Infection de Trojans

Résolu
Bronksman -  
Bonjour,

J'ai été atteint d'un trojan dernièrement. Je dois vous avouer que plusieurs différents types ont été détecté suite à mon auto-détection de mon antivirus. Par contre il y a quelques-uns qui on été supprimé partiellement selon ce qui m'est rapporté.

J'ai fais des recherches sur symantec pour trojan.Srizbi (un de ceux downloader) et fait ce que ça disait mais pas certain que tout est correct. J'ai trouvé votre site par hazard. J'espère que quelqu'un pourra m'aider afin de vérifier si tout est correct ou non sur mon PC.

J'ai lu un peu les différents problèmes retrouvé ici sur votre site et j'ai tenté avec ewido un scan online et ça m'a donné d'autre trojan qui non pas été ressorti avec mon antivirus et en plus il n'a pas détecté ceux que mon antivirus avait détecté.

Je vous affiche le log de Hijackthis et si possible j'attends impatient une réponse à mon sujet.

Logfile of HijackThis v1.99.1
Scan saved at 16:48:35, on 2007-11-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
D:\ClipPlus36\ClipPlus36.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\HijackThis\test.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///D:/Sites%20Web/01mes%20liens/mesliens.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1C4DCFCA-1F18-476C-9E0A-FC6F303BC986} - C:\WINDOWS\system32\cmcfg3.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [\\MAISON-ENFANTS\EPSON Stylus CX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE /P43 "\\MAISON-ENFANTS\EPSON Stylus CX3800 Series" /O6 "USB001" /M "Stylus CX3800"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ClipPlus36.exe.lnk = D:\ClipPlus36\ClipPlus36.exe
O4 - Global Startup: Acrobat Assistant.lnk = F:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Iqxtccd - C:\WINDOWS\SYSTEM32\iqxtccd.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Microsoft Internet Service - Unknown owner - C:\WINDOWS\system32\_svchost.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Configuration: Windows XP sp3
Internet Explorer 6.0

72 réponses

Résumé de la discussion

Plusieurs trojans ont été détectés sur le poste, avec des suppressions partielles reportées par l'antivirus et des incohérences entre les résultats d'un scan et le journal HijackThis. Des éléments de réponse suggèrent d'analyser les fichiers et processus listés par HijackThis et d'utiliser diaghelp pour repérer les fichiers suspects, puis de comparer les résultats entre les outils antivirus. Des services et pilotes malveillants, des entrées de démarrage et des composants Winlogon ou System32 suspects doivent être vérifiés, et l'intérêt d'un diagnostic en mode sans échec est discuté. Par ailleurs, l’examen des préfetch et des journaux d’événements peut révéler des indices récents, tandis que l’usage d’outils en ligne nécessite une vérification croisée sur le système.

Bobot (l’IA à votre service)
  2. FillPCA Contributeur sécurité
    Bonsoir,

    # Télécharge Vundofix (par Atribune) sur ton Bureau : http://www.atribune.org/ccount/click.php?id=4
    # Double-clique VundoFix.exe afin de le lancer.
    # Clique sur le bouton Scan for Vundo.
    # Lorsque le scan est complété, clique sur le bouton Remove Vundo (uniquement si des fichiers infectieux sont trouvés).
    # Une invite te demandera si tu veux supprimer les fichiers, clique YES.
    # Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
    # Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK.
    # Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

    FillPCA
    2. jorginho67 Contributeur sécurité
      salut raleuboleu !
      euh....... Ord1 , t'as tenté quoi là?
      a se rendre intéréssant ! apparament, il flood un peu partout ! encore un petit qui à besoin de se faire remarquer !
      bonne soirée !

      @ +
      Vivre à fond !!! la vie est tellement courte !!!
      2. FillPCA Contributeur sécurité
        Salut tout le monde,

        Le clavier doit être en qwerty et pas en azerty lol !
        1. jorginho67 Contributeur sécurité
          salut !
          enfin..... fô bien qu'ils s'amusent les gamins !
          bon courage et bonne soirée !
          2. raleuboleu
            lol quel loisir !!
            ah ben je comprend mieux pourquoi il dis au gens des le premier contact : formate ton disque dur
            enfin ca craint pour les gens qui attendent réllement une aide
            bah il va pas rester longtemps ici lui je crois

            bizz
            1. jorginho67 Contributeur sécurité
              pour l'instant c'est pas trop méchant, sinon, il faudra alerter en hauts lieux !
          3. Bronksman
            Voici le résultat Vundofix et nouveau Hijackthis

            VundoFix V6.5.11

            Checking Java version...

            Scan started at 17:17:44 2007-11-04

            Listing files found while scanning....

            No infected files were found.

            Logfile of HijackThis v1.99.1
            Scan saved at 17:23:40, on 2007-11-04
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\Ati2evxx.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\Ati2evxx.exe
            C:\WINDOWS\Explorer.EXE
            C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
            C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Symantec AntiVirus\DefWatch.exe
            C:\Program Files\Symantec AntiVirus\Rtvscan.exe
            C:\WINDOWS\system32\wscntfy.exe
            C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE
            C:\Program Files\Common Files\Symantec Shared\ccApp.exe
            C:\PROGRA~1\SYMANT~1\VPTray.exe
            C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
            C:\WINDOWS\system32\ctfmon.exe
            F:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
            D:\ClipPlus36\ClipPlus36.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Documents and Settings\Bronksman\Desktop\VundoFix.exe
            C:\Program Files\Internet Explorer\IEXPLORE.EXE
            C:\WINDOWS\system32\NOTEPAD.EXE
            F:\HijackThis\test.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///D:/Sites%20Web/01mes%20liens/mesliens.htm
            O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
            O2 - BHO: (no name) - {1C4DCFCA-1F18-476C-9E0A-FC6F303BC986} - C:\WINDOWS\system32\cmcfg3.dll
            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
            O4 - HKLM\..\Run: [\\MAISON-ENFANTS\EPSON Stylus CX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE /P43 "\\MAISON-ENFANTS\EPSON Stylus CX3800 Series" /O6 "USB001" /M "Stylus CX3800"
            O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
            O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
            O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
            O4 - Startup: ClipPlus36.exe.lnk = D:\ClipPlus36\ClipPlus36.exe
            O4 - Global Startup: Acrobat Assistant.lnk = F:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
            O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
            O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
            O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
            O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
            O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
            O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
            O20 - Winlogon Notify: Iqxtccd - C:\WINDOWS\SYSTEM32\iqxtccd.dll
            O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
            O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
            O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
            O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
            O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
            O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
            O23 - Service: Microsoft Internet Service - Unknown owner - C:\WINDOWS\system32\_svchost.exe (file missing)
            O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
            O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
            O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
            O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

            En attendant une réponse...Passez une bonne nuit!
            1. FillPCA Contributeur sécurité
              Re,

              1/ * Lance Vundofix mais ne clique pas sur "Scan for Vundo".
              * Fais un clic droit sur la fenêtre blanche et choisis "add more files".
              * Indique le ou les fichiers suivants dans les cases (un fichier par case) :

              C:\WINDOWS\system32\cmcfg3.dll
              C:\WINDOWS\SYSTEM32\iqxtccd.dll

              * Clique sur "add files" puis "close windows".
              * Clique sur "Remove Vundo". Un redémarrage sera peut-être nécessaire.
              * Poste le rapport généré. Il se trouve ici : C:\vundofix.txt

              2/ # Télécharge SDFix (créé par Andy Manchesta) et sauvegarde le sur ton Bureau : http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
              # Imprime ceci.
              # Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

              * Redémarre ton ordinateur.
              * Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (ou F5).
              * A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
              * Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
              * Choisis ton compte.

              # Déroule la liste des instructions ci-dessous :

              * En mode sans échec, double-clique sur le fichier SDFix.exe et clique sur install,
              * Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
              * Appuie sur Y pour commencer le script.
              * Il va supprimer les services de certains trojans, effectuera aussi quelques réparations du Registre et il te demandera d'appuyer sur une touche pour redémarrer.
              * Appuie sur une touche pour redémarrer le PC.
              * Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
              * Après le chargement du Bureau, l'outil terminera son travail et affichera Finished
              * Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
              * Enfin, ouvre le dossier de SDFix sur ton Bureau et copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

              3/ Télécharge Ccleaner Basic https://www.ccleaner.com/ccleaner/download

              Ouvre Ccleaner, clique sur "lancer le nettoyage".

              4/ Télécharge AVGantispyware : https://www.avg.com/en-ww/free-antivirus-download
              Tu l'installes.
              Lance AVG Anti-Spyware et clique sur le bouton Mise à jour. Patiente.

              Clique sur le bouton Analyse (de la barre d'outils)
              Puis sur l'onglets Comment réagir, clique sur Actions recommandées. Sélectionne Quarantaine.
              Reviens à l'onglet Analyse. Clique sur Analyse complète du système.
              A la fin du scan, choisis l'option " Appliquer toutes les actions " en bas. Ensuite.
              Clique sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.

              5/ Edite les rapports demandés (Vundofix, SDfix, AVGantispyware et Hijackthis).

              A demain, il est tard.

              FillPCA
              1. Bronksman
                Besoin d'aide...

                Dans la partie 2/ SDFiX...je suis toujours là eh oui

                * En mode sans échec, double-clique sur le fichier SDFix.exe et clique sur install,
                * Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
                * Appuie sur Y pour commencer le script.
                * Il va supprimer les services de certains trojans, effectuera aussi quelques réparations du Registre et il te demandera d'appuyer sur une touche pour redémarrer.
                * Appuie sur une touche pour redémarrer le PC.
                * Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
                * Après le chargement du Bureau, l'outil terminera son travail et affichera Finished
                Eh bien Finished n'est pas arrivé encore...plus de 15 heures plus tard.

                Que faire?
            2. FillPCA Contributeur sécurité
              Re,
              Tu arrêtes SDfix, tu le relances pour voir si ça fonctionne mieux. Normalement, ça dure une dizaine de minutes.
              Si ça ne marche toujours pas, on fera autrement.
              Edite dans ce cas le cas le rapport Vundofix et un nouveau rapport Hijackthis. Nous verrons Ccleaner et AVG AS parès si SDfix échoue.

              FillPCA
              1. Bronksman
                Je suis sur un autre ordi car j'ai arreté SDFiX en cliquant sur le X en haut à droite et pas pu le refaire démarrer. J'ai tenté un redémarrage mais là il est gelé sur l'écran loggin in

                Je tente un redémarrage en mode sans échec quand pense-tu?
            3. FillPCA Contributeur sécurité
              Re,

              C'est curieux un tel plantage. Essaie de redémarrer normalement. Si ça ne marche pas, essaie de redémarrer en mode sans échec avec prise en charge réseau pour avoir accès au net.

              FillPCA
              1. Bronksman
                J'ai redémarré normalement, j'ai mon image Bureau seulement. mon disque dur ne semble plus travaillé donc possiblement planté encore.
                je vais tenté un redémarrage sans échec.
                1. Bronksman
                  Bonjour,

                  redémarré en mode sans échec
                  Voici liste de Hijackthis et rapport de SDFiX

                  Logfile of HijackThis v1.99.1
                  Scan saved at 15:01:33, on 2007-11-05
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\Program Files\Internet Explorer\IEXPLORE.EXE
                  F:\HijackThis\test.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///D:/Sites%20Web/01mes%20liens/mesliens.htm
                  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
                  O2 - BHO: (no name) - {1C4DCFCA-1F18-476C-9E0A-FC6F303BC986} - C:\WINDOWS\system32\cmcfg3.dll
                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                  O4 - HKLM\..\Run: [\\MAISON-ENFANTS\EPSON Stylus CX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE /P43 "\\MAISON-ENFANTS\EPSON Stylus CX3800 Series" /O6 "USB001" /M "Stylus CX3800"
                  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                  O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
                  O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                  O4 - Startup: ClipPlus36.exe.lnk = D:\ClipPlus36\ClipPlus36.exe
                  O4 - Global Startup: Acrobat Assistant.lnk = F:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
                  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                  O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                  O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
                  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                  O20 - Winlogon Notify: Iqxtccd - C:\WINDOWS\SYSTEM32\Iqxtccd.dll
                  O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
                  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
                  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
                  O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
                  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                  O23 - Service: Microsoft Internet Service - Unknown owner - C:\WINDOWS\system32\_svchost.exe (file missing)
                  O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
                  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
                  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
                  O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

                  SDFix: Version 1.113

                  Run by Bronksman on 2007-11-04 at 21:14

                  Microsoft Windows XP [Version 5.1.2600]

                  Running From: C:\SDFix

                  Safe Mode:
                  Checking Services:

                  Restoring Windows Registry Values
                  Restoring Windows Default Hosts File

                  Rebooting...

                  Service NdisWon - Deleted after Reboot

                  Normal Mode:
                  Checking Files:

                  Trojan Files Found:

                  C:\Documents and Settings\Bronksman\ie_update3r.exe - Deleted
                  C:\WINDOWS\system32\drivers\NdisWon.sys - Deleted

                  Could Not Remove C:\WINDOWS\system32\87354753411123211122534452667798.data
                  Could Not Remove C:\WINDOWS\system32\87354753411123211122534452667798.log
                  Could Not Remove C:\WINDOWS\system32\87354753411123211122534452667798.data
                  Could Not Remove C:\WINDOWS\system32\87354753411123211122534452667798.log

                  Removing Temp Files...

                  ADS Check:

                  C:\WINDOWS
                  No streams found.

                  C:\WINDOWS\system32
                  No streams found.

                  C:\WINDOWS\system32\svchost.exe
                  No streams found.

                  C:\WINDOWS\system32\ntoskrnl.exe
                  No streams found.

                  Final Check:

                  catchme 0.3.1253 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2007-11-04 21:22:32
                  Windows 5.1.2600 Service Pack 2 NTFS

                  scanning hidden processes ...

                  scanning hidden services & system hive ...

                  scanning hidden registry entries ...

                  scanning hidden files ...

                  scan completed successfully
                  hidden processes: 0
                  hidden services: 0
                  hidden files: 0

                  Remaining Services:
                  ------------------

                  En espérant que tu pourra continuer avec celà

                  Bronksman
                  1. FillPCA Contributeur sécurité
                    Re,

                    1/ Peux-tu maintenant essayer de redémarrer normalement. Si ça ne fonctionne, redémarre en mode sans échec avec prise en charge réseau comme tu viens de le faire. Dis-moi ce qui marche.

                    2/ * Télécharge DiagHelp.zip sur ton bureau(Merci Malekal) : http://www.malekal.com/download/DiagHelp.zip
                    Tuto : http://www.malekal.com/DiagHelp/DiagHelp.php
                    * Ne double-clique pas dessus !! Fais un clic droit sur le fichier et extraire tout.
                    * Un nouveau dossier chercher va être créé.
                    * Ouvre le et double-clic sur go.cmd (le .cmd peut ne pas apparaître)
                    * Une fenêtre va s'ouvrir, choisis l'option 1
                    * L'analyse va commencer, ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand on te le demande.
                    * Pendant l'analyse après le rapport CATCHME sur l'écran rouge, tu dois appuyer sue entrée pour que l'outil continue ses recherches. Suis les consignes écrites.
                    * Une fenêtre avec le rapport s'ouvre alors. Copie/colle son contenu. (Il se trouve aussi ici : c:\resultat.txt)
                    * Double-clique sur ce fichier, Fais CTRL+A puis CTRL+C.
                    * Dans ta prochaine réponse, colle le rapport en faisant CTRL+V.

                    3/ * Télécharge SREng (de Smallfrogs) : http://www.kztechs.com/eng/download.html
                    * Dézippe tout son contenu sur ton bureau (clic droit >Extraire ici).
                    * Ouvre le dossier SReng2 et double-clique sur SREng.exe.
                    * Clique sur "smart scan".
                    * Clique sur le bouton "scan".
                    * Quand l'analyse est terminée, clique sur le bouton "save reports".
                    * Sauvegarde alors le rapport sur ton bureau.
                    * Copie/colle le contenu du rapport SREnglLOG.log dans ta prochaine réponse.

                    FillPCA
                    1. Bronksman
                      Redémarré en mode sans échec car comme précédamment image bureau seulement

                      Je vais continuer ce que tu m'a demandé de faire et je te reviens
                      1. Bronksman
                        Voici mes 2 rapport fait en mode sans échec

                        DiagHelp version v1.3 - http://www.malekal.com
                        excute le 2007-11-05 à 15:46:44,16

                        Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
                        C:\WINDOWS\prefetch\WSCNTFY.EXE-1B24F5EB.pf -->2007-11-04 17:59:19
                        C:\WINDOWS\prefetch\NOTEPAD.EXE-336351A9.pf -->2007-11-04 17:57:35
                        C:\WINDOWS\prefetch\WMIPRVSE.EXE-28F301A9.pf -->2007-11-04 17:56:33
                        C:\WINDOWS\prefetch\DOSCAN.EXE-2CDA015C.pf -->2007-11-04 17:56:28
                        C:\WINDOWS\prefetch\CLIPPLUS36.EXE-191CBCC9.pf -->2007-11-04 17:56:22
                        C:\WINDOWS\prefetch\OSA.EXE-2CD63980.pf -->2007-11-04 17:56:18
                        C:\WINDOWS\prefetch\ACROTRAY.EXE-14187682.pf -->2007-11-04 17:56:18
                        C:\WINDOWS\prefetch\SVCHOST.EXE-3530F672.pf -->2007-11-04 17:56:17
                        C:\WINDOWS\prefetch\CTFMON.EXE-0E17969B.pf -->2007-11-04 17:56:16
                        C:\WINDOWS\prefetch\WUAUCLT.EXE-399A8E72.pf -->2007-11-04 17:56:15

                        C:\WINDOWS\System32\drivers\FILEM701.SYS -->2007-11-01 16:43:33
                        C:\WINDOWS\System32\drivers\ubsxriif.dat -->2007-10-30 18:40:00
                        C:\WINDOWS\System32\drivers\pkdipxac.dat -->2007-10-30 18:39:58
                        C:\WINDOWS\System32\drivers\scdemu.sys -->2007-04-09 07:27:07
                        C:\WINDOWS\System32\drivers\SYMEVENT.SYS -->2006-09-18 16:55:28
                        C:\WINDOWS\System32\drivers\symtdi.sys -->2006-08-07 15:02:26
                        C:\WINDOWS\System32\drivers\symredrv.sys -->2006-08-07 15:02:22

                        C:\WINDOWS\System32\87354753411123211122534452667798.data -->2007-11-05 15:26:57
                        C:\WINDOWS\System32\87354753411123211122534452667798.log -->2007-11-04 21:21:52
                        C:\WINDOWS\System32\wpa.dbl -->2007-11-04 06:43:04
                        C:\WINDOWS\System32\ptrsrgpw.tmp -->2007-11-02 15:01:28
                        C:\WINDOWS\System32\Blank.htm -->2007-10-25 12:00:05
                        C:\WINDOWS\System32\TZLog.log -->2007-10-10 18:23:31
                        C:\WINDOWS\System32\FNTCACHE.DAT -->2007-10-10 18:12:48
                        C:\WINDOWS\System32\Iqxtccd.dll -->2007-09-27 10:07:32
                        C:\WINDOWS\System32\MRT.exe -->2007-09-05 18:50:44
                        C:\WINDOWS\System32\jupdate-1.6.0_02-b06.log -->2007-08-02 11:14:52
                        C:\WINDOWS\System32\wuaueng.dll -->2007-07-30 18:19:42
                        C:\WINDOWS\System32\wuapi.dll -->2007-07-30 18:19:36
                        C:\WINDOWS\System32\wucltui.dll -->2007-07-30 18:19:32
                        C:\WINDOWS\System32\wuaucpl.cpl.mui -->2007-07-30 18:19:32
                        C:\WINDOWS\System32\wuweb.dll -->2007-07-30 18:19:28
                        C:\WINDOWS\System32\wuaucpl.cpl -->2007-07-30 18:19:28
                        C:\WINDOWS\System32\cdm.dll -->2007-07-30 18:19:20
                        C:\WINDOWS\System32\wuauclt.exe -->2007-07-30 18:19:16
                        C:\WINDOWS\System32\wups2.dll -->2007-07-30 18:19:12
                        C:\WINDOWS\System32\mucltui.dll -->2007-07-30 18:19:10
                        C:\WINDOWS\System32\muweb.dll -->2007-07-30 18:19:04
                        C:\WINDOWS\System32\wuapi.dll.mui -->2007-07-30 18:19:02
                        C:\WINDOWS\System32\mucltui.dll.mui -->2007-07-30 18:19:02
                        C:\WINDOWS\System32\wucltui.dll.mui -->2007-07-30 18:18:44
                        C:\WINDOWS\System32\wups.dll -->2007-07-30 18:18:40

                        C:\WINDOWS\ntbtlog.txt -->2007-11-05 15:27:06
                        C:\WINDOWS\0.log -->2007-11-05 15:27:03
                        C:\WINDOWS\bootstat.dat -->2007-11-05 15:26:42
                        C:\WINDOWS\WindowsUpdate.log -->2007-11-05 15:19:15
                        C:\WINDOWS\SchedLgU.Txt -->2007-11-04 17:59:28
                        C:\WINDOWS\OEWABLog.txt -->2007-11-04 17:55:30
                        C:\WINDOWS\setupapi.log -->2007-11-04 13:27:22
                        C:\WINDOWS\iltwain.ini -->2007-10-25 12:00:03
                        C:\WINDOWS\ODBC.INI -->2007-10-09 16:48:44
                        C:\WINDOWS\win.ini -->2007-10-09 16:47:57
                        C:\WINDOWS\setupapi.log.0.old -->2007-09-25 05:55:01
                        C:\WINDOWS\mozver.dat -->2007-08-15 07:04:39
                        C:\WINDOWS\25 ans 017.jpg -->2007-07-24 11:32:35
                        C:\WINDOWS\oiseau_rouge 004.jpg -->2007-07-19 22:04:13
                        C:\WINDOWS\EntPack.ini -->2007-07-19 11:38:01

                        MD5 des fichiers sensibles
                        tcpip.sys 2a4818aea80acd2c95d7d92d2f3155f8
                        ndis.sys 558635d3af1c7546d26067d5d9b6959e
                        null.sys 73c1e1f395918bc2c6dd67af7591a3ad
                        svchost.exe 8f078ae4ed187aaabc0a305146de6716

                        ListDLLs v2.25 - DLL lister for Win9x/NT
                        Copyright (C) 1997-2004 Mark Russinovich
                        Sysinternals - www.sysinternals.com

                        ------------------------------------------------------------------------------
                        explorer.exe pid: 1500
                        Command line: C:\WINDOWS\Explorer.EXE

                        Base Size Version Path
                        0x5d090000 0x9a000 5.82.2900.2649 C:\WINDOWS\system32\comctl32.dll
                        0x76fd0000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
                        0x77050000 0xc5000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
                        0x76b20000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
                        0x745e0000 0x2c6000 3.01.4000.2435 C:\WINDOWS\system32\msi.dll
                        0x01500000 0x29000 F:\Program Files\WinRAR\rarext.dll
                        0x1c000000 0x6000 1.02.0001.0000 F:\Program Files\Notepad++\nppcm.dll
                        0x23200000 0x3b000 9.00.0000.0000 F:\Program Files\Ipswitch\WS_FTP Pro\wsftpsi.dll
                        0x23300000 0xb5000 9.00.0000.0000 F:\Program Files\Ipswitch\WS_FTP Pro\wsftpext.dll
                        0x25100000 0xd0000 F:\Program Files\Ipswitch\WS_FTP Pro\LIBEAY32.dll
                        0x25000000 0x27000 F:\Program Files\Ipswitch\WS_FTP Pro\SSLEAY32.dll
                        0x23500000 0xf000 9.00.0000.0000 F:\Program Files\Ipswitch\WS_FTP Pro\sslsvc.dll
                        0x23600000 0x25000 F:\Program Files\Ipswitch\WS_FTP Pro\wsftplib.dll
                        0x22200000 0x11000 F:\Program Files\Ipswitch\WS_FTP Pro\wsfirscr.dll
                        0x22100000 0xc000 F:\Program Files\Ipswitch\WS_FTP Pro\wshosts.dll
                        0x23900000 0x4c000 F:\Program Files\Ipswitch\WS_FTP Pro\ipspgp.dll
                        0x23700000 0x15d000 9.00.0000.0000 F:\Program Files\Ipswitch\WS_FTP Pro\res0409.dll
                        0x73dd0000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL
                        0x10000000 0xf000 C:\Program Files\Unlocker\UnlockerCOM.dll
                        0x00ce0000 0x37000 3.07.0000.0000 F:\Program Files\PowerISO\PWRISOSH.DLL
                        0x65870000 0xd000 10.01.0005.5000 C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll
                        0x7c340000 0x56000 7.10.3052.0004 C:\WINDOWS\system32\MSVCR71.dll
                        0x00d30000 0x10000 C:\WINDOWS\system32\CopyToSendTo.dll
                        0x32520000 0x12000 10.00.2609.0000 C:\Program Files\Microsoft Office\Office10\msohev.dll
                        0x01160000 0x1a000 5.00.0000.0352 C:\WINDOWS\system32\PDFShell.dll

                        ListDLLs v2.25 - DLL lister for Win9x/NT
                        Copyright (C) 1997-2004 Mark Russinovich
                        Sysinternals - www.sysinternals.com

                        ------------------------------------------------------------------------------
                        winlogon.exe pid: 460
                        Command line: winlogon.exe

                        Base Size Version Path
                        0x01000000 0x80000 \??\C:\WINDOWS\system32\winlogon.exe
                        0x5d090000 0x9a000 5.82.2900.2649 C:\WINDOWS\system32\COMCTL32.dll
                        0x74320000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
                        0x20000000 0x17000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
                        0x10000000 0x11000 6.14.0010.4123 C:\WINDOWS\system32\Ati2evxx.dll
                        0x65e30000 0xd000 10.01.0005.5000 C:\WINDOWS\system32\NavLogon.dll
                        0x77050000 0xc5000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
                        0x76fd0000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL

                        Volume in drive C is Bootdisk 10 Gig
                        Volume Serial Number is 4C35-E683

                        Directory of C:\WINDOWS\system32

                        2006-01-12 20:13 6 144 csrss.exe
                        1 File(s) 6 144 bytes
                        0 Dir(s) 3 817 504 768 bytes free

                        Contenu de Downloaded Program Files
                        Volume in drive C is Bootdisk 10 Gig
                        Volume Serial Number is 4C35-E683

                        Directory of C:\WINDOWS\Downloaded Program Files

                        2007-11-04 13:27 <DIR> .
                        2007-11-04 13:27 <DIR> ..
                        2007-04-15 23:24 65 desktop.ini
                        2006-07-11 09:41 345 656 ewidoOnlineScan.dll
                        2 File(s) 345 721 bytes

                        Total Files Listed:
                        2 File(s) 345 721 bytes
                        2 Dir(s) 3 817 504 768 bytes free

                        Recherche de rootkit! (Merci S!Ri)

                        Recherche d'infections connues

                        Export des clefs sensibles..

                        Liste des fichiers en exception sur le pare-feu XP SP2

                        "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                        "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
                        "C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE:*:Enabled:SAgent4"
                        "C:\\Program Files\\BitTorrent_DNA\\dna.exe"="C:\\Program Files\\BitTorrent_DNA\\dna.exe:*:Enabled:BitTorrent DNA"
                        "F:\\Program Files\\BitTorrent\\bittorrent.exe"="F:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"

                        "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                        "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

                        Export de la clef SharedTaskScheduler

                        [SharedTaskScheduler]

                        exports des policies
                        REGEDIT4

                        [system]
                        "dontdisplaylastusername"=dword:00000000
                        "legalnoticecaption"=""
                        "legalnoticetext"=""
                        "shutdownwithoutlogon"=dword:00000001
                        "undockwithoutlogon"=dword:00000001

                        Export des clefs sensibles..
                        Rechercher adresses sensibles dans le fichier HOSTS...
                        catchme 0.3.1253 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                        Rootkit scan 2007-11-04 21:22:32
                        Windows 5.1.2600 Service Pack 2 NTFS

                        scanning hidden processes ...

                        scanning hidden services & system hive ...

                        scanning hidden registry entries ...

                        scanning hidden files ...

                        scan completed successfully
                        hidden processes: 0
                        hidden services: 0
                        hidden files: 0

                        KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

                        Error loading kernel support driver!
                        Make sure you are running this as Administrator.

                        KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

                        Error loading kernel support driver!
                        Make sure you are running this as Administrator.

                        Liste des programmes installes

                        ACDSee 5.0 PowerPack
                        Adobe Acrobat 5.0
                        Adobe Flash Player ActiveX
                        Adobe Reader 7.0.5
                        Apple Software Update
                        ATI Display Driver
                        CCleaner (remove only)
                        CoffeeCup LockBox
                        EasyPHP 1.8
                        HijackThis 1.99.1
                        HotDog Professional 6
                        Ipswitch WS_FTP Pro
                        Jasc Paint Shop Pro 8
                        Java(TM) 6 Update 2
                        Java(TM) SE Runtime Environment 6 Update 1
                        LiveUpdate 3.1 (Symantec Corporation)
                        Microsoft Office XP French User Interface Pack
                        Microsoft Office XP Professional with FrontPage
                        Mozilla Firefox (1.5)
                        Norton Utilities 2003 for Windows
                        Notepad++
                        Photo-Objects 50,000 Premium Image Collection
                        PowerISO
                        QuickTime
                        Sausage Software Common Files
                        Security Update for Windows Media Player (KB911564)
                        Software Update for Web Folders
                        Symantec AntiVirus
                        WD Diagnostics
                        Windows XP Hotfix - KB885884
                        WinRAR archiver

                        Volume in drive C is Bootdisk 10 Gig
                        Volume Serial Number is 4C35-E683

                        Directory of C:\Program Files

                        2007-10-11 12:12 <DIR> .
                        2007-10-11 12:12 <DIR> ..
                        2007-04-15 23:27 <DIR> Adobe
                        2007-07-30 15:25 <DIR> Apple Software Update
                        2007-10-09 16:46 <DIR> Common Files
                        2007-04-15 22:05 <DIR> ComPlus Applications
                        2007-04-30 11:02 <DIR> EPSON
                        2007-10-10 18:24 <DIR> Internet Explorer
                        2007-08-02 11:14 <DIR> Java
                        2007-04-15 22:19 <DIR> Messenger
                        2007-10-09 17:36 <DIR> Microsoft ActiveSync
                        2007-04-15 22:11 <DIR> microsoft frontpage
                        2007-10-09 17:33 <DIR> Microsoft Office
                        2007-04-15 23:22 <DIR> Movie Maker
                        2007-08-28 14:03 <DIR> Mozilla Firefox
                        2007-04-15 22:05 <DIR> MSN
                        2007-04-15 22:04 <DIR> MSN Gaming Zone
                        2007-04-15 23:12 <DIR> MSN Messenger
                        2007-04-15 23:22 <DIR> NetMeeting
                        2007-04-15 22:08 <DIR> Online Services
                        2007-10-10 18:21 <DIR> Outlook Express
                        2007-04-30 18:27 <DIR> Symantec
                        2007-11-04 17:59 <DIR> Symantec AntiVirus
                        2007-04-15 23:19 <DIR> Unlocker
                        2007-07-17 22:01 <DIR> Western Digital Technologies
                        2007-09-27 10:24 <DIR> Windows Media Player
                        2007-04-15 23:11 <DIR> Windows NT
                        2007-05-31 10:55 <DIR> WinRAR
                        2007-04-15 22:11 <DIR> xerox
                        0 File(s) 0 bytes
                        29 Dir(s) 3 806 773 248 bytes free
                        Volume in drive C is Bootdisk 10 Gig
                        Volume Serial Number is 4C35-E683

                        Directory of C:\Program Files\common files

                        2007-10-09 16:46 <DIR> .
                        2007-10-09 16:46 <DIR> ..
                        2007-04-17 18:44 <DIR> ACD Systems
                        2007-04-17 19:13 <DIR> Adobe
                        2007-10-09 17:36 <DIR> Designer
                        2007-04-17 19:02 <DIR> InstallShield
                        2007-04-30 21:59 <DIR> Java
                        2007-10-09 17:37 <DIR> Microsoft Shared
                        2007-04-15 22:06 <DIR> MSSoap
                        2007-04-15 18:51 <DIR> ODBC
                        2007-04-15 22:07 <DIR> Services
                        2007-04-15 18:51 <DIR> SpeechEngines
                        2007-04-30 18:28 <DIR> Symantec Shared
                        2007-10-10 18:21 <DIR> System
                        0 File(s) 0 bytes
                        14 Dir(s) 3 806 773 248 bytes free
                        Volume in drive C is Bootdisk 10 Gig
                        Volume Serial Number is 4C35-E683

                        Directory of C:\

                        2007-04-19 16:55 140 288 javex.exe
                        1 File(s) 140 288 bytes
                        0 Dir(s) 3 806 773 248 bytes free

                        c:\Documents and Settings\All Users\Documents\Jasc PaintShop Pro 7 (1).exe
                        c:\Documents and Settings\Bronksman\Application Data\Microsoft\Installer\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}\ARPPRODUCTICON.exe
                        c:\Documents and Settings\Bronksman\Application Data\Microsoft\Installer\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}\Uninstall_WD_Diagnos_0AB76F69E7614CFAB9B0A1906B4E9E4B.exe
                        c:\Documents and Settings\Bronksman\Application Data\Microsoft\Installer\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}\WinDlg.exe_0AB76F69E7614CFAB9B0A1906B4E9E4B_3.exe
                        c:\Documents and Settings\Bronksman\Desktop\avgas-setup-7.5.1.43.exe
                        c:\Documents and Settings\Bronksman\Desktop\ccsetup201.exe
                        c:\Documents and Settings\Bronksman\Desktop\SDFix.exe
                        c:\Documents and Settings\Bronksman\Desktop\spybotsd_includes.exe
                        c:\Documents and Settings\Bronksman\Desktop\spybotsd15.exe
                        c:\Documents and Settings\Bronksman\Desktop\VundoFix.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\catchme.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\diff.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\dumphive.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\FilesInfoCmd.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\find2.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\Fport.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\grep.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\gzip.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\KProcCheck.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\LFiles.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\LISTDLLS.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\md5sums.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\pslist.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\streams.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\swreg.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\tar.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\catchme.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\diff.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\dumphive.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\FilesInfoCmd.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\find2.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\Fport.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\grep.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\gzip.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\KProcCheck.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\LFiles.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\LISTDLLS.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\md5sums.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\pslist.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\streams.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\swreg.exe
                        c:\Documents and Settings\Bronksman\Desktop\DiagHelp\DiagHelp\tar.exe
                        c:\Documents and Settings\Bronksman\Local Settings\Temporary Internet Files\Content.IE5\1AB3MNFY\avgas-setup-7.5.1.43[1].exe
                        c:\Documents and Settings\Bronksman\My Documents\My Received Files\test\PowerISO 3.7.exe
                        c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll

                        ****** Fin du rapport DiagHelp
                        Veuillez svp envoyer le fichier C:\upload_moi_PAPA900MHZ.tar.gz a l'adresse http://upload.malekal.com

                        Et voici le second ----------------------------------------------------------------------------------------------

                        [CODE]

                        2007-11-05,16:12:12

                        System Repair Engineer 2.5.16.900
                        Smallfrogs (http://www.KZTechs.com)

                        Windows XP Professional Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed

                        Follow item(s) have been choosed:
                        All Boot Items (Including Registry, Startup Folders, Services and so on)
                        Browser Add-ons
                        Runing Processes (Including process model information)
                        File Associations
                        Winsock Provider
                        Autorun.Inf
                        HOSTS File
                        Process Privileges Scan

                        Boot Items
                        Registry
                        [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
                        <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
                        [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
                        <load><> [N/A]
                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
                        <\\MAISON-ENFANTS\EPSON Stylus CX3800 Series><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE /P43 "\\MAISON-ENFANTS\EPSON Stylus CX3800 Series" /O6 "USB001" /M "Stylus CX3800"> [N/A]
                        <ccApp><"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> [(Verified)Symantec Corporation]
                        <vptray><C:\PROGRA~1\SYMANT~1\VPTray.exe> [(Verified)Symantec Corporation]
                        <SunJavaUpdateSched><"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"> [(Verified)"Sun Microsystems, Inc."]
                        <QuickTime Task><"F:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Inc.]
                        <KernelFaultCheck><> [N/A]
                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
                        <shell><Explorer.exe> [Microsoft Corporation]
                        <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
                        <AppInit_DLLs><> [N/A]
                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
                        <UIHost><logonui.exe> [Microsoft Corporation]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
                        <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [Microsoft Corporation]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
                        <PostBootReminder><%SystemRoot%\system32\SHELL32.dll> [Microsoft Corporation]
                        <CDBurn><%SystemRoot%\system32\SHELL32.dll> [Microsoft Corporation]
                        <WebCheck><%SystemRoot%\system32\webcheck.dll> [(Verified)Microsoft Windows Publisher]
                        <SysTray><C:\WINDOWS\system32\stobject.dll> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
                        <WinlogonNotify: crypt32chain><crypt32.dll> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
                        <WinlogonNotify: cryptnet><cryptnet.dll> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
                        <WinlogonNotify: cscdll><cscdll.dll> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Iqxtccd]
                        <WinlogonNotify: Iqxtccd><Iqxtccd.dll> []
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
                        <WinlogonNotify: NavLogon><C:\WINDOWS\system32\NavLogon.dll> [(Verified)Symantec Corporation]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
                        <WinlogonNotify: ScCertProp><wlnotify.dll> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
                        <WinlogonNotify: Schedule><wlnotify.dll> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
                        <WinlogonNotify: sclgntfy><sclgntfy.dll> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
                        <WinlogonNotify: SensLogn><WlNotify.dll> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
                        <WinlogonNotify: termsrv><wlnotify.dll> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
                        <WinlogonNotify: wlballoon><wlnotify.dll> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
                        <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher]
                        <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
                        <Microsoft Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
                        <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
                        <Browser Customizations><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
                        <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
                        <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
                        <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4b218e3e-bc98-4770-93d3-2731b9329278}]
                        <Internet Explorer><%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf> [N/A]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
                        <Windows Messenger 4.0><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser> []
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
                        <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
                        <Address Book 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
                        <Windows Desktop Update><regsvr32.exe /s /n /i:U shell32.dll> [(Verified)Microsoft Windows Publisher]
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
                        <Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe> [(Verified)Microsoft Windows Publisher]

                        ==================================
                        Startup Folders
                        [Acrobat Assistant]
                        <C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk --> F:\PROGRA~1\Adobe\ACROBA~1.0\Distillr\acrotray.exe [Adobe Systems Inc.]><N>
                        [Microsoft Office]
                        <C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office10\OSA.EXE [Microsoft Corporation]><N>
                        [ClipPlus36.exe]
                        <C:\Documents and Settings\Bronksman\Start Menu\Programs\Startup\ClipPlus36.exe.lnk --> D:\CLIPPL~1\CLIPPL~1.EXE [Written by Matt English, menglish@teleport.com]><N>

                        ==================================
                        Services
                        [Ati HotKey Poller / Ati HotKey Poller][Stopped/Auto Start]
                        <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
                        [Symantec Event Manager / ccEvtMgr][Stopped/Auto Start]
                        <"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
                        [Symantec Settings Manager / ccSetMgr][Stopped/Auto Start]
                        <"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
                        [Symantec AntiVirus Definition Watcher / DefWatch][Stopped/Auto Start]
                        <"C:\Program Files\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
                        [Human Interface Device Access / HidServ][Stopped/Disabled]
                        <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
                        [LiveUpdate / LiveUpdate][Stopped/Manual Start]
                        <"C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"><Symantec Corporation>
                        [Microsoft Internet Service / Microsoft Internet Service][Stopped/Auto Start]
                        <C:\WINDOWS\system32\_svchost.exe -A><N/A>
                        [SavRoam / SavRoam][Stopped/Manual Start]
                        <"C:\Program Files\Symantec AntiVirus\SavRoam.exe"><symantec>
                        [Symantec Network Drivers Service / SNDSrvc][Stopped/Manual Start]
                        <"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
                        [Symantec SPBBCSvc / SPBBCSvc][Stopped/Manual Start]
                        <"C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"><Symantec Corporation>
                        [Symantec AntiVirus / Symantec AntiVirus][Stopped/Auto Start]
                        <"C:\Program Files\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>

                        ==================================
                        Drivers
                        [ati2mtag / ati2mtag][Stopped/Manual Start]
                        <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
                        [atimtag / atimtag][Stopped/Manual Start]
                        <System32\DRIVERS\atimtag.sys><ATI Technologies Inc.>
                        [Symantec Eraser Control driver / eeCtrl][Stopped/System Start]
                        <\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys><Symantec Corporation>
                        [3Com 3C90X-BC Family PCI EtherLink Adapter / EL90XBC][Running/Manual Start]
                        <System32\DRIVERS\el90xbc5.sys><3Com Corporation>
                        [EraserUtilDrv10733 / EraserUtilDrv10733][Stopped/Manual Start]
                        <\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10733.sys><N/A>
                        [Creative AudioPCI (ES1371,ES1373) (WDM) / es1371][Stopped/Manual Start]
                        <system32\drivers\es1371mp.sys><Creative Technology Ltd.>
                        [mckzmvlc / mckzmvlc][Running/Boot Start]
                        <\SystemRoot\system32\drivers\ubsxriif.dat><N/A>
                        [NAVENG / NAVENG][Stopped/Manual Start]
                        <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20071104.009\naveng.sys><Symantec Corporation>
                        [NAVEX15 / NAVEX15][Stopped/Manual Start]
                        <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20071104.009\navex15.sys><Symantec Corporation>
                        [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
                        <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
                        [SAVRT / SAVRT][Stopped/System Start]
                        <\??\C:\Program Files\Symantec AntiVirus\savrt.sys><Symantec Corporation>
                        [SAVRTPEL / SAVRTPEL][Stopped/System Start]
                        <\??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys><Symantec Corporation>
                        [Secdrv / Secdrv][Stopped/Auto Start]
                        <System32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
                        [SPBBCDrv / SPBBCDrv][Stopped/Manual Start]
                        <\??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys><Symantec Corporation>
                        [SymEvent / SymEvent][Stopped/Manual Start]
                        <\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
                        [SYMREDRV / SYMREDRV][Stopped/Manual Start]
                        <\SystemRoot\System32\Drivers\SYMREDRV.SYS><Symantec Corporation>
                        [SYMTDI / SYMTDI][Stopped/System Start]
                        <\SystemRoot\System32\Drivers\SYMTDI.SYS><Symantec Corporation>
                        [TCP/IP Protocol Driver / Tcpip][Running/System Start]
                        <System32\DRIVERS\tcpip.sys><Microsoft Corporation>
                        [ultra / ultra][Running/Boot Start]
                        <\SystemRoot\system32\DRIVERS\ultra.sys><Promise Technology, Inc.>
                        [VIA AGP Bus Filter / viaagp][Running/Boot Start]
                        <\SystemRoot\System32\DRIVERS\viaagp.sys><Microsoft Corporation>
                        [VIA AGP Filter / viaagp1][Running/Boot Start]
                        <\SystemRoot\system32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
                        [ViaIde / ViaIde][Running/Boot Start]
                        <\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>

                        ==================================
                        Browser Add-ons
                        [AcroIEHlprObj Class]
                        {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <F:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx, >
                        []
                        {1C4DCFCA-1F18-476C-9E0A-FC6F303BC986} <C:\WINDOWS\system32\cmcfg3.dll, N/A>
                        [SSVHelper Class]
                        {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
                        [Java Plug-in 1.6.0_02]
                        {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
                        [ewidoOnlineScan Control]
                        {193C772A-87BE-4B19-A7BB-445B226FE9A1} <C:\WINDOWS\DOWNLO~1\EWIDOO~1.DLL, Anti-Malware Development a.s.>
                        [Java Plug-in 1.6.0_02]
                        {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
                        [Java Plug-in 1.6.0_01]
                        {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
                        [Java Plug-in 1.6.0_02]
                        {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
                        [Java Plug-in 1.6.0_02]
                        {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll, Sun Microsystems, Inc.>
                        [AcroIEHlprObj Class]
                        {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <F:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx, >
                        [ewidoOnlineScan Control]
                        {193C772A-87BE-4B19-A7BB-445B226FE9A1} <C:\WINDOWS\DOWNLO~1\EWIDOO~1.DLL, Anti-Malware Development a.s.>
                        []
                        {1C4DCFCA-1F18-476C-9E0A-FC6F303BC986} <C:\WINDOWS\system32\cmcfg3.dll, N/A>
                        [DHTML Edit Control Safe for Scripting for IE5]
                        {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
                        [XML Document]
                        {48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
                        [SSVHelper Class]
                        {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
                        [Shockwave Flash Object]
                        {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
                        [E&xport to Microsoft Excel]
                        <res://F:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000, N/A>

                        ==================================
                        Running Processes
                        [PID: 320 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [PID: 436 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\CSRSRV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\basesrv.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\winsrv.dll] [Microsoft Corporation, 5.1.2600.2751 (xpsp.050831-1531)]
                        [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                        [C:\WINDOWS\system32\KERNEL32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                        [C:\WINDOWS\system32\sxs.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                        [PID: 460 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                        [C:\WINDOWS\system32\AUTHZ.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                        [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\CRYPT32.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                        [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                        [C:\WINDOWS\system32\MSASN1.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\NDdeApi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\PROFMAP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2756 (xpsp.050908-1544)]
                        [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\PSAPI.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\REGAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\SETUPAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WINSTA.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WINTRUST.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\IMAGEHLP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\MSGINA.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                        [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                        [C:\WINDOWS\system32\COMCTL32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                        [C:\WINDOWS\system32\ODBC32.dll] [Microsoft Corporation, 3.525.1117.0 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\comdlg32.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\odbcint.dll] [Microsoft Corporation, 3.525.1117.0 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\SHSVCS.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\sfc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\sfc_os.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                        [C:\WINDOWS\system32\Apphelp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WINSCARD.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WTSAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4123]
                        [C:\WINDOWS\system32\cscdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)]
                        [C:\WINDOWS\system32\WlNotify.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WINSPOOL.DRV] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\MPR.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                        [C:\WINDOWS\system32\SAMLIB.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\msv1_0.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\wldap32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\mswsock.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\hnetcfg.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\System32\wshtcpip.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\System32\winrnr.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\rasadhlp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\cscui.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\NavLogon.dll] [Symantec Corporation, 10.1.5.5000]
                        [C:\WINDOWS\system32\NTMARTA.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\COMRes.dll] [Microsoft Corporation, 2001.12.4414.258]
                        [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                        [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308]
                        [PID: 504 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                        [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                        [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                        [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\SCESRV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\AUTHZ.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                        [C:\WINDOWS\system32\umpnpmgr.dll] [Microsoft Corporation, 5.1.2600.2744 (xpsp.050822-1649)]
                        [C:\WINDOWS\system32\WINSTA.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2756 (xpsp.050908-1544)]
                        [C:\WINDOWS\system32\NCObjAPI.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
                        [C:\WINDOWS\system32\ShimEng.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\AppPatch\AcGenral.DLL] [Microsoft Corporation, 5.1.2600.2558 (xpsp.040919-1030)]
                        [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                        [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                        [C:\WINDOWS\system32\MSACM32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                        [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                        [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                        [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                        [C:\WINDOWS\system32\secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\Apphelp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\eventlog.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\PSAPI.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\wtsapi32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [PID: 516 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                        [C:\WINDOWS\system32\LSASRV.dll] [Microsoft Corporation, 5.1.2600.2525 (xpsp.040919-1030)]
                        [C:\WINDOWS\system32\MPR.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                        [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                        [C:\WINDOWS\system32\MSASN1.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2756 (xpsp.050908-1544)]
                        [C:\WINDOWS\system32\NTDSAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WLDAP32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\SAMLIB.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\SAMSRV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\cryptdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ShimEng.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\AppPatch\AcGenral.DLL] [Microsoft Corporation, 5.1.2600.2558 (xpsp.040919-1030)]
                        [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                        [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                        [C:\WINDOWS\system32\MSACM32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                        [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                        [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                        [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                        [C:\WINDOWS\system32\msprivs.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\kerberos.dll] [Microsoft Corporation, 5.1.2600.2698 (xpsp.050614-1527)]
                        [C:\WINDOWS\system32\msv1_0.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\netlogon.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\w32time.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
                        [C:\WINDOWS\system32\schannel.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\CRYPT32.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\wdigest.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)]
                        [C:\WINDOWS\system32\setupapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\scecli.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [PID: 672 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                        [C:\WINDOWS\system32\ShimEng.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\AppPatch\AcGenral.DLL] [Microsoft Corporation, 5.1.2600.2558 (xpsp.040919-1030)]
                        [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                        [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                        [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                        [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                        [C:\WINDOWS\system32\MSACM32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                        [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                        [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                        [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                        [C:\WINDOWS\system32\NTMARTA.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WLDAP32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\SAMLIB.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\rpcss.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                        [c:\windows\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\termsrv.dll] [Microsoft Corporation, 5.1.2600.2627 (xpsp.050309-1716)]
                        [c:\windows\system32\ICAAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\SETUPAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WINTRUST.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\CRYPT32.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\MSASN1.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\IMAGEHLP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\AUTHZ.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                        [c:\windows\system32\mstlsapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\ACTIVEDS.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\adsldpc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2756 (xpsp.050908-1544)]
                        [c:\windows\system32\ATL.DLL] [Microsoft Corporation, 3.05.2284]
                        [C:\WINDOWS\system32\REGAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)]
                        [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308]
                        [C:\WINDOWS\system32\COMRes.dll] [Microsoft Corporation, 2001.12.4414.258]
                        [PID: 720 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                        [C:\WINDOWS\system32\ShimEng.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\AppPatch\AcGenral.DLL] [Microsoft Corporation, 5.1.2600.2558 (xpsp.040919-1030)]
                        [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                        [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                        [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                        [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                        [C:\WINDOWS\system32\MSACM32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                        [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                        [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                        [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                        [c:\windows\system32\rpcss.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                        [c:\windows\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)]
                        [C:\WINDOWS\system32\mswsock.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\hnetcfg.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\System32\wshtcpip.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\System32\winrnr.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WLDAP32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\rasadhlp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308]
                        [C:\WINDOWS\system32\COMRes.dll] [Microsoft Corporation, 2001.12.4414.258]
                        [PID: 828 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                        [C:\WINDOWS\system32\ShimEng.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\AppPatch\AcGenral.DLL] [Microsoft Corporation, 5.1.2600.2558 (xpsp.040919-1030)]
                        [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                        [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                        [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                        [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                        [C:\WINDOWS\system32\MSACM32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                        [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                        [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                        [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                        [C:\WINDOWS\system32\NTMARTA.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\WLDAP32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\SAMLIB.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\dhcpcsvc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                        [c:\windows\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rt
                        1. Bronksman
                          Le second rapport ne semble pas complet en voici une copie

                          [CODE]

                          2007-11-05,16:12:12

                          System Repair Engineer 2.5.16.900
                          Smallfrogs (http://www.KZTechs.com)

                          Windows XP Professional Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed

                          Follow item(s) have been choosed:
                          All Boot Items (Including Registry, Startup Folders, Services and so on)
                          Browser Add-ons
                          Runing Processes (Including process model information)
                          File Associations
                          Winsock Provider
                          Autorun.Inf
                          HOSTS File
                          Process Privileges Scan

                          Boot Items
                          Registry
                          [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
                          <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
                          [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
                          <load><> [N/A]
                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
                          <\\MAISON-ENFANTS\EPSON Stylus CX3800 Series><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE /P43 "\\MAISON-ENFANTS\EPSON Stylus CX3800 Series" /O6 "USB001" /M "Stylus CX3800"> [N/A]
                          <ccApp><"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> [(Verified)Symantec Corporation]
                          <vptray><C:\PROGRA~1\SYMANT~1\VPTray.exe> [(Verified)Symantec Corporation]
                          <SunJavaUpdateSched><"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"> [(Verified)"Sun Microsystems, Inc."]
                          <QuickTime Task><"F:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Inc.]
                          <KernelFaultCheck><> [N/A]
                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
                          <shell><Explorer.exe> [Microsoft Corporation]
                          <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
                          <AppInit_DLLs><> [N/A]
                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
                          <UIHost><logonui.exe> [Microsoft Corporation]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
                          <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [Microsoft Corporation]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
                          <PostBootReminder><%SystemRoot%\system32\SHELL32.dll> [Microsoft Corporation]
                          <CDBurn><%SystemRoot%\system32\SHELL32.dll> [Microsoft Corporation]
                          <WebCheck><%SystemRoot%\system32\webcheck.dll> [(Verified)Microsoft Windows Publisher]
                          <SysTray><C:\WINDOWS\system32\stobject.dll> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
                          <WinlogonNotify: crypt32chain><crypt32.dll> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
                          <WinlogonNotify: cryptnet><cryptnet.dll> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
                          <WinlogonNotify: cscdll><cscdll.dll> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Iqxtccd]
                          <WinlogonNotify: Iqxtccd><Iqxtccd.dll> []
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
                          <WinlogonNotify: NavLogon><C:\WINDOWS\system32\NavLogon.dll> [(Verified)Symantec Corporation]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
                          <WinlogonNotify: ScCertProp><wlnotify.dll> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
                          <WinlogonNotify: Schedule><wlnotify.dll> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
                          <WinlogonNotify: sclgntfy><sclgntfy.dll> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
                          <WinlogonNotify: SensLogn><WlNotify.dll> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
                          <WinlogonNotify: termsrv><wlnotify.dll> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
                          <WinlogonNotify: wlballoon><wlnotify.dll> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
                          <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher]
                          <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
                          <Microsoft Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
                          <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
                          <Browser Customizations><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
                          <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
                          <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
                          <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4b218e3e-bc98-4770-93d3-2731b9329278}]
                          <Internet Explorer><%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf> [N/A]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
                          <Windows Messenger 4.0><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser> []
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
                          <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
                          <Address Book 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
                          <Windows Desktop Update><regsvr32.exe /s /n /i:U shell32.dll> [(Verified)Microsoft Windows Publisher]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
                          <Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe> [(Verified)Microsoft Windows Publisher]

                          ==================================
                          Startup Folders
                          [Acrobat Assistant]
                          <C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk --> F:\PROGRA~1\Adobe\ACROBA~1.0\Distillr\acrotray.exe [Adobe Systems Inc.]><N>
                          [Microsoft Office]
                          <C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office10\OSA.EXE [Microsoft Corporation]><N>
                          [ClipPlus36.exe]
                          <C:\Documents and Settings\Bronksman\Start Menu\Programs\Startup\ClipPlus36.exe.lnk --> D:\CLIPPL~1\CLIPPL~1.EXE [Written by Matt English, menglish@teleport.com]><N>

                          ==================================
                          Services
                          [Ati HotKey Poller / Ati HotKey Poller][Stopped/Auto Start]
                          <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
                          [Symantec Event Manager / ccEvtMgr][Stopped/Auto Start]
                          <"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
                          [Symantec Settings Manager / ccSetMgr][Stopped/Auto Start]
                          <"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
                          [Symantec AntiVirus Definition Watcher / DefWatch][Stopped/Auto Start]
                          <"C:\Program Files\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
                          [Human Interface Device Access / HidServ][Stopped/Disabled]
                          <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
                          [LiveUpdate / LiveUpdate][Stopped/Manual Start]
                          <"C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"><Symantec Corporation>
                          [Microsoft Internet Service / Microsoft Internet Service][Stopped/Auto Start]
                          <C:\WINDOWS\system32\_svchost.exe -A><N/A>
                          [SavRoam / SavRoam][Stopped/Manual Start]
                          <"C:\Program Files\Symantec AntiVirus\SavRoam.exe"><symantec>
                          [Symantec Network Drivers Service / SNDSrvc][Stopped/Manual Start]
                          <"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
                          [Symantec SPBBCSvc / SPBBCSvc][Stopped/Manual Start]
                          <"C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"><Symantec Corporation>
                          [Symantec AntiVirus / Symantec AntiVirus][Stopped/Auto Start]
                          <"C:\Program Files\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>

                          ==================================
                          Drivers
                          [ati2mtag / ati2mtag][Stopped/Manual Start]
                          <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
                          [atimtag / atimtag][Stopped/Manual Start]
                          <System32\DRIVERS\atimtag.sys><ATI Technologies Inc.>
                          [Symantec Eraser Control driver / eeCtrl][Stopped/System Start]
                          <\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys><Symantec Corporation>
                          [3Com 3C90X-BC Family PCI EtherLink Adapter / EL90XBC][Running/Manual Start]
                          <System32\DRIVERS\el90xbc5.sys><3Com Corporation>
                          [EraserUtilDrv10733 / EraserUtilDrv10733][Stopped/Manual Start]
                          <\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10733.sys><N/A>
                          [Creative AudioPCI (ES1371,ES1373) (WDM) / es1371][Stopped/Manual Start]
                          <system32\drivers\es1371mp.sys><Creative Technology Ltd.>
                          [mckzmvlc / mckzmvlc][Running/Boot Start]
                          <\SystemRoot\system32\drivers\ubsxriif.dat><N/A>
                          [NAVENG / NAVENG][Stopped/Manual Start]
                          <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20071104.009\naveng.sys><Symantec Corporation>
                          [NAVEX15 / NAVEX15][Stopped/Manual Start]
                          <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20071104.009\navex15.sys><Symantec Corporation>
                          [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
                          <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
                          [SAVRT / SAVRT][Stopped/System Start]
                          <\??\C:\Program Files\Symantec AntiVirus\savrt.sys><Symantec Corporation>
                          [SAVRTPEL / SAVRTPEL][Stopped/System Start]
                          <\??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys><Symantec Corporation>
                          [Secdrv / Secdrv][Stopped/Auto Start]
                          <System32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
                          [SPBBCDrv / SPBBCDrv][Stopped/Manual Start]
                          <\??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys><Symantec Corporation>
                          [SymEvent / SymEvent][Stopped/Manual Start]
                          <\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
                          [SYMREDRV / SYMREDRV][Stopped/Manual Start]
                          <\SystemRoot\System32\Drivers\SYMREDRV.SYS><Symantec Corporation>
                          [SYMTDI / SYMTDI][Stopped/System Start]
                          <\SystemRoot\System32\Drivers\SYMTDI.SYS><Symantec Corporation>
                          [TCP/IP Protocol Driver / Tcpip][Running/System Start]
                          <System32\DRIVERS\tcpip.sys><Microsoft Corporation>
                          [ultra / ultra][Running/Boot Start]
                          <\SystemRoot\system32\DRIVERS\ultra.sys><Promise Technology, Inc.>
                          [VIA AGP Bus Filter / viaagp][Running/Boot Start]
                          <\SystemRoot\System32\DRIVERS\viaagp.sys><Microsoft Corporation>
                          [VIA AGP Filter / viaagp1][Running/Boot Start]
                          <\SystemRoot\system32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
                          [ViaIde / ViaIde][Running/Boot Start]
                          <\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>

                          ==================================
                          Browser Add-ons
                          [AcroIEHlprObj Class]
                          {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <F:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx, >
                          []
                          {1C4DCFCA-1F18-476C-9E0A-FC6F303BC986} <C:\WINDOWS\system32\cmcfg3.dll, N/A>
                          [SSVHelper Class]
                          {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
                          [Java Plug-in 1.6.0_02]
                          {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
                          [ewidoOnlineScan Control]
                          {193C772A-87BE-4B19-A7BB-445B226FE9A1} <C:\WINDOWS\DOWNLO~1\EWIDOO~1.DLL, Anti-Malware Development a.s.>
                          [Java Plug-in 1.6.0_02]
                          {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
                          [Java Plug-in 1.6.0_01]
                          {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
                          [Java Plug-in 1.6.0_02]
                          {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
                          [Java Plug-in 1.6.0_02]
                          {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll, Sun Microsystems, Inc.>
                          [AcroIEHlprObj Class]
                          {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <F:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx, >
                          [ewidoOnlineScan Control]
                          {193C772A-87BE-4B19-A7BB-445B226FE9A1} <C:\WINDOWS\DOWNLO~1\EWIDOO~1.DLL, Anti-Malware Development a.s.>
                          []
                          {1C4DCFCA-1F18-476C-9E0A-FC6F303BC986} <C:\WINDOWS\system32\cmcfg3.dll, N/A>
                          [DHTML Edit Control Safe for Scripting for IE5]
                          {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
                          [XML Document]
                          {48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
                          [SSVHelper Class]
                          {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
                          [Shockwave Flash Object]
                          {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
                          [E&xport to Microsoft Excel]
                          <res://F:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000, N/A>

                          ==================================
                          Running Processes
                          [PID: 320 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [PID: 436 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\CSRSRV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\basesrv.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\winsrv.dll] [Microsoft Corporation, 5.1.2600.2751 (xpsp.050831-1531)]
                          [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                          [C:\WINDOWS\system32\KERNEL32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [C:\WINDOWS\system32\sxs.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                          [PID: 460 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                          [C:\WINDOWS\system32\AUTHZ.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\CRYPT32.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                          [C:\WINDOWS\system32\MSASN1.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\NDdeApi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\PROFMAP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2756 (xpsp.050908-1544)]
                          [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\PSAPI.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\REGAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SETUPAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WINSTA.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WINTRUST.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\IMAGEHLP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\MSGINA.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                          [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                          [C:\WINDOWS\system32\COMCTL32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                          [C:\WINDOWS\system32\ODBC32.dll] [Microsoft Corporation, 3.525.1117.0 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\comdlg32.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\odbcint.dll] [Microsoft Corporation, 3.525.1117.0 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SHSVCS.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\sfc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\sfc_os.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                          [C:\WINDOWS\system32\Apphelp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WINSCARD.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WTSAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4123]
                          [C:\WINDOWS\system32\cscdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)]
                          [C:\WINDOWS\system32\WlNotify.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WINSPOOL.DRV] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\MPR.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\SAMLIB.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\msv1_0.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\wldap32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\mswsock.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\hnetcfg.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\wshtcpip.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\winrnr.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\rasadhlp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\cscui.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\NavLogon.dll] [Symantec Corporation, 10.1.5.5000]
                          [C:\WINDOWS\system32\NTMARTA.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\COMRes.dll] [Microsoft Corporation, 2001.12.4414.258]
                          [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                          [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308]
                          [PID: 504 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                          [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                          [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SCESRV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\AUTHZ.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [C:\WINDOWS\system32\umpnpmgr.dll] [Microsoft Corporation, 5.1.2600.2744 (xpsp.050822-1649)]
                          [C:\WINDOWS\system32\WINSTA.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2756 (xpsp.050908-1544)]
                          [C:\WINDOWS\system32\NCObjAPI.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
                          [C:\WINDOWS\system32\ShimEng.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\AppPatch\AcGenral.DLL] [Microsoft Corporation, 5.1.2600.2558 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                          [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                          [C:\WINDOWS\system32\MSACM32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                          [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                          [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                          [C:\WINDOWS\system32\secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\Apphelp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\eventlog.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\PSAPI.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\wtsapi32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [PID: 516 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                          [C:\WINDOWS\system32\LSASRV.dll] [Microsoft Corporation, 5.1.2600.2525 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\MPR.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                          [C:\WINDOWS\system32\MSASN1.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2756 (xpsp.050908-1544)]
                          [C:\WINDOWS\system32\NTDSAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WLDAP32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SAMLIB.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SAMSRV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\cryptdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ShimEng.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\AppPatch\AcGenral.DLL] [Microsoft Corporation, 5.1.2600.2558 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                          [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                          [C:\WINDOWS\system32\MSACM32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                          [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                          [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                          [C:\WINDOWS\system32\msprivs.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\kerberos.dll] [Microsoft Corporation, 5.1.2600.2698 (xpsp.050614-1527)]
                          [C:\WINDOWS\system32\msv1_0.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\netlogon.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\w32time.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
                          [C:\WINDOWS\system32\schannel.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\CRYPT32.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\wdigest.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)]
                          [C:\WINDOWS\system32\setupapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\scecli.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [PID: 672 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                          [C:\WINDOWS\system32\ShimEng.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\AppPatch\AcGenral.DLL] [Microsoft Corporation, 5.1.2600.2558 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                          [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                          [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                          [C:\WINDOWS\system32\MSACM32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                          [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                          [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                          [C:\WINDOWS\system32\NTMARTA.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WLDAP32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SAMLIB.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\rpcss.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                          [c:\windows\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\termsrv.dll] [Microsoft Corporation, 5.1.2600.2627 (xpsp.050309-1716)]
                          [c:\windows\system32\ICAAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\SETUPAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WINTRUST.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\CRYPT32.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\MSASN1.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\IMAGEHLP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\AUTHZ.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [c:\windows\system32\mstlsapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\ACTIVEDS.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\adsldpc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2756 (xpsp.050908-1544)]
                          [c:\windows\system32\ATL.DLL] [Microsoft Corporation, 3.05.2284]
                          [C:\WINDOWS\system32\REGAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)]
                          [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308]
                          [C:\WINDOWS\system32\COMRes.dll] [Microsoft Corporation, 2001.12.4414.258]
                          [PID: 720 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                          [C:\WINDOWS\system32\ShimEng.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\AppPatch\AcGenral.DLL] [Microsoft Corporation, 5.1.2600.2558 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                          [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                          [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                          [C:\WINDOWS\system32\MSACM32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                          [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                          [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                          [c:\windows\system32\rpcss.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                          [c:\windows\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)]
                          [C:\WINDOWS\system32\mswsock.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\hnetcfg.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\wshtcpip.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\winrnr.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WLDAP32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\rasadhlp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308]
                          [C:\WINDOWS\system32\COMRes.dll] [Microsoft Corporation, 2001.12.4414.258]
                          [PID: 828 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                          [C:\WINDOWS\system32\ShimEng.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\AppPatch\AcGenral.DLL] [Microsoft Corporation, 5.1.2600.2558 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                          [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                          [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                          [C:\WINDOWS\system32\MSACM32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                          [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                          [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                          [C:\WINDOWS\system32\NTMARTA.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WLDAP32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SAMLIB.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\dhcpcsvc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\mswsock.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\hnetcfg.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\wshtcpip.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\wzcsvc.dll] [Microsoft Corporation, 5.1.2600.2703 (xpsp.050620-1711)]
                          [c:\windows\system32\rtutils.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WMI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\CRYPT32.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\MSASN1.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WTSAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WINSTA.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2756 (xpsp.050908-1544)]
                          [c:\windows\system32\ESENT.dll] [Microsoft Corporation, 5.1.2600.2780 (xpsp.051019-1520)]
                          [c:\windows\system32\ATL.DLL] [Microsoft Corporation, 3.05.2284]
                          [c:\windows\system32\wkssvc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\NTDSAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)]
                          [C:\WINDOWS\System32\rastls.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\CRYPTUI.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WINTRUST.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\IMAGEHLP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WININET.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                          [C:\WINDOWS\system32\MPRAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ACTIVEDS.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\adsldpc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SETUPAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\RASAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\rasman.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\TAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SCHANNEL.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WinSCard.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\raschap.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\msv1_0.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\cryptsvc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\certcli.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\wbem\wmisvc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\VSSAPI.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\srsvc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\POWRPROF.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308]
                          [C:\WINDOWS\system32\COMRes.dll] [Microsoft Corporation, 2001.12.4414.258]
                          [c:\windows\system32\netman.dll] [Microsoft Corporation, 5.1.2600.2743 (xpsp.050819-1528)]
                          [c:\windows\system32\netshell.dll] [Microsoft Corporation, 5.1.2600.2703 (xpsp.050620-1711)]
                          [c:\windows\system32\credui.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WZCSAPI.DLL] [Microsoft Corporation, 5.1.2600.2703 (xpsp.050620-1711)]
                          [c:\windows\system32\srvsvc.dll] [Microsoft Corporation, 5.1.2600.2577 (xpsp.041130-1728)]
                          [c:\windows\pchealth\helpctr\binaries\pchsvc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\dmserver.dll] [Microsoft Corp., 2600.2180.503.0]
                          [c:\windows\system32\ipnathlp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\AUTHZ.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [C:\WINDOWS\system32\winspool.drv] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\browser.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\wbem\wbemcomn.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WBEM\wbemcore.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
                          [C:\WINDOWS\system32\WBEM\esscli.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WBEM\FastProx.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\wbem\wmiutils.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\wbem\repdrvfs.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\wbem\wmiprvsd.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\NCObjAPI.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\wbem\wbemess.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\wbem\ncprov.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [PID: 884 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                          [C:\WINDOWS\system32\ShimEng.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\AppPatch\AcGenral.DLL] [Microsoft Corporation, 5.1.2600.2558 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                          [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                          [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                          [C:\WINDOWS\system32\MSACM32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                          [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                          [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                          [c:\windows\system32\dnsrslvr.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\mswsock.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\hnetcfg.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\wshtcpip.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [PID: 968 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                          [C:\WINDOWS\system32\ShimEng.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\AppPatch\AcGenral.DLL] [Microsoft Corporation, 5.1.2600.2558 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                          [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                          [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                          [C:\WINDOWS\system32\MSACM32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                          [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                          [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                          [C:\WINDOWS\system32\NTMARTA.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WLDAP32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SAMLIB.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\lmhsvc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [c:\windows\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [PID: 1500 / Bronksman][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2649 (xpsp.050406-1732)]
                          [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                          [C:\WINDOWS\system32\BROWSEUI.dll] [Microsoft Corporation, 6.00.2900.2802 (xpsp.051123-1236)]
                          [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                          [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                          [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                          [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                          [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                          [C:\WINDOWS\system32\SHDOCVW.dll] [Microsoft Corporation, 6.00.2900.2805 (xpsp.051130-1602)]
                          [C:\WINDOWS\system32\CRYPT32.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\MSASN1.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\CRYPTUI.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WINTRUST.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\IMAGEHLP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2756 (xpsp.050908-1544)]
                          [C:\WINDOWS\system32\WININET.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                          [C:\WINDOWS\system32\WLDAP32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                          [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\ShimEng.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\AppPatch\AcGenral.DLL] [Microsoft Corporation, 5.1.2600.2558 (xpsp.040919-1030)]
                          [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\MSACM32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.050406-1732)]
                          [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308]
                          [C:\WINDOWS\system32\COMRes.dll] [Microsoft Corporation, 2001.12.4414.258]
                          [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\appHelp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\cscui.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\CSCDLL.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\themeui.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\MSIMG32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\LINKINFO.dll] [Microsoft Corporation, 5.1.2600.2751 (xpsp.050831-1531)]
                          [C:\WINDOWS\system32\ntshrui.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\ATL.DLL] [Microsoft Corporation, 3.05.2284]
                          [C:\WINDOWS\system32\SAMLIB.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\SETUPAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\rtutils.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\WINSTA.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\system32\msi.dll] [Microsoft Corporation, 3.1.4000.2435]
                          [C:\WINDOWS\system32\MPR.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\drprov.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\ntlanman.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\NETUI0.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\NETUI1.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\NETRAP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [C:\WINDOWS\System32\davclnt.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [F:\Program Files\WinRAR\rarext.dll] [N/A, ]
                          [F:\Program Files\Notepad++\nppcm.dll] [Burgaud.com, 1.2.1]
                          [F:\Program Files\Ipswitch\WS_FTP Pro\wsftpsi.dll] [Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421, 9,0,0,0]
                          [F:\Program Files\Ipswitch\WS_FTP Pro\wsftpext.dll] [Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421, 9,0,0,0]
                          [F:\Program Files\Ipswitch\WS_FTP Pro\LIBEAY32.dll] [N/A, ]
                          [C:\WINDOWS\system32\WSOCK32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                          [F:\Program Files\Ipswitch\WS_FTP Pro\SSLEAY32.dll] [N/A, ]
                          [F:\Program Files\Ipswitch\WS_FTP Pro\sslsvc.dll] [Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421, 9,0,0,0]
                          [F:\Program Files\Ipswitch\WS_FTP Pro\wsftplib.dll] [N/A, ]
                          [F:\Program Files\Ipswitch\WS_FTP Pro\wsfirscr.dll] [N/A, ]
                          [F:\Program Files\Ipswitch\WS_FTP Pro\wshosts.dll] [N/A, ]
                          [F:\Program Files\Ipswitch\WS_FTP Pro\ipspgp.dll] [N/A, ]
                          [F:\Program Files\Ipswitch\WS_FTP Pro\res0409.dll] [Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA
                          1. FillPCA Contributeur sécurité
                            Re,

                            OK. Je décrypte cela.
                            1/ Navigue jusqu'à C:\Windows\ERDNTpuis ouvre le dossier jaune portant une date. Clique sur ERDNT.exe
                            Clique deux fois sur OK. Suis les indications et redémarre le pc. Dis-moi si tu peux redémarrer normalement.

                            2/ Si ça ne fonctionne pas, clique sur démarrer>programmes>Accessoires>Outils systèmes>Restauration du système>Restaurer mon système à une date antérieure. Choisis la date en gras la plus récente possible et valide-la.

                            Dis-moi ce qu'il en est pour qu'on puisse reprendre le nettoyage car des bébettes demeurent.

                            FillPCA
                            1. Bronksman
                              Le restant

                              [F:\Program Files\Ipswitch\WS_FTP Pro\res0409.dll] [Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421, 9,0,0,0]
                              [C:\WINDOWS\system32\MFC42.DLL] [Microsoft Corporation, 6.02.4131.0]
                              [C:\WINDOWS\system32\RASAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\rasman.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\TAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\Program Files\Unlocker\UnlockerCOM.dll] [N/A, ]
                              [F:\Program Files\PowerISO\PWRISOSH.DLL] [PowerISO Computing, Inc., 3, 7, 0, 0]
                              [C:\WINDOWS\system32\comdlg32.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\WINSPOOL.DRV] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll] [Symantec Corporation, 10.1.5.5000]
                              [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
                              [C:\WINDOWS\system32\CopyToSendTo.dll] [N/A, ]
                              [C:\WINDOWS\system32\browselc.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\urlmon.dll] [Microsoft Corporation, 6.00.2900.2790 (xpsp.051104-1533)]
                              [C:\WINDOWS\system32\shdoclc.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)]
                              [C:\WINDOWS\system32\SXS.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\MSGINA.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\ODBC32.dll] [Microsoft Corporation, 3.525.1117.0 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\odbcint.dll] [Microsoft Corporation, 3.525.1117.0 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\actxprxy.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\mydocs.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\Program Files\Microsoft Office\Office10\msohev.dll] [Microsoft Corporation, 10.0.2609]
                              [C:\WINDOWS\system32\PDFShell.dll] [Adobe Systems Incorporated, 5.0.0.2001042700]
                              [PID: 1808 / Bronksman][C:\Documents and Settings\Bronksman\Desktop\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
                              [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)]
                              [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)]
                              [C:\WINDOWS\system32\comdlg32.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                              [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp.051110-1543)]
                              [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2869 (xpsp_sp2_gdr.060316-1512)]
                              [C:\WINDOWS\system32\WINSPOOL.DRV] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\oledlg.dll] [Microsoft Corporation, 1.0 (XPClient.010817-1148)]
                              [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp.050725-1531)]
                              [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180]
                              [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\CRYPT32.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\MSASN1.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\WININET.dll] [Microsoft Corporation, 6.00.2900.2781 (xpsp.051020-1728)]
                              [C:\WINDOWS\system32\RICHED20.DLL] [Microsoft Corporation, 5.30.23.1221]
                              [C:\WINDOWS\system32\NTMARTA.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\WLDAP32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\SAMLIB.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)]
                              [C:\WINDOWS\system32\sfc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\sfc_os.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\WINTRUST.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\IMAGEHLP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\Documents and Settings\Bronksman\Desktop\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
                              [C:\WINDOWS\system32\urlmon.dll] [Microsoft Corporation, 6.00.2900.2790 (xpsp.051104-1533)]
                              [C:\WINDOWS\system32\wsock32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\RASAPI32.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\rasman.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2756 (xpsp.050908-1544)]
                              [C:\WINDOWS\system32\TAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\rtutils.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\System32\mswsock.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\rasadhlp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\hnetcfg.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\System32\wshtcpip.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)]
                              [C:\WINDOWS\system32\Winsta.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
                              [C:\WINDOWS\system32\utildll.dll] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
                              [C:\WINDOWS\system32\SETUPAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

                              ==================================
                              File Associations
                              .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
                              .EXE OK. ["%1" %*]
                              .COM OK. ["%1" %*]
                              .PIF OK. ["%1" %*]
                              .REG OK. [regedit.exe "%1"]
                              .BAT OK. ["%1" %*]
                              .SCR OK. ["%1" /S]
                              .CHM OK. ["C:\WINDOWS\hh.exe" %1]
                              .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
                              .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
                              .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
                              .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
                              .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
                              .LNK OK. [{00021401-0000-0000-C000-000000000046}]

                              ==================================
                              Winsock Provider
                              N/A

                              ==================================
                              Autorun.Inf
                              N/A

                              ==================================
                              HOSTS File
                              127.0.0.1 localhost

                              ==================================
                              Process Privileges Scan
                              Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1500, C:\WINDOWS\EXPLORER.EXE]

                              ==================================
                              API HOOK
                              Entrypoint Error: NtCreateProcess (Dangerous Level: High, Hooked by Module: 0x00D706EC)
                              Entrypoint Error: NtCreateProcessEx (Dangerous Level: High, Hooked by Module: 0x00D70714)
                              Entrypoint Error: NtCreateThread (Dangerous Level: High, Hooked by Module: 0x00D706C4)
                              Entrypoint Error: NtTerminateProcess (Dangerous Level: High, Hooked by Module: 0x00D7073C)
                              Entrypoint Error: ZwCreateProcess (Dangerous Level: High, Hooked by Module: 0x00D706EC)
                              Entrypoint Error: ZwCreateProcessEx (Dangerous Level: High, Hooked by Module: 0x00D70714)
                              Entrypoint Error: ZwCreateThread (Dangerous Level: High, Hooked by Module: 0x00D706C4)
                              Entrypoint Error: ZwTerminateProcess (Dangerous Level: High, Hooked by Module: 0x00D7073C)

                              ==================================
                              Hidden Process
                              N/A

                              ==================================
                              • 1
                              • 2
                              • 3
                              • 4

                              Discussions similaires

                              infection
                              céline0034

                              12 réponses
                              Infection
                              toast3r

                              44 réponses
                              Comment éliminer facilement un TROJAN ?
                              LOM

                              7 réponses
                              Trojans et Spywares
                              lulu1009

                              1 réponse
                              Comment enlever les trojan de mon ordinateur
                              moun

                              22 réponses