Virus sur l'ordinateur

Bonjour,
J'ai téléchargé un point .Exe sur mon PC que j'ai d abord fait analyser par avast avant de le lancer.
je l'ai executé mais il a apparemment installé un vers ou un virus sur mon ordinateur.
depuis il m'est impossible de me connecter sur le site de comment ca marche et j'ai souvent un renvoi vers un site apellé porntube .......

de plus j ai fait une analyse complete anti virus par avast, il m'a trouvé quelques virus dont il a detruit les fichiers.

j ai également fait une analyse anti trojan a l'aide de spybot-sd, il a trouvé quelques trojan que j'ai supprimé.

j'ai fait une analyse avec hijackthis mais je ne sais pas comment transferer le fichier sans risquer de corrompre cet ordinateur portable ....

je vais quand meme vous mettre le point txt créé par hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:19:32, on 12/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--
End of file - 3879 bytes
Configuration: Windows XP
Firefox 3.0.1

10 réponses

  1. Contributeur sécurité
    Bonjour anakin661,

    Voila ce qui arrive quand on fait trop confiance à son antivirus (surtout Avast qui est médiocre...)

    Ton rapport hijackthis est très court, l'infection a probablement masqué des lignes...

    Télécharge et installe Malwarebyte's Anti-Malware : http://www.malwarebytes.org/mbam/program/mbam-setup.exe
    - A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
    - Lance Malwarebyte's Anti-Malware, laisse les Mises à jour se télécharger et referme le programme

    Redémarre en "Mode sans échec" : redémarre ton ordinateur et tapote sur la touche F8 jusqu'à l'affichage du menu des options avancées de Windows, et sélectionne "Mode sans échec". Choisis ta session habituelle

    Lance Malwarebyte's Anti-Malware
    - Puis va dans l'onglet "Recherche", coche "Exécuter un examen complet" puis "Rechercher"
    - Sélectionne tes disques durs" puis clique sur "Lancer l’examen"
    - A la fin du scan, clique sur Afficher les résultats puis sur Enregistrer le rapport
    - Suppression des éléments détectés --> clique sur Supprimer la sélection
    - S'il t'es demandé de redémarrer, clique sur Yes

    Poste le rapport de scan après la suppression ici

    -1
    1. Voila aprés un scan trés long, j'ai eu ceci comme rapport, Y a t il encore quelque chose que je doive faire ?

      ---------------------------------------------------------------------------------------------------------------------------------------------------

      Malwarebytes' Anti-Malware 1.28
      Version de la base de données: 1141
      Windows 5.1.2600 Service Pack 2

      12/09/2008 16:09:52
      mbam-log-2008-09-12 (16-09-52).txt

      Type de recherche: Examen complet (C:\|F:\|G:\|)
      Eléments examinés: 219270
      Temps écoulé: 1 hour(s), 2 minute(s), 7 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 6
      Valeur(s) du Registre infectée(s): 0
      Elément(s) de données du Registre infecté(s): 2
      Dossier(s) infecté(s): 1
      Fichier(s) infecté(s): 21

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\TypeLib\{9233c3c0-1472-4091-a505-5580a23bb4ac} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Elément(s) de données du Registre infecté(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Trace) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Trace) -> Data: system32\ -> Quarantined and deleted successfully.

      Dossier(s) infecté(s):
      C:\Program Files\Helper (Adware.BHO) -> Quarantined and deleted successfully.

      Fichier(s) infecté(s):
      C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Renaud\Local Settings\Temp\D6.tmp (Rogue.Installer) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\ (Malware.Trace) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\casino1.ico (Malware.Trace) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\casino2.ico (Malware.Trace) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\casino3.ico (Malware.Trace) -> Quarantined and deleted successfully.
      C:\Program Files\SAV\sav0.dat (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
      C:\Program Files\SAV\sav1.dat (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
      C:\Program Files\SAV\sav.ooo (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\gwgzcy.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\gvwjxr.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\gntkqu.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\gmucjk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\mywallpaper.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      -1
      1. Contributeur sécurité
        Peux-tu poster un nouveau rapport hijacthis stp ?
        -1
        1. voila
          ======================================

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 16:17:04, on 12/09/2008
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16705)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          C:\Program Files\Alwil Software\Avast4\ashServ.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
          C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
          C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
          C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
          C:\WINDOWS\system32\wuauclt.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
          C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
          C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
          C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

          O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
          O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
          O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
          O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
          O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
          O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
          O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
          O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
          O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
          O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
          -1
          1. Contributeur sécurité
            On va utiliser Combofix pour finir la désinfection. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...

            Fais exactement ce qui suit :

            Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
            Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

            --------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
            !! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation : en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!
            Dans ton cas, il s'agit d'Avast et ton pare-feu Kerio

            ---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

            Tuto ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
            ---------------------------------------------------------------------------------------------------------------------------------

            Ensuite :
            double-clique sur C-Fix.exe (= combofix.exe ) .

            Appuie sur une touche pour démarrer le scan .

            Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

            Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp

            1
            1. Voila le log de combo

              ========================================================

              ComboFix 08-09-10.04 - Renaud 2008-09-12 17:31:08.4 - NTFSx86
              Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1084 [GMT 2:00]
              Endroit: C:\Documents and Settings\Renaud\Bureau\ComboFix.exe
              .

              (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .
              ---- Previous Run -------
              .
              C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
              C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
              C:\Documents and Settings\celine\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
              C:\WINDOWS\system32\tdsspopup.dll
              C:\WINDOWS\system32\tdsspopup1.url
              C:\WINDOWS\system32\tdsspopup2.url
              C:\WINDOWS\system32\tdsspopup3.url

              .
              ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
              .

              -------\Legacy_TDSSSERV
              -------\Service_TDSSserv

              ((((((((((((((((((((((((((((( Fichiers créés 2008-08-12 to 2008-09-12 ))))))))))))))))))))))))))))))))))))
              .

              2008-09-12 16:38 . 2008-07-16 09:57 269,736 -ra------ C:\WINDOWS\system32\drivers\SbFw.sys
              2008-09-12 16:38 . 2008-06-21 04:54 65,576 --a------ C:\WINDOWS\system32\drivers\SbFwIm.sys
              2008-09-12 14:50 . 2008-09-12 14:50 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
              2008-09-12 14:50 . 2008-09-12 14:50 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\Malwarebytes
              2008-09-12 14:50 . 2008-09-12 14:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
              2008-09-12 14:50 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
              2008-09-12 14:50 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
              2008-09-11 19:42 . 2008-09-11 19:42 <REP> d-------- C:\Program Files\Electronic Arts
              2008-09-11 18:12 . 2008-09-12 16:09 <REP> d-------- C:\Program Files\SAV
              2008-09-06 09:08 . 2008-09-06 09:08 <REP> d-------- C:\Documents and Settings\celine\Application Data\Nero
              2008-09-06 03:12 . 2008-09-10 11:08 <REP> d-------- C:\Documents and Settings\Nouveau dossier\[u]0/u9Septembre2008
              2008-09-05 17:26 . 2008-09-05 17:26 <REP> d-------- C:\Program Files\Real Alternative
              2008-09-05 11:38 . 2008-09-05 11:39 <REP> d-------- C:\Program Files\OpenOffice.org 2.4
              2008-09-05 01:02 . 2008-09-05 01:02 <REP> d-------- C:\Games
              2008-08-29 15:22 . 2008-09-05 18:19 69 --a------ C:\WINDOWS\NeroDigital.ini
              2008-08-29 14:43 . 2008-08-29 14:44 60 --a------ C:\WINDOWS\RESULT.QTW
              2008-08-29 14:07 . 2008-08-29 14:07 <REP> d-------- C:\Program Files\FileZilla FTP Client
              2008-08-29 14:07 . 2008-09-04 20:05 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\FileZilla
              2008-08-29 11:27 . 2008-08-29 11:27 <REP> d-------- C:\Program Files\DriverMagic
              2008-08-29 11:27 . 2008-08-29 11:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SymplisIT
              2008-08-29 10:20 . 2008-08-29 10:20 <REP> d-------- C:\Program Files\Nero
              2008-08-29 10:20 . 2008-08-29 10:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
              2008-08-26 10:51 . 2008-08-31 22:03 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\Azureus
              2008-08-26 10:51 . 2008-08-26 10:51 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
              2008-08-26 10:50 . 2008-08-26 10:51 <REP> d-------- C:\Program Files\Vuze
              2008-08-26 10:49 . 2008-08-26 10:49 <REP> d-------- C:\Documents and Settings\Renaud\Temp
              2008-08-22 02:11 . 2008-08-22 02:11 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\Sony Online Entertainment
              2008-08-22 01:24 . 2008-08-22 01:24 <REP> d-------- C:\Program Files\VideoLAN
              2008-08-21 12:00 . 2008-08-21 12:00 305,664 --a------ C:\Documents and Settings\Nouveau dossier\Xtremsplit.exe
              2008-08-21 02:55 . 2008-08-21 02:55 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\MPEG Streamclip
              2008-08-12 16:54 . 2008-08-12 16:57 3,326,400 --a------ C:\s2fo.2
              2008-08-12 16:54 . 2008-08-12 16:57 3,326,400 --a------ C:\s2fo.1
              2008-08-12 16:54 . 2008-08-12 16:57 3,326,400 --a------ C:\s2fo

              .
              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              2008-09-12 15:27 --------- d-----w C:\Documents and Settings\Renaud\Application Data\OpenOffice.org2
              2008-09-12 15:03 --------- d-----w C:\Program Files\Spybot - Search & Destroy
              2008-09-12 15:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
              2008-09-12 14:29 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
              2008-09-12 12:53 658 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
              2008-09-11 17:38 --------- d-----w C:\Documents and Settings\Renaud\Application Data\uTorrent
              2008-09-10 13:55 --------- d-----w C:\Program Files\Mozilla Thunderbird
              2008-09-09 18:28 --------- d-----w C:\Program Files\StarWarsGalaxies
              2008-09-05 09:38 --------- d-----w C:\Program Files\OpenOffice.org 2.3
              2008-09-05 09:36 --------- d-----w C:\Program Files\Java
              2008-08-29 08:20 --------- d-----w C:\Program Files\Fichiers communs\Nero
              2008-08-24 18:25 --------- d-----w C:\Program Files\Sony
              2008-08-21 23:41 --------- d-----w C:\Documents and Settings\Renaud\Application Data\vlc
              2008-07-21 14:04 --------- d-----w C:\Documents and Settings\celine\Application Data\Winamp
              2008-07-21 13:58 --------- d-----w C:\Documents and Settings\celine\Application Data\Media Player Classic
              2008-07-21 13:58 --------- d-----w C:\Documents and Settings\celine\Application Data\CyberLink
              2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
              2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
              2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
              2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
              2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
              2008-04-24 18:54 596 ----a-w C:\Program Files\mpc1.reg
              2008-04-24 18:54 3,476 ----a-w C:\Program Files\mpc7.reg
              2008-04-24 18:54 3,026 ----a-w C:\Program Files\mpc3.reg
              2008-04-24 18:54 18,156 ----a-w C:\Program Files\mpc6.reg
              2008-04-24 18:54 16,150 ----a-w C:\Program Files\mpc5.reg
              2008-04-24 18:54 1,658 ----a-w C:\Program Files\ffdssetts.reg
              2008-04-24 18:54 1,646 ----a-w C:\Program Files\mpc4.reg
              2008-04-24 18:54 1,292 ----a-w C:\Program Files\ffdsasetts.reg
              2008-04-24 18:52 4,688 ----a-w C:\Program Files\satsukidecodersettings.ini
              2008-01-22 18:40 16 ---ha-w C:\Program Files\mxfilerelatedcache.mxc2
              2008-01-25 16:53 594,944 ----a-w C:\Program Files\mozilla firefox\plugins\MannequinPlayer2.dll
              .

              ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .
              *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
              REGEDIT4

              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-06-01 196608]
              "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "EPSON Stylus Photo RX420 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE" [2004-04-09 98304]
              "NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
              "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]

              C:\Documents and Settings\Renaud\Menu D‚marrer\Programmes\D‚marrage\
              OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]

              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
              "msacm.enc"= ITIG726.acm

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
              "EnableFirewall"= 0 (0x0)

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
              "%windir%\\system32\\sessmgr.exe"=
              "C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
              "C:\\Program Files\\uTorrent\\uTorrent.exe"=
              "C:\\Program Files\\Messenger\\msmsgs.exe"=
              "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
              "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
              "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
              "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
              "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
              "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
              "C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
              "C:\\Program Files\\Freeplayer\\vlc\\vlc.exe"=
              "C:\\Program Files\\StarWarsGalaxies\\SwgClient_r.exe"=

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
              "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

              R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
              R1 SbFw;SbFw;C:\WINDOWS\system32\drivers\SbFw.sys [2008-07-16 269736]
              R1 sbhips;Sunbelt HIPS Driver;C:\WINDOWS\system32\drivers\sbhips.sys [2008-06-21 66600]
              R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
              R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr.sys [2007-10-17 43816]
              R2 fsssvc;Windows Live OneCare Contrôle parental;C:\Program Files\Windows Live\Contrôle parental\fsssvc.exe [2007-12-17 523816]
              R2 SbPF.Launcher;SbPF.Launcher;C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-07-30 95528]
              R2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-07-30 1361192]
              R3 PhilCam8116_XP;Logitech QuickCam Pro 3000(PID_08B1);C:\WINDOWS\system32\DRIVERS\CamDrL20.sys [2004-05-21 245760]
              R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\sbfwim.sys [2008-06-21 65576]
              S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]

              *Newly Created Service* - ASWUPDSV
              *Newly Created Service* - AVAST!_MAIL_SCANNER
              *Newly Created Service* - AVAST!_WEB_SCANNER
              .
              Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
              .
              .
              ------- Supplementary Scan -------
              .
              FireFox -: Profile - C:\Documents and Settings\Renaud\Application Data\Mozilla\Firefox\Profiles\m0z3v94x.default\
              FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://famille.maydat.free.fr/
              FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npredoute.dll
              .

              **************************************************************************

              catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
              Rootkit scan 2008-09-12 17:36:57
              Windows 5.1.2600 Service Pack 2 NTFS

              Balayage processus cachés ...

              Balayage caché autostart entries ...

              Balayage des fichiers cachés ...

              Scan terminé avec succès
              Les fichiers cachés: 0

              **************************************************************************
              .
              Temps d'accomplissement: 2008-09-12 17:39:41
              ComboFix-quarantined-files.txt 2008-09-12 15:39:34

              Pre-Run: 434,722,799,616 octets libres
              Post-Run: 434,712,281,088 octets libres

              165 --- E O F --- 2008-09-10 01:01:27
              -1
              1. Quelqu'un pourrait'il finir de repondre a mon sujet pls ?
                -1
                1. Contributeur sécurité
                  Un peu de patience...

                  Toujours avec toutes les protections désactivées, fais ceci :

                  Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
                  Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

                  ----------------------------------------------------------
                  File::
                  C:\WINDOWS\RESULT.QTW
                  C:\s2fo.2
                  C:\s2fo.1
                  C:\s2fo

                  Folder::
                  C:\Program Files\SAV
                  C:\s2fo.2
                  C:\s2fo.1
                  C:\s2fo

                  ------------------------------------------------------------------

                  - Enregistre ce fichier sur ton bureau (et pas ailleurs !) sous le nom CFScript.txt
                  - Quitte le Bloc Notes

                  · Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) comme sur ce lien :
                  http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

                  * Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort), tape 1 puis valide.
                  * Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
                  Ne touche à rien tant que le scan n'est pas terminé.
                  * Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
                  * Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
                  -1
                  1. ComboFix 08-09-16.05 - Renaud 2008-09-17 23:37:32.5 - NTFSx86
                    Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1081 [GMT 2:00]
                    Lancé depuis: C:\Documents and Settings\Renaud\Bureau\ComboFix.exe
                    Command switches used :: C:\Documents and Settings\Renaud\Bureau\CFScript.txt
                    * Un nouveau point de restauration a été créé
                    .

                    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                    .

                    C:\Program Files\SAV
                    C:\s2fo
                    C:\s2fo.1
                    C:\s2fo.1\
                    C:\s2fo.2
                    C:\s2fo.2\
                    C:\s2fo\
                    C:\WINDOWS\RESULT.QTW

                    .
                    ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                    .

                    -------\Legacy_TDSSSERV
                    -------\Service_TDSSserv

                    ((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-17 au 2008-09-17 ))))))))))))))))))))))))))))))))))))
                    .

                    2008-09-15 21:47 . 2008-09-15 21:47 <REP> d-------- C:\WINDOWS\system32\fr
                    2008-09-15 21:47 . 2008-09-15 21:47 <REP> d-------- C:\WINDOWS\system32\bits
                    2008-09-15 21:47 . 2008-09-15 21:47 <REP> d-------- C:\WINDOWS\l2schemas
                    2008-09-15 21:23 . 2008-09-15 21:52 <REP> d-------- C:\WINDOWS\ServicePackFiles
                    2008-09-12 20:05 . 2008-09-12 20:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SimCity Societies
                    2008-09-12 20:04 . 2008-07-12 08:18 3,851,784 --a------ C:\WINDOWS\system32\D3DX9_39.dll
                    2008-09-12 20:03 . 2008-09-12 20:03 <REP> d-------- C:\WINDOWS\Logs
                    2008-09-12 20:02 . 2008-09-12 20:02 <REP> d-------- C:\Program Files\directX
                    2008-09-12 18:36 . 2008-09-12 18:36 <REP> d-------- C:\Program Files\Avira
                    2008-09-12 18:36 . 2008-09-12 18:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
                    2008-09-12 18:06 . 2008-07-16 09:57 269,736 -ra------ C:\WINDOWS\system32\drivers\SbFw.sys
                    2008-09-12 18:06 . 2008-06-21 04:54 65,576 --a------ C:\WINDOWS\system32\drivers\SbFwIm.sys
                    2008-09-12 14:50 . 2008-09-12 14:50 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                    2008-09-12 14:50 . 2008-09-12 14:50 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\Malwarebytes
                    2008-09-12 14:50 . 2008-09-12 14:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                    2008-09-12 14:50 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                    2008-09-12 14:50 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                    2008-09-11 19:42 . 2008-09-11 19:42 <REP> d-------- C:\Program Files\Electronic Arts
                    2008-09-06 09:08 . 2008-09-06 09:08 <REP> d-------- C:\Documents and Settings\celine\Application Data\Nero
                    2008-09-06 03:12 . 2008-09-17 23:06 <REP> d-------- C:\Documents and Settings\Nouveau dossier\[u]0/u9Septembre2008
                    2008-09-05 17:26 . 2008-09-05 17:26 <REP> d-------- C:\Program Files\Real Alternative
                    2008-09-05 11:38 . 2008-09-05 11:39 <REP> d-------- C:\Program Files\OpenOffice.org 2.4
                    2008-09-05 01:02 . 2008-09-05 01:02 <REP> d-------- C:\Games
                    2008-08-29 15:22 . 2008-09-05 18:19 69 --a------ C:\WINDOWS\NeroDigital.ini
                    2008-08-29 14:07 . 2008-08-29 14:07 <REP> d-------- C:\Program Files\FileZilla FTP Client
                    2008-08-29 14:07 . 2008-09-04 20:05 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\FileZilla
                    2008-08-29 11:27 . 2008-08-29 11:27 <REP> d-------- C:\Program Files\DriverMagic
                    2008-08-29 11:27 . 2008-08-29 11:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SymplisIT
                    2008-08-29 10:20 . 2008-08-29 10:20 <REP> d-------- C:\Program Files\Nero
                    2008-08-29 10:20 . 2008-08-29 10:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
                    2008-08-26 10:51 . 2008-08-31 22:03 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\Azureus
                    2008-08-26 10:51 . 2008-08-26 10:51 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
                    2008-08-26 10:50 . 2008-08-26 10:51 <REP> d-------- C:\Program Files\Vuze
                    2008-08-26 10:49 . 2008-08-26 10:49 <REP> d-------- C:\Documents and Settings\Renaud\Temp
                    2008-08-22 02:11 . 2008-08-22 02:11 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\Sony Online Entertainment
                    2008-08-22 01:24 . 2008-08-22 01:24 <REP> d-------- C:\Program Files\VideoLAN
                    2008-08-21 12:00 . 2008-08-21 12:00 305,664 --a------ C:\Documents and Settings\Nouveau dossier\Xtremsplit.exe
                    2008-08-21 02:55 . 2008-08-21 02:55 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\MPEG Streamclip

                    .
                    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                    .
                    2008-09-17 21:30 --------- d-----w C:\Documents and Settings\Renaud\Application Data\OpenOffice.org2
                    2008-09-17 21:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                    2008-09-17 21:00 --------- d-----w C:\Program Files\Spybot - Search & Destroy
                    2008-09-17 13:39 --------- d-----w C:\Program Files\Mozilla Thunderbird
                    2008-09-12 14:29 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
                    2008-09-12 12:53 658 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
                    2008-09-11 17:38 --------- d-----w C:\Documents and Settings\Renaud\Application Data\uTorrent
                    2008-09-09 18:28 --------- d-----w C:\Program Files\StarWarsGalaxies
                    2008-09-05 09:38 --------- d-----w C:\Program Files\OpenOffice.org 2.3
                    2008-09-05 09:36 --------- d-----w C:\Program Files\Java
                    2008-08-29 08:20 --------- d-----w C:\Program Files\Fichiers communs\Nero
                    2008-08-24 18:25 --------- d-----w C:\Program Files\Sony
                    2008-08-21 23:41 --------- d-----w C:\Documents and Settings\Renaud\Application Data\vlc
                    2008-07-21 14:04 --------- d-----w C:\Documents and Settings\celine\Application Data\Winamp
                    2008-07-21 13:58 --------- d-----w C:\Documents and Settings\celine\Application Data\Media Player Classic
                    2008-07-21 13:58 --------- d-----w C:\Documents and Settings\celine\Application Data\CyberLink
                    2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
                    2008-04-24 18:54 596 ----a-w C:\Program Files\mpc1.reg
                    2008-04-24 18:54 3,476 ----a-w C:\Program Files\mpc7.reg
                    2008-04-24 18:54 3,026 ----a-w C:\Program Files\mpc3.reg
                    2008-04-24 18:54 18,156 ----a-w C:\Program Files\mpc6.reg
                    2008-04-24 18:54 16,150 ----a-w C:\Program Files\mpc5.reg
                    2008-04-24 18:54 1,658 ----a-w C:\Program Files\ffdssetts.reg
                    2008-04-24 18:54 1,646 ----a-w C:\Program Files\mpc4.reg
                    2008-04-24 18:54 1,292 ----a-w C:\Program Files\ffdsasetts.reg
                    2008-04-24 18:52 4,688 ----a-w C:\Program Files\satsukidecodersettings.ini
                    2008-01-22 18:40 16 ---ha-w C:\Program Files\mxfilerelatedcache.mxc2
                    2008-01-25 16:53 594,944 ----a-w C:\Program Files\mozilla firefox\plugins\MannequinPlayer2.dll
                    .

                    ((((((((((((((((((((((((((((( snapshot@2008-09-12_17.38.16.37 )))))))))))))))))))))))))))))))))))))))))
                    .
                    - 2004-08-19 15:09:34 82,944 -c----w C:\WINDOWS\$NtUninstallKB946648$\msgsc.dll
                    + 2004-08-19 15:09:34 82,944 -c----w C:\WINDOWS\$NtUninstallKB946648_0$\msgsc.dll
                    + 2007-11-30 12:39:29 234,872 -c----w C:\WINDOWS\$NtUninstallKB946648_0$\spuninst\spuninst.exe
                    + 2007-11-30 12:39:31 406,392 -c----w C:\WINDOWS\$NtUninstallKB946648_0$\spuninst\updspapi.dll
                    - 2006-07-13 08:48:58 202,240 -c----w C:\WINDOWS\$NtUninstallKB950762$\rmcast.sys
                    + 2006-07-13 08:48:58 202,240 -c----w C:\WINDOWS\$NtUninstallKB950762_0$\rmcast.sys
                    + 2007-11-30 12:39:29 234,872 -c----w C:\WINDOWS\$NtUninstallKB950762_0$\spuninst\spuninst.exe
                    + 2007-11-30 12:39:31 406,392 -c----w C:\WINDOWS\$NtUninstallKB950762_0$\spuninst\updspapi.dll
                    - 2005-07-26 04:39:57 243,200 -c----w C:\WINDOWS\$NtUninstallKB950974$\es.dll
                    + 2005-07-26 04:39:57 243,200 -c----w C:\WINDOWS\$NtUninstallKB950974_0$\es.dll
                    + 2007-11-30 12:39:29 234,872 -c----w C:\WINDOWS\$NtUninstallKB950974_0$\spuninst\spuninst.exe
                    + 2007-11-30 12:39:29 406,392 -c----w C:\WINDOWS\$NtUninstallKB950974_0$\spuninst\updspapi.dll
                    - 2007-08-21 06:17:23 683,520 -c----w C:\WINDOWS\$NtUninstallKB951066$\inetcomm.dll
                    + 2007-08-21 06:17:23 683,520 -c----w C:\WINDOWS\$NtUninstallKB951066_0$\inetcomm.dll
                    + 2007-11-30 12:39:29 234,872 -c----w C:\WINDOWS\$NtUninstallKB951066_0$\spuninst\spuninst.exe
                    + 2007-11-30 12:39:31 406,392 -c----w C:\WINDOWS\$NtUninstallKB951066_0$\spuninst\updspapi.dll
                    - 2008-04-14 15:52:45 272,768 -c----w C:\WINDOWS\$NtUninstallKB951376-v2$\bthport.sys
                    + 2008-04-14 15:52:45 272,768 -c----w C:\WINDOWS\$NtUninstallKB951376-v2_0$\bthport.sys
                    + 2007-11-30 11:19:06 234,872 -c----w C:\WINDOWS\$NtUninstallKB951376-v2_0$\spuninst\spuninst.exe
                    + 2007-11-30 11:19:10 406,392 -c----w C:\WINDOWS\$NtUninstallKB951376-v2_0$\spuninst\updspapi.dll
                    + 2007-11-30 11:19:06 234,872 -c----w C:\WINDOWS\$NtUninstallKB951376_0$\spuninst\spuninst.exe
                    + 2007-11-30 11:19:10 406,392 -c----w C:\WINDOWS\$NtUninstallKB951376_0$\spuninst\updspapi.dll
                    - 2007-10-29 22:43:32 1,293,824 -c----w C:\WINDOWS\$NtUninstallKB951698$\quartz.dll
                    + 2007-10-29 22:43:32 1,293,824 -c----w C:\WINDOWS\$NtUninstallKB951698_0$\quartz.dll
                    + 2007-11-30 11:19:06 234,872 -c----w C:\WINDOWS\$NtUninstallKB951698_0$\spuninst\spuninst.exe
                    + 2007-11-30 12:39:31 406,392 -c----w C:\WINDOWS\$NtUninstallKB951698_0$\spuninst\updspapi.dll
                    - 2004-08-03 22:14:16 138,496 -c----w C:\WINDOWS\$NtUninstallKB951748$\afd.sys
                    - 2008-02-20 05:35:05 148,992 -c----w C:\WINDOWS\$NtUninstallKB951748$\dnsapi.dll
                    - 2004-08-03 23:54:36 247,808 -c----w C:\WINDOWS\$NtUninstallKB951748$\mswsock.dll
                    - 2007-10-30 17:20:55 360,064 -c----w C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
                    - 2006-08-16 09:37:30 225,664 -c----w C:\WINDOWS\$NtUninstallKB951748$\tcpip6.sys
                    + 2004-08-03 22:14:16 138,496 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\afd.sys
                    + 2008-02-20 05:35:05 148,992 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\dnsapi.dll
                    + 2004-08-03 23:54:36 247,808 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\mswsock.dll
                    + 2007-11-30 12:39:29 234,872 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\spuninst\spuninst.exe
                    + 2007-11-30 12:39:29 406,392 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\spuninst\updspapi.dll
                    + 2007-10-30 17:20:55 360,064 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\tcpip.sys
                    + 2006-08-16 09:37:30 225,664 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\tcpip6.sys
                    - 2004-08-03 23:54:32 331,776 -c----w C:\WINDOWS\$NtUninstallKB952287$\msadce.dll
                    + 2004-08-03 23:54:32 331,776 -c----w C:\WINDOWS\$NtUninstallKB952287_0$\msadce.dll
                    + 2007-11-30 11:19:06 234,872 -c----w C:\WINDOWS\$NtUninstallKB952287_0$\spuninst\spuninst.exe
                    + 2007-11-30 11:19:10 406,392 -c----w C:\WINDOWS\$NtUninstallKB952287_0$\spuninst\updspapi.dll
                    - 2005-06-29 01:49:41 74,240 -c----w C:\WINDOWS\$NtUninstallKB952954$\mscms.dll
                    + 2005-06-29 01:49:41 74,240 -c----w C:\WINDOWS\$NtUninstallKB952954_0$\mscms.dll
                    + 2007-11-30 11:19:06 234,872 -c----w C:\WINDOWS\$NtUninstallKB952954_0$\spuninst\spuninst.exe
                    + 2007-11-30 12:39:31 406,392 -c----w C:\WINDOWS\$NtUninstallKB952954_0$\spuninst\updspapi.dll
                    + 2008-04-14 02:33:18 39,424 ------w C:\WINDOWS\AppPatch\acadproc.dll
                    - 2004-08-03 23:54:22 1,852,416 ----a-w C:\WINDOWS\AppPatch\AcGenral.dll
                    + 2008-04-14 02:33:18 1,852,928 ----a-w C:\WINDOWS\AppPatch\acgenral.dll
                    - 2004-08-03 23:54:22 450,048 ----a-w C:\WINDOWS\AppPatch\AcLayers.dll
                    + 2008-04-14 02:33:18 451,072 ----a-w C:\WINDOWS\AppPatch\aclayers.dll
                    - 2004-08-03 23:54:22 137,728 ----a-w C:\WINDOWS\AppPatch\AcLua.dll
                    + 2008-04-14 02:33:18 141,312 ----a-w C:\WINDOWS\AppPatch\aclua.dll
                    - 2004-08-03 23:54:22 244,736 ----a-w C:\WINDOWS\AppPatch\AcSpecfc.dll
                    + 2008-04-14 02:33:18 245,248 ----a-w C:\WINDOWS\AppPatch\acspecfc.dll
                    - 2004-08-03 23:54:22 116,224 ----a-w C:\WINDOWS\AppPatch\AcXtrnal.dll
                    + 2008-04-14 02:33:18 116,224 ----a-w C:\WINDOWS\AppPatch\acxtrnal.dll
                    + 2008-09-12 18:04:14 53,248 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
                    + 2008-09-12 18:04:15 12,800 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
                    + 2008-09-12 18:04:15 473,600 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
                    + 2008-09-12 18:04:11 2,676,224 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                    + 2008-09-12 18:04:12 2,846,720 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                    + 2008-09-12 18:04:12 563,712 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                    + 2008-09-12 18:04:12 567,296 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                    + 2008-09-12 18:04:13 576,000 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                    + 2008-09-12 18:04:13 577,024 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                    + 2008-09-12 18:04:13 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                    + 2008-09-12 18:04:13 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                    + 2008-09-12 18:04:14 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                    + 2008-09-12 18:04:15 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                    + 2008-09-12 18:04:15 145,920 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
                    + 2008-09-12 18:04:15 159,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
                    + 2008-09-12 18:04:15 364,544 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
                    + 2008-09-12 18:04:15 178,176 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
                    + 2008-09-12 18:04:14 223,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
                    - 2008-09-11 15:31:34 68,608 ----a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
                    + 2008-09-15 22:34:27 68,608 ----a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
                    - 2008-09-11 15:31:38 72,192 ----a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
                    + 2008-09-15 22:34:32 72,192 ----a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
                    - 2008-09-11 15:31:38 4,308,992 ----a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
                    + 2008-09-15 22:34:32 4,308,992 ----a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
                    - 2008-09-11 15:31:39 482,304 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
                    + 2008-09-15 22:34:33 482,304 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
                    - 2008-09-11 15:31:37 2,878,976 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
                    + 2008-09-15 22:34:30 2,902,016 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
                    - 2008-09-11 15:31:32 258,048 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
                    + 2008-09-15 22:34:25 258,048 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
                    - 2008-09-11 15:31:32 114,176 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
                    + 2008-09-15 22:34:25 114,176 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
                    - 2008-09-11 15:31:41 260,096 ----a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
                    + 2008-09-15 22:34:35 260,096 ----a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
                    - 2008-09-11 15:31:35 5,025,792 ----a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
                    + 2008-09-15 22:34:28 5,156,864 ----a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
                    - 2008-09-11 15:31:34 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
                    + 2008-09-15 22:34:27 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
                    - 2008-09-11 15:31:32 503,808 ----a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
                    + 2008-09-15 22:34:25 507,904 ----a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
                    - 2008-09-11 15:31:33 13,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
                    + 2008-09-15 22:34:26 13,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
                    - 2008-09-11 15:31:37 8,192 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
                    + 2008-09-15 22:34:31 8,192 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
                    - 2008-09-11 15:31:38 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
                    + 2008-09-15 22:34:31 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
                    - 2008-09-11 15:31:38 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
                    + 2008-09-15 22:34:32 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
                    - 2008-09-11 15:31:33 413,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
                    + 2008-09-15 22:34:26 413,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
                    - 2008-09-11 15:31:33 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
                    + 2008-09-15 22:34:26 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
                    - 2008-09-11 15:31:34 647,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
                    + 2008-09-15 22:34:27 647,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
                    - 2008-09-11 15:31:34 73,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
                    + 2008-09-15 22:34:27 73,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
                    - 2008-09-11 15:31:33 745,472 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
                    + 2008-09-15 22:34:26 749,568 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
                    - 2008-09-11 15:31:41 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
                    + 2008-09-15 22:34:35 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
                    - 2008-09-11 15:31:41 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
                    + 2008-09-15 22:34:35 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
                    - 2008-09-11 15:31:31 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
                    + 2008-09-15 22:34:25 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
                    - 2008-09-11 15:31:41 667,648 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
                    + 2008-09-15 22:34:35 667,648 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
                    - 2008-09-11 15:31:42 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
                    + 2008-09-15 22:34:35 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
                    - 2008-09-11 15:31:32 12,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
                    + 2008-09-15 22:34:25 12,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
                    - 2008-09-11 15:31:32 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
                    + 2008-09-15 22:34:25 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
                    - 2008-09-11 15:31:32 7,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
                    + 2008-09-15 22:34:25 7,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
                    - 2008-09-11 15:31:40 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
                    + 2008-09-15 22:34:33 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
                    - 2008-09-11 15:31:34 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
                    + 2008-09-15 22:34:27 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
                    - 2008-09-11 15:31:40 389,120 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
                    + 2008-09-15 22:34:34 413,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
                    - 2008-09-11 15:31:39 716,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
                    + 2008-09-15 22:34:33 716,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
                    - 2008-09-11 15:31:33 884,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
                    + 2008-09-15 22:34:26 888,832 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
                    - 2008-09-11 15:31:37 5,050,368 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
                    + 2008-09-15 22:34:30 5,001,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
                    - 2008-09-11 15:31:35 188,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
                    + 2008-09-15 22:34:28 188,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
                    - 2008-09-11 15:31:35 397,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
                    + 2008-09-15 22:34:28 397,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
                    - 2008-09-11 15:31:35 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
                    + 2008-09-15 22:34:28 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
                    - 2008-09-11 15:31:40 700,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
                    + 2008-09-15 22:34:34 577,536 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
                    - 2008-09-11 15:31:39 368,640 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
                    + 2008-09-15 22:34:33 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
                    - 2008-09-11 15:31:40 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
                    + 2008-09-15 22:34:34 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
                    - 2008-09-11 15:31:39 299,008 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
                    + 2008-09-15 22:34:33 299,008 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
                    - 2008-09-11 15:31:39 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
                    + 2008-09-15 22:34:33 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
                    - 2008-09-11 15:31:34 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
                    + 2008-09-15 22:34:27 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
                    - 2008-09-11 15:31:35 114,688 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
                    + 2008-09-15 22:34:28 114,688 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
                    - 2008-09-11 15:31:41 835,584 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
                    + 2008-09-15 22:34:35 835,584 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
                    - 2008-09-11 15:31:36 86,016 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
                    + 2008-09-15 22:34:29 86,016 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
                    - 2008-09-11 15:31:36 823,296 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
                    + 2008-09-15 22:34:29 823,296 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
                    - 2008-09-11 15:31:36 5,316,608 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
                    + 2008-09-15 22:34:29 5,152,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
                    - 2008-09-11 15:31:36 2,035,712 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
                    + 2008-09-15 22:34:30 2,027,520 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
                    - 2008-09-11 15:31:40 3,018,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
                    + 2008-09-15 22:34:34 2,940,928 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
                    + 2008-09-15 22:41:20 26,624 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\[u]0/u34a44742647d86bbaa1c8f15b7cb528\Accessibility.ni.dll
                    + 2008-09-15 22:41:20 888,832 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\bb304cec0361eca66b0fa89d1a59e969\AspNetMMCExt.ni.dll
                    + 2008-09-15 22:41:21 237,568 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\a6eea31abed00f52cc062c424092dafd\CustomMarshalers.ni.dll
                    + 2008-09-15 22:41:21 15,360 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\dfsvc\1dd3efadaa530f2449dc13c568ea5164\dfsvc.ni.exe
                    + 2008-09-15 22:41:22 880,640 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\6930d162678847a01f47fed348873e15\Microsoft.Build.Engine.ni.dll
                    + 2008-09-15 22:41:22 81,920 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\a2f7cb74d513ff512c4bec4c300aaa15\Microsoft.Build.Framework.ni.dll
                    + 2008-09-15 22:41:24 1,687,552 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\917a297b2ea5a0f5fbd388a4259c26ba\Microsoft.Build.Tasks.ni.dll
                    + 2008-09-15 22:41:25 163,840 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\c9adde7899f180b78f199267c84fa3a0\Microsoft.Build.Utilities.ni.dll
                    + 2008-09-15 22:41:26 1,720,320 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\[u]0/u44886a99768c9ee6dfae01b295354c9\Microsoft.VisualBasic.ni.dll
                    + 2008-09-15 22:35:09 11,304,960 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\1fb9d8194c139bc9c29600e687c112b6\mscorlib.ni.dll
                    + 2008-09-15 22:41:27 1,003,520 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\c4ec8ced34ef9ab8954cff5bf5d0fc05\System.Configuration.ni.dll
                    + 2008-09-15 22:35:26 6,676,480 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\ab5532e25121f69c1df505c56ed62fab\System.Data.ni.dll
                    + 2008-09-15 22:41:29 1,724,416 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Deployment\600ab411d9ec3bc2df23b85bf663d9f9\System.Deployment.ni.dll
                    + 2008-09-15 22:35:38 10,702,848 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Design\51b0a2ce84b66381e636f67a29179050\System.Design.ni.dll
                    + 2008-09-15 22:41:31 512,000 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\[u]0/ufa46f97e5901f66384d24c91953fca1\System.DirectoryServices.Protocols.ni.dll
                    + 2008-09-15 22:41:30 1,216,512 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\bcb19767b1dd92ea6ead4713747a3f9d\System.DirectoryServices.ni.dll
                    + 2008-09-15 22:35:41 229,376 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\df7ec312ebe9d15ba00294c1e1b3a5c6\System.Drawing.Design.ni.dll
                    + 2008-09-15 22:35:40 1,601,536 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\171abffae7d81afa0a1f913aa092d753\System.Drawing.ni.dll
                    + 2008-09-15 22:41:32 659,456 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\[u]0/ucb936db5338057a6eefd08d17cf1749\System.EnterpriseServices.ni.dll
                    + 2008-09-15 22:41:32 294,912 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\[u]0/ucb936db5338057a6eefd08d17cf1749\System.EnterpriseServices.Wrapper.dll
                    + 2008-09-15 22:41:33 729,088 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\531fdb92069c959eb4c7f6fc87a2c943\System.Security.ni.dll
                    + 2008-09-15 22:41:34 684,032 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\1f04130d373d41e907397eb57ba046bb\System.Transactions.ni.dll
                    + 2008-09-15 22:41:50 2,306,048 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\830d818643869a46b45df035b39913c0\System.Web.Mobile.ni.dll
                    + 2008-09-15 22:41:50 237,568 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\[u]0/u83e36946f184bd0578406e00584e953\System.Web.RegularExpressions.ni.dll
                    + 2008-09-15 22:41:52 1,941,504 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\2861d1fbebc0438e1a199f430e2dec4c\System.Web.Services.ni.dll
                    + 2008-09-15 22:41:47 12,185,600 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\d1df715e50f008d994d12ef39606a565\System.Web.ni.dll
                    + 2008-09-15 22:35:53 13,107,200 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\c137809123042cafa5275b677638c165\System.Windows.Forms.ni.dll
                    + 2008-09-15 22:35:59 5,623,808 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\8fbebde964c57f779f777a2c19c75919\System.Xml.ni.dll
                    + 2008-09-15 22:35:19 8,130,560 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\30bad1d3e889c7b60f85b092688c76de\System.ni.dll
                    - 2008-06-14 17:59:52 272,768 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys
                    + 2008-06-14 17:33:37 272,768 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys
                    + 2008-04-14 02:34:10 58,368 ------w C:\WINDOWS\ehome\medctrro.exe
                    - 2007-06-13 13:22:28 1,037,312 ----a-w C:\WINDOWS\explorer.exe
                    + 2008-04-14 02:34:03 1,037,824 ----a-w C:\WINDOWS\explorer.exe
                    - 2004-08-03 23:54:42 34,816 ----a-w C:\WINDOWS\Help\sniffpol.dll
                    + 2008-04-14 02:33:41 34,816 ----a-w C:\WINDOWS\Help\sniffpol.dll
                    - 2004-08-03 23:54:42 33,280 ----a-w C:\WINDOWS\Help\sstub.dll
                    + 2008-04-14 02:33:46 33,280 ----a-w C:\WINDOWS\Help\sstub.dll
                    - 2004-08-03 23:54:44 279,040 ----a-w C:\WINDOWS\Help\tshoot.dll
                    + 2008-04-14 02:33:46 279,040 ----a-w C:\WINDOWS\Help\tshoot.dll
                    - 2005-05-26 23:22:01 10,752 ----a-w C:\WINDOWS\hh.exe
                    + 2008-04-14 02:34:06 10,752 ----a-w C:\WINDOWS\hh.exe
                    - 2004-08-03 23:54:32 220,160 ----a-w C:\WINDOWS\ime\mscandui.dll
                    + 2008-04-14 02:33:30 220,160 ----a-w C:\WINDOWS\ime\mscandui.dll
                    - 2004-08-03 23:54:42 130,048 ----a-w C:\WINDOWS\ime\SOFTKBD.DLL
                    + 2008-04-14 02:33:41 130,048 ----a-w C:\WINDOWS\ime\softkbd.dll
                    - 2004-08-03 23:53:48 62,976 ----a-w C:\WINDOWS\ime\SPGRMR.dll
                    + 2008-04-13 16:43:18 62,976 ----a-w C:\WINDOWS\ime\spgrmr.dll
                    - 2004-08-03 23:54:42 272,384 ----a-w C:\WINDOWS\ime\SPTIP.dll
                    + 2008-04-14 02:33:46 272,384 ----a-w C:\WINDOWS\ime\sptip.dll
                    - 2004-08-03 23:55:02 208,896 ----a-w C:\WINDOWS\inf\unregmp2.exe
                    + 2008-04-14 02:34:26 208,896 ----a-w C:\WINDOWS\inf\unregmp2.exe
                    - 2008-09-12 14:38:38 18,718 ----a-r C:\WINDOWS\Installer\{F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}\ARPPRODUCTICON.exe
                    + 2008-09-12 16:07:06 18,718 ----a-r C:\WINDOWS\Installer\{F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}\ARPPRODUCTICON.exe
                    - 2008-09-12 14:38:38 18,718 ----a-r C:\WINDOWS\Installer\{F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe
                    + 2008-09-12 16:07:06 18,718 ----a-r C:\WINDOWS\Installer\{F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe
                    - 2008-09-12 14:38:38 57,344 ----a-r C:\WINDOWS\Installer\{F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}\NewShortcut4_C665E66BE8EF49DBB30B81BB5E60462C.exe
                    + 2008-09-12 16:07:06 57,344 ----a-r C:\WINDOWS\Installer\{F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}\NewShortcut4_C665E66BE8EF49DBB30B81BB5E60462C.exe
                    + 2008-01-18 15:13:09 2,247 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscdsbl.bat
                    + 2007-12-12 10:33:51 18,917 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscinst.vbs
                    + 2007-10-30 10:06:46 13,801 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscuinst.vbs
                    + 2008-04-14 02:33:06 25,600 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscupdc.dll
                    + 2005-03-18 14:23:10 53,248 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll
                    + 2005-03-18 14:23:10 12,800 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll
                    + 2005-03-18 14:23:14 473,600 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll
                    + 2004-09-29 10:38:58 2,676,224 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll
                    + 2005-03-18 14:23:10 145,920 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll
                    + 2005-03-18 14:23:10 159,232 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll
                    + 2005-03-18 14:23:14 364,544 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll
                    + 2005-03-18 14:23:12 178,176 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll
                    + 2005-03-18 14:23:14 223,232 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll
                    + 2004-12-01 13:53:06 2,846,720 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll
                    + 2005-02-05 17:32:54 563,712 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll
                    + 2005-03-18 15:23:14 567,296 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll
                    + 2005-05-26 13:15:56 576,000 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll
                    + 2005-07-22 15:21:34 577,024 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll
                    + 2005-09-28 12:11:52 577,536 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll
                    + 2005-12-05 15:20:50 577,536 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll
                    + 2006-02-03 05:40:48 578,560 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.dll
                    + 2006-03-31 09:27:50 578,560 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.dll
                    - 2005-09-23 05:28:58 55,488 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
                    + 2007-04-13 01:21:18 58,712 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
                    - 2005-09-23 05:28:32 10,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
                    + 2007-04-13 01:20:52 10,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
                    - 2005-09-23 05:28:32 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
                    + 2007-04-13 01:20:52 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
                    - 2005-09-23 05:28:32 23,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
                    + 2007-04-13 01:20:52 23,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
                    - 2005-09-23 05:28:32 70,656 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
                    + 2007-04-13 01:20:50 75,264 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
                    - 2005-09-23 05:28:32 26,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
                    + 2007-04-13 01:20:52 32,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
                    - 2005-09-23 05:28:32 29,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
                    + 2007-04-13 01:20:52 33,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
                    - 2005-09-23 05:28:32 29,888 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
                    + 2007-04-13 01:20:52 32,600 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
                    - 2005-09-23 05:28:32 503,808 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
                    + 2007-04-13 01:20:52 507,904 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
                    - 2005-09-23 05:28:56 88,576 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
                    + 2007-04-13 01:21:16 88,576 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
                    - 2005-09-23 05:28:38 4,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
                    + 2007-04-13 01:20:58 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
                    - 2005-09-23 05:28:56 9,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
                    + 2007-04-13 01:21:16 9,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
                    - 2005-09-23 05:28:56 224,952 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
                    + 2007-04-13 01:21:16 228,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
                    - 2005-09-23 05:28:56 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
                    + 2007-04-13 01:21:16 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
                    - 2005-09-23 05:28:48 413,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
                    + 2007-04-13 01:21:10 413,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
                    - 2005-09-23 05:28:48 647,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
                    + 2007-04-13 01:21:10 647,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
                    - 2005-09-23 05:28:48 745,472 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
                    + 2007-04-13 01:21:08 749,568 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
                    - 2005-09-23 05:28:32 87,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
                    + 2007-04-13 01:20:52 87,040 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
                    - 2005-09-23 05:28:56 800,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
                    + 2007-04-13 01:21:18 802,304 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
                    - 2005-09-23 05:28:56 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
                    + 2007-04-13 01:21:16 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
                    - 2005-09-23 05:28:56 326,144 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
                    + 2007-04-13 01:21:16 326,656 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
                    - 2005-09-23 05:28:56 4,308,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
                    + 2007-04-13 01:21:16 4,308,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
                    - 2005-09-23 05:28:56 102,400 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
                    + 2007-04-13 01:21:16 102,912 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
                    - 2005-09-23 05:28:56 226,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
                    + 2007-04-13 01:21:18 227,328 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
                    - 2005-09-23 05:28:56 66,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                    + 2007-04-13 01:21:18 68,952 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                    - 2005-09-23 05:28:50 5,615,616 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
                    + 2007-04-13 01:21:12 5,634,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
                    - 2005-09-23 05:28:56 96,440 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe
                    + 2007-04-13 01:21:16 99,152 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe
                    - 2005-09-23 05:28:56 14,848 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll
                    + 2007-04-13 01:21:18 15,360 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll
                    - 2005-09-23 05:28:50 136,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll
                    + 2007-04-13 01:21:12 136,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll
                    - 2005-09-23 05:28:56 377,344 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll
                    + 2007-04-13 01:21:18 382,464 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll
                    - 2005-09-23 05:28:56 110,592 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
                    + 2007-04-13 01:21:18 110,592 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
                    - 2005-09-23 05:28:58 389,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
                    + 2007-04-13 01:21:18 413,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
                    - 2005-09-23 05:28:56 2,878,976 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
                    + 2007-04-13 01:21:16 2,902,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
                    - 2005-09-23 05:28:56 482,304 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
                    + 2007-04-13 01:21:18 482,304 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
                    - 2005-09-23 05:28:56 716,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
                    + 2007-04-13 01:21:18 716,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
                    - 2005-09-23 05:28:38 884,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
                    + 2007-04-13 01:20:58 888,832 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
                    - 2005-09-23 05:28:56 5,050,368 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
                    + 2007-04-13 01:21:16 5,001,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
                    - 2005-09-23 05:28:56 188,416 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
                    + 2007-04-13 01:21:18 188,416 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
                    - 2005-09-23 05:28:56 3,018,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll
                    + 2007-04-13 01:21:16 2,940,928 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll
                    - 2005-09-23 05:28:56 700,416 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
                    + 2007-04-13 01:21:16 577,536 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
                    - 2005-09-23 05:28:56 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
                    + 2007-04-13 01:21:16 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
                    - 2005-09-23 05:28:56 47,616 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
                    + 2007-04-13 01:21:18 47,616 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
                    - 2005-09-23 05:28:56 114,176 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
                    + 2007-04-13 01:21:18 114,176 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
                    - 2005-09-23 05:28:56 368,640 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
                    + 2007-04-13 01:21:16 372,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
                    - 2005-09-23 05:28:56 299,008 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
                    + 2007-04-13 01:21:16 299,008 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
                    - 2005-09-23 05:28:56 260,096 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
                    + 2007-04-13 01:21:18 260,096 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
                    - 2005-09-23 05:28:56 5,025,792 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
                    + 2007-04-13 01:21:16 5,156,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
                    - 2005-09-23 05:28:56 5,316,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
                    + 2007-04-13 01:21:16 5,152,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
                    - 2005-09-23 05:28:56 2,035,712 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
                    + 2007-04-13 01:21:16 2,027,520 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
                    - 2005-09-23 05:29:06 1,140,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    + 2007-04-13 01:21:28 1,166,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    - 2005-09-23 05:28:30 1,306,624 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
                    + 2007-04-13 01:20:50 1,330,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
                    - 2005-09-23 05:28:32 298,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll
                    + 2007-04-13 01:20:52 406,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll
                    - 2004-08-03 23:54:22 24,064 ----a-w C:\WINDOWS\msagent\agentanm.dll
                    + 2008-04-14 02:33:18 24,064 ----a-w C:\WINDOWS\msagent\agentanm.dll
                    - 2004-08-03 23:54:22 214,016 ----a-w C:\WINDOWS\msagent\agentctl.dll
                    + 2008-04-14 02:33:18 214,016 ----a-w C:\WINDOWS\msagent\agentctl.dll
                    - 2006-10-12 14:04:13 42,496 ----a-w C:\WINDOWS\msagent\agentdp2.dll
                    + 2008-04-14 02:33:18 42,496 ----a-w C:\WINDOWS\msagent\agentdp2.dll
                    - 2007-03-09 13:48:06 57,344 ----a-w C:\WINDOWS\msagent\agentdpv.dll
                    + 2008-04-14 02:33:18 57,344 ----a-w C:\WINDOWS\msagent\agentdpv.dll
                    - 2004-08-03 23:54:22 49,152 ----a-w C:\WINDOWS\msagent\agentmpx.dll
                    + 2008-04-14 02:33:18 49,152 ----a-w C:\WINDOWS\msagent\agentmpx.dll
                    - 2004-08-03 23:54:22 24,064 ----a-w C:\WINDOWS\msagent\agentpsh.dll
                    + 2008-04-14 02:33:18 24,064 ----a-w C:\WINDOWS\msagent\agentpsh.dll
                    - 2004-08-03 23:54:22 44,032 ----a-w C:\WINDOWS\msagent\agentsr.dll
                    + 2008-04-14 02:33:18 44,032 ----a-w C:\WINDOWS\msagent\agentsr.dll
                    - 2006-10-12 11:09:53 256,512 ----a-w C:\WINDOWS\msagent\agentsvr.exe
                    + 2008-04-14 02:33:53 256,512 ----a-w C:\WINDOWS\msagent\agentsvr.exe
                    - 2004-08-03 23:54:22 24,064 ----a-w C:\WINDOWS\msagent\agtintl.dll
                    + 2008-04-14 02:33:19 24,064 ----a-w C:\WINDOWS\msagent\agtintl.dll
                    - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0405.dll
                    + 2007-04-02 18:25:59 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0405.dll
                    - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0406.dll
                    + 2007-04-02 18:25:59 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0406.dll
                    - 2001-08-28 11:00:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt0407.dll
                    + 2007-04-02 18:26:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt0407.dll
                    - 2001-08-28 11:00:00 22,016 ----a-w C:\WINDOWS\msagent\intl\agt0408.dll
                    + 2007-04-02 18:26:00 22,016 ----a-w C:\WINDOWS\msagent\intl\agt0408.dll
                    - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0409.dll
                    + 2008-04-13 17:32:28 19,968 ----a-w C:\WINDOWS\msagent\intl\agt0409.dll
                    - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt040b.dll
                    + 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt040b.dll
                    - 2001-08-28 11:00:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt040c.dll
                    + 2007-04-02 18:26:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt040c.dll
                    - 2001-08-28 11:00:00 19,968 ----a-w C:\WINDOWS\msagent\intl\agt040e.dll
                    + 2007-04-02 18:26:00 19,968 ----a-w C:\WINDOWS\msagent\intl\agt040e.dll
                    - 2001-08-28 11:00:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0410.dll
                    + 2007-04-02 18:26:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0410.dll
                    - 2001-08-28 11:00:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0413.dll
                    + 2007-04-02 18:26:01 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0413.dll
                    - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0414.dll
                    + 2007-04-02 18:26:01 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0414.dll
                    - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0415.dll
                    + 2007-04-02 18:26:01 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0415.dll
                    - 2001-08-28 11:00:00 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0416.dll
                    + 2007-04-02 18:26:01 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0416.dll
                    - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0419.dll
                    + 2007-04-02 18:26:01 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0419.dll
                    - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041d.dll
                    + 2007-04-02 18:26:01 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041d.dll
                    - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041f.dll
                    + 2007-04-02 18:26:01 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041f.dll
                    - 2001-08-28 11:00:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0816.dll
                    + 2007-04-02 18:26:02 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0816.dll
                    - 2001-08-28 11:00:00 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0c0a.dll
                    + 2007-04-02 18:26:02 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0c0a.dll
                    - 2004-08-03 23:54:34 39,936 ----a-w C:\WINDOWS\msagent\mslwvtts.dll
                    + 2008-04-14 02:33:32 39,936 ----a-w C:\WINDOWS\msagent\mslwvtts.dll
                    + 2008-04-14 02:33:22 33,792 ------w C:\WINDOWS\network diagnostic\custsat.dll
                    + 2008-04-13 18:53:32 558,080 ------w C:\WINDOWS\network diagnostic\xpnetdiag.exe
                    - 2004-08-03 23:55:00 70,656 ----a-w C:\WINDOWS\NOTEPAD.EXE
                    + 2008-04-14 02:34:15 70,656 ----a-w C:\WINDOWS\notepad.exe
                    - 2004-08-03 23:54:52 768,512 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
                    + 2008-04-14 02:34:06 769,024 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
                    - 2004-08-03 23:54:52 743,936 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe
                    + 2008-04-14 02:34:06 744,448 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\helpsvc.exe
                    - 2004-08-03 23:54:52 18,944 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe
                    + 2008-04-14 02:34:06 18,432 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\hscupd.exe
                    - 2004-08-03 23:54:58 160,768 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
                    + 2008-04-14 02:34:12 172,544 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
                    - 2004-08-03 23:54:34 381,952 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msinfo.dll
                    + 2008-04-14 02:33:32 382,464 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msinfo.dll
                    - 2004-08-03 23:54:36 102,400 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchshell.dll
                    + 2008-04-14 02:33:38 102,912 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchshell.dll
                    - 2004-08-03 23:54:36 38,912 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll
                    + 2008-04-14 02:33:38 38,400 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll
                    - 2008-01-08 16:34:53 86,331 ----a-w C:\WINDOWS\pchealth\helpctr\OfflineCache\index.dat
                    + 2008-09-15 20:13:16 86,331 ----a-w C:\WINDOWS\pchealth\helpctr\OfflineCache\index.dat
                    - 2008-01-08 16:34:53 2,430 ----a-w C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
                    + 2008-09-15 20:13:16 2,744 ----a-w C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
                    - 2004-08-03 23:55:02 151,040 ----a-w C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe
                    + 2008-04-14 02:34:26 151,040 ----a-w C:\WINDOWS\pchealth\UploadLB\Binaries\uploadm.exe
                    - 2004-08-03 23:54:42 151,552 ----a-w C:\WINDOWS\PeerNet\sqldb20.dll
                    + 2008-04-14 02:33:46 151,552 ----a-w C:\WINDOWS\PeerNet\sqldb20.dll
                    - 2004-08-03 23:54:42 462,848 ----a-w C:\WINDOWS\PeerNet\sqlqp20.dll
                    + 2008-04-14 02:33:46 462,848 ----a-w C:\WINDOWS\PeerNet\sqlqp20.dll
                    - 2004-08-03 23:54:42 110,592 ----a-w C:\WINDOWS\PeerNet\sqlse20.dll
                    + 2008-04-14 02:33:46 110,592 ----a-w C:\WINDOWS\PeerNet\sqlse20.dll
                    - 2004-08-03 23:55:02 153,088 ----a-w C:\WINDOWS\regedit.exe
                    + 2008-04-14 02:34:19 153,088 ----a-w C:\WINDOWS\regedit.exe
                    + 2008-04-13 18:46:18 53,376 ------w C:\WINDOWS\ServicePackFiles\i386\1394bus.sys
                    + 2008-04-13 18:40:50 12,288 ------w C:\WINDOWS\ServicePackFiles\i386\4mmdat.sys
                    + 2008-04-13 18:46:20 48,128 ------w C:\WINDOWS\ServicePackFiles\i386\61883.sys
                    + 2008-04-14 02:33:18 100,352 ------w C:\WINDOWS\ServicePackFiles\i386\6to4svc.dll
                    + 2008-04-14 02:33:18 136,192 ------w C:\WINDOWS\ServicePackFiles\i386\aaclient.dll
                    + 2004-08-03 20:32:22 231,552 ------w C:\WINDOWS\ServicePackFiles\i386\ac97ali.sys
                    + 2004-08-03 20:32:32 84,480 ------w C:\WINDOWS\ServicePackFiles\i386\ac97via.sys
                    + 2008-04-14 02:33:18 39,424 ------w C:\WINDOWS\ServicePackFiles\i386\acadproc.dll
                    + 2008-04-14 02:33:53 190,464 ------w C:\WINDOWS\ServicePackFiles\i386\accwiz.exe
                    + 2008-04-14 02:33:18 1,852,928 ------w C:\WINDOWS\ServicePackFiles\i386\acgenral.dll
                    + 2008-04-14 02:33:18 451,072 ------w C:\WINDOWS\ServicePackFiles\i386\aclayers.dll
                    + 2008-04-14 02:33:18 141,312 ------w C:\WINDOWS\ServicePackFiles\i386\aclua.dll
                    + 2008-04-14 02:33:18 120,320 ------w C:\WINDOWS\ServicePackFiles\i386\aclui.dll
                    + 2008-04-14 01:52:42 188,672 ------w C:\WINDOWS\ServicePackFiles\i386\acpi.sys
                    + 2008-04-14 02:33:18 245,248 ------w C:\WINDOWS\ServicePackFiles\i386\acspecfc.dll
                    + 2008-04-14 02:33:18 193,536 ------w C:\WINDOWS\ServicePackFiles\i386\activeds.dll
                    + 2008-04-14 02:33:53 4,096 ------w C:\WINDOWS\ServicePackFiles\i386\actmovie.exe
                    + 2008-04-14 02:33:18 98,304 ------w C:\WINDOWS\ServicePackFiles\i386\actxprxy.dll
                    + 2008-04-14 02:33:18 116,224 ------w C:\WINDOWS\ServicePackFiles\i386\acxtrnal.dll
                    + 2008-04-14 02:33:18 29,696 ------w C:\WINDOWS\ServicePackFiles\i386\admexs.dll
                    + 2008-04-14 02:33:18 20,540 ------w C:\WINDOWS\ServicePackFiles\i386\admin.dll
                    + 2008-04-14 02:33:53 16,439 ------w C:\WINDOWS\ServicePackFiles\i386\admin.exe
                    + 2004-08-03 20:32:24 10,880 ------w C:\WINDOWS\ServicePackFiles\i386\admjoy.sys
                    + 2008-04-14 02:33:18 61,440 ------w C:\WINDOWS\ServicePackFiles\i386\admparse.dll
                    + 2008-04-14 02:33:18 43,520 ------w C:\WINDOWS\ServicePackFiles\i386\admwprox.dll
                    + 2008-04-14 02:33:18 290,816 ------w C:\WINDOWS\ServicePackFiles\i386\adsiis51.dll
                    + 2008-04-14 02:33:18 175,616 ------w C:\WINDOWS\ServicePackFiles\i386\adsldp.dll
                    + 2008-04-14 02:33:18 143,360 ------w C:\WINDOWS\ServicePackFiles\i386\adsldpc.dll
                    + 2008-04-14 02:33:18 68,096 ------w C:\WINDOWS\ServicePackFiles\i386\adsmsext.dll
                    + 2008-04-14 02:33:18 263,680 ------w C:\WINDOWS\ServicePackFiles\i386\adsnt.dll
                    + 2008-04-14 02:33:18 123,392 ------w C:\WINDOWS\ServicePackFiles\i386\adsnw.dll
                    + 2007-04-02 13:10:44 85,813 ------w C:\WINDOWS\ServicePackFiles\i386\adsutil.vbs
                    + 2008-04-14 02:33:18 4,255 ------w C:\WINDOWS\ServicePackFiles\i386\adv01nt5.dll
                    + 2008-04-14 02:33:18 3,967 ------w C:\WINDOWS\ServicePackFiles\i386\adv02nt5.dll
                    + 2008-04-14 02:33:18 3,615 ------w C:\WINDOWS\ServicePackFiles\i386\adv05nt5.dll
                    + 2008-04-14 02:33:18 3,647 ------w C:\WINDOWS\ServicePackFiles\i386\adv07nt5.dll
                    + 2008-04-14 02:33:18 3,135 ------w C:\WINDOWS\ServicePackFiles\i386\adv08nt5.dll
                    + 2008-04-14 02:33:18 3,711 ------w C:\WINDOWS\ServicePackFiles\i386\adv09nt5.dll
                    + 2008-04-14 02:33:18 3,775 ------w C:\WINDOWS\ServicePackFiles\i386\adv11nt5.dll
                    + 2008-04-14 02:33:18 685,568 ------w C:\WINDOWS\ServicePackFiles\i386\advapi32.dll
                    + 2008-04-14 02:33:18 101,888 ------w C:\WINDOWS\ServicePackFiles\i386\advpack.dll
                    + 2008-04-13 16:39:23 142,592 ------w C:\WINDOWS\ServicePackFiles\i386\aec.sys
                    + 2008-04-13 19:19:23 138,112 ------w C:\WINDOWS\ServicePackFiles\i386\afd.sys
                    + 2008-04-14 02:33:18 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agentanm.dll
                    + 2008-04-14 02:33:18 214,016 ------w C:\WINDOWS\ServicePackFiles\i386\agentctl.dll
                    + 2008-04-14 02:33:18 42,496 ------w C:\WINDOWS\ServicePackFiles\i386\agentdp2.dll
                    + 2008-04-14 02:33:18 57,344 ------w C:\WINDOWS\ServicePackFiles\i386\agentdpv.dll
                    + 2008-04-14 02:33:18 49,152 ------w C:\WINDOWS\ServicePackFiles\i386\agentmpx.dll
                    + 2008-04-14 02:33:18 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agentpsh.dll
                    + 2008-04-14 02:33:18 44,032 ------w C:\WINDOWS\ServicePackFiles\i386\agentsr.dll
                    + 2008-04-14 02:33:53 256,512 ------w C:\WINDOWS\ServicePackFiles\i386\agentsvr.exe
                    + 2008-04-13 18:36:38 42,368 ------w C:\WINDOWS\ServicePackFiles\i386\agp440.sys
                    + 2008-04-13 18:36:39 44,928 ------w C:\WINDOWS\ServicePackFiles\i386\agpcpq.sys
                    + 2007-04-02 18:25:59 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0401.dll
                    + 2007-04-02 18:25:59 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0404.dll
                    + 2007-04-02 18:25:59 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0405.dll
                    + 2007-04-02 18:25:59 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0406.dll
                    + 2007-04-02 18:26:00 21,504 ------w C:\WINDOWS\ServicePackFiles\i386\agt0407.dll
                    + 2007-04-02 18:26:00 22,016 ------w C:\WINDOWS\ServicePackFiles\i386\agt0408.dll
                    + 2008-04-13 17:32:28 19,968 ------w C:\WINDOWS\ServicePackFiles\i386\agt0409.dll
                    + 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt040b.dll
                    + 2007-04-02 18:26:00 21,504 ------w C:\WINDOWS\ServicePackFiles\i386\agt040c.dll
                    + 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt040d.dll
                    + 2007-04-02 18:26:00 19,968 ------w C:\WINDOWS\ServicePackFiles\i386\agt040e.dll
                    + 2007-04-02 18:26:00 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\agt0410.dll
                    + 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0411.dll
                    + 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0412.dll
                    + 2007-04-02 18:26:01 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\agt0413.dll
                    + 2007-04-02 18:26:01 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0414.dll
                    + 2007-04-02 18:26:01 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0415.dll
                    + 2007-04-02 18:26:01 20,480 ------w C:\WINDOWS\ServicePackFiles\i386\agt0416.dll
                    + 2007-04-02 18:26:01 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0419.dll
                    + 2007-04-02 18:26:01 19,456 ------w C:\WINDOWS\Servi
                    -1
                    1. Contributeur sécurité
                      Ok, peux-tu poster un nouveau rapport hijackthis stp ?
                      1