Probleme virusWin32/Ursnif

Résolu
alain8693 -  
Bonjour,depuis deux trois jours j'ai un probleme je n'arrive plus a acceder a mon antivirus antivir ni a wiondows defender et pas plus a windows update.
un rapport de microsoft m'a mis ceci

Virus alert: Microsoft detected the WinNT / Bagle.gen virus on your computer

This problem was caused by WinNT / Bagle.gen, a known computer virus.

WinNT / Bagle.gen is also known by the following names:

Win32/Ursnif
Trojan-Downloader.Win32.Bagle.cu
W32.Beagle.GM
Troj/BagleDl-DB
Troj/Bagle-TH

j'ai fait des scans avec des programmes conseilles sur d'autres post du meme ordres
je vous mets les rapports si quelq'un peut m'aider ce serait tres sympatiique merci.
Fri Mar 07 14:53:31 2008
EliBagle v11.11 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle

Fri Mar 07 14:54:02 2008
EliBagle v11.11 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\100640.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\43739937.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\46250.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\50718.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\51890.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\52828.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\53015.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\53640.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\54406.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\54796.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\54859.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\55968.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\57937.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\58062.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\58296.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\58437.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\58703.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\59215890.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\59312.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\59531.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\60140.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\61843.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\65265.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\66109.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\67859.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\69859.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\72328.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\76468.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\77000.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\78156.EXE.VIR --> Eliminado Bagle
C:\QooBox\Quarantine\C\Windows\System32\drivers\down\83484.EXE.VIR --> Eliminado Bagle

Nº Total de Directorios: 11748
Nº Total de Ficheros: 89778
Nº de Ficheros Analizados: 11233
Nº de Ficheros Infectados: 31
Nº de Ficheros Limpiados: 31

Fri Mar 07 14:59:40 2008
EliBagle v11.11 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 11749
Nº Total de Ficheros: 89797
Nº de Ficheros Analizados: 11202
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Fri Mar 07 15:02:12 2008
EliBagle v11.11 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad N:\
N:\emule\BILLPRO POS FOR RESTAURANT 7.0 (KEY+SERIAL).ZIP --> Eliminado Bagle.dldr

Nº Total de Directorios: 290
Nº Total de Ficheros: 8018
Nº de Ficheros Analizados: 229
Nº de Ficheros Infectados: 1
Nº de Ficheros Limpiados: 1
Configuration: Windows Vista
Internet Explorer 7.0

21 réponses

Résumé de la discussion

Problème majeur rencontré: l’utilisateur ne peut plus accéder à l’antivirus Antivir, à Windows Defender ni à Windows Update après l’apparition d’une alerte indiquant WinNT / Bagle.gen et d’autres noms malveillants. Les rapports et scans montrent des actions de suppression et de quarantaine: fichiers infectés localisés dans C:\QooBox\Quarantine et Dossiers down, 31 fichiers infectés et 31 nettoyés lors d’une première exploration. D’autres intervenants proposent d’essayer en mode administrateur, d’éviter les doublons et d’effectuer un rootkit scan; le rapport GMER répertorie des services et pilotes Windows susceptibles d’être compromis. Une information utile: un scan de type GMER peut révéler des éléments actifs et désactivés, indiquant une contamination profonde qui peut nécessiter une réinstallation système ou une restauration depuis une image fiable.

Bobot (l’IA à votre service)
  1. green day Modérateur
    Salut

    télécharge combo-fix (par sUBs) ici :

    http://download.bleepingcomputer.com/sUBs/Combo-Fix.exe

    et enregistre le sur le bureau (pas besoin de le renommer, c'est fait)

    déconnecte toi d'internet et ferme toutes tes applications.

    désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

    double-clique sur combo-fix.exe et suis les instructions

    à la fin, il va produire un rapport C:\ComboFix.txt

    ++
    1. alain8693
      voici le rapport que faire maintenant merci

      Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6000.0.1252.1.1036.18.1211 [GMT 1:00]
      Endroit: C:\Users\philipponneau\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FN9EO9M2\Combo-Fix[1].exe
      .

      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .

      C:\Windows\system32\koos.exe
      C:\Windows\system32\kprof
      C:\Windows\system32\poof

      .
      ((((((((((((((((((((((((((((( Fichiers créés 2008-02-07 to 2008-03-07 ))))))))))))))))))))))))))))))))))))
      .

      Pas de nouveau fichier créé dans cet espace de temps

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-03-07 14:24 --------- d-----w C:\Program Files\Trend Micro
      2008-03-07 14:04 0 ----a-w C:\ntuser.dat
      2008-03-06 23:06 --------- d-----w C:\Program Files\Everest Poker
      2008-03-06 14:28 --------- d-----w C:\Program Files\a-squared Anti-Malware
      2008-03-05 23:25 --------- d-----w C:\Program Files\Common Files\Ulead Systems
      2008-03-05 23:23 --------- d-----w C:\Program Files\Alwil Software
      2008-03-05 23:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
      2008-03-05 23:18 --------- d-----w C:\PROGRA~2\Ulead Systems
      2008-03-05 23:00 --------- d-----w C:\Users\philipponneau\AppData\Roaming\Ulead Systems
      2008-03-05 23:00 --------- d-----w C:\Users\PHILIP~1\AppData\Roaming\Ulead Systems
      2008-03-05 22:59 --------- d-----w C:\Program Files\Intel
      2008-03-05 22:59 --------- d-----w C:\PROGRA~2\SmartSound Software Inc
      2008-03-05 22:58 --------- d-----w C:\Program Files\SmartSound Software
      2008-03-05 22:57 --------- d-----w C:\Program Files\Windows Media Components
      2008-03-05 22:57 --------- d-----w C:\Program Files\Common Files\InstallShield
      2008-03-05 00:18 --------- d-----w C:\Program Files\Macrogaming
      2008-02-29 16:13 --------- d-----w C:\PROGRA~2\Kiwee Toolbar2
      2008-02-29 16:11 --------- d-----w C:\Program Files\Kiwee Toolbar2
      2008-02-29 14:40 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
      2008-02-29 14:40 --------- d-----w C:\Program Files\Windows Live
      2008-02-29 14:34 --------- d-----w C:\PROGRA~2\WLInstaller
      2008-02-27 22:53 --------- d-----w C:\Program Files\Common Files\DVDVIDEOSOFT
      2008-02-24 10:22 --------- d-----w C:\PROGRA~2\Pinnacle
      2008-02-21 17:11 --------- d-----w C:\Program Files\Mio DigiWalker
      2008-02-20 15:22 74,752 ----a-w C:\Windows\ST6UNST.EXE
      2008-02-20 15:22 253,952 ------w C:\Windows\Setup1.exe
      2008-02-15 13:03 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
      2008-02-15 13:02 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
      2008-02-15 13:02 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
      2008-02-15 13:02 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
      2008-02-15 13:02 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
      2008-02-15 13:02 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
      2008-02-15 13:02 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
      2008-02-15 13:00 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
      2008-02-15 13:00 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
      2008-02-15 13:00 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
      2008-02-15 13:00 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
      2008-02-15 13:00 20,024 ----a-w C:\Windows\system32\drivers\viaide.sys
      2008-02-15 13:00 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
      2008-02-15 13:00 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
      2008-02-15 12:59 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
      2008-02-15 12:59 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
      2008-02-15 12:59 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
      2008-02-15 12:59 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
      2008-02-15 12:56 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
      2008-02-07 14:34 --------- d-----w C:\Users\philipponneau\AppData\Roaming\ZoomBrowser EX
      2008-02-07 14:34 --------- d-----w C:\Users\PHILIP~1\AppData\Roaming\ZoomBrowser EX
      2008-02-07 14:27 --------- d-----w C:\PROGRA~2\ZoomBrowser
      2008-02-07 14:19 --------- d-----w C:\Program Files\Canon
      2008-02-07 14:16 --------- d-----w C:\Program Files\Common Files\Canon
      2008-02-07 14:13 --------- d-----w C:\Users\philipponneau\AppData\Roaming\Canon
      2008-02-07 14:13 --------- d-----w C:\Users\PHILIP~1\AppData\Roaming\Canon
      2008-01-17 14:51 --------- d-----w C:\Users\philipponneau\AppData\Roaming\Bioshock
      2008-01-17 14:51 --------- d-----w C:\Users\PHILIP~1\AppData\Roaming\Bioshock
      2008-01-10 15:00 --------- d-----w C:\Program Files\Windows Sidebar
      2008-01-10 15:00 --------- d-----w C:\Program Files\Windows Mail
      2008-01-10 14:55 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
      2008-01-10 14:55 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
      2008-01-09 22:57 --------- d-----w C:\Users\philipponneau\AppData\Roaming\InstallShield Installation Information
      2008-01-09 22:57 --------- d-----w C:\Users\PHILIP~1\AppData\Roaming\InstallShield Installation Information
      2008-01-09 22:35 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
      2008-01-09 22:35 --------- d-----w C:\Program Files\AGEIA Technologies
      2007-12-22 14:05 22,328 ----a-w C:\Users\philipponneau\AppData\Roaming\PnkBstrK.sys
      2007-12-22 14:05 22,328 ----a-w C:\Users\PHILIP~1\AppData\Roaming\PnkBstrK.sys
      2007-08-31 12:10 174 --sha-w C:\Program Files\desktop.ini
      2006-07-23 17:10 484,522 --sha-r C:\Program Files\serial.tde
      .

      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      REGEDIT4
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]
      2008-02-18 14:01 248976 --a------ C:\Program Files\Kiwee Toolbar2\1.3.118\KiweeIEToolbar.dll

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d3e23b4b-f153-4687-82c2-816319dd3c5a}]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
      {D3E23B4B-F153-4687-82C2-816319DD3C5A}
      {2318C2B1-4965-11D4-9B18-009027A5CD4F}
      {6638A9DE-0745-4292-8A2E-AE530E7B9B3F}

      [HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
      [HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
      [HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
      [HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
      "{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= C:\Program Files\Kiwee Toolbar2\1.3.118\KiweeIEToolbar.dll [2008-02-18 14:01 248976]

      [HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
      [HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
      [HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
      [HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-10 15:55 1232896]
      "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-09-03 15:30 171448]
      "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" [2007-07-02 11:22 219008]
      "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
      "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:34 201728]
      "eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [2007-05-13 15:57 5308416]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-08-28 12:58 1006264]
      "RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 12:37 4186112 C:\Windows\RtHDVCpl.exe]
      "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-03-07 00:29 249896]
      "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 14:44 101136 C:\Windows\KHALMNPR.Exe]
      "NeroCheck"="C:\Windows\system32\\NeroCheck.exe" [2001-07-09 11:50 155648]
      "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-12 05:28 86016]
      "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-12 05:28 8497696]
      "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-12 05:28 81920]
      "Windows Mobile-based device management"="%windir%\WindowsMobile\wmdSync.exe" [ ]
      "KiweeHook"="C:\Program Files\Kiwee Toolbar2\1.3.118\kwtbaim.exe" [2008-02-18 14:01 48264]
      "devenv"="C:\Windows\system\smvss.exe" [2008-03-03 23:42 34304]
      "RegistryMechanic"="" []
      "a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2008-03-07 00:29 1816208]

      C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
      Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-08-28 21:03:50 688128]

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2916708062-3166946556-1105536220-1000]
      "EnableNotificationsRef"=dword:00000003

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
      "TCP Query User{805198C9-8EF6-4D64-A7AB-2110C29C57C5}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule|Desc=eMule
      "UDP Query User{8CBFF5A0-BC38-4058-B764-91E70FAADC8A}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule|Desc=eMule
      "{6DE27ACA-BF9B-4F8E-B92B-31FD272D2F89}"= UDP:C:\Program Files\Shareaza\Shareaza.exe:Shareaza
      "{E62C89B4-44B4-47E3-A3A0-1CB36627C714}"= TCP:C:\Program Files\Shareaza\Shareaza.exe:Shareaza
      "TCP Query User{57113E69-098F-4B66-862B-2F5A71E49AD6}C:\program files\activision\call of duty 2\cod2mp_s.exe"= UDP:C:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s|Desc=CoD2MP_s
      "UDP Query User{A1AEB8E3-C43D-41C9-A06E-66D27165AA75}C:\program files\activision\call of duty 2\cod2mp_s.exe"= TCP:C:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s|Desc=CoD2MP_s
      "{3D70DB90-A318-4116-AC88-A801D6C52EA8}"= UDP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)
      "{96E374CA-B67A-4805-9E4A-B5978C81C119}"= TCP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)
      "{4CA92578-8968-437E-9D8E-6D5623FF0FE2}"= UDP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)
      "{156F3F27-181C-4693-85DE-7B221E97E2D7}"= TCP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)
      "TCP Query User{C4554F2E-C896-42BD-857D-4647F4F7C60C}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule|Desc=eMule
      "UDP Query User{2EDFF14C-7DB0-4F4D-BB14-397CCA7BF524}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule|Desc=eMule
      "{F4B5C900-2503-4410-9E5A-90FA97BCDC6E}"= UDP:C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\Binaries\MOHA.exe:Medal of Honor Airborne
      "{88EA7DD2-D0A6-406A-BD80-64569F3322E3}"= TCP:C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\Binaries\MOHA.exe:Medal of Honor Airborne
      "{9CAD50AD-711C-4221-8643-B21C7AE2E3CF}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
      "{135701F1-6B13-40C9-9EAD-6987080820AE}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
      "{F068B452-528F-41D3-8554-19F196B87E9E}"= UDP:N:\Nouveau dossier\Bin32\Crysis.exe:Crysis_32
      "{4D33774A-B1AF-49F2-8D85-B79BBBCA99C8}"= TCP:N:\Nouveau dossier\Bin32\Crysis.exe:Crysis_32
      "{8412CD16-33B3-41FE-A817-4DE04FF6489E}"= UDP:N:\Nouveau dossier\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
      "{B8D3E2D5-8042-4681-B693-F57E0168B5F1}"= TCP:N:\Nouveau dossier\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
      "{22415CAF-5E18-41A9-91CC-EBCD7985C3B8}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
      "{F8FEEC67-927F-4035-8E69-C6E48E9871A0}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
      "{A2FED326-BC3F-4BCA-A2B3-5DC91CA63D95}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
      "{A36DB4B9-55EE-4553-8A8F-B150375ACFA9}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
      "{2B73F565-D707-462D-B477-69D68CB89A89}"= UDP:N:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)
      "{D07939C4-6775-4DDD-B2E0-B9F888B85734}"= TCP:N:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)
      "{7EB1F5A5-FABE-4DA2-B2B4-228C82AE69C3}"= UDP:N:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)
      "{327E932F-9F31-4EB5-85C7-629D31C7EA1A}"= TCP:N:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)
      "{CC5F3BC0-3958-4AD2-A339-DF498833E5F1}"= UDP:N:\conflit\wic.exe:World in Conflict
      "{3DEBDA30-F23F-40DF-991D-51F0CD60CDF8}"= TCP:N:\conflit\wic.exe:World in Conflict
      "{90D3D478-6007-4F86-8361-4F95BE896BE8}"= UDP:N:\conflit\wic_online.exe:World in Conflict - En ligne uniquement
      "{A836A8D0-C488-4F79-815F-8C985E3CC769}"= TCP:N:\conflit\wic_online.exe:World in Conflict - En ligne uniquement
      "{30A3C118-32DE-452F-B365-2B0EF7AAA3B6}"= UDP:N:\conflit\wic_ds.exe:World in Conflict - Serveur dédié
      "{7456A23D-73D6-4CEE-9159-628404E45C73}"= TCP:N:\conflit\wic_ds.exe:World in Conflict - Serveur dédié
      "{570F81AD-7DB0-4A70-BBB1-A0D4CBA7F0A0}"= UDP:N:\ut3\Binaries\UT3.exe:Unreal Tournament 3
      "{88BC3ED7-203B-4E9D-9E98-ABA9F0B977CC}"= TCP:N:\ut3\Binaries\UT3.exe:Unreal Tournament 3
      "TCP Query User{8D454791-78DB-4C5B-8331-2DEA27203681}C:\program files\speedcams_serveur\speedcams_serveur.exe"= UDP:C:\program files\speedcams_serveur\speedcams_serveur.exe:SpeedCams_Serveur|Desc=SpeedCams_Serveur
      "UDP Query User{EC5B6E01-E2C5-4C8A-B9A4-9FED491E640B}C:\program files\speedcams_serveur\speedcams_serveur.exe"= TCP:C:\program files\speedcams_serveur\speedcams_serveur.exe:SpeedCams_Serveur|Desc=SpeedCams_Serveur

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
      "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

      R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);C:\Windows\system32\drivers\pe3ah4nc.sys [2007-05-18 20:53]
      R0 pe3ajbeb;L Ile Noyee Environment Driver (pe3ajbeb);C:\Windows\system32\drivers\pe3ajbeb.sys [2007-08-22 17:31]
      R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\Windows\system32\drivers\ps6ah4nc.sys [2007-05-18 20:52]
      R0 ps7ajbeb;L Ile Noyee Synchronization Driver (ps7ajbeb);C:\Windows\system32\drivers\ps7ajbeb.sys [2007-08-22 17:30]
      R2 RapiMgr;Connectivité de l'appareil Windows Mobile;C:\Windows\system32\svchost.exe [2006-11-02 10:45]
      R2 UxTuneUp;TuneUp Extension de thème;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
      R2 WcesComm;Connectivité de l'appareil Windows Mobile 2003;C:\Windows\system32\svchost.exe [2006-11-02 10:45]
      S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\Windows\system32\pr2ah4nc.exe svc []
      S2 pr2ajbeb;L Ile Noyee Drivers Auto Removal (pr2ajbeb);C:\Windows\system32\pr2ajbeb.exe svc []
      S3 W8100PCI;D-Link AirPlus G Wireless Driver;C:\Windows\system32\DRIVERS\mrv8k51.sys [2004-01-08 19:45]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
      LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
      WindowsMobile REG_MULTI_SZ wcescomm rapimgr
      LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
      UxTuneUp

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{19030640-6ecd-11dc-8d43-001966236e64}]
      \shell\AutoRun\command - E:\BSAutoRun.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4cd90cb-562f-11dc-8c09-001966236e64}]
      \shell\AutoRun\command - H:\BSAutoRun.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4cd90cd-562f-11dc-8c09-001966236e64}]
      \shell\AutoRun\command - J:\TheMark.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4cd90ce-562f-11dc-8c09-001966236e64}]
      \shell\AutoRun\command - K:\setup.exe

      .
      **************************************************************************

      catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-03-07 15:34:07
      Windows 6.0.6000 NTFS

      Balayage processus cachés ...

      Balayage caché autostart entries ...

      Balayage des fichiers cachés ...

      Scan terminé avec succès
      Les fichiers cachés: 0

      **************************************************************************
      .
      ------------------------ Other Running Processes ------------------------
      .
      C:\Windows\system32\PnkBstrA.exe
      C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
      C:\Windows\system32\conime.exe
      C:\Windows\System32\rundll32.exe
      C:\Windows\WindowsMobile\wmdSync.exe
      C:\Windows\System32\rundll32.exe
      C:\Program Files\Windows Media Player\wmpnetwk.exe
      .
      **************************************************************************
      .
      Temps d'accomplissement: 2008-03-07 15:36:11 - machine was rebooted
      ComboFix-quarantined-files.txt 2008-03-07 14:36:07
      ComboFix2.txt 2008-03-06 23:33:56
      .
      2008-02-22 18:52:39 --- E O F ---
  2. cristiano ronaldo
    Elimine ce fichier de emule : N:\emule\BILLPRO POS FOR RESTAURANT 7.0 (KEY+SERIAL).ZIP et ton probleme deviendra une soltion ;)
    1. alain8693
      j'essaie tout de suite
    2. alain8693
      j'ai elimine ce fichier mais c'est toujours pareil. je viens de faire un scan avec hijackthis voici le rapport
      Scan saved at 15:26:52, on 07/03/2008
      Platform: Windows Vista (WinNT 6.00.1904)
      MSIE: Internet Explorer v7.00 (7.00.6000.16609)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\Dwm.exe
      C:\Windows\system32\taskeng.exe
      C:\Windows\RtHDVCpl.exe
      C:\Windows\System32\rundll32.exe
      C:\Windows\WindowsMobile\wmdSync.exe
      C:\Program Files\Kiwee Toolbar2\1.3.118\kwtbaim.exe
      C:\Windows\system\smvss.exe
      C:\Program Files\Windows Sidebar\sidebar.exe
      C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Windows Media Player\wmpnscfg.exe
      C:\Program Files\eMule\emule.exe
      C:\Program Files\Logitech\SetPoint\SetPoint.exe
      C:\Windows\System32\rundll32.exe
      C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
      C:\Windows\Explorer.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
      C:\Windows\system32\SearchFilterHost.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/webhp?sourceid=navclient&hl=fr&ie=UTF-8&gws_rd=ssl
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      R3 - URLSearchHook: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.3.118\KiweeIEToolbar.dll
      R3 - URLSearchHook: free-downloads Toolbar - {d3e23b4b-f153-4687-82c2-816319dd3c5a} - blank (file missing)
      R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
      O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.3.118\KiweeIEToolbar.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O2 - BHO: free-downloads Toolbar - {d3e23b4b-f153-4687-82c2-816319dd3c5a} - blank (file missing)
      O3 - Toolbar: free-downloads Toolbar - {d3e23b4b-f153-4687-82c2-816319dd3c5a} - blank (file missing)
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.3.118\KiweeIEToolbar.dll
      O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
      O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
      O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
      O4 - HKLM\..\Run: [NeroCheck] C:\Windows\system32\\NeroCheck.exe
      O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
      O4 - HKLM\..\Run: [KiweeHook] "C:\Program Files\Kiwee Toolbar2\1.3.118\kwtbaim.exe"
      O4 - HKLM\..\Run: [devenv] C:\Windows\system\smvss.exe /w
      O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
      O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
      O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
      O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
      O4 - Global Startup: Logitech SetPoint.lnk = ?
      O13 - Gopher Prefix:
      O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
      O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
      O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
      O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\Windows\system32\pr2ah4nc.exe
      O23 - Service: L Ile Noyee Drivers Auto Removal (pr2ajbeb) (pr2ajbeb) - Micro Application - C:\Windows\system32\pr2ajbeb.exe
      O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
  3. green day Modérateur
    ok,

    Télécharge SDFix sur ton bureau

    http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

    Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
    Redémarre ton ordinateur en mode sans échec
    Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.cmd pour lancer le script.
    Appuie sur Y pour commencer le processus de nettoyage.
    Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
    Appuie sur une touche pour redémarrer le PC.
    Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
    Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
    Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
    Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
    Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum stp

    ++
    1. alain8693
      j'essaie tout de suite merci
    2. alain8693
      j'ai essaye ce que tu m'a dis mais quand je redemarre en mode sans echec quand j'essaie de double cliquer sur run this la fenetre s'ouvre et se referme ausitot donc je ne peut pas continuer
      quand j'ai installe le programme un message m' a indique qiue le programme ne s'etait peut etre pas installe correctement cela vient il de ca
      j'ai essaye' 3fois sans succes
      merci
  4. green day Modérateur
    c'est normal, tu es sous vista ! :)

    * Désactiver le contrôle des comptes utilisateurs (le réactiver à la fin de la désinfection) :
    * Aller dans démarrer puis panneau de configuration
    * Double Cliquer sur l'icône Comptes d'utilisateurs
    * Cliquer ensuite sur désactiver et valider.

    ++
    2. alain8693
      dans mon compte utilisateur il n'y a pas de cases desactiver il y a uniquement une case utiliser le controle des comptesd'utilisateurs pour vous aidera gerer votre ordinateur
      1. green day Modérateur
        décoche cette case !

        ++
        1. alain8693
          c'est fait mais je peut toujours pas lancer sd fix
      2. green day Modérateur
        essaye en faisant un clic droit dessus => utiliser en tant qu'administrateur

        ++
        1. alain8693
          non ca ne marche pas non plus la fenetre se referme aussitot
      3. green day Modérateur
        mince ! :/

        poste un nouveau rapport EliBagle stp

        ++
        1. alain8693
          merci a toi green day mais je doit m'en aller je reessairai demain avec un nouveau post
          vous etes vraiment cool
      4. green day Modérateur
        un nouveau poste ??

        merci de continuer ici, éviter les doublons ! ;-)

        @+
        1. alain8693
          suite a mon probleme je vous envoi un nouveau rapport je ne peut toujours pas acceder a differents programmes le message applicatioh win 32 n'est pas valide s'affiche si quelqun peut me conseiller merci d'avance

          apllicationComboFix 08-03-03.15 - philipponneau 2008-03-09 14:09:54.2 - NTFSx86
          Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6000.0.1252.1.1036.18.1412 [GMT 1:00]
          Endroit: C:\Users\philipponneau\Desktop\Combo-Fix.exe
          .

          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
          .

          C:\Windows\system32\koos.exe
          C:\Windows\system32\kprof
          C:\Windows\system32\poof

          .
          ((((((((((((((((((((((((((((( Fichiers créés 2008-02-09 to 2008-03-09 ))))))))))))))))))))))))))))))))))))
          .

          Pas de nouveau fichier créé dans cet espace de temps

          .
          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2008-03-08 23:13 --------- d-----w C:\Program Files\Everest Poker
          2008-03-08 22:25 --------- d-----w C:\Program Files\Google
          2008-03-08 22:25 --------- d-----w C:\Program Files\a-squared Anti-Malware
          2008-03-07 16:24 --------- d---a-w C:\ProgramData\TEMP
          2008-03-07 16:16 --------- d-----w C:\Users\philipponneau\AppData\Roaming\Simply Super Software
          2008-03-07 16:16 --------- d-----w C:\ProgramData\Simply Super Software
          2008-03-07 16:16 --------- d-----w C:\Program Files\Trojan Remover
          2008-03-07 14:24 --------- d-----w C:\Program Files\Trend Micro
          2008-03-07 14:04 0 ----a-w C:\ntuser.dat
          2008-03-05 23:25 --------- d-----w C:\Program Files\Common Files\Ulead Systems
          2008-03-05 23:23 --------- d-----w C:\Program Files\Alwil Software
          2008-03-05 23:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
          2008-03-05 23:18 --------- d-----w C:\ProgramData\Ulead Systems
          2008-03-05 23:00 --------- d-----w C:\Users\philipponneau\AppData\Roaming\Ulead Systems
          2008-03-05 22:59 --------- d-----w C:\ProgramData\SmartSound Software Inc
          2008-03-05 22:59 --------- d-----w C:\Program Files\Intel
          2008-03-05 22:58 --------- d-----w C:\Program Files\SmartSound Software
          2008-03-05 22:57 --------- d-----w C:\Program Files\Windows Media Components
          2008-03-05 22:57 --------- d-----w C:\Program Files\Common Files\InstallShield
          2008-03-05 00:18 --------- d-----w C:\Program Files\Macrogaming
          2008-02-29 16:13 --------- d-----w C:\ProgramData\Kiwee Toolbar2
          2008-02-29 16:11 --------- d-----w C:\Program Files\Kiwee Toolbar2
          2008-02-29 14:40 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
          2008-02-29 14:40 --------- d-----w C:\Program Files\Windows Live
          2008-02-29 14:34 --------- d-----w C:\ProgramData\WLInstaller
          2008-02-27 22:53 --------- d-----w C:\Program Files\Common Files\DVDVIDEOSOFT
          2008-02-24 10:22 --------- d-----w C:\ProgramData\Pinnacle
          2008-02-21 17:11 --------- d-----w C:\Program Files\Mio DigiWalker
          2008-02-20 15:22 74,752 ----a-w C:\Windows\ST6UNST.EXE
          2008-02-20 15:22 253,952 ------w C:\Windows\Setup1.exe
          2008-02-15 13:03 194,560 ----a-w C:\Windows\System32\WebClnt.dll
          2008-02-15 13:03 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
          2008-02-15 13:00 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
          2008-02-15 13:00 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
          2008-02-15 13:00 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
          2008-02-15 13:00 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
          2008-02-15 13:00 24,064 ----a-w C:\Windows\System32\netcfg.exe
          2008-02-15 13:00 22,016 ----a-w C:\Windows\System32\netiougc.exe
          2008-02-15 13:00 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
          2008-02-15 13:00 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
          2008-02-15 13:00 20,024 ----a-w C:\Windows\system32\drivers\viaide.sys
          2008-02-15 13:00 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
          2008-02-15 13:00 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
          2008-02-15 13:00 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
          2008-02-15 12:59 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
          2008-02-15 12:59 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
          2008-02-15 12:59 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
          2008-02-15 12:59 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
          2008-02-15 12:59 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
          2008-02-15 12:59 1,686,528 ----a-w C:\Windows\System32\gameux.dll
          2008-02-15 12:56 824,832 ----a-w C:\Windows\System32\wininet.dll
          2008-02-15 12:56 56,320 ----a-w C:\Windows\System32\iesetup.dll
          2008-02-15 12:56 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
          2008-02-15 12:56 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
          2008-02-07 14:34 --------- d-----w C:\Users\philipponneau\AppData\Roaming\ZoomBrowser EX
          2008-02-07 14:27 --------- d-----w C:\ProgramData\ZoomBrowser
          2008-02-07 14:19 --------- d-----w C:\Program Files\Canon
          2008-02-07 14:16 --------- d-----w C:\Program Files\Common Files\Canon
          2008-02-07 14:13 --------- d-----w C:\Users\philipponneau\AppData\Roaming\Canon
          2008-01-17 14:51 --------- d-----w C:\Users\philipponneau\AppData\Roaming\Bioshock
          2008-01-10 15:00 --------- d-----w C:\Program Files\Windows Sidebar
          2008-01-10 15:00 --------- d-----w C:\Program Files\Windows Mail
          2008-01-10 14:55 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
          2008-01-10 14:55 11,776 ----a-w C:\Windows\System32\sbunattend.exe
          2008-01-10 14:55 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
          2008-01-09 22:57 --------- d-----w C:\Users\philipponneau\AppData\Roaming\InstallShield Installation Information
          2008-01-09 22:35 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
          2008-01-09 22:35 --------- d-----w C:\Program Files\AGEIA Technologies
          2007-12-22 22:07 229,888 ----a-w C:\Windows\System32\msshsq.dll
          2007-12-22 14:05 669,184 ----a-w C:\Windows\System32\pbsvc.exe
          2007-12-22 14:05 66,872 ----a-w C:\Windows\System32\PnkBstrA.exe
          2007-12-22 14:05 22,328 ----a-w C:\Users\philipponneau\AppData\Roaming\PnkBstrK.sys
          2007-12-22 14:05 103,736 ----a-w C:\Windows\System32\PnkBstrB.exe
          2007-12-12 22:59 1,327,104 ----a-w C:\Windows\System32\quartz.dll
          2007-12-12 22:58 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
          2007-12-12 22:58 223,232 ----a-w C:\Windows\System32\WMASF.DLL
          2007-08-31 12:10 174 --sha-w C:\Program Files\desktop.ini
          2006-07-23 17:10 484,522 --sha-r C:\Program Files\serial.tde
          .

          ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          REGEDIT4
          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

          [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]
          2008-02-18 14:01 248976 --a------ C:\Program Files\Kiwee Toolbar2\1.3.118\KiweeIEToolbar.dll

          [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d3e23b4b-f153-4687-82c2-816319dd3c5a}]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
          {D3E23B4B-F153-4687-82C2-816319DD3C5A}
          {2318C2B1-4965-11D4-9B18-009027A5CD4F}
          {6638A9DE-0745-4292-8A2E-AE530E7B9B3F}

          [HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
          [HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
          [HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
          [HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
          "{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= C:\Program Files\Kiwee Toolbar2\1.3.118\KiweeIEToolbar.dll [2008-02-18 14:01 248976]

          [HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
          [HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
          [HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
          [HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-10 15:55 1232896]
          "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-09-03 15:30 171448]
          "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" [2007-07-02 11:22 219008]
          "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
          "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:34 201728]
          "eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [2007-05-13 15:57 5308416]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-08-28 12:58 1006264]
          "RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 12:37 4186112 C:\Windows\RtHDVCpl.exe]
          "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-03-08 23:53 249896]
          "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 14:44 101136 C:\Windows\KHALMNPR.Exe]
          "NeroCheck"="C:\Windows\system32\\NeroCheck.exe" [2001-07-09 11:50 155648]
          "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-12 05:28 86016]
          "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-12 05:28 8497696]
          "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-12 05:28 81920]
          "Windows Mobile-based device management"="%windir%\WindowsMobile\wmdSync.exe" [ ]
          "KiweeHook"="C:\Program Files\Kiwee Toolbar2\1.3.118\kwtbaim.exe" [2008-02-18 14:01 48264]
          "devenv"="C:\Windows\system\smvss.exe" [2008-03-03 23:42 34304]
          "RegistryMechanic"="" []
          "a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2008-03-08 23:53 1816208]

          C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
          Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-08-28 21:03:50 688128]

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2916708062-3166946556-1105536220-1000]
          "EnableNotificationsRef"=dword:00000003

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
          "TCP Query User{805198C9-8EF6-4D64-A7AB-2110C29C57C5}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule|Desc=eMule
          "UDP Query User{8CBFF5A0-BC38-4058-B764-91E70FAADC8A}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule|Desc=eMule
          "{6DE27ACA-BF9B-4F8E-B92B-31FD272D2F89}"= UDP:C:\Program Files\Shareaza\Shareaza.exe:Shareaza
          "{E62C89B4-44B4-47E3-A3A0-1CB36627C714}"= TCP:C:\Program Files\Shareaza\Shareaza.exe:Shareaza
          "TCP Query User{57113E69-098F-4B66-862B-2F5A71E49AD6}C:\program files\activision\call of duty 2\cod2mp_s.exe"= UDP:C:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s|Desc=CoD2MP_s
          "UDP Query User{A1AEB8E3-C43D-41C9-A06E-66D27165AA75}C:\program files\activision\call of duty 2\cod2mp_s.exe"= TCP:C:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s|Desc=CoD2MP_s
          "{3D70DB90-A318-4116-AC88-A801D6C52EA8}"= UDP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)
          "{96E374CA-B67A-4805-9E4A-B5978C81C119}"= TCP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)
          "{4CA92578-8968-437E-9D8E-6D5623FF0FE2}"= UDP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)
          "{156F3F27-181C-4693-85DE-7B221E97E2D7}"= TCP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)
          "TCP Query User{C4554F2E-C896-42BD-857D-4647F4F7C60C}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule|Desc=eMule
          "UDP Query User{2EDFF14C-7DB0-4F4D-BB14-397CCA7BF524}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule|Desc=eMule
          "{F4B5C900-2503-4410-9E5A-90FA97BCDC6E}"= UDP:C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\Binaries\MOHA.exe:Medal of Honor Airborne
          "{88EA7DD2-D0A6-406A-BD80-64569F3322E3}"= TCP:C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\Binaries\MOHA.exe:Medal of Honor Airborne
          "{9CAD50AD-711C-4221-8643-B21C7AE2E3CF}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
          "{135701F1-6B13-40C9-9EAD-6987080820AE}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
          "{F068B452-528F-41D3-8554-19F196B87E9E}"= UDP:N:\Nouveau dossier\Bin32\Crysis.exe:Crysis_32
          "{4D33774A-B1AF-49F2-8D85-B79BBBCA99C8}"= TCP:N:\Nouveau dossier\Bin32\Crysis.exe:Crysis_32
          "{8412CD16-33B3-41FE-A817-4DE04FF6489E}"= UDP:N:\Nouveau dossier\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
          "{B8D3E2D5-8042-4681-B693-F57E0168B5F1}"= TCP:N:\Nouveau dossier\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
          "{22415CAF-5E18-41A9-91CC-EBCD7985C3B8}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
          "{F8FEEC67-927F-4035-8E69-C6E48E9871A0}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
          "{A2FED326-BC3F-4BCA-A2B3-5DC91CA63D95}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
          "{A36DB4B9-55EE-4553-8A8F-B150375ACFA9}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
          "{2B73F565-D707-462D-B477-69D68CB89A89}"= UDP:N:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)
          "{D07939C4-6775-4DDD-B2E0-B9F888B85734}"= TCP:N:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)
          "{7EB1F5A5-FABE-4DA2-B2B4-228C82AE69C3}"= UDP:N:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)
          "{327E932F-9F31-4EB5-85C7-629D31C7EA1A}"= TCP:N:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)
          "{CC5F3BC0-3958-4AD2-A339-DF498833E5F1}"= UDP:N:\conflit\wic.exe:World in Conflict
          "{3DEBDA30-F23F-40DF-991D-51F0CD60CDF8}"= TCP:N:\conflit\wic.exe:World in Conflict
          "{90D3D478-6007-4F86-8361-4F95BE896BE8}"= UDP:N:\conflit\wic_online.exe:World in Conflict - En ligne uniquement
          "{A836A8D0-C488-4F79-815F-8C985E3CC769}"= TCP:N:\conflit\wic_online.exe:World in Conflict - En ligne uniquement
          "{30A3C118-32DE-452F-B365-2B0EF7AAA3B6}"= UDP:N:\conflit\wic_ds.exe:World in Conflict - Serveur dédié
          "{7456A23D-73D6-4CEE-9159-628404E45C73}"= TCP:N:\conflit\wic_ds.exe:World in Conflict - Serveur dédié
          "{570F81AD-7DB0-4A70-BBB1-A0D4CBA7F0A0}"= UDP:N:\ut3\Binaries\UT3.exe:Unreal Tournament 3
          "{88BC3ED7-203B-4E9D-9E98-ABA9F0B977CC}"= TCP:N:\ut3\Binaries\UT3.exe:Unreal Tournament 3
          "TCP Query User{8D454791-78DB-4C5B-8331-2DEA27203681}C:\program files\speedcams_serveur\speedcams_serveur.exe"= UDP:C:\program files\speedcams_serveur\speedcams_serveur.exe:SpeedCams_Serveur|Desc=SpeedCams_Serveur
          "UDP Query User{EC5B6E01-E2C5-4C8A-B9A4-9FED491E640B}C:\program files\speedcams_serveur\speedcams_serveur.exe"= TCP:C:\program files\speedcams_serveur\speedcams_serveur.exe:SpeedCams_Serveur|Desc=SpeedCams_Serveur

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
          "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

          R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);C:\Windows\system32\drivers\pe3ah4nc.sys [2007-05-18 20:53]
          R0 pe3ajbeb;L Ile Noyee Environment Driver (pe3ajbeb);C:\Windows\system32\drivers\pe3ajbeb.sys [2007-08-22 17:31]
          R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\Windows\system32\drivers\ps6ah4nc.sys [2007-05-18 20:52]
          R0 ps7ajbeb;L Ile Noyee Synchronization Driver (ps7ajbeb);C:\Windows\system32\drivers\ps7ajbeb.sys [2007-08-22 17:30]
          R2 RapiMgr;Connectivité de l'appareil Windows Mobile;C:\Windows\system32\svchost.exe [2006-11-02 10:45]
          R2 UxTuneUp;TuneUp Extension de thème;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
          R2 WcesComm;Connectivité de l'appareil Windows Mobile 2003;C:\Windows\system32\svchost.exe [2006-11-02 10:45]
          S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\Windows\system32\pr2ah4nc.exe svc []
          S2 pr2ajbeb;L Ile Noyee Drivers Auto Removal (pr2ajbeb);C:\Windows\system32\pr2ajbeb.exe svc []
          S3 W8100PCI;D-Link AirPlus G Wireless Driver;C:\Windows\system32\DRIVERS\mrv8k51.sys [2004-01-08 19:45]

          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
          LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
          WindowsMobile REG_MULTI_SZ wcescomm rapimgr
          LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
          UxTuneUp

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{19030640-6ecd-11dc-8d43-001966236e64}]
          \shell\AutoRun\command - E:\BSAutoRun.exe

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4cd90cb-562f-11dc-8c09-001966236e64}]
          \shell\AutoRun\command - H:\BSAutoRun.exe

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4cd90cd-562f-11dc-8c09-001966236e64}]
          \shell\AutoRun\command - J:\TheMark.exe

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4cd90ce-562f-11dc-8c09-001966236e64}]
          \shell\AutoRun\command - K:\setup.exe

          .
          Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
          "2008-02-29 16:28:48 C:\Windows\Tasks\Maintenance en 1 clic.job"
          - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
          "2008-03-08 22:30:30 C:\Windows\Tasks\User_Feed_Synchronization-{64AE2160-D476-4FC7-AEB3-367CBBD7AA92}.job"
          - C:\Windows\system32\msfeedssync.exe
          .
          **************************************************************************

          catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-03-09 14:12:30
          Windows 6.0.6000 NTFS

          Balayage processus cachés ...

          Balayage caché autostart entries ...

          Balayage des fichiers cachés ...

          Scan terminé avec succès
          Les fichiers cachés: 0

          **************************************************************************
          .
          ------------------------ Other Running Processes ------------------------
          .
          C:\Windows\system32\PnkBstrA.exe
          C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
          C:\Windows\system32\conime.exe
          C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe
          C:\Windows\WindowsMobile\wmdSync.exe
          C:\Program Files\Windows Media Player\wmpnetwk.exe
          C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
          C:\Program Files\Windows Live\Messenger\usnsvc.exe
          .
          **************************************************************************
          .
          Temps d'accomplissement: 2008-03-09 14:14:11 - machine was rebooted
          ComboFix-quarantined-files.txt 2008-03-09 13:14:06
          ComboFix2.txt 2008-03-08 22:57:56
          ComboFix3.txt 2008-03-07 14:36:12
          ComboFix4.txt 2008-03-06 23:33:56
          .
          2008-02-22 18:52:39 --- E O F ---
      5. green day Modérateur
        Salut

        poste un nouveau rapport EliBagle stp

        ++
        1. alain8693
          quand je fais un scan avec elibagle je ne trouve plus de rapport a la fin j'ai pourtant cherche partout
          par contre j'ai reussi a faire un rapport avec sd fix mais uniquement en mode normal pas en mode sans echec je le ets peut etre cela pourra servir merci

          [b]System Report[/b]
          *************

          Run on 09/03/2008 at 20:15

          Microsoft Windows [version 6.0.6000]

          Current user is not an administrator

          [b]Running Processes[/b]:

          C:\Windows\system32\taskeng.exe [1780]
          C:\Windows\system32\Dwm.exe [1848]
          C:\Windows\Explorer.EXE [1872]
          C:\Windows\RtHDVCpl.exe [376]
          C:\Windows\System32\rundll32.exe [468]
          C:\Windows\WindowsMobile\wmdSync.exe [552]
          C:\Program Files\Kiwee Toolbar2\1.3.118\kwtbaim.exe [608]
          C:\Windows\system\smvss.exe [668]
          C:\Windows\System32\rundll32.exe [1076]
          C:\Program Files\Windows Sidebar\sidebar.exe [1420]
          C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [1456]
          C:\Program Files\Windows Live\Messenger\msnmsgr.exe [1484]
          C:\Program Files\Windows Media Player\wmpnscfg.exe [1636]
          C:\Program Files\eMule\emule.exe [1728]
          C:\Program Files\Logitech\SetPoint\SetPoint.exe [1792]
          C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE [564]
          C:\Windows\system32\conime.exe [2268]
          C:\Program Files\Internet Explorer\iexplore.exe [4084]
          C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe [2220]

          [b]Drivers - Running[/b]:

          ACPI
          AFD
          atapi
          avgio
          avipbb
          Beep
          bowser
          cdrom
          CLFS
          crcdisk
          DfsC
          disk
          Ecache
          FileInfo
          FltMgr
          HTTP
          i8042prt
          irda
          kbdclass
          KSecDD
          lltdio
          luafv
          mouclass
          MountMgr
          MRxDAV
          mrxsmb
          mrxsmb10
          mrxsmb20
          Msfs
          msisadrv
          Mup
          NativeWifiP
          NDIS
          NetBIOS
          netbt
          Npfs
          nsiproxy
          Null
          Parport
          partmgr
          Parvdm
          pci
          PCLEPCI
          pe3ah4nc
          pe3ajbeb
          PEAUTH
          PptpMiniport
          ps6ah4nc
          ps7ajbeb
          PSched
          RasAcd
          rdbss
          RDPCDD
          RDPENCDD
          rspndr
          secdrv
          Serial
          Smb
          spldr
          sptd
          srv
          srv2
          srvnet
          ssmdrv
          Tcpip
          tcpipreg
          tdx
          TermDD
          uagp35
          VgaSave
          viaide
          volmgr
          volmgrx
          volsnap
          Wanarpv6
          Wdf01000

          [b]Drivers - Stopped[/b]:

          adp94xx
          adpahci
          adpu160m
          adpu320
          aic78xx
          aliide
          amdagp
          amdide
          AmdK7
          AmdK8
          arc
          arcsas
          AsyncMac
          avgntflt
          blbdrive
          BrFiltLo
          BrFiltUp
          Brserid
          BrSerWdm
          BrUsbMdm
          BrUsbSer
          BTHMODEM
          catchme
          cdfs
          circlass
          cmdide
          Compbatt
          Crusoe
          drmkaud
          DXGKrnl
          E1G60
          elxstor
          fastfat
          fdc
          FETNDIS
          Filetrace
          flpydisk
          gagp30kx
          HdAudAddService
          HidBth
          HidIr
          HidUsb
          HpCISSs
          i2omp
          iaStorV
          iirsp
          IntcAzAudAddService
          intelide
          intelppm
          IpFilterDriver
          IpInIp
          IPMIDRV
          IPNAT
          IRENUM
          irsir
          isapnp
          iScsiPrt
          iteatapi
          iteraid
          kbdhid
          L8042Kbd
          L8042mou
          LMouKE
          LSI_FC
          LSI_SAS
          LSI_SCSI
          megasas
          Modem
          monitor
          mouhid
          mpio
          mpsdrv
          Mraid35x
          msahci
          msdsm
          MSKSSRV
          MSPCLOCK
          MSPQM
          MsRPC
          MSTEE
          NdisTapi
          Ndisuio
          NdisWan
          NDProxy
          nfrd960
          Ntfs
          ntrigdigi
          nvlddmkm
          nvraid
          nvstor
          nv_agp
          NwlnkFlt
          NwlnkFwd
          ohci1394
          pciide
          pcmcia
          Processor
          ql2300
          ql40xx
          QWAVEdrv
          Rasl2tp
          RasPppoe
          rdpdr
          RDPWD
          RT61
          sbp2port
          Serenum
          sermouse
          sffdisk
          sffp_mmc
          sffp_sd
          sfloppy
          SiSRaid2
          SiSRaid4
          swenum
          Symc8xx
          Sym_hi
          Sym_u3
          Tcpip6
          TDPIPE
          TDTCP
          tssecsrv
          tunmp
          tunnel
          udfs
          uliagpkx
          uliahci
          UlSata
          ulsata2
          umbus
          usbccgp
          usbcir
          usbehci
          usbhub
          usbohci
          usbprint
          usbscan
          USBSTOR
          usbuhci
          vga
          viaagp
          ViaC7
          vsmraid
          W8100PCI
          WacomPen
          Wanarp
          Wd
          winusb
          WmiAcpi
          ws2ifsl
          WUDFRd

          [b]Services - Running[/b]:

          AeLookupSvc
          AudioEndpointBuilder
          Audiosrv
          BFE
          Browser
          CryptSvc
          DcomLaunch
          Dhcp
          Dnscache
          DPS
          EapHost
          EMDMgmt
          Eventlog
          EventSystem
          FDResPub
          gpsvc
          IKEEXT
          iphlpsvc
          Irmon
          KeyIso
          LanmanServer
          LanmanWorkstation
          lmhosts
          MMCSS
          Netman
          netprofm
          NlaSvc
          nsi
          PcaSvc
          PlugPlay
          PnkBstrA
          PolicyAgent
          ProfSvc
          RapiMgr
          RasMan
          RpcSs
          SamSs
          Schedule
          seclogon
          SENS
          ShellHWDetection
          slsvc
          Spooler
          SSDPSRV
          StarWindServiceAE
          stisvc
          SysMain
          TabletInputService
          TapiSrv
          TermService
          Themes
          TrkWks
          upnphost
          usnjsvc
          UxSms
          UxTuneUp
          W32Time
          WcesComm
          WdiSystemHost
          WebClient
          WerSvc
          WinHttpAutoProxySvc
          Winmgmt
          WMPNetworkSvc
          WPDBusEnum
          WSearch
          wudfsvc

          [b]Services - Stopped[/b]:

          ALG
          AntiVirScheduler
          AntiVirService
          Appinfo
          BITS
          CertPropSvc
          clr_optimization_v2.0.50727_32
          COMSysApp
          DFSR
          dot3svc
          fdPHost
          FontCache3.0.0.0
          gusvc
          hidserv
          hkmsvc
          idsvc
          IPBusEnum
          KtmRm
          lltdsvc
          MpsSvc
          MSDTC
          MSiSCSI
          msiserver
          napagent
          Netlogon
          NetTcpPortSharing
          p2pimsvc
          p2psvc
          pla
          PNRPAutoReg
          PNRPsvc
          pr2ah4nc
          pr2ajbeb
          ProtectedStorage
          QWAVE
          RasAuto
          RemoteAccess
          RemoteRegistry
          RpcLocator
          SCardSvr
          SCPolicySvc
          SDRSVC
          SessionEnv
          SharedAccess
          SLUINotify
          SNMPTRAP
          swprv
          TBS
          THREADORDER
          TrustedInstaller
          UI0Detect
          vds
          VSS
          wcncsvc
          WcsPlugInService
          WdiServiceHost
          Wecsvc
          wercplsupport
          WinDefend
          WinRM
          Wlansvc
          WLSetupSvc
          wmiApSrv
          WPCSvc
          wscsvc
          wuauserv

          [b]Files Created/Modified - 60 Days[/b]:

          C:\

          9 Mar 2008 14:14:14 18 724 A.... "C:\ComboFix.txt"
          7 Mar 2008 15:04:02 0 A.... "C:\ntuser.dat"
          7 Mar 2008 15:04:02 0 A..H. "C:\ntuser.dat.LOG1"
          7 Mar 2008 15:04:02 0 A..H. "C:\ntuser.dat.LOG2"
          9 Mar 2008 20:13:04 1 610 612 736 A.SH. "C:\pagefile.sys"

          C:\Windows\

          9 Mar 2008 20:13:10 67 584 A.S.. "C:\Windows\bootstat.dat"
          9 Mar 2008 20:11:54 291 582 A.... "C:\Windows\ntbtlog.txt"
          7 Feb 2008 15:07:10 0 A.... "C:\Windows\OpPrintServer.INI"
          9 Mar 2008 14:11:56 664 A.... "C:\Windows\PFRO.log"
          5 Mar 2008 23:58:14 1 409 A.... "C:\Windows\QTFont.for"
          5 Mar 2008 23:58:14 54 156 A..H. "C:\Windows\QTFont.qfn"
          20 Feb 2008 16:22:16 253 952 ..... "C:\Windows\Setup1.exe"
          20 Feb 2008 16:22:16 74 752 A.... "C:\Windows\ST6UNST.EXE"
          9 Mar 2008 14:12:26 215 A.... "C:\Windows\system.ini"
          21 Feb 2008 18:17:46 90 A.... "C:\Windows\TLCAPPS.INI"
          6 Mar 2008 0:18:36 12 A.... "C:\Windows\Ulead32.ini"
          9 Mar 2008 20:09:42 1 434 886 A.... "C:\Windows\WindowsUpdate.log"
          15 Feb 2008 13:59:44 2 144 256 A.... "C:\Windows\AppPatch\AcGenral.dll"
          15 Feb 2008 13:59:44 537 600 A.... "C:\Windows\AppPatch\AcLayers.dll"
          15 Feb 2008 13:59:44 2 560 A.... "C:\Windows\AppPatch\AcRes.dll"
          15 Feb 2008 13:59:44 449 536 A.... "C:\Windows\AppPatch\AcSpecfc.dll"
          15 Feb 2008 13:59:44 173 056 A.... "C:\Windows\AppPatch\AcXtrnal.dll"
          15 Feb 2008 13:59:44 82 194 A.... "C:\Windows\AppPatch\drvmain.sdb"
          15 Feb 2008 13:56:56 52 736 A.... "C:\Windows\AppPatch\iebrshim.dll"
          15 Feb 2008 13:59:44 1 534 322 A.... "C:\Windows\AppPatch\msimain.sdb"
          15 Feb 2008 13:59:44 22 618 A.... "C:\Windows\AppPatch\pcamain.sdb"
          15 Feb 2008 13:59:44 3 217 016 A.... "C:\Windows\AppPatch\sysmain.sdb"
          15 Feb 2008 13:59:44 2 144 256 A.... "C:\Windows\AppPatch\AcGenral.dll"
          15 Feb 2008 13:59:44 537 600 A.... "C:\Windows\AppPatch\AcLayers.dll"
          15 Feb 2008 13:59:44 2 560 A.... "C:\Windows\AppPatch\AcRes.dll"
          15 Feb 2008 13:59:44 449 536 A.... "C:\Windows\AppPatch\AcSpecfc.dll"
          15 Feb 2008 13:59:44 173 056 A.... "C:\Windows\AppPatch\AcXtrnal.dll"
          15 Feb 2008 13:59:44 82 194 A.... "C:\Windows\AppPatch\drvmain.sdb"
          15 Feb 2008 13:56:56 52 736 A.... "C:\Windows\AppPatch\iebrshim.dll"
          15 Feb 2008 13:59:44 1 534 322 A.... "C:\Windows\AppPatch\msimain.sdb"
          15 Feb 2008 13:59:44 22 618 A.... "C:\Windows\AppPatch\pcamain.sdb"
          15 Feb 2008 13:59:44 3 217 016 A.... "C:\Windows\AppPatch\sysmain.sdb"
          9 Mar 2008 20:13:10 0 A.... "C:\Windows\Debug\PASSWD.LOG"
          18 Jan 2008 12:17:22 507 A.... "C:\Windows\Downloaded Program Files\OSDED4D.OSD"
          8 Mar 2008 23:54:10 110 A.... "C:\Windows\erdnt\CFrecovery.bat"
          15 Feb 2008 14:54:54 665 600 A.... "C:\Windows\inf\drvindex.dat"
          29 Feb 2008 15:41:14 1 682 944 A.... "C:\Windows\inf\INFCACHE.1"
          29 Feb 2008 15:41:14 51 200 A.... "C:\Windows\inf\infpub.dat"
          29 Feb 2008 15:41:14 86 016 A.... "C:\Windows\inf\infstor.dat"
          29 Feb 2008 15:41:14 86 016 A.... "C:\Windows\inf\infstrng.dat"
          15 Feb 2008 14:54:54 65 966 A.... "C:\Windows\inf\keyboard.inf"
          15 Feb 2008 14:54:56 96 528 A.... "C:\Windows\inf\keyboard.PNF"
          15 Feb 2008 14:54:32 47 458 A.... "C:\Windows\inf\mshdc.inf"
          15 Feb 2008 14:54:34 82 344 A.... "C:\Windows\inf\mshdc.PNF"
          15 Feb 2008 14:54:54 56 342 A.... "C:\Windows\inf\msmouse.inf"
          15 Feb 2008 14:54:58 99 376 A.... "C:\Windows\inf\msmouse.PNF"
          9 Jan 2008 23:35:18 1 718 A.... "C:\Windows\inf\oem14.inf"
          9 Jan 2008 23:35:20 8 428 A.... "C:\Windows\inf\oem14.PNF"
          7 Feb 2008 14:58:30 11 568 A.... "C:\Windows\inf\oem15.PNF"
          7 Feb 2008 15:09:28 3 030 A.... "C:\Windows\inf\oem16.inf"
          7 Feb 2008 15:09:28 11 568 A.... "C:\Windows\inf\oem16.PNF"
          29 Feb 2008 15:41:14 35 940 A.... "C:\Windows\inf\oem17.inf"
          29 Feb 2008 15:41:14 25 216 A.... "C:\Windows\inf\oem17.PNF"
          18 Feb 2008 22:12:18 13 408 A.... "C:\Windows\inf\setupapi.ev1"
          18 Feb 2008 22:12:18 24 984 A.... "C:\Windows\inf\setupapi.ev2"
          18 Feb 2008 22:12:18 239 616 A.... "C:\Windows\inf\setupapi.ev3"
          9 Mar 2008 20:13:26 1 437 452 A.... "C:\Windows\inf\setupapi.app.log"
          29 Feb 2008 15:41:14 8 506 647 A.... "C:\Windows\inf\setupapi.dev.log"
          7 Feb 2008 14:58:02 34 156 A.... "C:\Windows\inf\sti.PNF"
          15 Feb 2008 14:59:40 98 088 A.... "C:\Windows\inf\usbport.PNF"
          10 Jan 2008 16:00:04 2 062 A.... "C:\Windows\inf\volume.inf"
          10 Jan 2008 16:00:04 6 260 A.... "C:\Windows\inf\volume.PNF"
          18 Feb 2008 21:18:34 236 404 A.... "C:\Windows\inf\wceusbsh.PNF"
          18 Feb 2008 21:18:34 50 636 A.... "C:\Windows\inf\winmobil.PNF"
          15 Feb 2008 14:57:44 682 072 A.... "C:\Windows\rescache\ResCache.mni"
          15 Feb 2008 14:02:28 18 432 A.... "C:\Windows\servicing\CbsMsg.dll"
          3 Mar 2008 23:42:42 34 304 A.... "C:\Windows\system\smvss.exe"
          9 Mar 2008 20:13:16 3 952 A..H. "C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0"
          9 Mar 2008 20:13:16 3 952 A..H. "C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0"
          9 Mar 2008 20:13:16 3 952 A..H. "C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0"
          15 Feb 2008 13:57:00 124 928 A.... "C:\Windows\System32\advpack.dll"
          15 Feb 2008 14:02:26 12 800 A.... "C:\Windows\System32\batt.dll"
          15 Feb 2008 14:02:28 19 456 A.... "C:\Windows\System32\cfgmgr32.dll"
          15 Feb 2008 14:02:28 224 824 A.... "C:\Windows\System32\clfs.sys"
          6 Mar 2008 0:23:52 2 577 A.... "C:\Windows\System32\config.nt"
          15 Feb 2008 14:02:26 35 328 A.... "C:\Windows\System32\dispci.dll"
          15 Feb 2008 14:02:28 260 096 A.... "C:\Windows\System32\dpx.dll"
          15 Feb 2008 14:02:28 101 888 A.... "C:\Windows\System32\drvinst.exe"
          15 Feb 2008 13:56:56 347 136 A.... "C:\Windows\System32\dxtmsft.dll"
          15 Feb 2008 13:56:56 214 528 A.... "C:\Windows\System32\dxtrans.dll"
          15 Feb 2008 14:02:26 7 168 A.... "C:\Windows\System32\f3ahvoas.dll"
          6 Mar 2008 0:08:48 252 680 A.... "C:\Windows\System32\FNTCACHE.DAT"
          15 Feb 2008 13:59:44 1 686 528 A.... "C:\Windows\System32\gameux.dll"
          15 Feb 2008 13:56:54 63 488 A.... "C:\Windows\System32\icardie.dll"
          15 Feb 2008 13:56:52 70 656 A.... "C:\Windows\System32\ie4uinit.exe"
          15 Feb 2008 13:57:00 383 488 A.... "C:\Windows\System32\ieapfltr.dll"
          15 Feb 2008 13:57:10 6 066 176 A.... "C:\Windows\System32\ieframe.dll"
          15 Feb 2008 13:56:52 44 544 A.... "C:\Windows\System32\iernonce.dll"
          15 Feb 2008 13:56:52 56 320 A.... "C:\Windows\System32\iesetup.dll"
          15 Feb 2008 13:57:10 180 736 A.... "C:\Windows\System32\ieui.dll"
          15 Feb 2008 13:56:52 26 624 A.... "C:\Windows\System32\ieUnatt.exe"
          15 Feb 2008 13:56:54 1 831 424 A.... "C:\Windows\System32\inetcpl.cpl"
          15 Feb 2008 13:57:00 27 648 A.... "C:\Windows\System32\jsproxy.dll"
          15 Feb 2008 14:02:28 6 656 A.... "C:\Windows\System32\kbd106n.dll"
          15 Feb 2008 14:02:26 115 200 A.... "C:\Windows\System32\loadperf.dll"
          15 Feb 2008 14:02:26 39 424 A.... "C:\Windows\System32\lodctr.exe"
          5 Feb 2008 0:09:46 18 214 008 A.... "C:\Windows\System32\mrt.exe"
          15 Feb 2008 13:57:04 3 592 192 A.... "C:\Windows\System32\mshtml.dll"
          15 Feb 2008 13:57:02 1 383 424 A.... "C:\Windows\System32\mshtml.tlb"
          15 Feb 2008 13:57:08 478 208 A.... "C:\Windows\System32\mshtmled.dll"
          15 Feb 2008 13:56:54 671 232 A.... "C:\Windows\System32\mstime.dll"
          15 Feb 2008 14:00:10 24 064 A.... "C:\Windows\System32\netcfg.exe"
          15 Feb 2008 14:00:10 22 016 A.... "C:\Windows\System32\netiougc.exe"
          15 Feb 2008 14:02:26 23 552 A.... "C:\Windows\System32\nshhttp.dll"
          15 Feb 2008 14:00:30 3 504 696 A.... "C:\Windows\System32\ntkrnlpa.exe"
          15 Feb 2008 14:00:30 3 470 392 A.... "C:\Windows\System32\ntoskrnl.exe"
          15 Feb 2008 14:02:28 558 080 A.... "C:\Windows\System32\oleaut32.dll"
          28 Feb 2008 22:31:04 107 416 A.... "C:\Windows\System32\perfc009.dat"
          28 Feb 2008 22:31:04 121 814 A.... "C:\Windows\System32\perfc00C.dat"
          28 Feb 2008 22:31:04 618 272 A.... "C:\Windows\System32\perfh009.dat"
          28 Feb 2008 22:31:04 699 984 A.... "C:\Windows\System32\perfh00C.dat"
          28 Feb 2008 22:31:04 1 538 854 A.... "C:\Windows\System32\PerfStringBackup.INI"
          15 Feb 2008 13:57:00 44 544 A.... "C:\Windows\System32\pngfilt.dll"
          15 Feb 2008 14:02:26 17 408 A.... "C:\Windows\System32\prflbmsg.dll"
          15 Feb 2008 14:02:24 595 456 A.... "C:\Windows\System32\schedsvc.dll"
          15 Feb 2008 14:02:28 1 585 664 A.... "C:\Windows\System32\setupapi.dll"
          15 Feb 2008 14:00:10 167 424 A.... "C:\Windows\System32\tcpipcfg.dll"
          15 Feb 2008 14:02:28 221 696 A.... "C:\Windows\System32\umpnpmgr.dll"
          15 Feb 2008 14:02:26 32 256 A.... "C:\Windows\System32\unlodctr.exe"
          15 Feb 2008 13:57:00 1 159 680 A.... "C:\Windows\System32\urlmon.dll"
          15 Feb 2008 14:03:42 194 560 A.... "C:\Windows\System32\WebClnt.dll"
          15 Feb 2008 13:57:00 824 832 A.... "C:\Windows\System32\wininet.dll"
          15 Feb 2008 14:02:26 943 800 A.... "C:\Windows\System32\winload.exe"
          15 Feb 2008 14:02:28 613 888 A.... "C:\Windows\System32\wpd_ci.dll"
          29 Feb 2008 17:28:50 424 A.... "C:\Windows\Tasks\Maintenance en 1 clic.job"
          9 Mar 2008 20:13:14 6 A..H. "C:\Windows\Tasks\SA.DAT"
          9 Mar 2008 20:09:42 32 594 A.... "C:\Windows\Tasks\SCHEDLGU.TXT"
          8 Mar 2008 23:30:32 434 A..H. "C:\Windows\Tasks\User_Feed_Synchronization-{64AE2160-D476-4FC7-AEB3-367CBBD7AA92}.job"
          9 Mar 2008 18:41:40 11 514 A.... "C:\Windows\TEMP\lpksetup-20080309-184129-0.log"
          9 Mar 2008 18:41:40 622 A.... "C:\Windows\TEMP\lpksetup-20080309-184138-0.log"
          9 Mar 2008 19:18:52 11 514 A.... "C:\Windows\TEMP\lpksetup-20080309-191842-0.log"
          9 Mar 2008 19:18:52 622 A.... "C:\Windows\TEMP\lpksetup-20080309-191851-0.log"
          15 Feb 2008 14:55:06 2 556 A.... "C:\Windows\winsxs\cleanup.xml"
          19 Feb 2008 12:14:54 82 A.... "C:\Windows\winsxs\poqexec.log"
          9 Mar 2008 19:03:42 0 A.... "C:\Windows\Debug\UserMode\ChkAcc.bak"
          9 Mar 2008 20:13:12 0 A.... "C:\Windows\Debug\UserMode\ChkAcc.log"
          7 Feb 2008 15:33:56 5 033 A.... "C:\Windows\Debug\WIA\wiatrace.log"
          9 Mar 2008 18:29:50 290 816 A.... "C:\Windows\erdnt\dss\default"
          9 Mar 2008 18:29:26 220 A.... "C:\Windows\erdnt\dss\README.txt"
          9 Mar 2008 18:29:26 57 344 A.... "C:\Windows\erdnt\dss\sam"
          9 Mar 2008 18:29:42 20 455 424 A.... "C:\Windows\erdnt\dss\software"
          9 Mar 2008 18:29:48 10 735 616 A.... "C:\Windows\erdnt\dss\system"
          8 Mar 2008 23:50:46 10 235 904 A.... "C:\Windows\erdnt\Hiv-backup\COMPON~2"
          8 Mar 2008 23:50:44 118 784 A.... "C:\Windows\erdnt\Hiv-backup\DEFAULT"
          8 Mar 2008 23:50:46 814 A.... "C:\Windows\erdnt\Hiv-backup\ERDNT.CON"
          8 Mar 2008 23:50:46 1 055 A.... "C:\Windows\erdnt\Hiv-backup\ERDNT.INF"
          8 Mar 2008 23:50:44 57 344 A.... "C:\Windows\erdnt\Hiv-backup\SAM"
          8 Mar 2008 23:50:42 24 576 A.... "C:\Windows\erdnt\Hiv-backup\SECURITY"
          8 Mar 2008 23:50:44 20 684 800 A.... "C:\Windows\erdnt\Hiv-backup\SOFTWARE"
          8 Mar 2008 23:50:44 15 876 096 A.... "C:\Windows\erdnt\Hiv-backup\SYSTEM"
          8 Mar 2008 23:54:16 10 235 904 A.... "C:\Windows\erdnt\subs\COMPON~2"
          8 Mar 2008 23:54:14 122 880 A.... "C:\Windows\erdnt\subs\DEFAULT"
          8 Mar 2008 23:54:16 814 A.... "C:\Windows\erdnt\subs\ERDNT.CON"
          8 Mar 2008 23:54:16 546 A.... "C:\Windows\erdnt\subs\ERDNT.INF"
          8 Mar 2008 23:54:14 57 344 A.... "C:\Windows\erdnt\subs\SAM"
          8 Mar 2008 23:54:12 24 576 A.... "C:\Windows\erdnt\subs\SECURITY"
          8 Mar 2008 23:54:14 20 684 800 A.... "C:\Windows\erdnt\subs\SOFTWARE"
          8 Mar 2008 23:54:22 65 536 A.SH. "C:\Windows\erdnt\subs\SOFTWARE{313f5a53-ed5c-11dc-b44e-001966236e64}.TM.blf"
          8 Mar 2008 23:54:22 262 144 A..H. "C:\Windows\erdnt\subs\software.LOG1"
          8 Mar 2008 23:54:22 524 288 A.SH. "C:\Windows\erdnt\subs\SOFTWARE{313f5a53-ed5c-11dc-b44e-001966236e64}.TMContainer00000000000000000001.regtrans-ms"
          8 Mar 2008 23:54:20 0 A..H. "C:\Windows\erdnt\subs\software.LOG2"
          8 Mar 2008 23:54:22 524 288 A.SH. "C:\Windows\erdnt\subs\SOFTWARE{313f5a53-ed5c-11dc-b44e-001966236e64}.TMContainer00000000000000000002.regtrans-ms"
          8 Mar 2008 23:54:14 15 876 096 A.... "C:\Windows\erdnt\subs\SYSTEM"
          8 Mar 2008 23:54:22 65 536 A.SH. "C:\Windows\erdnt\subs\SYSTEM{313f5a4f-ed5c-11dc-b44e-001966236e64}.TM.blf"
          8 Mar 2008 23:54:22 262 144 A..H. "C:\Windows\erdnt\subs\system.LOG1"
          8 Mar 2008 23:54:22 524 288 A.SH. "C:\Windows\erdnt\subs\SYSTEM{313f5a4f-ed5c-11dc-b44e-001966236e64}.TMContainer00000000000000000001.regtrans-ms"
          8 Mar 2008 23:54:20 0 A..H. "C:\Windows\erdnt\subs\system.LOG2"
          8 Mar 2008 23:54:22 524 288 A.SH. "C:\Windows\erdnt\subs\SYSTEM{313f5a4f-ed5c-11dc-b44e-001966236e64}.TMContainer00000000000000000002.regtrans-ms"
          28 Feb 2008 22:29:26 3 766 A.... "C:\Windows\inf\WmiApRpl\WmiApRpl.h"
          9 Mar 2008 20:09:42 19 393 445 A.... "C:\Windows\Logs\CBS\CBS.log"
          15 Feb 2008 14:55:08 55 107 321 A.... "C:\Windows\Logs\CBS\CBS.persist.log"
          18 Feb 2008 21:20:44 12 610 A.... "C:\Windows\Logs\DPX\setupact.log"
          18 Feb 2008 21:20:44 12 610 A.... "C:\Windows\Logs\DPX\setuperr.log"
          27 Feb 2008 15:42:04 23 994 A.... "C:\Windows\Performance\WinSAT\winsat.log"
          15 Feb 2008 14:57:44 775 496 A.... "C:\Windows\rescache\rc0003\Segment0.cmf"
          15 Feb 2008 14:57:44 48 064 A.... "C:\Windows\rescache\rc0003\Segment0.toc"
          15 Feb 2008 14:57:46 845 032 A.... "C:\Windows\rescache\rc0003\Segment1.cmf"
          15 Feb 2008 14:57:46 48 064 A.... "C:\Windows\rescache\rc0003\Segment1.toc"
          15 Feb 2008 14:57:46 1 300 551 A.... "C:\Windows\rescache\rc0003\Segment2.cmf"
          15 Feb 2008 14:57:46 48 064 A.... "C:\Windows\rescache\rc0003\Segment2.toc"
          15 Feb 2008 14:57:46 916 769 A.... "C:\Windows\rescache\rc0003\Segment3.cmf"
          15 Feb 2008 14:57:46 48 064 A.... "C:\Windows\rescache\rc0003\Segment3.toc"
          15 Feb 2008 14:57:46 1 142 717 A.... "C:\Windows\rescache\rc0003\Segment4.cmf"
          15 Feb 2008 14:57:46 48 064 A.... "C:\Windows\rescache\rc0003\Segment4.toc"
          15 Feb 2008 14:57:46 376 632 A.... "C:\Windows\rescache\rc0003\Segment5.cmf"
          15 Feb 2008 14:57:46 48 064 A.... "C:\Windows\rescache\rc0003\Segment5.toc"
          19 Jan 2008 3:36:58 10 964 A.... "C:\Windows\servicing\Packages\Package_for_KB937287_client~31bf3856ad364e35~x86~~6.0.1.18000.cat"
          15 Jan 2008 2:48:30 4 745 A.... "C:\Windows\servicing\Packages\Package_1_for_KB946456~31bf3856ad364e35~x86~~6.0.1.4.mum"
          19 Jan 2008 3:36:58 10 964 A.... "C:\Windows\servicing\Packages\Package_for_KB937287_client_0~31bf3856ad364e35~x86~~6.0.1.18000.cat"
          14 Jan 2008 2:05:46 3 504 A.... "C:\Windows\servicing\Packages\Package_1_for_KB946026~31bf3856ad364e35~x86~~6.0.1.3.mum"
          15 Jan 2008 2:45:06 17 696 A.... "C:\Windows\servicing\Packages\Package_1_for_KB946456~31bf3856ad364e35~x86~~6.0.1.4.cat"
          19 Jan 2008 3:36:38 1 889 A.... "C:\Windows\servicing\Packages\Package_1_for_KB937287~31bf3856ad364e35~x86~~6.0.1.18000.mum"
          30 Jan 2008 19:20:20 2 408 A.... "C:\Windows\servicing\Packages\Package_1_for_KB905866~31bf3856ad364e35~x86~~6.0.16.0.mum"
          19 Jan 2008 21:04:14 7 815 A.... "C:\Windows\servicing\Packages\Package_2_for_KB943899~31bf3856ad364e35~x86~~6.0.2.1.mum"
          14 Jan 2008 2:01:46 14 740 A.... "C:\Windows\servicing\Packages\Package_1_for_KB946026~31bf3856ad364e35~x86~~6.0.1.3.cat"
          30 Jan 2008 19:39:38 1 897 A.... "C:\Windows\servicing\Packages\Package_for_KB943302~31bf3856ad364e35~x86~~6.0.2.1.mum"
          19 Jan 2008 3:36:58 24 195 A.... "C:\Windows\servicing\Packages\Package_1_for_KB937287~31bf3856ad364e35~x86~~6.0.1.18000.cat"
          19 Jan 2008 21:00:20 33 241 A.... "C:\Windows\servicing\Packages\Package_2_for_KB943899~31bf3856ad364e35~x86~~6.0.2.1.cat"
          19 Jan 2008 21:04:14 2 400 A.... "C:\Windows\servicing\Packages\Package_1_for_KB943899~31bf3856ad364e35~x86~~6.0.2.1.mum"
          30 Jan 2008 19:40:42 10 930 A.... "C:\Windows\servicing\Packages\Package_for_KB943302~31bf3856ad364e35~x86~~6.0.2.1.cat"
          19 Jan 2008 21:00:14 12 686 A.... "C:\Windows\servicing\Packages\Package_1_for_KB943899~31bf3856ad364e35~x86~~6.0.2.1.cat"
          19 Jan 2008 21:04:14 2 108 A.... "C:\Windows\servicing\Packages\Package_for_KB943899~31bf3856ad364e35~x86~~6.0.2.1.mum"
          19 Jan 2008 3:36:38 1 565 A.... "C:\Windows\servicing\Packages\Package_for_KB937287~31bf3856ad364e35~x86~~6.0.1.18000.mum"
          19 Jan 2008 21:00:08 10 930 A.... "C:\Windows\servicing\Packages\Package_for_KB943899~31bf3856ad364e35~x86~~6.0.2.1.cat"
          30 Jan 2008 19:16:16 12 686 A.... "C:\Windows\servicing\Packages\Package_1_for_KB905866~31bf3856ad364e35~x86~~6.0.16.0.cat"
          19 Jan 2008 3:36:38 1 556 A.... "C:\Windows\servicing\Packages\Package_for_KB937287_client~31bf3856ad364e35~x86~~6.0.1.18000.mum"
          19 Jan 2008 3:36:38 1 551 A.... "C:\Windows\servicing\Packages\Package_for_KB937287_client_0~31bf3856ad364e35~x86~~6.0.1.18000.mum"
          30 Jan 2008 19:39:38 7 768 A.... "C:\Windows\servicing\Packages\Package_2_for_KB943302~31bf3856ad364e35~x86~~6.0.2.1.mum"
          19 Jan 2008 3:36:58 10 964 A.... "C:\Windows\servicing\Packages\Package_for_KB937287~31bf3856ad364e35~x86~~6.0.1.18000.cat"
          30 Jan 2008 19:39:38 3 764 A.... "C:\Windows\servicing\Packages\Package_1_for_KB943302~31bf3856ad364e35~x86~~6.0.2.1.mum"
          30 Jan 2008 19:40:56 21 450 A.... "C:\Windows\servicing\Packages\Package_2_for_KB943302~31bf3856ad364e35~x86~~6.0.2.1.cat"
          30 Jan 2008 19:40:50 16 182 A.... "C:\Windows\servicing\Packages\Package_1_for_KB943302~31bf3856ad364e35~x86~~6.0.2.1.cat"
          19 Feb 2008 11:37:20 9 153 253 A.... "C:\Windows\System32\CodeIntegrity\bootcat.cache"
          15 Feb 2008 14:00:30 21 560 A.... "C:\Windows\System32\drivers\atapi.sys"
          15 Feb 2008 14:00:30 109 624 A.... "C:\Windows\System32\drivers\ataport.sys"
          15 Feb 2008 14:02:26 54 784 A.... "C:\Windows\System32\drivers\i8042prt.sys"
          15 Feb 2008 14:02:26 35 384 A.... "C:\Windows\System32\drivers\kbdclass.sys"
          15 Feb 2008 14:02:26 34 360 A.... "C:\Windows\System32\drivers\mouclass.sys"
          15 Feb 2008 14:03:42 110 080 A.... "C:\Windows\System32\drivers\mrxdav.sys"
          15 Feb 2008 14:00:10 216 632 A.... "C:\Windows\System32\drivers\netio.sys"
          10 Jan 2008 15:55:34 1 060 920 A.... "C:\Windows\System32\drivers\ntfs.sys"
          15 Feb 2008 14:00:28 154 624 A.... "C:\Windows\System32\drivers\nwifi.sys"
          15 Feb 2008 14:00:30 45 112 A.... "C:\Windows\System32\drivers\pciidex.sys"
          15 Feb 2008 14:02:26 19 968 A.... "C:\Windows\System32\drivers\sermouse.sys"
          15 Feb 2008 14:00:10 803 328 A.... "C:\Windows\System32\drivers\tcpip.sys"
          15 Feb 2008 14:00:30 20 024 A.... "C:\Windows\System32\drivers\viaide.sys"
          10 Jan 2008 15:55:34 211 000 A.... "C:\Windows\System32\drivers\volsnap.sys"
          15 Feb 2008 14:02:26 495 160 A.... "C:\Windows\System32\drivers\Wdf01000.sys"
          15 Feb 2008 14:02:28 35 384 A.... "C:\Windows\System32\drivers\WdfLdr.sys"
          15 Feb 2008 14:00:10 49 152 A.... "C:\Windows\System32\migration\netiomig.dll"
          8 Mar 2008 23:23:06 458 752 A.... "C:\Windows\System32\NDF\eventlog.etl"
          9 Mar 2008 19:05:52 5 479 A.... "C:\Windows\System32\spool\spooler.xml"
          9 Mar 2008 20:13:22 4 096 ..... "C:\Windows\System32\spool\SpoolerETW.etl"
          15 Feb 2008 14:03:06 101 888 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.0.6000.16609_none_75246f2a2fbd4c23_drvinst.exe_6593e92a"
          15 Feb 2008 14:03:06 3 692 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.0.6000.16609_none_75246f2a2fbd4c23_umpnpmgr.mof_112f9e6c"
          15 Feb 2008 14:03:06 39 424 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.0.6000.16609_none_6fa8c14c01b81c8f_lodctr.exe_b02cefba"
          15 Feb 2008 13:58:36 195 203 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ie-htmlactivexcompat_31bf3856ad364e35_6.0.6000.16609_none_1592313b129ab58c.manifest"
          15 Feb 2008 14:03:06 3 726 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.0.6000.16609_fr-fr_173e50dcd9ce3198.manifest"
          15 Feb 2008 14:03:06 53 248 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-setupapi.resources_31bf3856ad364e35_6.0.6000.16609_fr-fr_0b0664296d2c92b1_setupapi.dll.mui_bcc172a4"
          15 Feb 2008 14:03:06 88 936 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ole-automation_31bf3856ad364e35_6.0.6000.16609_none_bb22ee81fe4b8646.manifest"
          15 Feb 2008 14:00:12 22 016 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16627_none_5f90b964923d030a_netiougc.exe_94123cfe"
          15 Feb 2008 14:03:06 30 674 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.0.6000.16609_none_6fa8c14c01b81c8f_perfd.dat_f1e3dfd2"
          15 Feb 2008 14:00:34 3 470 392 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16584_none_69f7a2dcb739c934_ntoskrnl.exe_0fb0ab79"
          15 Feb 2008 14:00:12 167 424 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16627_none_5f90b964923d030a_tcpipcfg.dll_e3a99e8a"
          15 Feb 2008 14:03:06 3 472 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-commonlog_31bf3856ad364e35_6.0.6000.16609_none_7ca55ea12a5d5913_clfs.mof_04dfde60"
          15 Feb 2008 13:58:40 3 592 192 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_6.0.6000.16609_none_1165d69024face3a_mshtml.dll_fab8f891"
          15 Feb 2008 14:00:36 3 504 696 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16584_none_69f7a2dcb739c934_ntkrnlpa.exe_165c312a"
          15 Feb 2008 14:03:06 287 440 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.0.6000.16609_none_6fa8c14c01b81c8f_perfi.dat_e3a35ecf"
          15 Feb 2008 14:00:12 216 632 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-netio-infrastructure_31bf3856ad364e35_6.0.6000.16627_none_54a6905db830dfb1_netio.sys_a06e75d0"
          15 Feb 2008 13:58:42 64 512 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16609_none_000bb771a4a46504_wininetplugin.dll_f2ff35f9"
          15 Feb 2008 13:58:38 6 066 176 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ieframe_31bf3856ad364e35_6.0.6000.16609_none_62c53093b0f05c67_ieframe.dll_c6cbe33f"
          15 Feb 2008 13:58:42 824 832 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16609_none_000bb771a4a46504_wininet.dll_790e2e3a"
          10 Jan 2008 15:55:36 15 275 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.16586_none_a43a6b8d2000830d.manifest"
          15 Feb 2008 14:03:06 17 524 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.0.6000.16609_none_75246f2a2fbd4c23.manifest"
          15 Feb 2008 14:03:06 8 279 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-commonlog_31bf3856ad364e35_6.0.6000.16609_none_7ca55ea12a5d5913.manifest"
          15 Feb 2008 14:03:06 3 685 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.0.6000.16609_none_75246f2a2fbd4c23_drvinst.mof_6593cf80"
          15 Feb 2008 13:58:38 829 928 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ieframe_31bf3856ad364e35_6.0.6000.16609_none_62c53093b0f05c67.manifest"
          15 Feb 2008 14:03:06 3 689 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-setupapi_31bf3856ad364e35_6.0.6000.16609_none_33181da4c90f2d73_setupapi.mof_8d9de59f"
          15 Feb 2008 13:58:42 347 136 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ie-directxtransforms_31bf3856ad364e35_6.0.6000.16609_none_95e9130384756585_dxtmsft.dll_4b67eac6"
          15 Feb 2008 14:03:06 120 320 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.0.6000.16609_none_6fa8c14c01b81c8f_cntrtextmig.dll_08675f2d"
          15 Feb 2008 13:58:38 1 383 424 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_6.0.6000.16609_none_1165d69024face3a_mshtml.tlb_fab8f577"
          15 Feb 2008 14:03:06 287 440 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.0.6000.16609_none_6fa8c14c01b81c8f_perfh.dat_e67d1236"
          15 Feb 2008 13:59:02 124 928 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-advpack_31bf3856ad364e35_6.0.6000.16609_none_a9ee296df5a1e10e_advpack.dll_8c6ea088"
          15 Feb 2008 13:58:44 283 492 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_6.0.6000.16609_none_b305dbcfd99b3e71.manifest"
          10 Jan 2008 15:55:36 1 060 920 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.16586_none_a43a6b8d2000830d_ntfs.sys_e80dca04"
          15 Feb 2008 14:00:12 28 871 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16627_none_5f90b964923d030a.manifest"
          15 Feb 2008 13:58:42 463 701 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ie-directxtransforms_31bf3856ad364e35_6.0.6000.16609_none_95e9130384756585.manifest"
          15 Feb 2008 14:03:06 17 408 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.0.6000.16609_none_6fa8c14c01b81c8f_prflbmsg.dll_2e46e937"
          15 Feb 2008 14:03:06 558 080 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ole-automation_31bf3856ad364e35_6.0.6000.16609_none_bb22ee81fe4b8646_oleaut32.dll_730e3d41"
          15 Feb 2008 13:59:02 7 571 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-advpack_31bf3856ad364e35_6.0.6000.16609_none_a9ee296df5a1e10e.manifest"
          15 Feb 2008 14:03:06 17 408 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.0.6000.16609_fr-fr_173e50dcd9ce3198_winresume.exe.mui_ff8b5358"
          15 Feb 2008 14:00:34 18 778 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16584_none_69f7a2dcb739c934.manifest"
          15 Feb 2008 14:03:06 19 532 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-setupapi_31bf3856ad364e35_6.0.6000.16609_none_33181da4c90f2d73.manifest"
          15 Feb 2008 13:58:36 42 229 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ie-extcompat_31bf3856ad364e35_6.0.6000.16609_none_3ad26ff6d96b5938.manifest"
          15 Feb 2008 14:00:12 3 908 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-netio-infrastructure_31bf3856ad364e35_6.0.6000.16627_none_54a6905db830dfb1.manifest"
          15 Feb 2008 13:58:38 180 736 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ieframe_31bf3856ad364e35_6.0.6000.16609_none_62c53093b0f05c67_ieui.dll_f0fcf806"
          15 Feb 2008 14:03:06 32 256 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.0.6000.16609_none_6fa8c14c01b81c8f_unlodctr.exe_69df45bb"
          15 Feb 2008 14:03:06 943 800 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.0.6000.16609_none_59497e266f783366_winload.exe_75835076"
          15 Feb 2008 14:03:06 115 200 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.0.6000.16609_none_6fa8c14c01b81c8f_loadperf.dll_3a569bab"
          15 Feb 2008 14:03:06 28 672 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.0.6000.16609_fr-fr_173e50dcd9ce3198_winload.exe.mui_3bc5b827"
          15 Feb 2008 14:03:06 123 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-commonlog_31bf3856ad364e35_6.0.6000.16609_none_7ca55ea12a5d5913_clfsuninstall.mof_d0605990"
          15 Feb 2008 14:03:06 224 824 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-commonlog_31bf3856ad364e35_6.0.6000.16609_none_7ca55ea12a5d5913_clfs.sys_04dfdff9"
          15 Feb 2008 13:58:38 928 494 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_6.0.6000.16609_none_1165d69024face3a.manifest"
          15 Feb 2008 13:58:42 27 648 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16609_none_000bb771a4a46504_jsproxy.dll_3cc8d651"
          15 Feb 2008 14:00:12 803 328 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16627_none_5f90b964923d030a_tcpip.sys_3339bd51"
          15 Feb 2008 14:03:06 1 585 664 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-setupapi_31bf3856ad364e35_6.0.6000.16609_none_33181da4c90f2d73_setupapi.dll_8d9de2e7"
          15 Feb 2008 14:03:06 20 589 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.0.6000.16609_none_6fa8c14c01b81c8f.manifest"
          15 Feb 2008 13:58:44 1 159 680 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_6.0.6000.16609_none_b305dbcfd99b3e71_urlmon.dll_95c89473"
          15 Feb 2008 13:58:42 56 602 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16609_none_000bb771a4a46504.manifest"
          15 Feb 2008 14:03:06 30 674 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.0.6000.16609_none_6fa8c14c01b81c8f_perfc.dat_f4bd9339"
          15 Feb 2008 14:03:06 19 456 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.0.6000.16609_none_75246f2a2fbd4c23_cfgmgr32.dll_7bc7e545"
          15 Feb 2008 14:00:12 49 152 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16627_none_5f90b964923d030a_netiomig.dll_917b9a36"
          15 Feb 2008 14:03:06 221 696 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.0.6000.16609_none_75246f2a2fbd4c23_umpnpmgr.dll_112f9bb4"
          15 Feb 2008 13:58:42 214 528 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-ie-directxtransforms_31bf3856ad364e35_6.0.6000.16609_none_95e9130384756585_dxtrans.dll_814d2aee"
          15 Feb 2008 14:03:06 3 034 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-setupapi.resources_31bf3856ad364e35_6.0.6000.16609_fr-fr_0b0664296d2c92b1.manifest"
          15 Feb 2008 14:03:06 5 227 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.0.6000.16609_none_59497e266f783366.manifest"
          15 Feb 2008 14:03:08 905 400 A.... "C:\Windows\winsxs\Backup\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.0.6000.16609_none_59497e266f783366_winresume.exe_85cd1215"
          13 Feb 2008 15:45:40 23 834 A.... "C:\Windows\winsxs\Catalogs\050b2a0163102501b05d9e43ac4c53e538cd93c9907b91c69907b04c365369b4.cat"
          13 Feb 2008 15:45:16 26 186 A.... "C:\Windows\winsxs\Catalogs\0ad6f09f2b2b39e5e7cfc19103cb31b78ead81597edba64691c6a502ae1f996d.cat"
          13 Feb 2008 22:57:06 24 195 A.... "C:\Windows\winsxs\Catalogs\10338debac71ca966896e544f26291a99bf38cc4b87e69c1798037b49a292a3d.cat"
          13 Feb 2008 15:42:18 43 345 A.... "C:\Windows\winsxs\Catalogs\1418952aacdf47d43eff052dd144e84b0acf1e45aa1af266830a59fcd6a881da.cat"
          9 Jan 2008 7:42:44 17 696 A.... "C:\Windows\winsxs\Catalogs\144add7cd07655ed578cb47f1cc1af21a113f3d9e2042b41c53a5b11600f4b46.cat"
          13 Feb 2008 15:44:44 23 834 A.... "C:\Windows\winsxs\Catalogs\19c7a4321d55036bd0f9aa87035a15ad62ec65e1d2d9c17978a81ef9ad0ea40f.cat"
          13 Feb 2008 15:47:50 14 740 A.... "C:\Windows\winsxs\Catalogs\1a3194f88073e6c03595db376a21306107a54b38fed11cf525c81d285871cd2f.cat"
          13 Feb 2008 15:44:56 23 834 A.... "C:\Windows\winsxs\Catalogs\1d6ebd3202f0931663348dc7328a614a25f513295a47a6ad3a50c4d64d4bab0f.cat"
          29 Feb 2008 15:41:18 8 335 A.... "C:\Windows\winsxs\Catalogs\3582cf91bea0e0e7b5f4b8a168a2e4bf248a01f764aa3c5d7c4f352ebc681e9d.cat"
          13 Feb 2008 15:44:46 14 442 A.... "C:\Windows\winsxs\Catalogs\37ae5936ba24fa473a5cbf11576ea349e1104dd54e48677cd2f844436c5633c1.cat"
          13 Feb 2008 15:45:04 23 834 A.... "C:\Windows\winsxs\Catalogs\3c6df958a8804ac9c1ad4af40edf97584f03fd8c1e911630f2ccbd82efea2704.cat"
          13 Feb 2008 15:45:10 23 834 A.... "C:\Windows\winsxs\Catalogs\417ad390502bf43875823bf5f549ab2031ac7531b518a2c50999f9e6b7735ce7.cat"
          13 Feb 2008 15:44:28 14 442 A.... "C:\Windows\winsxs\Catalogs\42820e7ec5f40412f525313282e3275550b72cda5621575a2fa437ad0849bbde.cat"
          13 Feb 2008 15:45:02 23 834 A.... "C:\Windows\winsxs\Catalogs\4548a2d79a4c9b0b9c97427ef50d1dec446548527929bf413532f9b5b0f70b39.cat"
          13 Feb 2008 15:45:54 14 442 A.... "C:\Windows\winsxs\Catalogs\45693e0f2c4ab93267df6ea67e58f33aaee6d12f796be1d26e196d7ba2f419fd.cat"
          13 Feb 2008 15:45:58 14 442 A.... "C:\Windows\winsxs\Catalogs\4600288784bed7de0849a49ca0c3e2569b02a27c1e54f448a61f3ea736f3c442.cat"
          13 Feb 2008 15:45:44 23 834 A.... "C:\Windows\winsxs\Catalogs\5658d911f1157c47dc0eec0603e9cff03918bdbcde0f5d6cee0a501a1c7d60d2.cat"
          13 Feb 2008 15:44:50 26 186 A.... "C:\Windows\winsxs\Catalogs\5a7b34dcbe7ba738719fa5c490ed3c0f863becc4844a8be011b0732be3678c34.cat"
          13 Feb 2008 15:45:20 26 186 A.... "C:\Windows\winsxs\Catalogs\64b20eb1d2e76ffad87d8824e80145679bfc0ef3a93bfcc5c70a688fad06aef0.cat"
          13 Feb 2008 15:42:14 37 850 A.... "C:\Windows\winsxs\Catalogs\6d88c5f3d266b8fa19190a8adae6f1729d1b8d51b9e698e9d358c4551bbce86e.cat"
          13 Feb 2008 15:46:14 23 834 A.... "C:\Windows\winsxs\Catalogs\6eb7ed514cde77a2b0b27813ebb2e1db09baa5c81e84869d5a16681d77cfe733.cat"
          13 Feb 2008 15:44:24 23 834 A.... "C:\Windows\winsxs\Catalogs\6ef00608b280e84f38da471beccf79ecd2613cbcc5b10d869ef11b83445afcfe.cat"
          29 Feb 2008 15:41:22 8 355 A.... "C:\Windows\winsxs\Catalogs\70f19edeeb8e3329aad18f744094ea0319d2ecc78dd6a12559a1e765c42418f7.cat"
          9 Jan 2008 7:44:08 12 686 A.... "C:\Windows\winsxs\Catalogs\721b79404ce8eb73db117e5cbed562cb30a2d670af42bb601de55e6c5de56807.cat"
          13 Feb 2008 15:44:40 26 186 A.... "C:\Windows\winsxs\Catalogs\7329a042cd17487bca411bd79b935eff81009162f092c3775e1c4a995eb24837.cat"
          13 Feb 2008 15:45:48 23 834 A.... "C:\Windows\winsxs\Catalogs\74c0aef9ec661126070eb1e01c25a94f7477f36dd92f4fde5f53fa4fbf8087c6.cat"
          13 Feb 2008 15:43:52 12 686 A.... "C:\Windows\winsxs\Catalogs\78ecd2524726f1a0c1e523bc98da9f8a18869029da0d1358c503666105e376ca.cat"
          9 Jan 2008 8:57:08 13 282 A.... "C:\Windows\winsxs\Catalogs\7b1489f0e63de7c78cf25db1961cc7ac18ba2145b4859f7b9c9f827689a57021.cat"
          13 Feb 2008 15:46:02 23 834 A.... "C:\Windows\winsxs\Catalogs\7c34856c5ef792d12929068d0871b07a0451fbe6d33b6dbca3d9e90b71c37db9.cat"
          13 Feb 2008 15:43:38 12 686 A.... "C:\Windows\winsxs\Catalogs\8272c03d107e462deb7a0bed70335833781b7e27bc6bbd24470701f9e4facde2.cat"
          13 Feb 2008 15:43:42 33 241 A.... "C:\Windows\winsxs\Catalogs\8370ceeeb1349c4051a13b0a8753199ed1063b831be02bc998a7b5f966a35489.cat"
          13 Feb 2008 15:44:18 72 898 A.... "C:\Windows\winsxs\Catalogs\8c45ae5136ba70d66ebd5d754502ba5aad0011368f20c209d5c4b7a661be76f6.cat"
          13 Feb 2008 15:45:36 26 186 A.... "C:\Windows\winsxs\Catalogs\9af3bcd7926ed3769be7ca1c9c967f346042206de363e8cec87759471fc2e059.cat"
          13 Feb 2008 15:42:22 135 621 A.... "C:\Windows\winsxs\Catalogs\9d67ac47c38b8b86cf4684bbbeefd4c02a2becb4bf536c9d5567eab3c4e45ee0.cat"
          13 Feb 2008 15:44:32 23 834 A.... "C:\Windows\winsxs\Catalogs\a22903d5ce47e64f53d64ca264f0fe9bdc3d309bc27878173df6509a55d87729.cat"
          13 Feb 2008 15:43:08 19 793 A.... "C:\Windows\winsxs\Catalogs\a3ddc45e866caf08b16911853771af9f2be815846bc1188b56bfe7d8800a6f46.cat"
          13 Feb 2008 15:43:32 17 696 A.... "C:\Windows\winsxs\Catalogs\a67bee86f4ddd7b5d823b4e3bdc802cc51e9ac59d1a9702c462926470bd9affe.cat"
          13 Feb 2008 15:44:20 13 282 A.... "C:\Windows\winsxs\Catalogs\aa7aebb6803806c5595bd9dfe773adbcb09a7478108e82c6364cce00c671fa85.cat"
          13 Feb 2008 15:44:18 13 282 A.... "C:\Windows\winsxs\Catalogs\aa98d2ed5f12ce319929af0c609bdd90da0afadb196555adeaf3b5ccd90e7a16.cat"
          13 Feb 2008 15:45:30 23 834 A.... "C:\Windows\winsxs\Catalogs\af48385c27977533539131f64eebfac116ddf3837fd1af1799c0bb1c77416716.cat"
          13 Feb 2008 15:45:50 14 442 A.... "C:\Windows\winsxs\Catalogs\b049af84ba1425fc9b9ef81afa8f496db0b39af2cd3784fe4d9175eb872a3bd2.cat"
          13 Feb 2008 15:44:26 20 322 A.... "C:\Windows\winsxs\Catalogs\b6f4dc620eb230c19e41e48651d27e52ce429a0cb349a5f5cad42c8918e2f783.cat"
          13 Feb 2008 15:45:54 23 834 A.... "C:\Windows\winsxs\Catalogs\b7e9df7d9dc37f7ce4badbb1a6f553e03dac91ba167cd6e71ddbbb4214e25ec1.cat"
          13 Feb 2008 15:43:14 16 182 A.... "C:\Windows\winsxs\Catalogs\b9512f562dea4141303c7b5a6839b26be7af70cee01f22eccf3b3bc96075e5a9.cat"
          13 Feb 2008 15:44:06 23 834 A.... "C:\Windows\winsxs\Catalogs\bb9dda7c7260df71c58f5fec039df5ff56ca2f8ba4e8528bdcd933fd6908c8f7.cat"
          9 Jan 2008 8:57:10 14 458 A.... "C:\Windows\winsxs\Catalogs\be4dc3a2321d774ec966b8e917ee8a4a95088fce80b9c9bc7e017de5dce37905.cat"
          13 Feb 2008 15:46:18 23 834 A.... "C:\Windows\winsxs\Catalogs\be62bbebe6895b3b4a10caa29a66b4ac1f2ff18b34578a0735de6107bfe57bef.cat"
          13 Feb 2008 15:45:56 14 442 A.... "C:\Windows\winsxs\Catalogs\beeec77608220868bda528bf899948046b3b922ffded14465988afcd1c3db193.cat"
          9 Jan 2008 7:31:58 24 378 A.... "C:\Windows\winsxs\Catalogs\bf34311b425c99bd6e567b7c5a8324409809ceca64a6a1d9bb68ffb696267248.cat"
          13 Feb 2008 15:44:36 23 834 A.... "C:\Windows\winsxs\Catalogs\cd1c81d8d2b9a09313dec1f96bad03f3c0446b80bc3cefe68b80b9ff92b4a6c1.cat"
          13 Feb 2008 15:44:52 14 442 A.... "C:\Windows\winsxs\Catalogs\d137bdccc0a688379a7fadf76fd5f8945454e1b2ec7cd5efe20b5f2cc2538d65.cat"
          13 Feb 2008 15:43:18 21 450 A.... "C:\Windows\winsxs\Catalogs\d2826c9bef8a60d97fbc60ec225f6a331abcc9015baa15c33dbc463d7b932585.cat"
          9 Jan 2008 8:57:08 12 090 A.... "C:\Windows\winsxs\Catalogs\db322104f6c64f6a821eaf7110abbbb5743736121ec99f17f0de297433a31e57.cat"
          13 Feb 2008 15:46:08 23 834 A.... "C:\Windows\winsxs\Catalogs\dc9f831dbef1aa69e0d852ff6968383bc9f93a79a37f78f5b51d7180fe80a255.cat"
          13 Feb 2008 15:45:26 14 442 A.... "C:\Windows\winsxs\Catalogs\e322773900b5ffb47a594c2d040319ad91ed21f9a2e99155d5a3e8f0288d525f.cat"
          13 Feb 2008 15:45:24 14 442 A.... "C:\Windows\winsxs\Catalogs\ec2e1f4cf320b916e9c2f8fd0a93e216815f9a8f1160d9f2e2ff48f7d1a51bd1.cat"
          18 Feb 2008 21:20:36 14 581 A.... "C:\Windows\winsxs\Catalogs\eca6a1dc64d59c8392cda9277c57fbe9b8fea5d3064fdbf421084752cddfe61c.cat"
          13 Feb 2008 15:46:10 14 442 A.... "C:\Windows\winsxs\Catalogs\f235f9917f5f5e390695388f3fe6eaefd57ff66be6d15f9dbded5420abffada5.cat"
          13 Feb 2008 15:45:24 23 834 A.... "C:\Windows\winsxs\Catalogs\f2703bd4476843033e9c5e86d1a16bc0490a60ac6d8c4cd775cea1a2f7658a02.cat"
          13 Feb 2008 15:45:06 14 442 A.... "C:\Windows\winsxs\Catalogs\ff85065990d8f9f0c6e7c21f66cf710d21290f0d872754c1c805fae5ab687be7.cat"
          13 Feb 2008 15:46:04 14 442 A.... "C:\Windows\winsxs\Catalogs\ffd3b8c1b322e41065c4049efd21125369dad80be8d6c03e707f02f1f5bd8f8a.cat"
          18 Feb 2008 20:25:22 692 A.... "C:\Windows\winsxs\FileMaps\$$_servicing_version_6.0.6001.18000_ace7738cfc7e50ca.cdf-ms"
          18 Feb 2008 20:25:22 1 344 A.... "C:\Windows\winsxs\FileMaps\$$_servicing_fc2045b9046cc796.cdf-ms"
          15 Feb 2008 14:03:08 1 040 A.... "C:\Windows\winsxs\FileMaps\$$_servicing_fr-fr_626f794e6d096759.cdf-ms"
          19 Feb 2008 11:31:54 856 A.... "C:\Windows\winsxs\FileMaps\_0000000000000000.cdf-ms"
          10 Jan 2008 15:55:24 1 048 A.... "C:\Windows\winsxs\FileMaps\program_files_windows_sidebar_fr-fr_467f8d09f4362fe5.cdf-ms"
          15 Feb 2008 13:59:04 2 280 A.... "C:\Windows\winsxs\FileMaps\program_files_internet_explorer_a421d1bfaf856e2b.cdf-ms"
          15 Feb 2008 13:59:50 3 080 A.... "C:\Windows\winsxs\FileMaps\$$_apppatch_1143992cbbbebcab.cdf-ms"
          15 Feb 2008 13:59:04 680 A.... "C:\Windows\winsxs\FileMaps\program_files_ffd0cbfc813cc4f1.cdf-ms"
          15 Feb 2008 14:03:08 6 072 A.... "C:\Windows\winsxs\FileMaps\$$_system32_migration_927a21df1acd7c18.cdf-ms"
          19 Feb 2008 11:31:54 3 564 A.... "C:\Windows\winsxs\FileMaps\$$.cdf-ms"
          15 Feb 2008 14:03:46 23 520 A.... "C:\Windows\winsxs\FileMaps\$$_system32_drivers_dc1b782427b5ee1b.cdf-ms"
          15 Feb 2008 14:03:08 14 984 A.... "C:\Windows\winsxs\FileMaps\$$_system32_drivers_fr-fr_4d9f89205bdfbc76.cdf-ms"
          19 Feb 2008 11:31:54 385 968 A.... "C:\Windows\winsxs\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms"
          15 Feb 2008 14:03:08 67 356 A.... "C:\Windows\winsxs\FileMaps\$$_system32_driverstore_fr-fr_f89b2012d73af418.cdf-ms"
          10 Jan 2008 15:56:48 2 264 A.... "C:\Windows\winsxs\FileMaps\program_files_windows_mail_e07902f329fe05e9.cdf-ms"
          10 Jan 2008 15:55:24 1 236 A.... "C:\Windows\winsxs\FileMaps\program_files_windows_sidebar_8d6dbc4becba56da.cdf-ms"
          15 Feb 2008 14:03:08 217 608 A.... "C:\Windows\winsxs\FileMaps\$$_system32_fr-fr_448347788202c03b.cdf-ms"
          10 Jan 2008 15:55:24 700 A.... "C:\Windows\winsxs\FileMaps\program_files_windows_sidebar_shared_gadgets_5e8909726fa64128.cdf-ms"
          13 Feb 2008 15:44:30 714 A.... "C:\Windows\winsxs\Manifests\x86_eb4ae9c87b1ad98dd78232703b1286b6_31bf3856ad364e35_6.0.6000.20734_none_35edac12437778fd.manifest"
          13 Feb 2008 15:45:48 2 674 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-s..stack-msg.resources_31bf3856ad364e35_6.0.6000.16609_pt-pt_62e65870024822b4.manifest"
          13 Feb 2008 15:46:06 6 228 A.... "C:\Windows\winsxs\Manifests\x86_msmouse.inf.resources_31bf3856ad364e35_6.0.6000.20734_tr-tr_5e1ff0dce90d8663.manifest"
          13 Feb 2008 15:44:12 19 532 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-setupapi_31bf3856ad364e35_6.0.6000.20734_none_337c4939e249a25d.manifest"
          13 Feb 2008 15:44:28 6 228 A.... "C:\Windows\winsxs\Manifests\x86_msmouse.inf.resources_31bf3856ad364e35_6.0.6000.20734_cs-cz_8ca05910cb292212.manifest"
          13 Feb 2008 15:44:46 2 093 A.... "C:\Windows\winsxs\Manifests\x86_usbport.inf.resources_31bf3856ad364e35_6.0.6000.20734_es-es_ec5f1016c309b7eb.manifest"
          13 Feb 2008 15:45:24 5 214 A.... "C:\Windows\winsxs\Manifests\x86_keyboard.inf.resources_31bf3856ad364e35_6.0.6000.16609_ko-kr_ff05ba691ee64e3c.manifest"
          13 Feb 2008 15:45:54 5 214 A.... "C:\Windows\winsxs\Manifests\x86_keyboard.inf.resources_31bf3856ad364e35_6.0.6000.20734_ru-ru_7650d8c6d96ef857.manifest"
          13 Feb 2008 22:57:06 45 290 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.0.6001.18000_none_095f6148c74a7a64.manifest"
          13 Feb 2008 15:46:08 5 214 A.... "C:\Windows\winsxs\Manifests\x86_keyboard.inf.resources_31bf3856ad364e35_6.0.6000.16609_tr-tr_baf4e1eda6198fb9.manifest"
          9 Jan 2008 7:31:58 15 275 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6000.20709_none_a51d8a7c38da8c7b.manifest"
          9 Jan 2008 7:44:08 704 A.... "C:\Windows\winsxs\Manifests\x86_81ff4cce838295fdc2c6e0709ba7424d_31bf3856ad364e35_6.0.6000.16618_none_7c532a1d75fff021.manifest"
          13 Feb 2008 15:44:52 3 034 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-setupapi.resources_31bf3856ad364e35_6.0.6000.16609_et-ee_620eb9ba7e6058de.manifest"
          13 Feb 2008 15:44:14 3 636 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-i..rd-japanese_106_key_31bf3856ad364e35_6.0.6000.20734_none_db8e59fc2fa737ae.manifest"
          13 Feb 2008 15:45:20 650 A.... "C:\Windows\winsxs\Manifests\x86_3813705a22550aab3e2721edbdc81963_31bf3856ad364e35_6.0.6000.16609_none_4c1a85b7425221ce.manifest"
          29 Feb 2008 15:41:18 1 869 ..... "C:\Windows\winsxs\Manifests\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.163_none_10b3ea459bfee365.manifest"
          13 Feb 2008 15:46:08 714 A.... "C:\Windows\winsxs\Manifests\x86_1b624da69682b16adf01703ab211a886_31bf3856ad364e35_6.0.6000.20734_none_205519f5f7bc54af.manifest"
          13 Feb 2008 15:46:06 2 093 A.... "C:\Windows\winsxs\Manifests\x86_usbport.inf.resources_31bf3856ad364e35_6.0.6000.16609_tr-tr_7a58d40de092594f.manifest"
          13 Feb 2008 15:44:48 3 034 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-setupapi.resources_31bf3856ad364e35_6.0.6000.20734_es-es_68b319bf9394f139.manifest"
          13 Feb 2008 15:45:02 2 093 A.... "C:\Windows\winsxs\Manifests\x86_usbport.inf.resources_31bf3856ad364e35_6.0.6000.20734_he-il_d3362db79c4acf3b.manifest"
          13 Feb 2008 15:45:34 3 726 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.0.6000.16609_nl-nl_2dc76f586fdd2598.manifest"
          13 Feb 2008 15:45:52 2 674 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-s..stack-msg.resources_31bf3856ad364e35_6.0.6000.20734_ru-ru_a9ed95c9006425ca.manifest"
          13 Feb 2008 15:42:10 195 203 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-ie-htmlactivexcompat_31bf3856ad364e35_6.0.6000.20734_none_15f65cd02bd52a76.manifest"
          13 Feb 2008 15:44:46 2 674 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-s..stack-msg.resources_31bf3856ad364e35_6.0.6000.16609_en-us_6068527f9624b539.manifest"
          13 Feb 2008 15:42:06 10 829 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-ieinstal_31bf3856ad364e35_6.0.6000.16609_none_e6be9d129473b09f.manifest"
          13 Feb 2008 15:44:30 3 034 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-setupapi.resources_31bf3856ad364e35_6.0.6000.16609_cs-cz_252d45ea93392e4c.manifest"
          13 Feb 2008 15:46:08 650 A.... "C:\Windows\winsxs\Manifests\x86_5d2852a42436cbe65843df801ed75193_31bf3856ad364e35_6.0.6000.20734_none_71ca92fae3a198a0.manifest"
          13 Feb 2008 15:45:04 2 674 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-s..stack-msg.resources_31bf3856ad364e35_6.0.6000.16609_he-il_470acd046f8cbe2e.manifest"
          13 Feb 2008 15:46:02 650 A.... "C:\Windows\winsxs\Manifests\x86_bdddb21009ff67bc814a07297e6eea73_31bf3856ad364e35_6.0.6000.16609_none_f7c063b3737d6542.manifest"
          13 Feb 2008 15:42:10 195 203 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-ie-htmlactivexcompat_31bf3856ad364e35_6.0.6000.16609_none_1592313b129ab58c.manifest"
          13 Feb 2008 15:44:20 3 726 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.0.6000.16609_fr-fr_173e50dcd9ce3198.manifest"
          13 Feb 2008 15:45:26 3 034 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-setupapi.resources_31bf3856ad364e35_6.0.6000.16609_lv-lv_df5650b71b905dad.manifest"
          13 Feb 2008 15:46:02 2 674 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-s..stack-msg.resources_31bf3856ad364e35_6.0.6000.20734_sv-se_45e8803df78d3025.manifest"
          13 Feb 2008 15:46:18 2 674 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-s..stack-msg.resources_31bf3856ad364e35_6.0.6000.16609_zh-tw_c3eafa437ab76bbb.manifest"
          13 Feb 2008 15:46:08 2 674 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-s..stack-msg.resources_31bf3856ad364e35_6.0.6000.16609_tr-tr_ee919eefcd0ebd2c.manifest"
          13 Feb 2008 15:46:12 3 034 A.... "C:\Windows\winsxs\Manifests\x86_microsoft-windows-setupapi.resources_31bf3856ad364e35_6.0.6000.20734_zh-cn_c86e27497a8fd9a6.manifest"
          13 Feb 2008 15:45:10 704 A.... "C:\Windows\winsxs\Manifests\x86_baa9e14d372fa449bee22e15716ac6eb_31bf3856ad364e35_6.0.6000.16609_none_8ee0ce1a902874b8.manifest"
          13 Feb 2008 15:45:44 2 093 A.... "C:\Windows\winsxs\Manifests\x86_usbport.inf.resources_31bf3856ad364e35_6.0.6000.16609_pt-pt_eead8d8e15cbbed7.manifest"
          13 Feb 2008 15:45:30 5 214 A.... "C:\Windows\winsxs\Manifests\x86_keyboard.inf.resources_31bf3856ad364e35_6.0.6000.16609_nb-no_e7983b9df70b79f8.manifest"
          13 Feb 2008 15:45:32 2 093 A.... "C:\Windows\winsxs\Manifests\x86_usbport.inf.
      6. green day Modérateur
        re

        le rapport se situe ici : C:\infoSat.txt

        ++
        1. alain8693
          je suis vraiment desole je viens de recherche; de refaire un scan je ne trouve rien sur mon disque dur alors quela premiere fois que j'avais fait le scan le dossier y etait
          quand je lance ekplorer sur elibagla tout de suite un message aceso denegado a la carpeta c:\srecycle. bin s'affiche ilme semble que ca ne le faisait pas a mon premier scan j'ai supprimer le programme et l'ai retelecharger mais c'est toujours pareil
      7. green day Modérateur
        ça c'est vraiment curieux ?!

        est-ce qu'il trouve quelque chose pendant le scan ??

        ++
        1. alain8693
          oui 31 fichiers infectes dugenre 67859 exe.vir bagle
      8. green day Modérateur
        est-ce qu'ils ont été supprimé ??

        peux tu me faire une copie d'écran stp !

        ++
        1. alain8693
          comment fait on une copie d'ecran
      9. green day Modérateur
        comme ceci ;-)

        ==> http://www.commentcamarche.net/faq/sujet 398 capture d ecran copie d ecran

        ++
        1. alain8693
          http://img507.imageshack.us/img507/7599/sanstitregi4.jpg
          j'espere que ca a marche
        2. alain8693
          http://img527.imageshack.us/img527/4563/79958704dd7.jpg
          celle la est mieu mille excuse
      10. green day Modérateur
        Salut

        pas d'soucis ! ils semblent avoir été supprimés !

        Télécharge Gmer sur ce lien : http://www2.gmer.net/gmer.zip

        Déconnecte toi d'internet si possible et ferme tous les programmes.
        Décompresse le fichier zip et double-clic sur gmer.exe
        IMPORTANT Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.
        Clic sur l'onglet "rootkit"
        A droite, coche "Files" et "Services"
        Clic sur Scan
        Lorsque le scan est terminé, clique sur "copy"

        Ouvre le bloc-note et clique sur le Menu Edition / Coller
        Le rapport doit alors apparaître.
        Enregistre le fichier sur ton bureau et poste le rapport dans ta prochaine réponse

        @+
        1. alain8693
          voila le rapport

          Rootkit scan 2008-03-10 15:22:16
          Windows 6.0.6000

          ---- Services - GMER 1.0.14 ----

          Service .NET CLR Data
          Service .NET CLR Networking
          Service .NET Data Provider for Oracle
          Service .NET Data Provider for SqlServer
          Service .NETFramework
          Service C:\Windows\system32\drivers\acpi.sys [BOOT] ACPI
          Service C:\Windows\system32\drivers\adp94xx.sys [DISABLED] adp94xx
          Service C:\Windows\system32\drivers\adpahci.sys [DISABLED] adpahci
          Service C:\Windows\system32\drivers\adpu160m.sys [DISABLED] adpu160m
          Service C:\Windows\system32\drivers\adpu320.sys [DISABLED] adpu320
          Service adsi
          Service C:\Windows\system32\svchost.exe [AUTO] AeLookupSvc
          Service C:\Windows\system32\drivers\afd.sys [SYSTEM] AFD
          Service C:\Windows\system32\drivers\djsvs.sys [DISABLED] aic78xx
          Service C:\Windows\System32\alg.exe [MANUAL] ALG
          Service C:\Windows\system32\drivers\aliide.sys [DISABLED] aliide
          Service C:\Windows\system32\drivers\amdagp.sys [MANUAL] amdagp
          Service C:\Windows\system32\drivers\amdide.sys [DISABLED] amdide
          Service C:\Windows\system32\drivers\amdk7.sys [DISABLED] AmdK7
          Service C:\Windows\system32\drivers\amdk8.sys [DISABLED] AmdK8
          Service C:\Program Files\AntiVir PersonalEdition Classic\sched.exe [AUTO] AntiVirScheduler
          Service C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe [AUTO] AntiVirService
          Service C:\Windows\system32\svchost.exe [MANUAL] Appinfo
          Service C:\Windows\system32\svchost.exe AppMgmt
          Service C:\Windows\system32\drivers\arc.sys [DISABLED] arc
          Service C:\Windows\system32\drivers\arcsas.sys [DISABLED] arcsas
          Service ASP.NET_1.1.4322
          Service C:\Windows\system32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac
          Service C:\Windows\system32\drivers\atapi.sys [BOOT] atapi
          Service C:\Windows\System32\svchost.exe [AUTO] AudioEndpointBuilder
          Service C:\Windows\System32\svchost.exe [AUTO] Audiosrv
          Service C:\??\C:\Program Files\AntiVir PersonalEdition Classic\avgio.sys [SYSTEM] avgio
          Service C:\??\C:\Program Files\AntiVir PersonalEdition Classic\avgntflt.sys [MANUAL] avgntflt
          Service C:\Windows\system32\DRIVERS\avipbb.sys [SYSTEM] avipbb
          Service BattC
          Service [SYSTEM] Beep
          Service C:\Windows\system32\svchost.exe [AUTO] BFE
          Service C:\Windows\System32\svchost.exe [AUTO] BITS
          Service system32\drivers\blbdrive.sys [DISABLED] blbdrive
          Service C:\Windows\system32\DRIVERS\bowser.sys [MANUAL] bowser
          Service C:\Windows\system32\drivers\brfiltlo.sys [MANUAL] BrFiltLo
          Service C:\Windows\system32\drivers\brfiltup.sys [MANUAL] BrFiltUp
          Service C:\Windows\system32\svchost.exe [AUTO] Browser
          Service C:\Windows\system32\drivers\brserid.sys [DISABLED] Brserid
          Service C:\Windows\system32\drivers\brserwdm.sys [DISABLED] BrSerWdm
          Service C:\Windows\system32\drivers\brusbmdm.sys [DISABLED] BrUsbMdm
          Service C:\Windows\system32\drivers\brusbser.sys [MANUAL] BrUsbSer
          Service C:\Windows\system32\drivers\bthmodem.sys [DISABLED] BTHMODEM
          Service C:\Users\PHILIP~1\AppData\Local\Temp\catchme.sys [MANUAL] catchme
          Service C:\Windows\system32\DRIVERS\cdfs.sys [DISABLED] cdfs
          Service C:\Windows\system32\DRIVERS\cdrom.sys [SYSTEM] cdrom
          Service C:\Windows\system32\svchost.exe [MANUAL] CertPropSvc
          Service C:\Windows\system32\drivers\circlass.sys [DISABLED] circlass
          Service C:\Windows\System32\CLFS.sys [BOOT] CLFS
          Service C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [MANUAL] clr_optimization_v2.0.50727_32
          Service C:\Windows\system32\drivers\cmdide.sys [DISABLED] cmdide
          Service C:\Windows\system32\drivers\compbatt.sys [DISABLED] Compbatt
          Service C:\Windows\system32\dllhost.exe [MANUAL] COMSysApp
          Service C:\Windows\system32\drivers\crcdisk.sys [BOOT] crcdisk
          Service C:\Windows\system32\drivers\crusoe.sys [DISABLED] Crusoe
          Service crypt32
          Service C:\Windows\system32\svchost.exe [AUTO] CryptSvc
          Service DCLocator
          Service C:\Windows\system32\svchost.exe [AUTO] DcomLaunch
          Service C:\Windows\System32\Drivers\dfsc.sys [SYSTEM] DfsC
          Service C:\Windows\system32\DFSR.exe [MANUAL] DFSR
          Service C:\Windows\system32\svchost.exe [AUTO] Dhcp
          Service C:\Windows\system32\drivers\disk.sys [BOOT] disk
          Service C:\Windows\system32\svchost.exe [AUTO] Dnscache
          Service C:\Windows\system32\svchost.exe [MANUAL] dot3svc
          Service C:\Windows\System32\svchost.exe [AUTO] DPS
          Service C:\Windows\system32\drivers\drmkaud.sys [MANUAL] drmkaud
          Service C:\Windows\System32\drivers\dxgkrnl.sys [MANUAL] DXGKrnl
          Service C:\Windows\system32\DRIVERS\E1G60I32.sys [MANUAL] E1G60
          Service C:\Windows\System32\svchost.exe [MANUAL] EapHost
          Service C:\Windows\System32\drivers\ecache.sys [BOOT] Ecache
          Service C:\Windows\system32\drivers\elxstor.sys [DISABLED] elxstor
          Service EmdCache
          Service C:\Windows\system32\svchost.exe [AUTO] EMDMgmt
          Service ESENT
          Service C:\Windows\System32\svchost.exe [AUTO] Eventlog
          Service C:\Windows\system32\svchost.exe [AUTO] EventSystem
          Service [MANUAL] fastfat
          Service C:\Windows\system32\DRIVERS\fdc.sys [MANUAL] fdc
          Service C:\Windows\system32\svchost.exe [MANUAL] fdPHost
          Service C:\Windows\system32\svchost.exe [AUTO] FDResPub
          Service C:\Windows\system32\DRIVERS\fetnd5.sys [MANUAL] FETNDIS
          Service C:\Windows\system32\drivers\fileinfo.sys [BOOT] FileInfo
          Service C:\Windows\system32\drivers\filetrace.sys [MANUAL] Filetrace
          Service C:\Windows\system32\DRIVERS\flpydisk.sys [DISABLED] flpydisk
          Service C:\Windows\system32\drivers\fltmgr.sys [BOOT] FltMgr
          Service C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [MANUAL] FontCache3.0.0.0
          Service [SYSTEM] Fs_Rec
          Service C:\Windows\system32\drivers\gagp30kx.sys [MANUAL] gagp30kx
          Service C:\Windows\System32\DRIVERS\gmer.sys [MANUAL] gmer
          Service C:\Windows\system32\svchost.exe [AUTO] gpsvc
          Service C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [MANUAL] gusvc
          Service C:\Windows\system32\drivers\HdAudio.sys [MANUAL] HdAudAddService
          Service C:\Windows\system32\DRIVERS\HDAudBus.sys [MANUAL] HDAudBus
          Service C:\Windows\system32\drivers\hidbth.sys [DISABLED] HidBth
          Service C:\Windows\system32\drivers\hidir.sys [DISABLED] HidIr
          Service C:\Windows\system32\svchost.exe [MANUAL] hidserv
          Service C:\Windows\system32\DRIVERS\hidusb.sys [MANUAL] HidUsb
          Service C:\Windows\System32\svchost.exe [MANUAL] hkmsvc
          Service C:\Windows\system32\drivers\hpcisss.sys [DISABLED] HpCISSs
          Service C:\Windows\system32\drivers\HTTP.sys [MANUAL] HTTP
          Service C:\Windows\system32\drivers\i2omp.sys [DISABLED] i2omp
          Service C:\Windows\system32\DRIVERS\i8042prt.sys [SYSTEM] i8042prt
          Service C:\Windows\system32\drivers\iastorv.sys [DISABLED] iaStorV
          Service C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [MANUAL] idsvc
          Service C:\Windows\system32\drivers\iirsp.sys [DISABLED] iirsp
          Service C:\Windows\system32\svchost.exe [AUTO] IKEEXT
          Service inetaccs
          Service C:\Windows\system32\drivers\RTKVHDA.sys [MANUAL] IntcAzAudAddService
          Service C:\Windows\system32\drivers\intelide.sys [DISABLED] intelide
          Service C:\Windows\system32\DRIVERS\intelppm.sys [MANUAL] intelppm
          Service C:\Windows\system32\svchost.exe [MANUAL] IPBusEnum
          Service C:\Windows\system32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver
          Service C:\Windows\System32\svchost.exe [AUTO] iphlpsvc
          Service system32\DRIVERS\ipinip.sys [MANUAL] IpInIp
          Service C:\Windows\system32\drivers\ipmidrv.sys [DISABLED] IPMIDRV
          Service C:\Windows\system32\DRIVERS\ipnat.sys [MANUAL] IPNAT
          Service C:\Windows\system32\DRIVERS\irda.sys [AUTO] irda
          Service C:\Windows\system32\drivers\irenum.sys [MANUAL] IRENUM
          Service C:\Windows\system32\svchost.exe [AUTO] Irmon
          Service C:\Windows\system32\DRIVERS\irsir.sys [MANUAL] irsir
          Service C:\Windows\system32\drivers\isapnp.sys [DISABLED] isapnp
          Service C:\Windows\system32\DRIVERS\msiscsi.sys [MANUAL] iScsiPrt
          Service C:\Windows\system32\drivers\iteatapi.sys [DISABLED] iteatapi
          Service C:\Windows\system32\drivers\iteraid.sys [DISABLED] iteraid
          Service C:\Windows\system32\DRIVERS\kbdclass.sys [SYSTEM] kbdclass
          Service C:\Windows\system32\drivers\kbdhid.sys [DISABLED] kbdhid
          Service C:\Windows\system32\lsass.exe [MANUAL] KeyIso
          Service C:\Windows\System32\Drivers\ksecdd.sys [BOOT] KSecDD
          Service C:\Windows\System32\svchost.exe [AUTO] KtmRm
          Service C:\Windows\system32\DRIVERS\L8042Kbd.sys [MANUAL] L8042Kbd
          Service C:\Windows\system32\DRIVERS\L8042mou.Sys [MANUAL] L8042mou
          Service C:\Windows\system32\svchost.exe [AUTO] LanmanServer
          Service C:\Windows\System32\svchost.exe [AUTO] LanmanWorkstation
          Service ldap
          Service LHidKe
          Service C:\Windows\system32\DRIVERS\lltdio.sys [AUTO] lltdio
          Service C:\Windows\System32\svchost.exe [MANUAL] lltdsvc
          Service C:\Windows\system32\svchost.exe [AUTO] lmhosts
          Service C:\Windows\system32\DRIVERS\LMouKE.Sys [MANUAL] LMouKE
          Service Lsa
          Service C:\Windows\system32\drivers\lsi_fc.sys [DISABLED] LSI_FC
          Service C:\Windows\system32\drivers\lsi_sas.sys [DISABLED] LSI_SAS
          Service C:\Windows\system32\drivers\lsi_scsi.sys [DISABLED] LSI_SCSI
          Service C:\Windows\system32\drivers\luafv.sys [AUTO] luafv
          Service C:\Windows\system32\drivers\megasas.sys [DISABLED] megasas
          Service C:\Windows\system32\svchost.exe [AUTO] MMCSS
          Service C:\Windows\system32\drivers\modem.sys [MANUAL] Modem
          Service C:\Windows\system32\DRIVERS\monitor.sys [MANUAL] monitor
          Service C:\Windows\system32\DRIVERS\mouclass.sys [SYSTEM] mouclass
          Service C:\Windows\system32\drivers\mouhid.sys [DISABLED] mouhid
          Service C:\Windows\System32\drivers\mountmgr.sys [BOOT] MountMgr
          Service C:\Windows\system32\drivers\mpio.sys [DISABLED] mpio
          Service C:\Windows\System32\drivers\mpsdrv.sys [MANUAL] mpsdrv
          Service C:\Windows\system32\svchost.exe [DISABLED] MpsSvc
          Service C:\Windows\system32\drivers\mraid35x.sys [DISABLED] Mraid35x
          Service C:\Windows\system32\drivers\mrxdav.sys [MANUAL] MRxDAV
          Service C:\Windows\system32\DRIVERS\mrxsmb.sys [MANUAL] mrxsmb
          Service C:\Windows\system32\DRIVERS\mrxsmb10.sys [MANUAL] mrxsmb10
          Service C:\Windows\system32\DRIVERS\mrxsmb20.sys [MANUAL] mrxsmb20
          Service C:\Windows\system32\drivers\msahci.sys [DISABLED] msahci
          Service C:\Windows\system32\drivers\msdsm.sys [DISABLED] msdsm
          Service C:\Windows\System32\msdtc.exe [MANUAL] MSDTC
          Service MSDTC Bridge 3.0.0.0
          Service [SYSTEM] Msfs
          Service C:\Windows\system32\drivers\msisadrv.sys [BOOT] msisadrv
          Service C:\Windows\system32\svchost.exe [MANUAL] MSiSCSI
          Service C:\Windows\system32\msiexec.exe [MANUAL] msiserver
          Service C:\Windows\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV
          Service C:\Windows\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK
          Service C:\Windows\system32\drivers\MSPQM.sys [MANUAL] MSPQM
          Service [MANUAL] MsRPC
          Service MSSCNTRS
          Service C:\Windows\system32\DRIVERS\mssmbios.sys [MANUAL] mssmbios
          Service C:\Windows\system32\drivers\MSTEE.sys [MANUAL] MSTEE
          Service C:\Windows\System32\Drivers\mup.sys [BOOT] Mup
          Service C:\Windows\System32\svchost.exe [MANUAL] napagent
          Service C:\Windows\system32\DRIVERS\nwifi.sys [MANUAL] NativeWifiP
          Service C:\Windows\system32\drivers\ndis.sys [BOOT] NDIS
          Service C:\Windows\system32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi
          Service C:\Windows\system32\DRIVERS\ndisuio.sys [DISABLED] Ndisuio
          Service C:\Windows\system32\DRIVERS\ndiswan.sys [MANUAL] NdisWan
          Service [MANUAL] NDProxy
          Service C:\Windows\system32\DRIVERS\netbios.sys [SYSTEM] NetBIOS
          Service C:\Windows\System32\DRIVERS\netbt.sys [SYSTEM] netbt
          Service C:\Windows\system32\lsass.exe [MANUAL] Netlogon
          Service C:\Windows\System32\svchost.exe [MANUAL] Netman
          Service C:\Windows\System32\svchost.exe [AUTO] netprofm
          Service C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [DISABLED] NetTcpPortSharing
          Service C:\Windows\system32\drivers\nfrd960.sys [DISABLED] nfrd960
          Service C:\Windows\System32\svchost.exe [AUTO] NlaSvc
          Service [SYSTEM] Npfs
          Service C:\Windows\system32\svchost.exe [AUTO] nsi
          Service C:\Windows\system32\drivers\nsiproxy.sys [SYSTEM] nsiproxy
          Service NTDS
          Service [MANUAL] Ntfs
          Service C:\Windows\system32\drivers\ntrigdigi.sys [DISABLED] ntrigdigi
          Service [SYSTEM] Null
          Service C:\Windows\system32\DRIVERS\nvlddmkm.sys [MANUAL] nvlddmkm
          Service C:\Windows\system32\drivers\nvraid.sys [DISABLED] nvraid
          Service C:\Windows\system32\drivers\nvstor.sys [DISABLED] nvstor
          Service C:\Windows\system32\drivers\nv_agp.sys [MANUAL] nv_agp
          Service system32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt
          Service system32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd
          Service C:\Windows\system32\drivers\ohci1394.sys [DISABLED] ohci1394
          Service C:\Windows\System32\svchost.exe [MANUAL] p2pimsvc
          Service C:\Windows\System32\svchost.exe [MANUAL] p2psvc
          Service C:\Windows\system32\DRIVERS\parport.sys [MANUAL] Parport
          Service C:\Windows\System32\drivers\partmgr.sys [BOOT] partmgr
          Service C:\Windows\system32\DRIVERS\parvdm.sys [AUTO] Parvdm
          Service C:\Windows\system32\svchost.exe [AUTO] PcaSvc
          Service C:\Windows\system32\drivers\pci.sys [BOOT] pci
          Service C:\Windows\system32\drivers\pciide.sys [DISABLED] pciide
          Service C:\??\C:\Windows\system32\drivers\pclepci.sys [SYSTEM] PCLEPCI
          Service C:\Windows\system32\drivers\pcmcia.sys [DISABLED] pcmcia
          Service C:\Windows\system32\drivers\pe3ah4nc.sys [BOOT] pe3ah4nc
          Service C:\Windows\system32\drivers\pe3ajbeb.sys [BOOT] pe3ajbeb
          Service C:\Windows\system32\drivers\peauth.sys [AUTO] PEAUTH
          Service PerfDisk
          Service PerfNet
          Service PerfOS
          Service PerfProc
          Service C:\Windows\System32\svchost.exe [MANUAL] pla
          Service C:\Windows\system32\svchost.exe [AUTO] PlugPlay
          Service C:\Windows\system32\PnkBstrA.exe [AUTO] PnkBstrA
          Service C:\Windows\System32\svchost.exe [MANUAL] PNRPAutoReg
          Service C:\Windows\System32\svchost.exe [MANUAL] PNRPsvc
          Service C:\Windows\system32\svchost.exe [AUTO] PolicyAgent
          Service PortProxy
          Service C:\Windows\system32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport
          Service C:\Windows\system32\pr2ah4nc.exe [AUTO] pr2ah4nc
          Service C:\Windows\system32\pr2ajbeb.exe [AUTO] pr2ajbeb
          Service C:\Windows\system32\drivers\processr.sys [DISABLED] Processor
          Service C:\Windows\system32\svchost.exe [AUTO] ProfSvc
          Service C:\Windows\system32\lsass.exe [MANUAL] ProtectedStorage
          Service C:\Windows\system32\drivers\ps6ah4nc.sys [BOOT] ps6ah4nc
          Service C:\Windows\system32\drivers\ps7ajbeb.sys [BOOT] ps7ajbeb
          Service C:\Windows\system32\DRIVERS\pacer.sys [SYSTEM] PSched
          Service C:\Windows\system32\drivers\ql2300.sys [DISABLED] ql2300
          Service C:\Windows\system32\drivers\ql40xx.sys [DISABLED] ql40xx
          Service C:\Windows\system32\svchost.exe [MANUAL] QWAVE
          Service C:\Windows\system32\drivers\qwavedrv.sys [MANUAL] QWAVEdrv
          Service C:\Windows\system32\svchost.exe [AUTO] RapiMgr
          Service C:\Windows\System32\DRIVERS\rasacd.sys [SYSTEM] RasAcd
          Service C:\Windows\system32\svchost.exe [MANUAL] RasAuto
          Service C:\Windows\system32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp
          Service C:\Windows\system32\svchost.exe [MANUAL] RasMan
          Service C:\Windows\system32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe
          Service C:\Windows\system32\DRIVERS\rdbss.sys [SYSTEM] rdbss
          Service C:\Windows\System32\DRIVERS\RDPCDD.sys [SYSTEM] RDPCDD
          Service RDPDD
          Service C:\Windows\system32\drivers\rdpdr.sys [DISABLED] rdpdr
          Service C:\Windows\system32\drivers\rdpencdd.sys [SYSTEM] RDPENCDD
          Service RDPNP
          Service [MANUAL] RDPWD
          Service C:\Windows\system32\svchost.exe [DISABLED] RemoteAccess
          Service C:\Windows\system32\svchost.exe [MANUAL] RemoteRegistry
          Service C:\Windows\system32\locator.exe [MANUAL] RpcLocator
          Service C:\Windows\system32\svchost.exe [AUTO] RpcSs
          Service C:\Windows\system32\DRIVERS\rspndr.sys [AUTO] rspndr
          Service C:\Windows\system32\DRIVERS\RT61.sys [MANUAL] RT61
          Service C:\Windows\system32\lsass.exe [AUTO] SamSs
          Service C:\Windows\system32\drivers\sbp2port.sys [DISABLED] sbp2port
          Service C:\Windows\system32\svchost.exe [MANUAL] SCardSvr
          Service C:\Windows\System32\svchost.exe [AUTO] Schedule
          Service C:\Windows\system32\svchost.exe [MANUAL] SCPolicySvc
          Service C:\Windows\system32\svchost.exe [MANUAL] SDRSVC
          Service [AUTO] secdrv
          Service C:\Windows\system32\svchost.exe [AUTO] seclogon
          Service C:\Windows\system32\svchost.exe [AUTO] SENS
          Service C:\Windows\system32\DRIVERS\serenum.sys [MANUAL] Serenum
          Service C:\Windows\system32\DRIVERS\serial.sys [SYSTEM] Serial
          Service C:\Windows\system32\drivers\sermouse.sys [DISABLED] sermouse
          Service ServiceModelEndpoint 3.0.0.0
          Service ServiceModelOperation 3.0.0.0
          Service ServiceModelService 3.0.0.0
          Service C:\Windows\System32\svchost.exe [MANUAL] SessionEnv
          Service C:\Windows\system32\drivers\sffdisk.sys [DISABLED] sffdisk
          Service C:\Windows\system32\drivers\sffp_mmc.sys [MANUAL] sffp_mmc
          Service C:\Windows\system32\drivers\sffp_sd.sys [MANUAL] sffp_sd
          Service C:\Windows\system32\drivers\sfloppy.sys [DISABLED] sfloppy
          Service C:\Windows\System32\svchost.exe [AUTO] SharedAccess
          Service C:\Windows\System32\svchost.exe [AUTO] ShellHWDetection
          Service C:\Windows\system32\drivers\sisraid2.sys [DISABLED] SiSRaid2
          Service C:\Windows\system32\drivers\sisraid4.sys [DISABLED] SiSRaid4
          Service C:\Windows\system32\SLsvc.exe [AUTO] slsvc
          Service C:\Windows\system32\svchost.exe [MANUAL] SLUINotify
          Service C:\Windows\system32\DRIVERS\smb.sys [SYSTEM] Smb
          Service SMSvcHost 3.0.0.0
          Service C:\Windows\System32\snmptrap.exe [MANUAL] SNMPTRAP
          Service [BOOT] spldr
          Service C:\Windows\System32\spoolsv.exe [AUTO] Spooler
          Service C:\Windows\System32\Drivers\sptd.sys [BOOT] sptd
          Service C:\Windows\System32\DRIVERS\srv.sys [MANUAL] srv
          Service C:\Windows\System32\DRIVERS\srv2.sys [MANUAL] srv2
          Service C:\Windows\System32\DRIVERS\srvnet.sys [MANUAL] srvnet
          Service C:\Windows\system32\svchost.exe [MANUAL] SSDPSRV
          Service C:\Windows\system32\DRIVERS\ssmdrv.sys [SYSTEM] ssmdrv
          Service C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe [AUTO] StarWindServiceAE
          Service C:\Windows\system32\svchost.exe [AUTO] stisvc
          Service C:\Windows\system32\DRIVERS\swenum.sys [MANUAL] swenum
          Service C:\Windows\System32\svchost.exe [MANUAL] swprv
          Service C:\Windows\system32\drivers\symc8xx.sys [DISABLED] Symc8xx
          Service C:\Windows\system32\drivers\sym_hi.sys [DISABLED] Sym_hi
          Service C:\Windows\system32\drivers\sym_u3.sys [DISABLED] Sym_u3
          Service C:\Windows\system32\svchost.exe [AUTO] SysMain
          Service C:\Windows\System32\svchost.exe [AUTO] TabletInputService
          Service C:\Windows\System32\svchost.exe [MANUAL] TapiSrv
          Service C:\Windows\System32\svchost.exe [MANUAL] TBS
          Service C:\Windows\System32\drivers\tcpip.sys [SYSTEM] Tcpip
          Service C:\Windows\system32\DRIVERS\tcpip.sys [MANUAL] Tcpip6
          Service C:\Windows\System32\drivers\tcpipreg.sys [AUTO] tcpipreg
          Service C:\Windows\system32\drivers\tdpipe.sys [MANUAL] TDPIPE
          Service C:\Windows\system32\drivers\tdtcp.sys [MANUAL] TDTCP
          Service C:\Windows\system32\DRIVERS\tdx.sys [SYSTEM] tdx
          Service C:\Windows\system32\DRIVERS\termdd.sys [SYSTEM] TermDD
          Service C:\Windows\System32\svchost.exe [AUTO] TermService
          Service C:\Windows\System32\svchost.exe [AUTO] Themes
          Service C:\Windows\system32\svchost.exe [MANUAL] THREADORDER
          Service C:\Windows\System32\svchost.exe [AUTO] TrkWks
          Service C:\Windows\servicing\TrustedInstaller.exe [MANUAL] TrustedInstaller
          Service TSDDD
          Service C:\Windows\System32\DRIVERS\tssecsrv.sys [MANUAL] tssecsrv
          Service C:\Windows\system32\DRIVERS\tunmp.sys [MANUAL] tunmp
          Service C:\Windows\system32\DRIVERS\tunnel.sys [MANUAL] tunnel
          Service C:\Windows\system32\DRIVERS\uagp35.sys [BOOT] uagp35
          Service C:\Windows\system32\DRIVERS\udfs.sys [DISABLED] udfs
          Service UGatherer
          Service UGTHRSVC
          Service C:\Windows\system32\UI0Detect.exe [MANUAL] UI0Detect
          Service C:\Windows\system32\drivers\uliagpkx.sys [MANUAL] uliagpkx
          Service C:\Windows\system32\drivers\uliahci.sys [DISABLED] uliahci
          Service C:\Windows\system32\drivers\ulsata.sys [DISABLED] UlSata
          Service C:\Windows\system32\drivers\ulsata2.sys [DISABLED] ulsata2
          Service C:\Windows\system32\DRIVERS\umbus.sys [MANUAL] umbus
          Service C:\Windows\system32\svchost.exe [AUTO] upnphost
          Service usb
          Service C:\Windows\system32\drivers\usbccgp.sys [DISABLED] usbccgp
          Service C:\Windows\system32\drivers\usbcir.sys [DISABLED] usbcir
          Service C:\Windows\system32\DRIVERS\usbehci.sys [MANUAL] usbehci
          Service C:\Windows\system32\DRIVERS\usbhub.sys [MANUAL] usbhub
          Service C:\Windows\system32\drivers\usbohci.sys [DISABLED] usbohci
          Service C:\Windows\system32\drivers\usbprint.sys [DISABLED] usbprint
          Service C:\Windows\system32\DRIVERS\usbscan.sys [MANUAL] usbscan
          Service C:\Windows\system32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR
          Service C:\Windows\system32\DRIVERS\usbuhci.sys [MANUAL] usbuhci
          Service C:\Program Files\Windows Live\Messenger\usnsvc.exe [MANUAL] usnjsvc
          Service C:\Windows\System32\svchost.exe [AUTO] UxSms
          Service C:\Windows\System32\svchost.exe [AUTO] UxTuneUp
          Service C:\Windows\System32\vds.exe [MANUAL] vds
          Service C:\Windows\system32\DRIVERS\vgapnp.sys [MANUAL] vga
          Service C:\Windows\System32\drivers\vga.sys [SYSTEM] VgaSave
          Service C:\Windows\system32\drivers\viaagp.sys [MANUAL] viaagp
          Service C:\Windows\system32\drivers\viac7.sys [DISABLED] ViaC7
          Service C:\Windows\system32\drivers\viaide.sys [BOOT] viaide
          Service C:\Windows\system32\drivers\volmgr.sys [BOOT] volmgr
          Service C:\Windows\System32\drivers\volmgrx.sys [BOOT] volmgrx
          Service C:\Windows\system32\drivers\volsnap.sys [BOOT] volsnap
          Service C:\Windows\system32\drivers\vsmraid.sys [DISABLED] vsmraid
          Service C:\Windows\system32\vssvc.exe [MANUAL] VSS
          Service C:\Windows\system32\svchost.exe [AUTO] W32Time
          Service W3SVC
          Service C:\Windows\system32\DRIVERS\mrv8k51.sys [MANUAL] W8100PCI
          Service C:\Windows\system32\drivers\wacompen.sys [DISABLED] WacomPen
          Service C:\Windows\system32\DRIVERS\wanarp.sys [MANUAL] Wanarp
          Service C:\Windows\system32\DRIVERS\wanarp.sys [SYSTEM] Wanarpv6
          Service C:\Windows\system32\svchost.exe [AUTO] WcesComm
          Service C:\Windows\System32\svchost.exe [MANUAL] wcncsvc
          Service C:\Windows\system32\svchost.exe [MANUAL] WcsPlugInService
          Service C:\Windows\system32\drivers\wd.sys [DISABLED] Wd
          Service C:\Windows\system32\drivers\Wdf01000.sys [BOOT] Wdf01000
          Service C:\Windows\System32\svchost.exe [MANUAL] WdiServiceHost
          Service C:\Windows\System32\svchost.exe [MANUAL] WdiSystemHost
          Service C:\Windows\system32\svchost.exe [AUTO] WebClient
          Service C:\Windows\system32\svchost.exe [MANUAL] Wecsvc
          Service C:\Windows\System32\svchost.exe [MANUAL] wercplsupport
          Service C:\Windows\System32\svchost.exe [AUTO] WerSvc
          Service C:\Windows\System32\svchost.exe [DISABLED] WinDefend
          Service Windows Workflow Foundation 3.0.0.0
          Service C:\Windows\system32\svchost.exe [MANUAL] WinHttpAutoProxySvc
          Service C:\Windows\system32\svchost.exe [AUTO] Winmgmt
          Service C:\Windows\System32\svchost.exe [MANUAL] WinRM
          Service [MANUAL] Winsock
          Service WinSock2
          Service C:\Windows\system32\DRIVERS\winusb.sys [MANUAL] winusb
          Service C:\Windows\system32\svchost.exe [AUTO] Wlansvc
          Service C:\Program Files\Windows Live\installer\WLSetupSvc.exe [MANUAL] WLSetupSvc
          Service C:\Windows\system32\drivers\wmiacpi.sys [DISABLED] WmiAcpi
          Service WmiApRpl
          Service C:\Windows\system32\wbem\WmiApSrv.exe [MANUAL] wmiApSrv
          Service C:\Program Files\Windows Media Player\wmpnetwk.exe [AUTO] WMPNetworkSvc
          Service C:\Windows\system32\svchost.exe [MANUAL] WPCSvc
          Service C:\Windows\system32\svchost.exe [AUTO] WPDBusEnum
          Service C:\Windows\system32\drivers\ws2ifsl.sys [DISABLED] ws2ifsl
          Service C:\Windows\System32\svchost.exe [AUTO] wscsvc
          Service C:\Windows\system32\SearchIndexer.exe [AUTO] WSearch
          Service WSearchIdxPi
          Service C:\Windows\system32\svchost.exe [AUTO] wuauserv
          Service C:\Windows\system32\DRIVERS\WUDFRd.sys [MANUAL] WUDFRd
          Service C:\Windows\system32\svchost.exe [AUTO] wudfsvc
          Service xmlprov
          Service {0C618F2D-76DC-4D48-B303-D93176297F05}
          Service {40331713-1488-4861-B72B-6417C33F902A}

          ---- Disk sectors - GMER 1.0.14 ----

          Disk \Device\Harddisk0\DR0 sector 00: MBR rootkit detected !!! <-- ROOTKIT !!!

          ---- EOF - GMER 1.0.14 ----
      11. green day Modérateur
        Salut

        ok, il détecte une bébétte ...

        scan ton PC avec un BitDefender en ligne (uniquement sous Internet Explorer) :

        www.bitdefender.com/scan8/ie.html

        Utilisation :

        * Cliquer sur "J'accepte" puis accepter également l'ActiveX bloqué par la barre anti-popup du SP2 qui clignotera en haut et l'installer.
        * Ensuite, cliquer sur "Cliquez ici pour scanner".
        * Patienter jusqu'à la fin du scan qui peut durer assez longtemps...

        Copier/coller le rapport entier sur le forum stp

        @+
        1. alain8693
          bon alors nouveau probleme j'ai acceptzer l'active x bloque mais le scan n'a pas voulu demarre j'ai donc ete dans les parametres de csecurite des options internets pour autoriser tous les controles acyives x mais ca n'a rien fait.
          en azllant sur le site de bit defender en francais apparzment il y aurait une incompatibiliute avec vista sp1 .
          du coup j'ai telecharge un version d'essai de bit defender total secutity 2008 il a scanne mes documents et m'a donne un rapport le voici

          Product : BitDefender Total Security 2008
          Version : BitDefender UIScanner v.11
          Log date : 23:01:59 10/03/2008
          Log path : C:\Users\philipponneau\AppData\Roaming\BitDefender\Desktop\Profiles\Logs\my_documents\1205186519_1_02.xml

          Scan Paths:Path0000: C:\Users\philipponneau\Documents
          Path0001: C:\Users\philipponneau\Desktop
          Path0002: C:\Users\philipponneau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

          Scan Options:Scan for viruses : Yes
          Scan for adware : Yes
          Scan for spyware : Yes
          Scan for applications : Yes
          Scan for dialers : Yes
          Scan for rootkits : No

          Target selection options:Scan registry keys : Yes
          Scan cookies : Yes
          Scan boot sectors : No
          Scan memory processes : Yes
          Scan archives : Yes
          Scan runtime packers : Yes
          Scan emails : Yes
          Scan all files : Yes
          Heuristic Scan : Yes
          Scanned extensions :
          Excluded extensions :

          Target ProcessingDefault action for infected objects : Disinfect
          Default action for suspicious objects : None
          Default action for hidden objects : None

          Scan engines summaryNumber of virus signatures : 986544
          Archive plugins : 41
          Email plugins : 6
          Scan plugins : 12
          Archive plugins : 41
          System plugins : 4
          Unpack plugins : 7

          Overall scan summaryScanned items : 8009
          Infected items : 3
          Suspicious items : 0
          Resolved items : 0
          Individual viruses found : 2
          Scanned directories : 219
          Scanned boot sectors : 0
          Scanned archives : 143
          Input-output errors : 0
          Scan time : 00:00:06:43
          Files per second : 18

          Scanned processes summaryScanned : 57
          Infected : 0

          Scanned registry keys summaryScanned : 376
          Infected : 0

          Scanned cookies summaryScanned : 1
          Infected : 0

          Remaining issues:Object Name Threat Name Final Status
          C:\Users\philipponneau\Desktop\[PC GAME] Medal of Honor European Assault EA Games\GameSpy\ArcadeInstallMOHPA14d.EXE=]wise0012 Adware.Gamespyarcade.F Delete Failed (file was in an archive)
          [System]=]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\devenv=]C:\WINDOWS\SYSTEM\SMVSS.EXE BehavesLike:Win32.ExplorerHijack Infected
          [System] BehavesLike:Win32.ExplorerHijack Disinfect Failed

          Resolved issues:Object Name Threat Name Final Status

          Objects that were not scanned:Object Name Reason Final Status
      12. green day Modérateur
        Salut

        ok, est-ce que microsoft te détecte toujours quelque chose ??

        @+
        1. alain8693
          au demarrage toujours application win 32 non valide pour windows defender et mon antivirus
      13. green day Modérateur
        Salut

        ok, sinon, est-ce qu'il détecte toujours bagle ??

        ++
        1. alain8693
          non mais comment faire pour refaire marcher windows update et defender dois je reinstaller a partir du cd
      15. green day Modérateur
        Salut

        pas d'quoi !

        juste un derneir détail :

        télécharge OTMoveIt (de Old_Timer) sur ton Bureau :
        http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

        double-clique sur OTMoveIt.exe pour le lancer.
        copie la liste qui se trouve en gras ci-dessous,
        et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

        C:\WIND­OWS\SYSTEM\SMVSS.EXE

        clique sur MoveIt! pour lancer la suppression.
        le résultat apparaitra dans le cadre Results.
        clique sur Exit pour fermer.
        poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
        il te sera peut-être demander de redémarrer le pc pour achever la suppression.
        si c'est le cas accepte par Yes.

        @+
        • 1
        • 2