantec 1.4.4.12 2009.10.14 Packed.Generic.255
TheHacker 6.5.0.2.041 2009.10.14 -
TrendMicro 8.950.0.1094 2009.10.14 -
VBA32 3.12.10.11 2009.10.14 -
ViRobot 2009.10.14.1984 2009.10.14 -
VirusBuster 4.6.5.0 2009.10.14 -
Information additionnelle
File size: 83456 bytes
MD5...: 77dc3acc2119b244d55fb10ae991cb39
SHA1..: 4bcc77ec8b57bd5dfc2845f650a43b53588e6a12
SHA256: 16cf4b8ddc2f7a1dca38c26deb5af188c3469e2cf1025875620c5f09d1faee02
ssdeep: 1536:4/i0mE+ATaW3a4wDYUlPJgu4MAF2tshJwgy9k9zWmp/EQOlMwwL2dZ/t+tY
p0H+d:dELTO4SPOXM92Xy9MNpctywe2dZ/EYpB

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10df
timedatestamp.....: 0x47f4842a (Thu Apr 03 07:15:54 2008)
machinetype.......: 0x14c (I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x52e5 0x5400 6.84 8792d68f53e4acdcac1e2dbdde8dbdcf
.rdata 0x7000 0x43a 0x600 3.88 d60f878fd545a52434faa6ebef61d9b9
.data 0x8000 0xd9ed 0xda00 7.10 32582fafa62714405664b06babbb321e
9dthMkGf 0x16000 0x1000 0x200 1.66 a51243e8684ac683e06f61dc43b79503
bnsD5pGk 0x17000 0x1000 0x200 1.91 c5c390e7cbef995f6acd2c3ea074af67
NwnapG2s 0x18000 0x1000 0x200 2.35 3e9897ea85e89a89935c10a81887b804
iZzwuQqC 0x19000 0x1000 0x200 2.14 a30f8b7d7f139b78424e02d411f30854
.rsrc 0x1a000 0x20000 0x600 2.52 443ee650b6f70ebbf11b20a8b431d922

( 2 imports )
> kernel32.dll: GetModuleFileNameA, GetProcessHeap, CloseHandle, GetCurrentProcessId, UnhandledExceptionFilter, CreateEventW, CreateThread, VirtualAlloc, GetCurrentProcess, DeleteCriticalSection, InterlockedDecrement, lstrlenA, EnterCriticalSection, LoadLibraryW, CreateFileW, InterlockedExchange, LoadLibraryA, GetModuleFileNameW, HeapDestroy, GetModuleHandleW, InitializeCriticalSection, lstrlenW
> user32.dll: PeekMessageW, GetDC, DialogBoxParamW, LoadCursorW, GetDesktopWindow, GetSystemMetrics, SendMessageW, EndPaint, EnableWindow, SetWindowLongW, DestroyWindow, IsDlgButtonChecked, GetWindowLongW, SetWindowPos, ShowWindow, GetSysColor

( 0 exports )

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
VXD Driver (0.1%)
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=0ECDE5100054160B469A0199C436D70031F427F7' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=0ECDE5100054160B469A0199C436D70031F427F7</a>
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

voici maintenant xtoehbv.exe :

Antivirus Version Dernière mise à jour Résultat

a-squared 4.5.0.41 2009.10.14 -
AhnLab-V3 5.0.0.2 2009.10.13 -
AntiVir 7.9.1.35 2009.10.14 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2009.10.14 -
Authentium 5.1.2.4 2009.10.14 -
Avast 4.8.1351.0 2009.10.13 -
AVG 8.5.0.420 2009.10.14 -
BitDefender 7.2 2009.10.14 -
CAT-QuickHeal 10.00 2009.10.14 -
ClamAV 0.94.1 2009.10.14 -
Comodo 2599 2009.10.13 -
DrWeb 5.0.0.12182 2009.10.14 Win32.HLLW.SpyBot
eSafe 7.0.17.0 2009.10.14 Win32.TRCrypt.ZPACK
eTrust-Vet 35.1.7067 2009.10.14 -
F-Prot 4.5.1.85 2009.10.14 -
F-Secure 8.0.14470.0 2009.10.14 -
Fortinet 3.120.0.0 2009.10.14 -
GData 19 2009.10.14 -
Ikarus T3.1.1.72.0 2009.10.14 -
Jiangmin 11.0.800 2009.10.08 -
K7AntiVirus 7.10.870 2009.10.14 -
Kaspersky 7.0.0.125 2009.10.14 -
McAfee 5770 2009.10.13 -
McAfee+Artemis 5770 2009.10.13 Artemis!77DC3ACC2119
Microsoft 1.5101 2009.10.14 VirTool:Win32/Obfuscator.FL
NOD32 4507 2009.10.14 a variant of Win32/Kryptik.AOK
Norman 6.01.09 2009.10.14 -
nProtect 2009.1.8.0 2009.10.14 -
Panda 10.0.2.2 2009.10.14 Trj/CI.A
PCTools 4.4.2.0 2009.10.14 -
Prevx 3.0 2009.10.14 Medium Risk Malware
Rising 21.51.24.00 2009.10.14 -
Sophos 4.46.0 2009.10.14 Mal/Generic-A
Sunbelt 3.2.1858.2 2009.10.14 Packer.Malicious.gen (v)
Symantec 1.4.4.12 2009.10.14 Packed.Generic.255
TheHacker 6.5.0.2.041 2009.10.14 -
TrendMicro 8.950.0.1094 2009.10.14 -
VBA32 3.12.10.11 2009.10.14 -
ViRobot 2009.10.14.1984 2009.10.14 -
VirusBuster 4.6.5.0 2009.10.14 -
Information additionnelle
File size: 83456 bytes
MD5...: 77dc3acc2119b244d55fb10ae991cb39
SHA1..: 4bcc77ec8b57bd5dfc2845f650a43b53588e6a12
SHA256: 16cf4b8ddc2f7a1dca38c26deb5af188c3469e2cf1025875620c5f09d1faee02
ssdeep: 1536:4/i0mE+ATaW3a4wDYUlPJgu4MAF2tshJwgy9k9zWmp/EQOlMwwL2dZ/t+tY
p0H+d:dELTO4SPOXM92Xy9MNpctywe2dZ/EYpB

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10df
timedatestamp.....: 0x47f4842a (Thu Apr 03 07:15:54 2008)
machinetype.......: 0x14c (I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x52e5 0x5400 6.84 8792d68f53e4acdcac1e2dbdde8dbdcf
.rdata 0x7000 0x43a 0x600 3.88 d60f878fd545a52434faa6ebef61d9b9
.data 0x8000 0xd9ed 0xda00 7.10 32582fafa62714405664b06babbb321e
9dthMkGf 0x16000 0x1000 0x200 1.66 a51243e8684ac683e06f61dc43b79503
bnsD5pGk 0x17000 0x1000 0x200 1.91 c5c390e7cbef995f6acd2c3ea074af67
NwnapG2s 0x18000 0x1000 0x200 2.35 3e9897ea85e89a89935c10a81887b804
iZzwuQqC 0x19000 0x1000 0x200 2.14 a30f8b7d7f139b78424e02d411f30854
.rsrc 0x1a000 0x20000 0x600 2.52 443ee650b6f70ebbf11b20a8b431d922

( 2 imports )
> kernel32.dll: GetModuleFileNameA, GetProcessHeap, CloseHandle, GetCurrentProcessId, UnhandledExceptionFilter, CreateEventW, CreateThread, VirtualAlloc, GetCurrentProcess, DeleteCriticalSection, InterlockedDecrement, lstrlenA, EnterCriticalSection, LoadLibraryW, CreateFileW, InterlockedExchange, LoadLibraryA, GetModuleFileNameW, HeapDestroy, GetModuleHandleW, InitializeCriticalSection, lstrlenW
> user32.dll: PeekMessageW, GetDC, DialogBoxParamW, LoadCursorW, GetDesktopWindow, GetSystemMetrics, SendMessageW, EndPaint, EnableWindow, SetWindowLongW, DestroyWindow, IsDlgButtonChecked, GetWindowLongW, SetWindowPos, ShowWindow, GetSysColor

( 0 exports )

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
VXD Driver (0.1%)
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=0ECDE5100054160B469A0199C436D70031F427F7' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=0ECDE5100054160B469A0199C436D70031F427F7</a>
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

[b]Checking Files [/b]:

No Trojan Files Found

Folder C:\WINDOWS\system32\kazaabackupfiles - Removed

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-14 11:03:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Documents and Settings\\Administrateur\\Local Settings\\Temporary Internet Files\\Content.IE5\\B1CMKFQO\\IMG00098714911567251832-JPG[1].EXE"="C:\\Documents and Settings\\Administrateur\\Local Settings\\Temporary Internet Files\\Content.IE5\\B1CMKFQO\\IMG00098714911567251832-JPG[1].EXE:*:Enabled:Microsoft Update"
"C:\\WINDOWS\\system32\\avrugad.exe"="C:\\WINDOWS\\system32\\avrugad.exe:*:Disabled:avrugad"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"
"C:\\Program Files\\Zone.com Deluxe Games\\Hexic Deluxe\\HexicDeluxe.exe"="C:\\Program Files\\Zone.com Deluxe Games\\Hexic Deluxe\\HexicDeluxe.exe:*:Enabled:Hexic Deluxe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"

[b]Remaining Files [/b]:

[b]Files with Hidden Attributes [/b]:

Mon 12 Oct 2009 75,776 ..SHR --- "C:\WINDOWS\livemessenger.com"
Mon 12 Oct 2009 41,472 ..SHR --- "C:\WINDOWS\msnsmgr.exe"
Mon 12 Oct 2009 83,456 ...H. --- "C:\WINDOWS\system32\ahivouj.exe"
Tue 13 Oct 2009 83,456 ...H. --- "C:\WINDOWS\system32\edyeejl.exe"
Mon 12 Oct 2009 83,456 ...H. --- "C:\WINDOWS\system32\eyfytti.exe"
Tue 13 Oct 2009 83,456 ...H. --- "C:\WINDOWS\system32\icjtdgu.exe"
Tue 13 Oct 2009 83,456 ...H. --- "C:\WINDOWS\system32\wgdajdr.exe"
Tue 13 Oct 2009 83,456 ...H. --- "C:\WINDOWS\system32\wubgkht.exe"
Tue 13 Oct 2009 83,456 ...H. --- "C:\WINDOWS\system32\xtoehbv.exe"
Tue 13 Oct 2009 83,456 ...H. --- "C:\WINDOWS\system32\ylftrsb.exe"
Wed 10 Jun 2009 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 25 May 2009 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

[b]Finished![/b]

Mauvaise nouvelle ...

Autolt Error

Line -1 :

Error : Variable used without being declared

.......

@Utilisateur anonymetite fille20, ça veut dire koi cette mauvaise nouvelle ?

meme erreur :S