Votre question

Probleme - Trojan-Proxy.Win32.Sefbov!IK

Tags :
  • Sécurité
Dernière réponse : dans Sécurité et virus
5 Août 2009 19:24:20

Bonsoir,

Je me permet de poster sur le forum suite à une analyse avec A-squared Anti-Malware. celui-ci trouve plusieurs infections Trojan-Proxy.Win32.Sefbov!IK, et il m'est impossible de le suprimer ou de le deplacer en quarantaine.

De plus mon ordinateur à un probleme apparemment lié, de redirection anarchique de lien google.
On fait une recherche on trouve les reponses et quand on clique, on se retrouve sur des pages publicitaires sans aucun rapport.

Merci de me venir en aide il semble "selon le programme" que le risque soit haut.

Pour information
PC intel core quad Q8200 2.33Ghz
Vista Premium 32 Bit
BitDefender total Security 2008

Voici le rapport du Scan Rusé:

Version - a-squared Anti-Malware 4.5
Dernière mise à jour : 05/08/2009 14:24:32

Paramètres des balayages :

Type de numérisation : Scan Rusé
Éléments : Mémoire, Traces, Cookies, C:\Windows\, C:\Program Files
Balaye dans les archives : Marche
Analyse heuristique : Arrêt
Balaye dans les ADS : Marche

Début du balayage : 05/08/2009 17:55:40

[2516] C:\Windows\Temp\kvcafctxew.exe Objets détectés : Trojan-Proxy.Win32.Sefbov!IK
C:\Windows\Temp\kvcafctxew.exe Objets détectés : Trojan-Proxy.Win32.Sefbov!IK

Analysé

Fichiers : 129058
Traces : 605844
Cookies : 2
Processus : 57

Objets trouvés

Fichiers : 1
Traces : 0
Cookies : 0
Processus : 1
Clés de Registre : 0

Fin du balayage : 05/08/2009 18:36:41
Temps du balayage : 0:41:01

Autres pages sur : probleme trojan proxy win32 sefbov

a c 327 8 Sécurité
5 Août 2009 20:02:27

Bonjour,

  • Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.
  • Double-clique sur RSIT.exe afin de lancer le programme.
    (Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)
  • Clique sur Continue à l'écran Disclaimer.
  • Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
  • Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

    Note : les rapports sont sauvegardés dans le dossier C:\rsit.
    6 Août 2009 09:21:59

    Merci beaucoup de ton aide.

    Voila donc les 2 rapports:

    - Log:

    Logfile of random's system information tool 1.06 (written by random/random)
    Run by Nono at 2009-08-06 09:19:30
    Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
    System drive C: has 44 GB (43%) free of 102 GB
    Total RAM: 3582 MB (66% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 09:19:31, on 06/08/2009
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v8.00 (8.00.6001.18813)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\USB Disk Win98 Driver\Res.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
    C:\Users\Nono\Desktop\RSIT.exe
    C:\Program Files\trend micro\Nono.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [EasyTuneVPro] C:\Program Files\Gigabyte\ET5Pro\ETcall.exe
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
    O4 - HKLM\..\Run: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
    O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.ap...
    O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/cert...
    O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://ccfiles.creative.com/Web/softwareupdate/su/ocx/1...
    O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSig...
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/fl...
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/...
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
    O23 - Service: Expérience d’application AeLookupSvcALG (AeLookupSvcALG) - Unknown owner - C:\Windows\TEMP\kvcafctxew.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
    O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\GEST\GSvr.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
    O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 7516 bytes

    ======Scheduled tasks folder======

    C:\Windows\tasks\User_Feed_Synchronization-{75316F05-6022-4151-BF2B-3B501A87030A}.job
    C:\Windows\tasks\User_Feed_Synchronization-{FF4B7D71-F587-42D8-B738-DED8092258BB}.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
    Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
    Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll [2008-02-28 86016]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
    "GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
    "StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-08-01 61440]
    "RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-02-13 4915200]
    "Skytel"=C:\Windows\Skytel.exe [2007-11-20 1826816]
    "EasyTuneVPro"=C:\Program Files\Gigabyte\ET5Pro\ETcall.exe [2007-07-26 20480]
    "ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-02-17 81920]
    "BitDefender Antiphishing Helper"=C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe [2007-10-09 61440]
    "BDAgent"=C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe [2008-09-04 368640]
    "P17RunE"=RunDll32 P17RunE.dll,RunDLLEntry []
    "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
    "WinampAgent"=C:\Program Files\Winamp\winampa.exe [2009-04-10 37888]
    "USB Storage Toolbox"=C:\Program Files\USB Disk Win98 Driver\Res.EXE [2005-09-14 65536]
    "a-squared"=C:\Program Files\a-squared Anti-Malware\a2guard.exe [2009-08-05 3208848]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-21 1233920]
    "ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]
    "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]
    "EA Core"=C:\Program Files\Electronic Arts\EADM\Core.exe [2009-03-28 3325952]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername"=0
    "legalnoticecaption"=
    "legalnoticetext"=
    "shutdownwithoutlogon"=1
    "undockwithoutlogon"=1
    "EnableUIADesktopToggle"=0

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{202efee8-6faf-11de-8446-001fd0846650}]
    shell\AutoRun\command - K:\EmDesk.exe
    shell\EmDesk\command - K:\EmDesk.exe


    ======File associations======

    .js - edit - C:\Windows\System32\Notepad.exe %1
    .js - open - C:\Windows\System32\WScript.exe "%1" %*

    ======List of files/folders created in the last 3 months======

    2009-08-06 09:14:32 ----D---- C:\Program Files\trend micro
    2009-08-06 09:14:31 ----D---- C:\rsit
    2009-08-05 17:50:08 ----A---- C:\Windows\system32\CF28644.exe
    2009-08-05 17:50:06 ----A---- C:\Windows\system32\swsc.exe
    2009-08-05 17:49:33 ----D---- C:\Qoobox
    2009-08-05 17:49:20 ----A---- C:\Bug.txt
    2009-08-05 14:21:35 ----D---- C:\Program Files\a-squared Anti-Malware
    2009-08-05 13:56:47 ----D---- C:\Users\Nono\AppData\Roaming\Yahoo!
    2009-08-05 13:56:46 ----D---- C:\Program Files\Yahoo!
    2009-08-05 13:56:44 ----D---- C:\Program Files\CCleaner
    2009-08-05 10:00:33 ----D---- C:\Program Files\a-squared Free
    2009-08-04 09:58:38 ----D---- C:\Program Files\QuickTime
    2009-07-31 15:47:39 ----D---- C:\Program Files\Freeplayer
    2009-07-31 11:56:54 ----D---- C:\Program Files\Ultimate Pinball Gold
    2009-07-29 08:48:35 ----A---- C:\Windows\system32\mshtml.dll
    2009-07-29 08:48:35 ----A---- C:\Windows\system32\ieframe.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\wininet.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\urlmon.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\occache.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\msfeedssync.exe
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\msfeedsbs.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\msfeeds.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\jsproxy.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\ieUnatt.exe
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\ieui.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\iesysprep.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\iesetup.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\iertutil.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\iernonce.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\iepeers.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\iedkcs32.dll
    2009-07-29 08:48:34 ----A---- C:\Windows\system32\ie4uinit.exe
    2009-07-23 20:40:25 ----D---- C:\Program Files\Common Files\SWF Studio
    2009-07-23 20:40:20 ----D---- C:\Program Files\USB Disk Win98 Driver
    2009-07-22 09:54:19 ----D---- C:\Users\Nono\AppData\Roaming\vlc
    2009-07-15 15:05:28 ----A---- C:\Windows\system32\t2embed.dll
    2009-07-15 15:05:28 ----A---- C:\Windows\system32\fontsub.dll
    2009-07-15 15:05:28 ----A---- C:\Windows\system32\dciman32.dll
    2009-07-15 15:05:28 ----A---- C:\Windows\system32\atmfd.dll
    2009-06-29 14:00:36 ----D---- C:\Users\Nono\AppData\Roaming\PhotoFiltre Studio X
    2009-06-29 14:00:33 ----D---- C:\Program Files\PhotoFiltre Studio X
    2009-06-13 09:30:31 ----A---- C:\Windows\system32\psisdecd.dll
    2009-06-13 09:30:31 ----A---- C:\Windows\system32\EncDec.dll
    2009-06-12 10:54:57 ----A---- C:\Windows\system32\localspl.dll
    2009-06-12 10:54:52 ----A---- C:\Windows\system32\rpcrt4.dll
    2009-05-27 14:12:15 ----D---- C:\Program Files\Electronic Arts
    2009-05-27 10:14:52 ----A---- C:\Windows\system32\vp6vfw.dll
    2009-05-27 10:14:50 ----D---- C:\Program Files\Microsoft WSE
    2009-05-27 09:56:24 ----D---- C:\Program Files\Undisker
    2009-05-23 12:06:06 ----D---- C:\ProgramData\Last.fm
    2009-05-23 12:05:38 ----D---- C:\Program Files\Last.fm
    2009-05-11 19:47:57 ----D---- C:\Program Files\Common Files\PX Storage Engine
    2009-05-11 19:47:54 ----D---- C:\Users\Nono\AppData\Roaming\Winamp
    2009-05-11 19:47:54 ----D---- C:\Program Files\Winamp
    2009-05-08 11:16:30 ----D---- C:\ProgramData\The Humans
    2009-05-08 11:10:30 ----D---- C:\Windows\system32\URTTEMP
    2009-05-08 10:49:10 ----D---- C:\ProgramData\eSellerate

    ======List of files/folders modified in the last 3 months======

    2009-08-06 09:19:31 ----D---- C:\Windows\Temp
    2009-08-06 09:18:46 ----D---- C:\Windows\Prefetch
    2009-08-06 09:15:55 ----D---- C:\Windows\System32
    2009-08-06 09:15:55 ----D---- C:\Windows\inf
    2009-08-06 09:15:55 ----A---- C:\Windows\system32\PerfStringBackup.INI
    2009-08-06 09:14:32 ----RD---- C:\Program Files
    2009-08-06 09:10:04 ----D---- C:\Windows
    2009-08-05 18:46:35 ----D---- C:\Windows\system32\drivers
    2009-08-05 17:50:07 ----D---- C:\Windows\system32\fr-FR
    2009-08-05 14:19:03 ----HD---- C:\ProgramData
    2009-08-05 14:00:39 ----D---- C:\Users\Nono\AppData\Roaming\Azureus
    2009-08-05 14:00:37 ----D---- C:\Windows\system32\LogFiles
    2009-08-05 14:00:37 ----D---- C:\Windows\Debug
    2009-08-05 10:03:25 ----D---- C:\Users\Nono\AppData\Roaming\GrabIt
    2009-08-04 09:58:40 ----SD---- C:\Windows\Downloaded Program Files
    2009-08-01 11:26:37 ----D---- C:\Windows\system32\catroot2
    2009-07-31 11:15:27 ----SHD---- C:\System Volume Information
    2009-07-29 18:40:57 ----D---- C:\Windows\system32\migration
    2009-07-29 18:40:57 ----D---- C:\Program Files\Internet Explorer
    2009-07-29 09:31:12 ----D---- C:\Windows\winsxs
    2009-07-29 09:30:59 ----SHD---- C:\Windows\Installer
    2009-07-29 08:48:03 ----D---- C:\Windows\system32\catroot
    2009-07-27 20:25:37 ----D---- C:\Users\Nono\AppData\Roaming\Adobe
    2009-07-27 20:25:37 ----D---- C:\ProgramData\Adobe
    2009-07-23 20:42:48 ----SD---- C:\Users\Nono\AppData\Roaming\Microsoft
    2009-07-23 20:40:25 ----D---- C:\Program Files\Common Files
    2009-07-23 20:40:22 ----HD---- C:\Program Files\InstallShield Installation Information
    2009-07-16 17:37:46 ----D---- C:\Program Files\Windows Mail
    2009-07-15 15:52:59 ----D---- C:\ProgramData\Microsoft Help
    2009-07-07 17:10:56 ----A---- C:\Windows\system32\mrt.exe
    2009-06-29 14:00:38 ----D---- C:\Users\Nono\AppData\Roaming\Identities
    2009-06-13 09:47:12 ----D---- C:\Windows\ehome
    2009-06-07 13:58:18 ----D---- C:\Windows\system32\WDI
    2009-05-27 14:13:02 ----D---- C:\ProgramData\Electronic Arts
    2009-05-27 10:14:52 ----RSD---- C:\Windows\assembly
    2009-05-23 12:06:10 ----D---- C:\Program Files\Windows Media Player
    2009-05-18 16:36:40 ----D---- C:\Program Files\Common Files\Nero
    2009-05-18 16:35:08 ----D---- C:\ProgramData\Nero
    2009-05-18 16:22:14 ----D---- C:\Program Files\Nero
    2009-05-18 16:21:43 ----A---- C:\Windows\Irremote.ini
    2009-05-10 18:26:10 ----RSD---- C:\Windows\Fonts
    2009-05-10 18:26:07 ----D---- C:\Program Files\Common Files\microsoft shared
    2009-05-10 18:25:58 ----D---- C:\Program Files\Microsoft Works
    2009-05-10 18:24:35 ----D---- C:\Program Files\Common Files\System
    2009-05-10 18:24:35 ----A---- C:\Windows\win.ini
    2009-05-10 18:22:56 ----D---- C:\Windows\Registration
    2009-05-08 16:11:54 ----D---- C:\Program Files\Microsoft Games

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 bdftdif;bdftdif; \??\C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys [2008-01-25 156688]
    R1 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2006-07-24 5632]
    R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-09-03 3929600]
    R3 Bdfndisf;BitDefender Firewall NDIS Filter Service; C:\Windows\system32\DRIVERS\bdfndisf.sys [2008-06-02 86792]
    R3 bdfsfltr;bdfsfltr; C:\Windows\system32\DRIVERS\bdfsfltr.sys [2008-01-07 196368]
    R3 BDSelfPr;BDSelfPr; \??\C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys [2008-01-16 8320]
    R3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
    R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-02-14 2061528]
    R3 P17;SB Live! 24-bit; C:\Windows\system32\drivers\P17.sys [2007-11-15 1136128]
    R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-01-25 106496]
    R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
    S3 ASPI;Advanced SCSI Programming Interface Driver; \??\C:\Windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
    S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
    S3 ET5Drv;ET5Drv; \??\C:\Windows\system32\Drivers\ET5Drv.sys [2007-10-11 30008]
    S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2009-03-08 16608]
    S3 GVTDrv;GVTDrv; \??\C:\Windows\system32\Drivers\GVTDrv.sys [2009-08-01 24944]
    S3 MarkFun_NT;MarkFun_NT; \??\C:\Program Files\GIGABYTE\ET5Pro\markfun.w32 [2007-08-21 17912]
    S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
    S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
    S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
    S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
    S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:\Windows\system32\DRIVERS\ssm_bus.sys [2007-05-02 83592]
    S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:\Windows\system32\DRIVERS\ssm_mdfl.sys [2007-05-02 15112]
    S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers; C:\Windows\system32\DRIVERS\ssm_mdm.sys [2007-05-02 109704]
    S3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]
    S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-21 39936]
    S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
    S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
    S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-21 11264]

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 a2AntiMalware;a-squared Anti-Malware Service; C:\Program Files\a-squared Anti-Malware\a2service.exe [2009-07-13 719392]
    R2 a2free;a-squared Free Service; C:\Program Files\a-squared Free\a2service.exe [2009-07-13 719392]
    R2 AeLookupSvcALG;Expérience d’application AeLookupSvcALG; C:\Windows\TEMP\kvcafctxew.exe [2009-08-05 40448]
    R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-09-03 704512]
    R2 LIVESRV;BitDefender Desktop Update Service; C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe [2008-11-18 1179648]
    R2 VSSERV;BitDefender Virus Shield; C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe [2008-08-29 1261568]
    R2 XCOMM;BitDefender Communicator; C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe [2007-11-27 86016]
    R3 scan;BitDefender Threat Scanner; C:\Windows\System32\svchost.exe [2008-01-21 21504]
    S2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe []
    S3 aspnet_state;Service d'état ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-27 34312]
    S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2009-03-07 79360]
    S3 GEST Service;GEST Service for program management.; C:\Program Files\GIGABYTE\GEST\GSvr.exe [2007-12-14 47624]
    S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
    S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
    S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
    S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

    -----------------EOF-----------------


    - Info :

    info.txt logfile of random's system information tool 1.06 2009-08-06 09:19:33

    ======Uninstall list======

    @BIOS -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}\setup.exe" -l0x9 -removeonly
    -->"C:\Program Files\Creative Installation Information\CREATIVE_MEDIASOURCE_U\Setup.exe" /remove /nolog/l0x040c
    -->"C:\Program Files\Creative Installation Information\E-CENTER_NET_CONTENT_U\Setup.exe" /remove /nolog/l0x040c
    -->"C:\Program Files\Creative Installation Information\E-CENTER_PLUGIN_CDBURNER_U\Setup.exe" /remove /l0x040c
    -->"C:\Program Files\Creative Installation Information\E-CENTER_PLUGIN_MINIDISC_U\Setup.exe" /remove /nolog/l0x040c
    -->"C:\Program Files\Creative Installation Information\E-CENTER_PLUGIN_ONLINESTORE_U\Setup.exe" /remove /nolog/l0x040c
    -->"C:\Program Files\Creative Installation Information\MEDIASOURCE_PLAYER_SKINPACK_U\Setup.exe" /remove /nolog/l0x040c
    -->"C:\Program Files\Creative\Sound Blaster X-Fi\Program\SETUP.EXE" /S /U /W /L:FRN
    -->MsiExec /X{8AAB4176-A747-493A-A42C-B63CFADFD8E3}
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12321490-F573-4815-B6CC-7ABEF18C9AC4}\setup.exe" -l0x40c
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x40c
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2670895A-4E6C-4450-B868-7B7DB80A3357}\setup.exe" -l0x40c
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x40c
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x40c /remove
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7AB55EC6-1158-41EF-B87D-90555A8F5C92}\setup.exe" -l0x40c
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7AB55EC6-1158-41EF-B87D-90555A8F5C92}\setup.exe" -l0x40c /remove
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{84F573D3-0F71-4768-978A-D35310E3FBA6}\setup.exe" -l0x40c
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{84F573D3-0F71-4768-978A-D35310E3FBA6}\setup.exe" -l0x40c /remove
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{888347B3-AEC5-4BB5-8BAB-781D72A57C73}\setup.exe" -l0x40c
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{888347B3-AEC5-4BB5-8BAB-781D72A57C73}\setup.exe" -l0x40c /remove
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\setup.exe" -l0x40c
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA9944C8-7D34-475E-8C90-2788685B2C47}\setup.exe" -l0x40c
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA9944C8-7D34-475E-8C90-2788685B2C47}\setup.exe" -l0x40c /remove
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AAEF329E-F353-46C9-933D-24A571986093}\setup.exe" -l0x40c
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AAEF329E-F353-46C9-933D-24A571986093}\setup.exe" -l0x40c /remove
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C88C3C27-AECE-4137-A6CC-D7A6FFAD2F84}\setup.exe" -l0x40c
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C88C3C27-AECE-4137-A6CC-D7A6FFAD2F84}\setup.exe" -l0x40c /remove
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FBFF2411-D066-4D24-BCE0-893086009E1B}\setup.exe" -l0x40c
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FBFF2411-D066-4D24-BCE0-893086009E1B}\setup.exe" -l0x40c /remove
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FCCDA302-32D9-4AE7-A094-4BE677554F26}\setup.exe" -l0x40c
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FCCDA302-32D9-4AE7-A094-4BE677554F26}\setup.exe" -l0x40c /remove
    Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Illustrator CS-->RunDll32 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{91A4AD99-69CE-4745-97B7-0E0DFBECFDE5}\setup.exe"
    Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
    Adobe SVG Viewer 3.0-->C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Install.log
    Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
    a-squared Anti-Malware 4.5-->"C:\Program Files\a-squared Anti-Malware\unins000.exe"
    a-squared Free 4.5-->"C:\Program Files\a-squared Free\unins000.exe"
    ATI AVIVO Codecs-->MsiExec.exe /I{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}
    AviSynth 2.5-->"E:\AviSynth\AviSynth 2.5\Uninstall.exe"
    Axis Camera Explorer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3D6E2470-E584-11D4-B097-009027BD8645}\Setup.exe" -l0x9 -uninst
    BitDefender Total Security 2008-->MsiExec.exe /I{E404EFD4-6110-413C-AD1A-D6D0F261960E}
    Catalyst Control Center - Branding-->MsiExec.exe /I{FA3A247D-437A-455E-A88F-7EB6E5F9E799}
    CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
    Creative ALchemy-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12321490-F573-4815-B6CC-7ABEF18C9AC4}\setup.exe" -l0x40c /remove
    Creative Audio Console-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x40c /remove
    Creative MediaSource 5-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}\SETUP.EXE" -l0x40c /remove
    Creative Software AutoUpdate-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\setup.exe" -l0x40c /remove
    Creative WaveStudio 7-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2670895A-4E6C-4450-B868-7B7DB80A3357}\setup.exe" -l0x40c /remove
    DMIView B06.1227.01-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3EE1008C-11A1-4F4F-8DB7-27573924DE78}\setup.exe" -l0x9 -removeonly
    Dynamic Energy Saver 1.0 B8.0128.1-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5869CE1E-BC0B-4648-B1AE-6EF4A985590C}\setup.exe" -l0x9 -removeonly
    EA Download Manager-->C:\Program Files\Electronic Arts\EADM\Uninstall.exe
    EasyTune5Pro-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Gigabyte\ET5Pro\Uninst.isu" -c"C:\Program Files\Gigabyte\ET5Pro\uninstdrv.dll"
    EPSON PRINT Image Framer Tool-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{19D2B63E-C1F1-4803-BA8B-4AB8FE216952}\setup.exe" -l0x40c anything
    EPSON Scan-->C:\Program Files\epson\escndv\setup\setup.exe /r
    Face_Wizard B07.1219.01-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E76FCE6B-9999-4250-8C75-B2DA4AD41268}\setup.exe" -l0x9 -removeonly
    Free CD Ripper V 1.8-->"C:\Program Files\Free Audio Pack\Free CD Ripper\unins000.exe"
    Freeplayer-->C:\Program Files\Freeplayer\Uninstall.exe
    GrabIt 1.7.2 Beta 4 (build 997)-->"E:\GrabIt\unins000.exe"
    HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
    HydraVision-->MsiExec.exe /X{74CA0C9E-1EB2-5620-C0B1-C8AA56421F75}
    ISO Commander 1.6 (remove only)-->C:\Program Files\ISO Commander\uninst.exe
    K-Lite Mega Codec Pack 4.7.0-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
    Lame ACM MP3 Codec-->C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection Remove_LameMP3 132 C:\Windows\INF\LameACM.inf
    Last.fm 1.5.4.24567-->"C:\Program Files\Last.fm\unins000.exe"
    Les Sims™ 3-->"C:\Program Files\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\Sims3Setup.exe" -runfromtemp -l0x040c -removeonly
    Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
    Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
    Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
    Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
    Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
    Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
    Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
    Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{20DEB77C-21D6-4D22-BB47-233E47613D57}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00BA-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
    Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
    Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
    Microsoft Office Groove MUI (French) 2007-->MsiExec.exe /X{90120000-00BA-040C-0000-0000000FF1CE}
    Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
    Microsoft Office OneNote MUI (French) 2007-->MsiExec.exe /X{90120000-00A1-040C-0000-0000000FF1CE}
    Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
    Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
    Microsoft Office Professional Plus 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
    Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
    Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
    Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
    Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
    Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
    Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
    Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
    Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
    Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
    Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
    Microsoft Office Ultimate 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ULTIMATER /dll OSETUP.DLL
    Microsoft Office Ultimate 2007-->MsiExec.exe /X{91120000-002E-0000-0000-0000000FF1CE}
    Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
    Microsoft WSE 3.0 Runtime-->MsiExec.exe /X{E3E71D07-CD27-46CB-8448-16D4FB29AA13}
    Mise à jour Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C}
    Mise à jour Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C}
    Mise à jour Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {51EFB347-1F3D-4BAC-8B79-F056B904FE21}
    Mise à jour Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {51EFB347-1F3D-4BAC-8B79-F056B904FE21}
    Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3}
    Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3}
    Mise à jour Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223}
    Mise à jour Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223}
    Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
    Mozilla Firefox (3.0.4)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
    neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
    NVIDIA PhysX-->MsiExec.exe /X{8AAB4176-A747-493A-A42C-B63CFADFD8E3}
    OpenAL-->"C:\Program Files\OpenAL\oalinst.exe" /U
    QuickPar 0.9-->E:\QuickPar\uninst.exe
    Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista-->C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\SETUP.EXE -runfromtemp -l0x040c -removeonly
    Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.EXE" -l0x40c -removeonly
    ReBirth RB-338 2.0-->C:\PROGRA~1\PROPEL~1\REBIRT~1.0\UNWISE.EXE C:\PROGRA~1\PROPEL~1\REBIRT~1.0\INSTALL.LOG
    Ri4m v5.0.1d-->E:\Ri4M\Ri4m_Uninstal.exe
    SAMSUNG Mobile Modem Driver Set-->C:\Windows\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
    Samsung Mobile phone USB driver Software-->C:\Windows\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
    SAMSUNG Mobile USB Modem 1.0 Software-->C:\Windows\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
    SAMSUNG Mobile USB Modem Software-->C:\Windows\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
    Samsung PC Studio 3 USB Driver Installer-->"C:\Program Files\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -runfromtemp -l0x040c -removeonly
    Samsung PC Studio 3-->"C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -runfromtemp -l0x040c -removeonly
    Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
    Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
    Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
    Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
    Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
    Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
    Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
    Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
    Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
    Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
    Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
    Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
    Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
    Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
    Sound Blaster X-Fi Xtreme Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{53E2DCBB-E6F7-4C83-B1EF-F78435B9814E}\SETUP.EXE" -l0x40c /remove
    SYSTEM_INFO B07.1219.01-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CC4914EF-6618-4949-A1CF-BD4917A00221}\setup.exe" -l0x9 -removeonly
    Test Drive Unlimited-->MsiExec.exe /X{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}
    The Godfather™ II-->MsiExec.exe /X{A1416622-0DDE-45B5-B06C-DFC3ED94C53B}
    The Humans-->C:\Program Files\InstallShield Installation Information\{79E0927E-6347-495F-83C1-92B0AB252B07}\SETUP.exe -runfromtemp -l0x040c -removeonly
    Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
    Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
    Update for Microsoft Office Outlook 2007 (KB969907)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {74F98B24-AFBD-4800-9BD6-87D349B5C462}
    Update for Microsoft Office Outlook 2007 (KB969907)-->msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {74F98B24-AFBD-4800-9BD6-87D349B5C462}
    Update for Outlook 2007 Junk Email Filter (kb971933)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {53C200F4-3B4B-49A5-8539-2C61F1A88CA2}
    Update for Outlook 2007 Junk Email Filter (kb971933)-->msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {53C200F4-3B4B-49A5-8539-2C61F1A88CA2}
    USB Disk Win98 Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4E79A62F-7A2D-4058-BCE0-94E6B9E2F162}\Setup.exe"
    Vuze-->C:\Program Files\Vuze\uninstall.exe
    Wanted: Les armes du destin-->"C:\Program Files\InstallShield Installation Information\{9312191B-30A5-44E1-8D8D-6936FE06CDE8}\setup.exe" -runfromtemp -l0x040c -removeonly
    Winamp-->"C:\Program Files\Winamp\UninstWA.exe"

    ======Security center information======

    AV: Bitdefender Antivirus
    FW: Bitdefender Firewall
    AS: BitDefender AntiSpam (disabled)
    AS: Windows Defender

    ======System event log======

    Computer Name: PC-de-NoNoB
    Event Code: 3004
    Message: L’agent de protection en temps réel Windows Defender a détecté des modifications. Microsoft vous recommande d’analyser les logiciels responsables de ces modifications, à la recherche de risques potentiels. Vous pouvez vous servir des informations relatives au fonctionnement de ces programmes pour autoriser ou non leur exécution, ou pour les supprimer de l’ordinateur. N’autorisez les modifications que si vous faites confiance au programme ou à l’éditeur de logiciel. Windows Defender ne peut pas annuler les modifications que vous autorisez.
    Pour plus d’informations, consultez les données suivantes :
    Non applicable
    ID d’analyse : {E61FC84C-EBF2-497B-AABF-E9270F55387D}
    Utilisateur : PC-de-NoNoB\Nono
    Nom : Unknown
    ID :
    ID de gravité :
    ID de catégorie :
    Chemin d’accès trouvé : driver:p ROCEXP90
    Type d’alerte : Logiciel non classifié
    Type de détection :
    Record Number: 56570
    Source Name: Microsoft-Windows-Windows Defender
    Time Written: 20090805155008.000000-000
    Event Type: Avertissement
    User:

    Computer Name: PC-de-NoNoB
    Event Code: 3004
    Message: L’agent de protection en temps réel Windows Defender a détecté des modifications. Microsoft vous recommande d’analyser les logiciels responsables de ces modifications, à la recherche de risques potentiels. Vous pouvez vous servir des informations relatives au fonctionnement de ces programmes pour autoriser ou non leur exécution, ou pour les supprimer de l’ordinateur. N’autorisez les modifications que si vous faites confiance au programme ou à l’éditeur de logiciel. Windows Defender ne peut pas annuler les modifications que vous autorisez.
    Pour plus d’informations, consultez les données suivantes :
    Non applicable
    ID d’analyse : {289B2FC2-41A1-4A0E-A871-B942C6DAAE17}
    Utilisateur : PC-de-NoNoB\Nono
    Nom : Unknown
    ID :
    ID de gravité :
    ID de catégorie :
    Chemin d’accès trouvé : service:mchInjDrv
    Type d’alerte : Logiciel non classifié
    Type de détection :
    Record Number: 56572
    Source Name: Microsoft-Windows-Windows Defender
    Time Written: 20090805164637.000000-000
    Event Type: Avertissement
    User:

    Computer Name: PC-de-NoNoB
    Event Code: 3004
    Message: L’agent de protection en temps réel Windows Defender a détecté des modifications. Microsoft vous recommande d’analyser les logiciels responsables de ces modifications, à la recherche de risques potentiels. Vous pouvez vous servir des informations relatives au fonctionnement de ces programmes pour autoriser ou non leur exécution, ou pour les supprimer de l’ordinateur. N’autorisez les modifications que si vous faites confiance au programme ou à l’éditeur de logiciel. Windows Defender ne peut pas annuler les modifications que vous autorisez.
    Pour plus d’informations, consultez les données suivantes :
    Non applicable
    ID d’analyse : {74B40639-B28D-46C7-BF46-A1856CC123F4}
    Utilisateur : PC-de-NoNoB\Nono
    Nom : Unknown
    ID :
    ID de gravité :
    ID de catégorie :
    Chemin d’accès trouvé : driver:mchInjDrv
    Type d’alerte : Logiciel non classifié
    Type de détection :
    Record Number: 56573
    Source Name: Microsoft-Windows-Windows Defender
    Time Written: 20090805164637.000000-000
    Event Type: Avertissement
    User:

    Computer Name: PC-de-NoNoB
    Event Code: 15016
    Message: Impossible d’initialiser le package de sécurité Kerberos pour l’authentification côté serveur. Le champ de données contient le numéro de l’erreur.
    Record Number: 56599
    Source Name: Microsoft-Windows-HttpEvent
    Time Written: 20090806071015.806542-000
    Event Type: Erreur
    User:

    Computer Name: PC-de-NoNoB
    Event Code: 7000
    Message: Le service Nero BackItUp Scheduler 4.0 n'a pas pu démarrer en raison de l'erreur :
    Le fichier spécifié est introuvable.
    Record Number: 56637
    Source Name: Service Control Manager
    Time Written: 20090806071153.000000-000
    Event Type: Erreur
    User:

    =====Application event log=====

    Computer Name: PC-de-NoNoB
    Event Code: 8210
    Message: Impossible de créer le point de restauration planifié. Informations supplémentaires : (0x800423f4).
    Record Number: 11839
    Source Name: System Restore
    Time Written: 20090805071546.000000-000
    Event Type: Erreur
    User:

    Computer Name: PC-de-NoNoB
    Event Code: 3013
    Message: Impossible de mettre à jour l'entrée <C:\USERS\NONO\APPDATA\LOCAL\MICROSOFT\WINDOWS\HISTORY\HISTORY.IE5\MSHIST012009080520090806> dans la configuration de hachage.

    Contexte : Application , Catalogue SystemIndex

    Détails :
    Un périphérique attaché au système ne fonctionne pas correctement. (0x8007001f)

    Record Number: 11841
    Source Name: Microsoft-Windows-Search
    Time Written: 20090805121852.000000-000
    Event Type: Erreur
    User:

    Computer Name: PC-de-NoNoB
    Event Code: 1530
    Message: Windows a détecté que votre fichier de Registre est toujours utilisé par d'autres applications ou services. Le fichier va être déchargé. Les applications ou services qui ont accès à votre Registre risquent de ne pas fonctionner correctement après cela.

    DÉTAIL -
    1 user registry handles leaked from \Registry\User\S-1-5-21-2611209188-2014074918-3142469776-1002:
    Process 928 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2611209188-2014074918-3142469776-1002

    Record Number: 11851
    Source Name: Microsoft-Windows-User Profiles Service
    Time Written: 20090805182553.000000-000
    Event Type: Avertissement
    User: AUTORITE NT\SYSTEM

    Computer Name: PC-de-NoNoB
    Event Code: 1530
    Message: Windows a détecté que votre fichier de Registre est toujours utilisé par d'autres applications ou services. Le fichier va être déchargé. Les applications ou services qui ont accès à votre Registre risquent de ne pas fonctionner correctement après cela.

    DÉTAIL -
    1 user registry handles leaked from \Registry\User\S-1-5-21-2611209188-2014074918-3142469776-1002_Classes:
    Process 928 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2611209188-2014074918-3142469776-1002_CLASSES

    Record Number: 11852
    Source Name: Microsoft-Windows-User Profiles Service
    Time Written: 20090805182554.000000-000
    Event Type: Avertissement
    User: AUTORITE NT\SYSTEM

    Computer Name: PC-de-NoNoB
    Event Code: 10
    Message: Le filtre d’événement avec la requête « SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99 » n’a pas pu être réactivé dans l’espace de noms « //./root/CIMV2 » à cause de l’erreur 0x80041003. Les événements ne peuvent pas être délivrés à travers ce filtre tant que le problème ne sera pas corrigé.
    Record Number: 11871
    Source Name: Microsoft-Windows-WMI
    Time Written: 20090806071153.000000-000
    Event Type: Erreur
    User:

    =====Security event log=====

    Computer Name: PC-de-NoNoB
    Event Code: 5038
    Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

    Nom du fichier : \Device\HarddiskVolume5\Windows\System32\drivers\tcpip.sys
    Record Number: 19674
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090806071931.509142-000
    Event Type: Échec de l'audit
    User:

    Computer Name: PC-de-NoNoB
    Event Code: 5038
    Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

    Nom du fichier : \Device\HarddiskVolume5\Windows\System32\drivers\tcpip.sys
    Record Number: 19675
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090806071931.524742-000
    Event Type: Échec de l'audit
    User:

    Computer Name: PC-de-NoNoB
    Event Code: 5038
    Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

    Nom du fichier : \Device\HarddiskVolume5\Windows\System32\drivers\tcpip.sys
    Record Number: 19676
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090806071931.555942-000
    Event Type: Échec de l'audit
    User:

    Computer Name: PC-de-NoNoB
    Event Code: 5038
    Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

    Nom du fichier : \Device\HarddiskVolume5\Windows\System32\drivers\tcpip.sys
    Record Number: 19677
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090806071931.587142-000
    Event Type: Échec de l'audit
    User:

    Computer Name: PC-de-NoNoB
    Event Code: 5038
    Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

    Nom du fichier : \Device\HarddiskVolume5\Windows\System32\drivers\tcpip.sys
    Record Number: 19678
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090806071931.602742-000
    Event Type: Échec de l'audit
    User:

    ======Environment variables======

    "ComSpec"=%SystemRoot%\system32\cmd.exe
    "FP_NO_HOST_CHECK"=NO
    "OS"=Windows_NT
    "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\Samsung\Samsung PC Studio 3\;C:\Program Files\Smart Projects\IsoBuster
    "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
    "PROCESSOR_ARCHITECTURE"=x86
    "TEMP"=%SystemRoot%\TEMP
    "TMP"=%SystemRoot%\TEMP
    "USERNAME"=SYSTEM
    "windir"=%SystemRoot%
    "PROCESSOR_LEVEL"=6
    "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 7, GenuineIntel
    "PROCESSOR_REVISION"=1707
    "NUMBER_OF_PROCESSORS"=4
    "TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
    "DFSTRACINGON"=FALSE

    -----------------EOF-----------------

    Vous remerciant par avance.
    a c 327 8 Sécurité
    6 Août 2009 14:11:33

  • Télécharge OTM (OldTimer) sur ton Bureau.
  • Clique droit sur OTM.exe et choisis Exécuter en tant qu'administrateur.
  • Copie (Ctrl+C) le texte suivant ci-dessous :

    :processes
    explorer.exe

    :services
    AeLookupSvcALG

    :reg
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

    :files
    C:\Windows\TEMP\kvcafctxew.exe

    :commands
    [purity]
    [emptytemp]
    [reboot]

  • Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
  • Clique maintenant sur le bouton MoveIt! puis ferme OTM.

    ---> Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
    Accepte en cliquant sur YES.

  • Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\
    ---> Le nom du rapport correspond au moment de sa création : date_heure.log
    7 Août 2009 08:54:42

    Encore Merci Destrio5

    J'ai suivi tes instructions à la lettres et voici le rapport :

    All processes killed
    ========== PROCESSES ==========
    No active process named explorer.exe was found!
    ========== SERVICES/DRIVERS ==========
    Service\Driver AeLookupSvcALG not found.
    Unable to delete service\driver keyAeLookupSvcALG.
    ========== REGISTRY ==========
    Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ scheduled to be deleted on reboot.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
    ========== FILES ==========
    File/Folder C:\Windows\TEMP\kvcafctxew.exe not found.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RZEBWMDH\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OM0YG1D1\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HP57OYSG\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\18ANKYEQ\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
    File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RZEBWMDH\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OM0YG1D1\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HP57OYSG\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\18ANKYEQ\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
    File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Nana
    File delete failed. C:\Users\Nana\AppData\Local\Temp\tmp13626.WMC\serviceinfo.xml scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\outlook logging\firstrun.log scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\msohtmlclip1\01\clip_colorschememapping.xml scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\msohtmlclip1\01\clip_themedata.thmx scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Journalisation d'Outlook\nmessasfreefr-Incoming-03_09_2009-18_18_57_195.log scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Journalisation d'Outlook\nmessasfreefr-Outgoing-03_09_2009-18_18_57_616.log scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\History\History.IE5\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\PV1Z4U1X\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\JB70UGS6\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\EUEOD4EL\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\BXNFNGRF\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\index.dat scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Cookies\index.dat scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\107531.od scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\11851801.od scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\137452.od scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\146547.od scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\1531274.od scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\213612.od scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\36036.od scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\44912.od scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\5288621.od scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\5746218.od scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\62072.od scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\7640835.od scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\CVR18BD.tmp.cvr scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\CVR3C73.tmp.cvr scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\CVR426C.tmp.cvr scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\CVR5D8A.tmp.cvr scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\CVR8CB4.tmp.cvr scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\CVR9703.tmp.cvr scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\CVRA40B.tmp.cvr scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\CVRAE2A.tmp.cvr scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\CVRAF70.tmp.cvr scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\CVRB2AD.tmp.cvr scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\CVRD819.tmp.cvr scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\CVRF269.tmp.cvr scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\EAD819D.exe scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\EAD819D.tmp scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\EAD89A8.exe scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\EAD89A8.tmp scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\EAD96F1.exe scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\EAD96F1.tmp scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Nana.bmp scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\OneNote_MigrationLog.txt scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\trk4107.tmp scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\trk7A50.tmp scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\TWAIN.LOG scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Twain001.Mtx scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Twunk001.MTX scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Twunk002.MTX scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\WER69F9.tmp.resp.erc.xml scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\Winamp.tmp scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Temp\wmsetup.log scheduled to be deleted on reboot.
    ->Temp folder emptied: 631474 bytes
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\Nana\AppData\Local\Adobe\Updater6\AdobeUpdaterPrefs.dat scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\Nana\AppData\Local\Adobe\Color\ACECache10.lst scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\Nana\AppData\Local\Adobe\Acrobat\9.0\Updater\updater.log scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\Nana\AppData\Local\GDIPFONTCACHEV1.DAT scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZCW0JP2L\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\I3D9M91J\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6YU4XEQH\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0FFMTA2Q\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3117B02B-A055-489C-8E95-A1E4615EDA09}.tmp scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{31F25D27-403F-482F-A0DD-DB904BF2982F}.tmp scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B91C8A81-15AA-4CC0-A4EF-0D0157E4DDC5}.tmp scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D8862582-6000-4882-98EA-12809483712F}.tmp scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{EB5A4682-66B0-4386-9139-623FFBD5301A}.tmp scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XVD1B4Z1\144[2] scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XVD1B4Z1\CSS[1] scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XVD1B4Z1\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VP42BHO2\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VP42BHO2\IMG[1] scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VP42BHO2\JS[1] scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N0YLF9XV\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N0YLF9XV\IMG[1] scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N0YLF9XV\JS[1] scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7F0INGWO\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7F0INGWO\IMG[1] scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7F0INGWO\IMG[2] scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
    File delete failed. C:\Users\Nana\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
    ->Temporary Internet Files folder emptied: 1771438 bytes

    User: Nono
    ->Temp folder emptied: 3603123 bytes
    ->Temporary Internet Files folder emptied: 16134368 bytes
    ->FireFox cache emptied: 26505584 bytes

    User: Public

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 782336 bytes
    Windows Temp folder emptied: 0 bytes
    RecycleBin emptied: 64631 bytes

    Total Files Cleaned = 47,26 mb


    OTM by OldTimer - Version 3.0.0.5 log created on 08072009_084754
    a c 327 8 Sécurité
    7 Août 2009 15:16:33

    Refais la manip' en désactivant l'UAC avant.
    8 Août 2009 15:38:33

    Ok, nous y revoila en ayant desactivé UAC.

    All processes killed
    ========== PROCESSES ==========
    No active process named explorer.exe was found!
    ========== SERVICES/DRIVERS ==========

    Service\Driver AeLookupSvcALG deleted successfully.
    ========== REGISTRY ==========
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
    ========== FILES ==========
    C:\Windows\TEMP\kvcafctxew.exe moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Nana
    ->Temp folder emptied: 631474 bytes
    ->Temporary Internet Files folder emptied: 1771438 bytes

    User: Nono
    ->Temp folder emptied: 6990788 bytes
    ->Temporary Internet Files folder emptied: 21678645 bytes
    ->FireFox cache emptied: 10199491 bytes

    User: Public

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 782336 bytes
    Windows Temp folder emptied: 526083 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 40,64 mb


    OTM by OldTimer - Version 3.0.0.5 log created on 08082009_153206

    Files moved on Reboot...

    Registry entries deleted on Reboot...
    a c 327 8 Sécurité
    8 Août 2009 16:49:40

    C'est mieux.

  • Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
  • Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
  • Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
  • Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
  • Sélectionne Exécuter un examen rapide.
  • Clique sur Rechercher. L'analyse démarre.
  • A la fin de l'analyse, un message s'affiche :
    Citation :
    L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

  • Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
  • Ferme tes navigateurs.
  • Si des malwares ont été détectés, clique sur Afficher les résultats.
  • Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
  • MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.
    8 Août 2009 21:18:45

    Alors,

    MBAM m'a indiqué qu'aucun probleme n'avait été remarqué lors de l'analyse, d'ou le rapport qui suit :

    Malwarebytes' Anti-Malware 1.40
    Version de la base de données: 2580
    Windows 6.0.6001 Service Pack 1

    08/08/2009 17:09:01
    mbam-log-2009-08-08 (17-09-01).txt

    Type de recherche: Examen rapide
    Eléments examinés: 91294
    Temps écoulé: 3 minute(s), 1 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 0
    Valeur(s) du Registre infectée(s): 0
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 0

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Valeur(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    (Aucun élément nuisible détecté)


    Cependant le probleme de redirection de page web c'etant à nouveau posé (certes juste une fois) j'ai refait une analyse avec A-squared qui avait etait le premier logiciel à diagnostiquer le probleme (Sans pour autant pouvoir le regler)


    Et voici son rapport


    Version - a-squared Anti-Malware 4.5
    Dernière mise à jour : 08/08/2009 17:11:10

    Paramètres des balayages :

    Type de numérisation : Scan Détail
    Éléments : Mémoire, Traces, Cookies, C:\, D:\, E:\, F:\, G:\, H:\, I:\
    Balaye dans les archives : Marche
    Analyse heuristique : Arrêt
    Balaye dans les ADS : Marche

    Début du balayage : 08/08/2009 18:05:08

    C:\_OTM\MovedFiles\08082009_153206\Windows\TEMP\kvcafctxew.exe Objets détectés : Trojan-Proxy.Win32.Sefbov!IK

    Analysé

    Fichiers : 209351
    Traces : 606215
    Cookies : 92
    Processus : 60

    Objets trouvés

    Fichiers : 1
    Traces : 0
    Cookies : 0
    Processus : 0
    Clés de Registre : 0

    Fin du balayage : 08/08/2009 21:09:29
    Temps du balayage : 3:04:21

    Donc me revoila avec mon soucis de depart...
    a c 327 8 Sécurité
    8 Août 2009 21:48:05

    Citation :
    Donc me revoila avec mon soucis de depart...

    --> L'infection que a-squared a trouvé est maintenant dans la quarantaine d'OTM.

  • Fais un scan avec Kaspersky Online Scanner et poste le rapport.
    9 Août 2009 13:06:18

    J'essaie depuis ce matin de faire le scan Kaspersky, mais voila le message d'erreur qu'il me donne.

    Échec de la mise à jour Impossible de démarrer le programme. Fermez la fenêtre de Kaspersky Online Scanner 7.0 et redémarrez le programme sur le site de Kaspersky Lab. Pour mettre à jour Kaspersky Online Scanner 7.0 et analyser votre ordinateur correctement, une connexion Internet permanente est nécessaire. Vérifiez que votre connexion Internet fonctionne. [ERROR: La licence est périmée]

    Alors que je lance bien le programme depuis Kaspersky Lab Qui lui ouvre Kaspersky Online Scanner 7.0 qui ne veut pas faire la mise à jours. (Ma connexion internent fonctionne parfaitement et j'ai bien desactivé mes programmes antivirus)

    Soit j'ai raté une etape et je m'en excuse soit leurs serveurs ont un problemes ...
    a c 327 8 Sécurité
    9 Août 2009 17:42:46

    [#ff0000]/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\[/#f]

  • Télécharge ComboFix ([#ff0000]sUBs[/#f]) sur ton Bureau.
  • Clique droit sur ComboFix.exe (le .exe n'est pas forcément visible) et choisis Exécuter en tant qu'administrateur.
  • Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

    Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix
    9 Août 2009 20:17:03

    Franchement, merci pour votre aide et votre reactivité !
    C'est pas evident de s'y retrouver dans tous ces parametres.

    Donc voila le rapport Combofix :

    ComboFix 09-08-08.04 - Nono 09/08/2009 19:43.1.4 - NTFSx86
    Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.3582.2564 [GMT 2:00]
    Running from: c:\users\Nono\Desktop\ComboFix.exe
    AV: Bitdefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
    FW: Bitdefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
    SP: BitDefender AntiSpam *disabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\$recycle.bin\S-1-5-21-2611209188-2014074918-3142469776-1000
    c:\windows\system32\Data

    .
    ((((((((((((((((((((((((( Files Created from 2009-07-09 to 2009-08-09 )))))))))))))))))))))))))))))))
    .

    2009-08-09 17:51 . 2009-08-09 17:51 -------- d-----w- c:\users\Nana\AppData\Local\temp
    2009-08-09 17:51 . 2009-08-09 17:51 -------- d-----w- c:\users\Default\AppData\Local\temp
    2009-08-09 07:53 . 2009-08-09 07:53 -------- d-----w- c:\windows\Sun
    2009-08-09 07:52 . 2009-08-09 07:52 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-08-09 07:52 . 2009-08-09 07:52 -------- d-----w- c:\program files\Java
    2009-08-08 18:12 . 2009-08-08 18:12 -------- d-----w- c:\progra~2\WindowsSearch
    2009-08-08 15:05 . 2009-08-08 15:05 -------- d-----w- c:\users\Nono\AppData\Roaming\Malwarebytes
    2009-08-08 15:05 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-08 15:05 . 2009-08-08 15:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-08-08 15:05 . 2009-08-08 15:05 -------- d-----w- c:\progra~2\Malwarebytes
    2009-08-08 15:05 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-07 07:02 . 2009-08-07 07:02 -------- d-----w- c:\windows\system32\xlive
    2009-08-07 07:02 . 2009-08-07 07:02 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
    2009-08-07 06:47 . 2009-08-07 06:47 -------- d-----w- C:\_OTM
    2009-08-06 07:14 . 2009-08-06 07:19 -------- d-----w- c:\program files\trend micro
    2009-08-06 07:14 . 2009-08-06 07:19 -------- d-----w- C:\rsit
    2009-08-05 12:21 . 2009-08-08 15:52 -------- d-----w- c:\program files\a-squared Anti-Malware
    2009-08-05 11:56 . 2009-08-05 11:56 -------- d-----w- c:\users\Nono\AppData\Roaming\Yahoo!
    2009-08-05 11:56 . 2009-08-06 07:10 -------- d-----w- c:\program files\Yahoo!
    2009-08-05 11:56 . 2009-08-05 11:57 -------- d-----w- c:\program files\CCleaner
    2009-08-05 08:00 . 2009-08-05 11:07 -------- d-----w- c:\program files\a-squared Free
    2009-08-04 07:58 . 2009-08-04 07:58 -------- d-----w- c:\program files\QuickTime
    2009-07-31 13:47 . 2009-07-31 13:47 -------- d-----w- c:\program files\Freeplayer
    2009-07-31 09:56 . 2009-07-31 09:56 -------- d-----w- c:\program files\Ultimate Pinball Gold
    2009-07-23 18:40 . 2009-07-23 18:40 -------- d-----w- c:\program files\Common Files\SWF Studio
    2009-07-23 18:40 . 2009-07-23 18:44 -------- d-----w- c:\program files\USB Disk Win98 Driver
    2009-07-22 07:54 . 2009-07-22 11:00 -------- d-----w- c:\users\Nono\AppData\Roaming\vlc
    2009-07-15 13:05 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll
    2009-07-15 13:05 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll
    2009-07-15 13:05 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll
    2009-07-15 13:05 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll
    2009-07-14 15:17 . 2009-07-14 15:17 15308440 ----a-w- c:\windows\system32\xlive.dll
    2009-07-14 15:17 . 2009-07-14 15:17 13642888 ----a-w- c:\windows\system32\xlivefnt.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-09 17:47 . 2008-01-21 08:40 681936 ----a-w- c:\windows\system32\perfh00C.dat
    2009-08-09 17:47 . 2008-01-21 08:40 129090 ----a-w- c:\windows\system32\perfc00C.dat
    2009-08-09 17:42 . 2009-03-07 09:43 81984 ----a-w- c:\windows\system32\bdod.bin
    2009-08-08 18:07 . 2009-03-07 09:43 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
    2009-08-07 10:25 . 2009-05-11 17:47 -------- d-----w- c:\users\Nono\AppData\Roaming\Winamp
    2009-08-07 09:49 . 2009-05-11 17:47 -------- d-----w- c:\program files\Winamp
    2009-08-05 12:00 . 2009-04-11 16:02 -------- d-----w- c:\users\Nono\AppData\Roaming\Azureus
    2009-08-05 08:03 . 2009-03-08 12:09 -------- d-----w- c:\users\Nono\AppData\Roaming\GrabIt
    2009-07-23 18:40 . 2009-03-06 19:53 -------- d--h--w- c:\program files\InstallShield Installation Information
    2009-07-21 21:52 . 2009-07-29 06:48 915456 ----a-w- c:\windows\system32\wininet.dll
    2009-07-21 21:47 . 2009-07-29 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2009-07-21 21:47 . 2009-07-29 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
    2009-07-21 20:13 . 2009-07-29 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2009-07-16 15:37 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
    2009-07-15 13:52 . 2009-03-06 15:39 -------- d-----w- c:\progra~2\Microsoft Help
    2009-06-29 12:04 . 2009-06-29 12:00 -------- d-----w- c:\users\Nono\AppData\Roaming\PhotoFiltre Studio X
    2009-06-29 12:00 . 2009-06-29 12:00 -------- d-----w- c:\program files\PhotoFiltre Studio X
    2009-06-28 16:32 . 2009-06-28 16:32 -------- d-----w- c:\users\Nana\AppData\Roaming\DivX
    2009-05-27 08:14 . 2009-05-27 08:14 10134 ----a-r- c:\users\Nono\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
    2009-05-14 10:27 . 2009-03-07 12:03 99864 ----a-w- c:\users\Nana\AppData\Local\GDIPFONTCACHEV1.DAT
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
    "EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
    "EasyTuneVPro"="c:\program files\Gigabyte\ET5Pro\ETcall.exe" [2007-07-26 20480]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
    "BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 61440]
    "BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2008-09-04 368640]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
    "USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 65536]
    "a-squared"="c:\program files\a-squared Anti-Malware\a2guard.exe" [2009-08-05 3208848]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-09 149280]
    "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-02-13 4915200]
    "P17RunE"="P17RunE.dll" - c:\windows\System32\P17RunE.dll [2007-04-09 14848]

    c:\users\Nana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "mixer2"=wdmaud.drv

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{DE3F0886-ED68-4711-9296-D4A9FC94E4F3}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{EA4473AC-A13D-4F10-9CFC-9E4066D69941}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{02AF42C7-4639-4374-8F74-2481AF5CC33F}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{A546FCC0-BB5E-43AD-8F95-52331F74647D}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{D70509B7-BF60-42EA-97DE-5FB1C25E9A88}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "TCP Query User{1C013964-5901-43DA-AB9D-C1B6554C0F94}c:\\program files\\gigabyte\\gest\\run.exe"= UDP:c:\program files\gigabyte\gest\run.exe:update
    "UDP Query User{373693EC-0AF9-471F-9D0F-E186B6FB2AB5}c:\\program files\\gigabyte\\gest\\run.exe"= TCP:c:\program files\gigabyte\gest\run.exe:update
    "{D0E48328-2252-432A-8EB3-BDECF4706B09}"= UDP:c:\program files\Orb Networks\Orb\bin\Orb.exe:o rb
    "{ACD64910-5267-4FF3-AA6B-99429B9250F7}"= TCP:c:\program files\Orb Networks\Orb\bin\Orb.exe:o rb
    "{99C551D7-54C9-4520-8353-D7428DB24D8C}"= UDP:c:\program files\Orb Networks\Orb\bin\OrbTray.exe:o rbTray
    "{CEEA9F70-360F-4921-9299-A4C0476AFE9C}"= TCP:c:\program files\Orb Networks\Orb\bin\OrbTray.exe:o rbTray
    "{66606E47-5ECD-4008-AA42-1D984DDA2227}"= UDP:c:\program files\Orb Networks\Orb\bin\OrbIR.exe:o rbIR
    "{28A5E291-B23F-4A85-A79E-A404FB526E42}"= TCP:c:\program files\Orb Networks\Orb\bin\OrbIR.exe:o rbIR
    "{02A1DE96-D760-465F-A505-263415AF5B62}"= UDP:c:\program files\Orb Networks\Orb\bin\OrbStreamerClient.exe:o rb Stream Client
    "{86A6FF35-9B52-4531-A0CF-FC2F6D21359B}"= TCP:c:\program files\Orb Networks\Orb\bin\OrbStreamerClient.exe:o rb Stream Client
    "{8F236852-14D8-4C60-8D6E-F71AECD3729E}"= UDP:c:\program files\Orb Networks\Orb\bin\xmltv.exe:o rbTVGuide
    "{8EB65903-7500-46C2-8F7F-2C7A868E2708}"= TCP:c:\program files\Orb Networks\Orb\bin\xmltv.exe:o rbTVGuide
    "{56D90E6E-3C0E-44AB-9BB4-8DD92EB2D830}"= UDP:c:\program files\Orb Networks\Orb\bin\OrbChannelScan.exe:o rbChannelScan
    "{8DC4C258-632A-4938-BCB2-4175FDC82501}"= TCP:c:\program files\Orb Networks\Orb\bin\OrbChannelScan.exe:o rbChannelScan

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
    "EnableFirewall"= 0 (0x0)

    R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\System32\drivers\bdfndisf.sys [02/06/2008 16:16 86792]
    S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\drivers\ASPI32.SYS [14/04/2009 15:34 84832]
    S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [07/03/2009 23:16 79360]
    S3 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\GEST\GSvr.exe [06/03/2009 21:53 47624]
    S3 GVTDrv;GVTDrv;c:\windows\System32\drivers\GVTDrv.sys [07/03/2009 11:43 24944]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bdx REG_MULTI_SZ scan

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.free.fr/
    IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} - hxxps://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
    DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-2.0.cab
    FF - ProfilePath - c:\users\Nono\AppData\Roaming\Mozilla\Firefox\Profiles\n3szn5w1.default\
    FF - prefs.js: browser.search.selectedEngine - xeoo.com
    FF - prefs.js: browser.startup.homepage - hxxp://82.242.160.112:9000
    FF - prefs.js: keyword.URL - hxxp://xeoo.com/?p=url&a=firefox&k=
    FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
    FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.bookmark_page", false);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.current_page", false);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.restore_default", false);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importBookmarksHTML", true);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importDefaults", false);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.search.selectedEngine", "xeoo.com");
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("keyword.URL", "http://xeoo.com/?p=url&a=firefox&k=");
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.startup.homepage", "http://www.xeoo.com/?p=h&a=firefox");
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-09 19:51
    Windows 6.0.6001 Service Pack 1 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files:

    **************************************************************************
    .
    Completion time: 2009-08-09 19:54
    ComboFix-quarantined-files.txt 2009-08-09 17:54

    Pre-Run: 46 439 104 512 octets libres
    Post-Run: 46 509 568 000 octets libres

    182 --- E O F --- 2009-08-07 07:03
    a c 327 8 Sécurité
    9 Août 2009 21:45:39

    Plus de souci ?
    10 Août 2009 09:04:18

    Au niveau de la redirection de pages ça a l'air d'aller mieux.

    Mais par contre Je subi une attaque permanente de Trojan.CrytRedol.Gen.3

    Il y a donc en permanenece une fenetre Bitdefender qui me previent qu'il a bloqué plusieur Virus Trojan.CrytRedol.Gen.3 par le chemin C:\Windows\System32\drivers\vsfocexeydpwrn.sys
    Et l'a deplacé en quarantaine. il y a donc au moins 150 fois ce fichier dans ma quarantaine...

    Alors que je n'ai vraiment rien fait de plus que ce que vous m'avait conseillé depuis hier.

    Je suis de plus en plus inquiet, merci d'avance.
    a c 327 8 Sécurité
    10 Août 2009 14:45:28

    Citation :
    C:\Windows\System32\drivers\vsfocexeydpwrn.sys

    --> C'est un rootkit. Retélécharge ComboFix pour avoir la dernière version puis exécute-le en tant qu'administrateur. S'il ne se lance pas,
    renomme-le en IDN.
    10 Août 2009 20:25:44

    J'ai du le faire depuis le mode sans echec, car il m'est impossible de faire quoi que ce soit. Tous les programme plante, meme Bitdefender et IE.

    Voila le rapport :

    ComboFix 09-08-10.01 - Nono 10/08/2009 20:05.2.4 - NTFSx86
    Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.3582.2521 [GMT 2:00]
    Running from: c:\users\Nono\Desktop\ComboFix.exe
    AV: Bitdefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
    FW: Bitdefender Firewall *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
    SP: BitDefender AntiSpam *enabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    * Created a new restore point
    * Resident AV is active

    .

    ((((((((((((((((((((((((( Files Created from 2009-07-10 to 2009-08-10 )))))))))))))))))))))))))))))))
    .

    2009-08-10 18:13 . 2009-08-10 18:13 -------- d-----w- c:\users\Nono\AppData\Local\temp
    2009-08-10 18:13 . 2009-08-10 18:13 -------- d-----w- c:\users\Public\AppData\Local\temp
    2009-08-10 18:13 . 2009-08-10 18:13 -------- d-----w- c:\users\Nana\AppData\Local\temp
    2009-08-10 18:13 . 2009-08-10 18:13 -------- d-----w- c:\users\Default\AppData\Local\temp
    2009-08-09 07:53 . 2009-08-09 07:53 -------- d-----w- c:\windows\Sun
    2009-08-09 07:52 . 2009-08-09 07:52 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-08-09 07:52 . 2009-08-09 07:52 -------- d-----w- c:\program files\Java
    2009-08-08 18:12 . 2009-08-08 18:12 -------- d-----w- c:\programdata\WindowsSearch
    2009-08-08 15:05 . 2009-08-08 15:05 -------- d-----w- c:\users\Nono\AppData\Roaming\Malwarebytes
    2009-08-08 15:05 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-08 15:05 . 2009-08-08 15:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-08-08 15:05 . 2009-08-08 15:05 -------- d-----w- c:\programdata\Malwarebytes
    2009-08-08 15:05 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-07 07:02 . 2009-08-07 07:02 -------- d-----w- c:\windows\system32\xlive
    2009-08-07 07:02 . 2009-08-07 07:02 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
    2009-08-07 06:47 . 2009-08-07 06:47 -------- d-----w- C:\_OTM
    2009-08-06 07:14 . 2009-08-06 07:19 -------- d-----w- c:\program files\trend micro
    2009-08-06 07:14 . 2009-08-06 07:19 -------- d-----w- C:\rsit
    2009-08-05 12:21 . 2009-08-10 07:05 -------- d-----w- c:\program files\a-squared Anti-Malware
    2009-08-05 11:56 . 2009-08-05 11:56 -------- d-----w- c:\users\Nono\AppData\Roaming\Yahoo!
    2009-08-05 11:56 . 2009-08-06 07:10 -------- d-----w- c:\program files\Yahoo!
    2009-08-05 11:56 . 2009-08-05 11:57 -------- d-----w- c:\program files\CCleaner
    2009-08-05 08:00 . 2009-08-05 11:07 -------- d-----w- c:\program files\a-squared Free
    2009-08-04 07:58 . 2009-08-04 07:58 -------- d-----w- c:\program files\QuickTime
    2009-07-31 13:47 . 2009-07-31 13:47 -------- d-----w- c:\program files\Freeplayer
    2009-07-31 09:56 . 2009-07-31 09:56 -------- d-----w- c:\program files\Ultimate Pinball Gold
    2009-07-31 09:25 . 2009-08-10 12:37 91 ----a-w- c:\windows\system32\vsfocebckxgiie.dat
    2009-07-31 09:14 . 2009-08-10 17:04 0 ----a-w- c:\windows\system32\drivers\vsfocexeydpwrn.sys
    2009-07-31 09:14 . 2009-08-10 17:02 41273 ----a-w- c:\windows\system32\vsfocebinthssi.dat
    2009-07-23 18:40 . 2009-07-23 18:40 -------- d-----w- c:\program files\Common Files\SWF Studio
    2009-07-23 18:40 . 2009-07-23 18:44 -------- d-----w- c:\program files\USB Disk Win98 Driver
    2009-07-22 07:54 . 2009-07-22 11:00 -------- d-----w- c:\users\Nono\AppData\Roaming\vlc
    2009-07-15 13:05 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll
    2009-07-15 13:05 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll
    2009-07-15 13:05 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll
    2009-07-15 13:05 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll
    2009-07-14 15:17 . 2009-07-14 15:17 15308440 ----a-w- c:\windows\system32\xlive.dll
    2009-07-14 15:17 . 2009-07-14 15:17 13642888 ----a-w- c:\windows\system32\xlivefnt.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-10 17:51 . 2008-01-21 08:40 681936 ----a-w- c:\windows\system32\perfh00C.dat
    2009-08-10 17:51 . 2008-01-21 08:40 129090 ----a-w- c:\windows\system32\perfc00C.dat
    2009-08-10 17:26 . 2009-03-07 09:43 81984 ----a-w- c:\windows\system32\bdod.bin
    2009-08-10 06:45 . 2009-03-07 09:43 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
    2009-08-09 18:39 . 2009-03-07 09:38 -------- d-----w- c:\program files\Common Files\BitDefender
    2009-08-07 10:25 . 2009-05-11 17:47 -------- d-----w- c:\users\Nono\AppData\Roaming\Winamp
    2009-08-07 09:49 . 2009-05-11 17:47 -------- d-----w- c:\program files\Winamp
    2009-08-05 12:00 . 2009-04-11 16:02 -------- d-----w- c:\users\Nono\AppData\Roaming\Azureus
    2009-08-05 08:03 . 2009-03-08 12:09 -------- d-----w- c:\users\Nono\AppData\Roaming\GrabIt
    2009-07-23 18:40 . 2009-03-06 19:53 -------- d--h--w- c:\program files\InstallShield Installation Information
    2009-07-21 21:52 . 2009-07-29 06:48 915456 ----a-w- c:\windows\system32\wininet.dll
    2009-07-21 21:47 . 2009-07-29 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2009-07-21 21:47 . 2009-07-29 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
    2009-07-21 20:13 . 2009-07-29 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2009-07-16 15:37 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
    2009-07-15 13:52 . 2009-03-06 15:39 -------- d-----w- c:\programdata\Microsoft Help
    2009-06-29 12:04 . 2009-06-29 12:00 -------- d-----w- c:\users\Nono\AppData\Roaming\PhotoFiltre Studio X
    2009-06-29 12:00 . 2009-06-29 12:00 -------- d-----w- c:\program files\PhotoFiltre Studio X
    2009-06-28 16:32 . 2009-06-28 16:32 -------- d-----w- c:\users\Nana\AppData\Roaming\DivX
    2009-05-27 08:14 . 2009-05-27 08:14 10134 ----a-r- c:\users\Nono\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
    2009-05-23 10:06 . 2009-05-23 10:06 107 ----a-w- c:\programdata\Last.fm\Client\uninst2.bat
    2009-05-23 10:06 . 2009-05-23 10:06 683801 ----a-w- c:\programdata\Last.fm\Client\UninstWMP\unins000.exe
    2009-05-23 10:06 . 2009-05-23 10:06 683801 ----a-w- c:\programdata\Last.fm\Client\UninstWA\unins000.exe
    2009-05-14 10:27 . 2009-03-07 12:03 99864 ----a-w- c:\users\Nana\AppData\Local\GDIPFONTCACHEV1.DAT
    .

    ((((((((((((((((((((((((((((( SnapShot_2009-08-10_17.45.32 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-01-21 01:58 . 2009-08-10 17:46 46970 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2006-11-02 13:05 . 2009-08-10 17:46 74078 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    + 2009-03-06 14:41 . 2009-08-10 17:52 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-03-06 14:41 . 2009-08-10 12:26 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-03-06 14:41 . 2009-08-10 17:52 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-03-06 14:41 . 2009-08-10 12:26 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-03-06 14:41 . 2009-08-10 12:26 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-03-06 14:41 . 2009-08-10 17:52 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-03-07 16:50 . 2009-08-10 17:46 8522 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2611209188-2014074918-3142469776-1002_UserData.bin
    + 2006-11-02 10:33 . 2009-08-10 17:51 598652 c:\windows\System32\perfh009.dat
    + 2006-11-02 10:33 . 2009-08-10 17:51 105922 c:\windows\System32\perfc009.dat
    + 2009-03-26 08:47 . 2009-08-10 17:52 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
    - 2009-03-26 08:47 . 2009-08-10 06:51 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
    "EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
    "EasyTuneVPro"="c:\program files\Gigabyte\ET5Pro\ETcall.exe" [2007-07-26 20480]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
    "BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 61440]
    "BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2008-09-04 368640]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
    "USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 65536]
    "a-squared"="c:\program files\a-squared Anti-Malware\a2guard.exe" [2009-08-05 3208848]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-09 149280]
    "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-02-13 4915200]
    "P17RunE"="P17RunE.dll" - c:\windows\System32\P17RunE.dll [2007-04-09 14848]

    c:\users\Nana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "mixer2"=wdmaud.drv

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "AntiSpywareOverride"=dword:00000001
    "FirewallOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{DE3F0886-ED68-4711-9296-D4A9FC94E4F3}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{EA4473AC-A13D-4F10-9CFC-9E4066D69941}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{02AF42C7-4639-4374-8F74-2481AF5CC33F}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{A546FCC0-BB5E-43AD-8F95-52331F74647D}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{D70509B7-BF60-42EA-97DE-5FB1C25E9A88}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "TCP Query User{1C013964-5901-43DA-AB9D-C1B6554C0F94}c:\\program files\\gigabyte\\gest\\run.exe"= UDP:c:\program files\gigabyte\gest\run.exe:update
    "UDP Query User{373693EC-0AF9-471F-9D0F-E186B6FB2AB5}c:\\program files\\gigabyte\\gest\\run.exe"= TCP:c:\program files\gigabyte\gest\run.exe:update
    "{D0E48328-2252-432A-8EB3-BDECF4706B09}"= UDP:c:\program files\Orb Networks\Orb\bin\Orb.exe:o rb
    "{ACD64910-5267-4FF3-AA6B-99429B9250F7}"= TCP:c:\program files\Orb Networks\Orb\bin\Orb.exe:o rb
    "{99C551D7-54C9-4520-8353-D7428DB24D8C}"= UDP:c:\program files\Orb Networks\Orb\bin\OrbTray.exe:o rbTray
    "{CEEA9F70-360F-4921-9299-A4C0476AFE9C}"= TCP:c:\program files\Orb Networks\Orb\bin\OrbTray.exe:o rbTray
    "{66606E47-5ECD-4008-AA42-1D984DDA2227}"= UDP:c:\program files\Orb Networks\Orb\bin\OrbIR.exe:o rbIR
    "{28A5E291-B23F-4A85-A79E-A404FB526E42}"= TCP:c:\program files\Orb Networks\Orb\bin\OrbIR.exe:o rbIR
    "{02A1DE96-D760-465F-A505-263415AF5B62}"= UDP:c:\program files\Orb Networks\Orb\bin\OrbStreamerClient.exe:o rb Stream Client
    "{86A6FF35-9B52-4531-A0CF-FC2F6D21359B}"= TCP:c:\program files\Orb Networks\Orb\bin\OrbStreamerClient.exe:o rb Stream Client
    "{8F236852-14D8-4C60-8D6E-F71AECD3729E}"= UDP:c:\program files\Orb Networks\Orb\bin\xmltv.exe:o rbTVGuide
    "{8EB65903-7500-46C2-8F7F-2C7A868E2708}"= TCP:c:\program files\Orb Networks\Orb\bin\xmltv.exe:o rbTVGuide
    "{56D90E6E-3C0E-44AB-9BB4-8DD92EB2D830}"= UDP:c:\program files\Orb Networks\Orb\bin\OrbChannelScan.exe:o rbChannelScan
    "{8DC4C258-632A-4938-BCB2-4175FDC82501}"= TCP:c:\program files\Orb Networks\Orb\bin\OrbChannelScan.exe:o rbChannelScan

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
    "EnableFirewall"= 0 (0x0)

    R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\System32\drivers\bdfndisf.sys [02/06/2008 15:16 86792]
    S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\drivers\ASPI32.SYS [14/04/2009 15:34 84832]
    S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [07/03/2009 23:16 79360]
    S3 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\GEST\GSvr.exe [06/03/2009 21:53 47624]
    S3 GVTDrv;GVTDrv;c:\windows\System32\drivers\GVTDrv.sys [07/03/2009 11:43 24944]
    S3 MarkFun_NT;MarkFun_NT;c:\program files\GIGABYTE\ET5Pro\MARKFUN.W32 [07/03/2009 11:26 17912]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bdx REG_MULTI_SZ scan

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    Contents of the 'Scheduled Tasks' folder

    2009-08-10 c:\windows\Tasks\User_Feed_Synchronization-{75316F05-6022-4151-BF2B-3B501A87030A}.job
    - c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]

    2009-08-10 c:\windows\Tasks\User_Feed_Synchronization-{FF4B7D71-F587-42D8-B738-DED8092258BB}.job
    - c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.free.fr/
    IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} - hxxps://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
    DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-2.0.cab
    FF - ProfilePath - c:\users\Nono\AppData\Roaming\Mozilla\Firefox\Profiles\n3szn5w1.default\
    FF - prefs.js: browser.search.selectedEngine - xeoo.com
    FF - prefs.js: browser.startup.homepage - hxxp://82.242.160.112:9000
    FF - prefs.js: keyword.URL - hxxp://xeoo.com/?p=url&a=firefox&k=
    FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
    FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.bookmark_page", false);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.current_page", false);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.restore_default", false);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importBookmarksHTML", true);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importDefaults", false);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.search.selectedEngine", "xeoo.com");
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("keyword.URL", "http://xeoo.com/?p=url&a=firefox&k=");
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.startup.homepage", "http://www.xeoo.com/?p=h&a=firefox");
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-10 20:13
    Windows 6.0.6001 Service Pack 1 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MarkFun_NT]
    "ImagePath"="\??\c:\program files\GIGABYTE\ET5Pro\markfun.w32"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-2611209188-2014074918-3142469776-1002\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    "??"=hex:a8,e3,8d,41,48,82,12,f0,33,41,2a,ae,0e,32,a5,68,9c,af,dc,60,d7,fd,48,
    38,97,8f,16,3c,13,39,ac,52,59,1b,30,c7,c9,e3,63,80,15,61,59,a5,35,e5,6f,f6,\
    "??"=hex:92,88,d6,0f,e7,05,2f,d3,6e,38,80,65,6e,5c,e6,fc

    [HKEY_USERS\S-1-5-21-2611209188-2014074918-3142469776-1002\Software\SecuROM\License information*]
    "datasecu"=hex:D 2,0f,50,67,ac,b5,a9,f2,28,5e,b5,ec,c3,b4,63,81,14,e4,0d,f4,45,
    80,48,36,28,64,95,ad,26,2c,c7,53,28,6f,b1,37,0d,e6,c9,2d,77,e3,8b,2a,00,0d,\
    "rkeysecu"=hex:1b,b5,52,6d,b9,b0,2c,c1,55,51,23,8c,25,8e,a7,8c

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:00000000
    .
    Completion time: 2009-08-10 20:15
    ComboFix-quarantined-files.txt 2009-08-10 18:15
    ComboFix2.txt 2009-08-10 17:49
    ComboFix3.txt 2009-08-09 17:54

    Pre-Run: 37 319 614 464 octets libres
    Post-Run: 37 170 843 648 octets libres

    244 --- E O F --- 2009-08-07 07:03
    a c 327 8 Sécurité
    10 Août 2009 20:46:58

    /!\ Seul nonob13 peut suivre cette procédure /!\

    Désactive toute protection résidente (Antivirus...) !

    ---> Copie (CTRL+C) le texte se situant dans le cadre ci-dessous :

    KillAll::

    Collect::[4]
    c:\windows\system32\vsfocebckxgiie.dat
    c:\windows\system32\drivers\vsfocexeydpwrn.sys
    c:\windows\system32\vsfocebinthssi.dat

    ---> Ouvre le Bloc-notes : Démarrer > Tous les programmes > Accessoires > Bloc-notes.

    - Colle (CTRL+V) le texte dans le Bloc-notes.
    - Enregistre ce fichier dans : Bureau
    - Nom du fichier : CFScript
    - Type du fichier : tous les fichiers !!
    - Clique sur Enregistrer.
    - Quitte le Bloc-notes.

    ---> Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :



  • Cela va relancer Combofix : au message qui apparaît, accepte.
  • Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
  • Ne touche à rien tant que le scan n'est pas terminé.
  • Une fois le scan achevé, un rapport va s'afficher, copie/colle son contenu sur le forum.
  • Si le fichier ne s'ouvre pas, il se trouve ici : C:\ComboFix.txt

    ;) 
    11 Août 2009 09:51:26

    Nous y revoila.
    A savoir que le systeme tourne deja mieux et qu'il m'est possible de refaire pas mal de truc depuis le mode normal (pas sans echec)

    Voila donc le rapport suite à l'execution minutieuse de vos instructions:

    ComboFix 09-08-10.01 - Nono 11/08/2009 9:06.3.4 - NTFSx86
    Running from: c:\users\Nono\Desktop\ComboFix.exe
    Command switches used :: c:\users\Nono\Desktop\CFScript.txt
    AV: Bitdefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
    FW: Bitdefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
    SP: BitDefender AntiSpam *disabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

    file zipped: c:\windows\system32\drivers\vsfocexeydpwrn.sys
    file zipped: c:\windows\system32\vsfocebckxgiie.dat
    file zipped: c:\windows\system32\vsfocebinthssi.dat
    .

    ((((((((((((((((((((((((( Files Created from 2009-07-11 to 2009-08-11 )))))))))))))))))))))))))))))))
    .

    2009-08-11 07:14 . 2009-08-11 07:32 -------- d-----w- c:\users\Nono\AppData\Local\temp
    2009-08-11 07:14 . 2009-08-11 07:14 -------- d-----w- c:\users\Public\AppData\Local\temp
    2009-08-11 07:14 . 2009-08-11 07:14 -------- d-----w- c:\users\Nana\AppData\Local\temp
    2009-08-11 07:14 . 2009-08-11 07:14 -------- d-----w- c:\users\Default\AppData\Local\temp
    2009-08-09 07:53 . 2009-08-09 07:53 -------- d-----w- c:\windows\Sun
    2009-08-09 07:52 . 2009-08-09 07:52 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-08-09 07:52 . 2009-08-09 07:52 -------- d-----w- c:\program files\Java
    2009-08-08 18:12 . 2009-08-08 18:12 -------- d-----w- c:\programdata\WindowsSearch
    2009-08-08 15:05 . 2009-08-08 15:05 -------- d-----w- c:\users\Nono\AppData\Roaming\Malwarebytes
    2009-08-08 15:05 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-08 15:05 . 2009-08-08 15:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-08-08 15:05 . 2009-08-08 15:05 -------- d-----w- c:\programdata\Malwarebytes
    2009-08-08 15:05 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-07 07:02 . 2009-08-07 07:02 -------- d-----w- c:\windows\system32\xlive
    2009-08-07 07:02 . 2009-08-07 07:02 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
    2009-08-07 06:47 . 2009-08-07 06:47 -------- d-----w- C:\_OTM
    2009-08-06 07:14 . 2009-08-06 07:19 -------- d-----w- c:\program files\trend micro
    2009-08-06 07:14 . 2009-08-06 07:19 -------- d-----w- C:\rsit
    2009-08-05 12:21 . 2009-08-10 07:05 -------- d-----w- c:\program files\a-squared Anti-Malware
    2009-08-05 11:56 . 2009-08-05 11:56 -------- d-----w- c:\users\Nono\AppData\Roaming\Yahoo!
    2009-08-05 11:56 . 2009-08-06 07:10 -------- d-----w- c:\program files\Yahoo!
    2009-08-05 11:56 . 2009-08-05 11:57 -------- d-----w- c:\program files\CCleaner
    2009-08-05 08:00 . 2009-08-05 11:07 -------- d-----w- c:\program files\a-squared Free
    2009-08-04 07:58 . 2009-08-04 07:58 -------- d-----w- c:\program files\QuickTime
    2009-07-31 13:47 . 2009-07-31 13:47 -------- d-----w- c:\program files\Freeplayer
    2009-07-31 09:56 . 2009-07-31 09:56 -------- d-----w- c:\program files\Ultimate Pinball Gold
    2009-07-31 09:25 . 2009-08-10 12:37 91 ----a-w- c:\windows\system32\vsfocebckxgiie.dat
    2009-07-31 09:14 . 2009-08-10 17:04 0 ----a-w- c:\windows\system32\drivers\vsfocexeydpwrn.sys
    2009-07-31 09:14 . 2009-08-10 17:02 41273 ----a-w- c:\windows\system32\vsfocebinthssi.dat
    2009-07-23 18:40 . 2009-07-23 18:40 -------- d-----w- c:\program files\Common Files\SWF Studio
    2009-07-23 18:40 . 2009-07-23 18:44 -------- d-----w- c:\program files\USB Disk Win98 Driver
    2009-07-22 07:54 . 2009-07-22 11:00 -------- d-----w- c:\users\Nono\AppData\Roaming\vlc
    2009-07-15 13:05 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll
    2009-07-15 13:05 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll
    2009-07-15 13:05 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll
    2009-07-15 13:05 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll
    2009-07-14 15:17 . 2009-07-14 15:17 15308440 ----a-w- c:\windows\system32\xlive.dll
    2009-07-14 15:17 . 2009-07-14 15:17 13642888 ----a-w- c:\windows\system32\xlivefnt.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-11 07:32 . 2009-03-07 09:43 81984 ----a-w- c:\windows\system32\bdod.bin
    2009-08-11 07:22 . 2008-01-21 08:40 681936 ----a-w- c:\windows\system32\perfh00C.dat
    2009-08-11 07:22 . 2008-01-21 08:40 129090 ----a-w- c:\windows\system32\perfc00C.dat
    2009-08-10 06:45 . 2009-03-07 09:43 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
    2009-08-09 18:39 . 2009-03-07 09:38 -------- d-----w- c:\program files\Common Files\BitDefender
    2009-08-07 10:25 . 2009-05-11 17:47 -------- d-----w- c:\users\Nono\AppData\Roaming\Winamp
    2009-08-07 09:49 . 2009-05-11 17:47 -------- d-----w- c:\program files\Winamp
    2009-08-05 12:00 . 2009-04-11 16:02 -------- d-----w- c:\users\Nono\AppData\Roaming\Azureus
    2009-08-05 08:03 . 2009-03-08 12:09 -------- d-----w- c:\users\Nono\AppData\Roaming\GrabIt
    2009-07-23 18:40 . 2009-03-06 19:53 -------- d--h--w- c:\program files\InstallShield Installation Information
    2009-07-21 21:52 . 2009-07-29 06:48 915456 ----a-w- c:\windows\system32\wininet.dll
    2009-07-21 21:47 . 2009-07-29 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2009-07-21 21:47 . 2009-07-29 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
    2009-07-21 20:13 . 2009-07-29 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2009-07-16 15:37 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
    2009-07-15 13:52 . 2009-03-06 15:39 -------- d-----w- c:\programdata\Microsoft Help
    2009-06-29 12:04 . 2009-06-29 12:00 -------- d-----w- c:\users\Nono\AppData\Roaming\PhotoFiltre Studio X
    2009-06-29 12:00 . 2009-06-29 12:00 -------- d-----w- c:\program files\PhotoFiltre Studio X
    2009-06-28 16:32 . 2009-06-28 16:32 -------- d-----w- c:\users\Nana\AppData\Roaming\DivX
    2009-05-27 08:14 . 2009-05-27 08:14 10134 ----a-r- c:\users\Nono\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
    2009-05-23 10:06 . 2009-05-23 10:06 107 ----a-w- c:\programdata\Last.fm\Client\uninst2.bat
    2009-05-23 10:06 . 2009-05-23 10:06 683801 ----a-w- c:\programdata\Last.fm\Client\UninstWMP\unins000.exe
    2009-05-23 10:06 . 2009-05-23 10:06 683801 ----a-w- c:\programdata\Last.fm\Client\UninstWA\unins000.exe
    2009-05-14 10:27 . 2009-03-07 12:03 99864 ----a-w- c:\users\Nana\AppData\Local\GDIPFONTCACHEV1.DAT
    .

    ((((((((((((((((((((((((((((( SnapShot_2009-08-10_17.45.32 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-01-21 01:58 . 2009-08-11 07:00 47018 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2006-11-02 13:05 . 2009-08-11 07:00 74086 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    + 2009-03-06 14:41 . 2009-08-11 07:24 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-03-06 14:41 . 2009-08-10 12:26 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-03-06 14:41 . 2009-08-11 07:24 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-03-06 14:41 . 2009-08-10 12:26 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2009-03-06 14:41 . 2009-08-11 07:24 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2009-03-06 14:41 . 2009-08-10 12:26 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-03-30 17:15 . 2009-08-10 18:17 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-03-30 17:15 . 2009-07-13 10:19 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-03-30 17:15 . 2009-07-13 10:19 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2009-03-30 17:15 . 2009-08-10 18:17 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-03-30 17:15 . 2009-07-13 10:19 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-03-30 17:15 . 2009-08-10 18:17 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2009-03-06 19:55 . 2009-08-10 17:26 3274 c:\windows\System32\WDI\ERCQueuedResolutions.dat
    + 2009-03-06 19:55 . 2009-08-11 07:14 3274 c:\windows\System32\WDI\ERCQueuedResolutions.dat
    + 2009-03-07 16:50 . 2009-08-11 07:00 8554 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2611209188-2014074918-3142469776-1002_UserData.bin
    + 2009-08-11 07:15 . 2009-08-11 07:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2009-08-10 17:42 . 2009-08-10 17:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2009-08-10 17:42 . 2009-08-10 17:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2009-08-11 07:15 . 2009-08-11 07:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2006-11-02 10:33 . 2009-08-11 07:22 598652 c:\windows\System32\perfh009.dat
    + 2006-11-02 10:33 . 2009-08-11 07:22 105922 c:\windows\System32\perfc009.dat
    - 2009-03-26 08:47 . 2009-08-10 06:51 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
    + 2009-03-26 08:47 . 2009-08-11 07:10 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
    "EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
    "EasyTuneVPro"="c:\program files\Gigabyte\ET5Pro\ETcall.exe" [2007-07-26 20480]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
    "BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 61440]
    "BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2008-09-04 368640]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
    "USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 65536]
    "a-squared"="c:\program files\a-squared Anti-Malware\a2guard.exe" [2009-08-05 3208848]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-09 149280]
    "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-02-13 4915200]
    "P17RunE"="P17RunE.dll" - c:\windows\System32\P17RunE.dll [2007-04-09 14848]

    c:\users\Nana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "mixer2"=wdmaud.drv

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "AntiSpywareOverride"=dword:00000001
    "FirewallOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{DE3F0886-ED68-4711-9296-D4A9FC94E4F3}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{EA4473AC-A13D-4F10-9CFC-9E4066D69941}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{02AF42C7-4639-4374-8F74-2481AF5CC33F}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{A546FCC0-BB5E-43AD-8F95-52331F74647D}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{D70509B7-BF60-42EA-97DE-5FB1C25E9A88}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "TCP Query User{1C013964-5901-43DA-AB9D-C1B6554C0F94}c:\\program files\\gigabyte\\gest\\run.exe"= UDP:c:\program files\gigabyte\gest\run.exe:update
    "UDP Query User{373693EC-0AF9-471F-9D0F-E186B6FB2AB5}c:\\program files\\gigabyte\\gest\\run.exe"= TCP:c:\program files\gigabyte\gest\run.exe:update
    "{D0E48328-2252-432A-8EB3-BDECF4706B09}"= UDP:c:\program files\Orb Networks\Orb\bin\Orb.exe:o rb
    "{ACD64910-5267-4FF3-AA6B-99429B9250F7}"= TCP:c:\program files\Orb Networks\Orb\bin\Orb.exe:o rb
    "{99C551D7-54C9-4520-8353-D7428DB24D8C}"= UDP:c:\program files\Orb Networks\Orb\bin\OrbTray.exe:o rbTray
    "{CEEA9F70-360F-4921-9299-A4C0476AFE9C}"= TCP:c:\program files\Orb Networks\Orb\bin\OrbTray.exe:o rbTray
    "{66606E47-5ECD-4008-AA42-1D984DDA2227}"= UDP:c:\program files\Orb Networks\Orb\bin\OrbIR.exe:o rbIR
    "{28A5E291-B23F-4A85-A79E-A404FB526E42}"= TCP:c:\program files\Orb Networks\Orb\bin\OrbIR.exe:o rbIR
    "{02A1DE96-D760-465F-A505-263415AF5B62}"= UDP:c:\program files\Orb Networks\Orb\bin\OrbStreamerClient.exe:o rb Stream Client
    "{86A6FF35-9B52-4531-A0CF-FC2F6D21359B}"= TCP:c:\program files\Orb Networks\Orb\bin\OrbStreamerClient.exe:o rb Stream Client
    "{8F236852-14D8-4C60-8D6E-F71AECD3729E}"= UDP:c:\program files\Orb Networks\Orb\bin\xmltv.exe:o rbTVGuide
    "{8EB65903-7500-46C2-8F7F-2C7A868E2708}"= TCP:c:\program files\Orb Networks\Orb\bin\xmltv.exe:o rbTVGuide
    "{56D90E6E-3C0E-44AB-9BB4-8DD92EB2D830}"= UDP:c:\program files\Orb Networks\Orb\bin\OrbChannelScan.exe:o rbChannelScan
    "{8DC4C258-632A-4938-BCB2-4175FDC82501}"= TCP:c:\program files\Orb Networks\Orb\bin\OrbChannelScan.exe:o rbChannelScan

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
    "EnableFirewall"= 0 (0x0)

    R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\System32\drivers\bdfndisf.sys [02/06/2008 15:16 86792]
    S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\drivers\ASPI32.SYS [14/04/2009 15:34 84832]
    S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [07/03/2009 23:16 79360]
    S3 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\GEST\GSvr.exe [06/03/2009 21:53 47624]
    S3 GVTDrv;GVTDrv;c:\windows\System32\drivers\GVTDrv.sys [07/03/2009 11:43 24944]
    S3 MarkFun_NT;MarkFun_NT;c:\program files\GIGABYTE\ET5Pro\MARKFUN.W32 [07/03/2009 11:26 17912]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bdx REG_MULTI_SZ scan

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    Contents of the 'Scheduled Tasks' folder

    2009-08-11 c:\windows\Tasks\User_Feed_Synchronization-{75316F05-6022-4151-BF2B-3B501A87030A}.job
    - c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]

    2009-08-11 c:\windows\Tasks\User_Feed_Synchronization-{FF4B7D71-F587-42D8-B738-DED8092258BB}.job
    - c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.free.fr/
    IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} - hxxps://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
    DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-2.0.cab
    FF - ProfilePath - c:\users\Nono\AppData\Roaming\Mozilla\Firefox\Profiles\n3szn5w1.default\
    FF - prefs.js: browser.search.selectedEngine - xeoo.com
    FF - prefs.js: browser.startup.homepage - hxxp://82.242.160.112:9000
    FF - prefs.js: keyword.URL - hxxp://xeoo.com/?p=url&a=firefox&k=
    FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
    FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.bookmark_page", false);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.current_page", false);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.restore_default", false);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importBookmarksHTML", true);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importDefaults", false);
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.search.selectedEngine", "xeoo.com");
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("keyword.URL", "http://xeoo.com/?p=url&a=firefox&k=");
    c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.startup.homepage", "http://www.xeoo.com/?p=h&a=firefox");
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-11 09:32
    Windows 6.0.6001 Service Pack 1 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    c:\windows\TEMP\TMP0000000B3B704B81A744AB05 524288 bytes executable

    scan completed successfully
    hidden files: 1

    **************************************************************************

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MarkFun_NT]
    "ImagePath"="\??\c:\program files\GIGABYTE\ET5Pro\markfun.w32"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-2611209188-2014074918-3142469776-1002\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    "??"=hex:a8,e3,8d,41,48,82,12,f0,33,41,2a,ae,0e,32,a5,68,9c,af,dc,60,d7,fd,48,
    38,97,8f,16,3c,13,39,ac,52,59,1b,30,c7,c9,e3,63,80,15,61,59,a5,35,e5,6f,f6,\
    "??"=hex:92,88,d6,0f,e7,05,2f,d3,6e,38,80,65,6e,5c,e6,fc

    [HKEY_USERS\S-1-5-21-2611209188-2014074918-3142469776-1002\Software\SecuROM\License information*]
    "datasecu"=hex:D 2,0f,50,67,ac,b5,a9,f2,28,5e,b5,ec,c3,b4,63,81,14,e4,0d,f4,45,
    80,48,36,28,64,95,ad,26,2c,c7,53,28,6f,b1,37,0d,e6,c9,2d,77,e3,8b,2a,00,0d,\
    "rkeysecu"=hex:1b,b5,52,6d,b9,b0,2c,c1,55,51,23,8c,25,8e,a7,8c

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:00000000
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\System32\Ati2evxx.exe
    c:\windows\System32\audiodg.exe
    c:\windows\System32\Ati2evxx.exe
    c:\program files\a-squared Anti-Malware\a2service.exe
    c:\program files\a-squared Free\a2service.exe
    c:\program files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
    c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    c:\program files\BitDefender\BitDefender 2008\vsserv.exe
    c:\windows\System32\WUDFHost.exe
    c:\windows\System32\conime.exe
    c:\program files\Windows Media Player\wmpnetwk.exe
    .
    **************************************************************************
    .
    Completion time: 2009-08-11 9:34 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-08-11 07:34
    ComboFix2.txt 2009-08-10 18:15
    ComboFix3.txt 2009-08-10 17:49
    ComboFix4.txt 2009-08-09 17:54

    Pre-Run: 37 000 249 344 octets libres
    Post-Run: 41 673 060 352 octets libres

    275 --- E O F --- 2009-08-11 07:19
    Upload was successful


    a c 327 8 Sécurité
    11 Août 2009 16:45:32

    /!\ Seul nonob13 peut suivre cette procédure /!\

    Désactive toute protection résidente (Antivirus...) !

    ---> Copie (CTRL+C) le texte se situant dans le cadre ci-dessous :

    KillAll::

    File::
    c:\windows\system32\vsfocebckxgiie.dat
    c:\windows\system32\drivers\vsfocexeydpwrn.sys
    c:\windows\system32\vsfocebinthssi.dat

    ---> Ouvre le Bloc-notes : Démarrer > Tous les programmes > Accessoires > Bloc-notes.

    - Colle (CTRL+V) le texte dans le Bloc-notes.
    - Enregistre ce fichier dans : Bureau
    - Nom du fichier : CFScript
    - Type du fichier : tous les fichiers !!
    - Clique sur Enregistrer.
    - Quitte le Bloc-notes.

    ---> Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :



  • Cela va relancer Combofix : au message qui apparaît, accepte.
  • Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
  • Ne touche à rien tant que le scan n'est pas terminé.
  • Une fois le scan achevé, un rapport va s'afficher, copie/colle son contenu sur le forum.
  • Si le fichier ne s'ouvre pas, il se trouve ici : C:\ComboFix.txt

    ;) 
    11 Août 2009 17:34:36

    Et Voila le dernier rapport conformement à ta demande

    ComboFix 09-08-10.06 - Nono 11/08/2009 17:07.4.4 - NTFSx86
    Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3582.2555 [GMT 2:00]
    Running from: c:\users\Nono\Desktop\ComboFix.exe
    Command switches used :: c:\users\Nono\Desktop\CFScript.txt
    AV: Bitdefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
    FW: Bitdefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
    SP: BitDefender AntiSpam *disabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

    FILE ::
    "c:\windows\system32\drivers\vsfocexeydpwrn.sys"
    "c:\windows\system32\vsfocebckxgiie.dat"
    "c:\windows\system32\vsfocebinthssi.dat"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\Data
    c:\windows\system32\drivers\vsfocexeydpwrn.sys
    c:\windows\system32\vsfocebckxgiie.dat
    c:\windows\system32\vsfocebinthssi.dat


    .
    ((((((((((((((((((((((((( Files Created from 2009-07-11 to 2009-08-11 )))))))))))))))))))))))))))))))
    .

    2009-08-11 15:17 . 2009-08-11 15:22 -------- d-----w- c:\users\Nono\AppData\Local\temp
    2009-08-11 15:17 . 2009-08-11 15:17 -------- d-----w- c:\users\Public\AppData\Local\temp
    2009-08-11 15:17 . 2009-08-11 15:17 -------- d-----w- c:\users\Nana\AppData\Local\temp
    2009-08-11 15:17 . 2009-08-11 15:17 -------- d-----w- c:\users\Default\AppData\Local\temp
    2009-08-11 13:16 . 2009-08-11 13:16 -------- d-----w- c:\windows\LastGood.Tmp
    2009-08-11 13:10 . 2009-08-11 13:11 -------- d-----w- c:\windows\system32\ca-ES
    2009-08-11 13:10 . 2009-08-11 13:10 -------- d-----w- c:\windows\system32\eu-ES
    2009-08-11 13:10 . 2009-08-11 13:10 -------- d-----w- c:\windows\system32\vi-VN
    2009-08-11 11:02 . 2009-08-11 11:02 -------- d-----w- c:\windows\system32\EventProviders
    2009-08-11 11:00 . 2009-04-11 06:32 527848 ----a-w- c:\windows\system32\drivers\ndis.sys
    2009-08-09 07:53 . 2009-08-09 07:53 -------- d-----w- c:\windows\Sun
    2009-08-09 07:52 . 2009-08-09 07:52 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-08-09 07:52 . 2009-08-09 07:52 -------- d-----w- c:\program files\Java
    2009-08-08 18:12 . 2009-08-08 18:12 -------- d-----w- c:\programdata\WindowsSearch
    2009-08-08 15:05 . 2009-08-08 15:05 -------- d-----w- c:\users\Nono\AppData\Roaming\Malwarebytes
    2009-08-08 15:05 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-08 15:05 . 2009-08-08 15:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-08-08 15:05 . 2009-08-08 15:05 -------- d-----w- c:\programdata\Malwarebytes
    2009-08-08 15:05 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-07 07:02 . 2009-08-07 07:02 -------- d-----w- c:\windows\system32\xlive
    2009-08-07 07:02 . 2009-08-07 07:02 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
    2009-08-07 06:47 . 2009-08-07 06:47 -------- d-----w- C:\_OTM
    2009-08-06 07:14 . 2009-08-06 07:19 -------- d-----w- c:\program files\trend micro
    2009-08-06 07:14 . 2009-08-06 07:19 -------- d-----w- C:\rsit
    2009-08-05 12:21 . 2009-08-11 10:24 -------- d-----w- c:\program files\a-squared Anti-Malware
    2009-08-05 11:56 . 2009-08-05 11:56 -------- d-----w- c:\users\Nono\AppData\Roaming\Yahoo!
    2009-08-05 11:56 . 2009-08-06 07:10 -------- d-----w- c:\program files\Yahoo!
    2009-08-05 11:56 . 2009-08-05 11:57 -------- d-----w- c:\program files\CCleaner
    2009-08-05 08:00 . 2009-08-11 10:25 -------- d-----w- c:\program files\a-squared Free
    2009-08-04 07:58 . 2009-08-04 07:58 -------- d-----w- c:\program files\QuickTime
    2009-07-31 13:47 . 2009-07-31 13:47 -------- d-----w- c:\program files\Freeplayer
    2009-07-31 09:56 . 2009-07-31 09:56 -------- d-----w- c:\program files\Ultimate Pinball Gold
    2009-07-23 18:40 . 2009-07-23 18:40 -------- d-----w- c:\program files\Common Files\SWF Studio
    2009-07-23 18:40 . 2009-07-23 18:44 -------- d-----w- c:\program files\USB Disk Win98 Driver
    2009-07-22 07:54 . 2009-07-22 11:00 -------- d-----w- c:\users\Nono\AppData\Roaming\vlc
    2009-07-15 13:05 . 2009-06-15 14:53 156672 ----a-w- c:\windows\system32\t2embed.dll
    2009-07-15 13:05 . 2009-06-15 14:52 23552 ----a-w- c:\windows\system32\lpk.dll
    2009-07-15 13:05 . 2009-06-15 14:52 72704 ----a-w- c:\windows\system32\fontsub.dll
    2009-07-15 13:05 . 2009-06-15 14:51 10240 ----a-w- c:\windows\system32\dciman32.dll
    2009-07-15 13:05 . 2009-06-15 12:42 289792 ----a-w- c:\windows\system32\atmfd.dll
    2009-07-15 13:05 . 2009-04-11 06:28 34304 ----a-w- c:\windows\system32\atmlib.dll
    2009-07-14 15:17 . 2009-07-14 15:17 15308440 ----a-w- c:\windows\system32\xlive.dll
    2009-07-14 15:17 . 2009-07-14 15:17 13642888 ----a-w- c:\windows\system32\xlivefnt.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-11 15:22 . 2009-03-07 09:43 81984 ----a-w- c:\windows\system32\bdod.bin
    2009-08-11 13:20 . 2008-01-21 08:40 716060 ----a-w- c:\windows\system32\perfh00C.dat
    2009-08-11 13:20 . 2008-01-21 08:40 144214 ----a-w- c:\windows\system32\perfc00C.dat
    2009-08-11 13:11 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
    2009-08-11 13:11 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
    2009-08-11 13:11 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
    2009-08-11 13:11 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
    2009-08-11 13:11 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
    2009-08-11 13:11 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
    2009-08-11 13:11 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
    2009-08-11 13:10 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
    2009-08-11 13:02 . 2006-11-02 12:37 37665 ----a-w- c:\windows\Fonts\GlobalUserInterface.CompositeFont
    2009-08-10 06:45 . 2009-03-07 09:43 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
    2009-08-09 18:39 . 2009-03-07 09:38 -------- d-----w- c:\program files\Common Files\BitDefender
    2009-08-07 10:25 . 2009-05-11 17:47 -------- d-----w- c:\users\Nono\AppData\Roaming\Winamp
    2009-08-07 09:49 . 2009-05-11 17:47 -------- d-----w- c:\program files\Winamp
    2009-08-05 12:00 . 2009-04-11 16:02 -------- d-----w- c:\users\Nono\AppData\Roaming\Azureus
    2009-08-05 08:03 . 2009-03-08 12:09 -------- d-----w- c:\users\Nono\AppData\Roaming\GrabIt
    2009-07-23 18:40 . 2009-03-06 19:53 -------- d--h--w- c:\program files\InstallShield Installation Information
    2009-07-21 21:52 . 2009-07-29 06:48 915456 ----a-w- c:\windows\system32\wininet.dll
    2009-07-21 21:47 . 2009-07-29 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2009-07-21 21:47 . 2009-07-29 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
    2009-07-21 20:13 . 2009-07-29 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2009-07-15 13:52 . 2009-03-06 15:39 -------- d-----w- c:\programdata\Microsoft Help
    2009-06-29 12:04 . 2009-06-29 12:00 -------- d-----w- c:\users\Nono\AppData\Roaming\PhotoFiltre Studio X
    2009-06-29 12:00 . 2009-06-29 12:00 -------- d-----w- c:\program files\PhotoFiltre Studio X
    2009-06-28 16:32 . 2009-06-28 16:32 -------- d-----w- c:\users\Nana\AppData\Roaming\DivX
    2009-05-27 08:14 . 2009-05-27 08:14 10134 ----a-r- c:\users\Nono\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
    2009-05-23 10:06 . 2009-05-23 10:06 107 ----a-w- c:\programdata\Last.fm\Client\uninst2.bat
    2009-05-23 10:06 . 2009-05-23 10:06 683801 ----a-w- c:\programdata\Last.fm\Client\UninstWMP\unins000.exe
    2009-05-23 10:06 . 2009-05-23 10:06 683801 ----a-w- c:\programdata\Last.fm\Client\UninstWA\unins000.exe
    2009-05-14 10:27 . 2009-03-07 12:03 99864 ----a-w- c:\users\Nana\AppData\Local\GDIPFONTCACHEV1.DAT
    .

    ((((((((((((((((((((((((((((( SnapShot_2009-08-10_17.45.32 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-08-11 11:01 . 2009-04-11 06:28 52224 c:\windows\winsxs\x86_wudfusbcciddriver.inf_31bf3856ad364e35_6.0.6002.18005_none_646528b4fed68d6e\WUDFUsbccidDriver.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 54272 c:\windows\winsxs\x86_wsdscdrv.inf_31bf3856ad364e35_6.0.6002.18005_none_d229bfffc6a32553\WSDScPrx.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 56320 c:\windows\winsxs\x86_wsdprint.inf_31bf3856ad364e35_6.0.6002.18005_none_173ab75eae68bace\WSDPrPxy.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 16896 c:\windows\winsxs\x86_wsdprint.inf_31bf3856ad364e35_6.0.6002.18005_none_173ab75eae68bace\WSDPrint.sys
    + 2009-08-11 11:00 . 2009-02-18 18:39 23408 c:\windows\winsxs\x86_wpf-xamlviewer_31bf3856ad364e35_6.0.6002.18005_none_57f9c58d7a0eaddb\XamlViewer_v0300.exe
    + 2009-08-11 11:01 . 2009-02-18 18:39 94208 c:\windows\winsxs\x86_wpf-windowsformsintegration_31bf3856ad364e35_6.0.6002.18005_none_fc07886f78f1dcd7\WindowsFormsIntegration.dll
    + 2009-08-11 11:00 . 2009-02-18 18:39 98304 c:\windows\winsxs\x86_wpf-uiautomationtypes_31bf3856ad364e35_6.0.6002.18005_none_5efd9a79981257bd\UIAutomationTypes.dll
    + 2009-08-11 11:00 . 2009-02-18 18:39 40960 c:\windows\winsxs\x86_wpf-uiautomationprovider_31bf3856ad364e35_6.0.6002.18005_none_06884a618813ae63\UIAutomationProvider.dll
    + 2009-08-11 11:00 . 2009-02-18 18:39 35680 c:\windows\winsxs\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_6.0.6002.18005_none_264ab896c8c14f1a\TsWpfWrp.exe
    + 2009-08-11 11:01 . 2009-02-18 18:39 41344 c:\windows\winsxs\x86_wpf-presentationhostproxy_31bf3856ad364e35_6.0.6002.18005_none_2c768fb876f0e8b7\PresentationHostProxy.dll
    + 2009-08-11 11:00 . 2009-02-18 18:39 43904 c:\windows\winsxs\x86_wpf-presentationfontcache_31bf3856ad364e35_6.0.6002.18005_none_07850fdb0f4fdd06\PresentationFontCache.exe
    + 2009-08-11 11:01 . 2009-02-18 18:39 68960 c:\windows\winsxs\x86_wpf-penimc_31bf3856ad364e35_6.0.6002.18005_none_ad9c8bf401cf9f35\PenIMC.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 39936 c:\windows\winsxs\x86_wpdmtp.inf_31bf3856ad364e35_6.0.6002.18005_none_2185beaf83d2688d\WpdUsb.sys
    + 2008-01-21 02:23 . 2008-01-21 02:23 60928 c:\windows\winsxs\x86_wpdmtp.inf_31bf3856ad364e35_6.0.6002.18005_none_2185beaf83d2688d\WpdMtpUS.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 66560 c:\windows\winsxs\x86_wpdmtp.inf_31bf3856ad364e35_6.0.6002.18005_none_2185beaf83d2688d\WpdMtpIP.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 33280 c:\windows\winsxs\x86_wpdmtp.inf_31bf3856ad364e35_6.0.6002.18005_none_2185beaf83d2688d\WpdConns.dll
    + 2009-08-11 11:00 . 2009-04-11 04:42 31616 c:\windows\winsxs\x86_winusb.inf_31bf3856ad364e35_6.0.6002.18005_none_f9e05d9212c3259d\winusb.sys
    + 2009-08-11 11:01 . 2009-04-11 06:27 87552 c:\windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6002.18005_none_3d746908b76294a3\SearchFilterHost.exe
    + 2009-08-11 11:01 . 2009-04-11 06:28 71680 c:\windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6002.18005_none_3d746908b76294a3\propdefs.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 43008 c:\windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6002.18005_none_3d746908b76294a3\msstrc.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 33280 c:\windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6002.18005_none_3d746908b76294a3\mssprxy.dll
    + 2009-08-11 11:01 . 2009-04-11 06:28 87040 c:\windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6002.18005_none_3d746908b76294a3\mssitlb.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 11776 c:\windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6002.18005_none_3d746908b76294a3\msshooks.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 60416 c:\windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6002.18005_none_3d746908b76294a3\msscntrs.dll
    + 2009-08-11 11:01 . 2009-04-11 06:28 35328 c:\windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6002.18005_none_3d746908b76294a3\msscb.dll
    + 2009-03-06 15:02 . 2008-05-27 04:59 18904 c:\windows\winsxs\x86_windowssearchengine..uredqueryschema.bin_31bf3856ad364e35_7.0.6002.18005_none_8ae0ca49e0ec3b69\StructuredQuerySchemaTrivial.bin
    + 2009-08-11 11:00 . 2009-04-11 06:28 13312 c:\windows\winsxs\x86_windowssearch-wtrservicingsupport_31bf3856ad364e35_7.0.6002.18005_none_1828286a1e96a1f4\WSWTRSvc.exe
    + 2009-08-11 11:00 . 2009-04-11 04:42 73216 c:\windows\winsxs\x86_wdma_usb.inf_31bf3856ad364e35_6.0.6002.18005_none_6f0354adb3fcb0ad\USBAUDIO.sys
    + 2009-08-11 11:01 . 2009-02-18 18:38 18288 c:\windows\winsxs\x86_wcf-m_svc_mon_sup_dll_31bf3856ad364e35_6.0.6002.18005_none_a7c97e5948c03629\ServiceMonikerSupport.dll
    + 2009-08-11 11:01 . 2009-02-18 18:38 99680 c:\windows\winsxs\x86_wcf-infocard_api_dll_31bf3856ad364e35_6.0.6002.18005_none_a5d273d4acc201ce\infocardapi.dll
    + 2009-08-11 11:00 . 2009-04-11 04:42 31616 c:\windows\winsxs\x86_wceusbsh.inf_31bf3856ad364e35_6.0.6002.18005_none_20c50bf85340ec11\winusb.sys
    + 2009-08-11 11:01 . 2009-04-11 04:42 65536 c:\windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6002.18005_none_4a71c7c294f4e68f\USBSTOR.SYS
    + 2008-01-21 02:23 . 2008-01-21 02:23 23552 c:\windows\winsxs\x86_usbport.inf_31bf3856ad364e35_6.0.6002.18005_none_bfadd87f00af6ca2\usbuhci.sys
    + 2009-08-11 11:00 . 2009-04-11 04:42 19456 c:\windows\winsxs\x86_usbport.inf_31bf3856ad364e35_6.0.6002.18005_none_bfadd87f00af6ca2\usbohci.sys
    + 2009-08-11 11:00 . 2009-04-11 04:42 39936 c:\windows\winsxs\x86_usbport.inf_31bf3856ad364e35_6.0.6002.18005_none_bfadd87f00af6ca2\usbehci.sys
    + 2008-01-21 02:23 . 2008-01-21 02:23 15872 c:\windows\winsxs\x86_usbport.inf_31bf3856ad364e35_6.0.6002.18005_none_bfadd87f00af6ca2\hcrstco.dll
    + 2009-08-11 11:00 . 2009-04-11 04:38 30208 c:\windows\winsxs\x86_usbccid.inf_31bf3856ad364e35_6.0.6002.18005_none_39242ea8a946a368\usbccid.sys
    + 2008-01-21 02:23 . 2008-01-21 02:23 73216 c:\windows\winsxs\x86_usb.inf_31bf3856ad364e35_6.0.6002.18005_none_cce3e0020b941ebb\usbccgp.sys
    + 2009-08-11 11:00 . 2009-04-11 04:42 31616 c:\windows\winsxs\x86_transfercable.inf_31bf3856ad364e35_6.0.6002.18005_none_628b1c3d8ef9a255\x86\winusb.sys
    + 2009-08-11 11:00 . 2009-04-11 05:06 19968 c:\windows\winsxs\x86_sti.inf_31bf3856ad364e35_6.0.6002.18005_none_5bca4a74dde86c1f\WSDScan.sys
    + 2008-01-21 02:23 . 2008-01-21 02:23 89088 c:\windows\winsxs\x86_sti.inf_31bf3856ad364e35_6.0.6002.18005_none_5bca4a74dde86c1f\wiafbdrv.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 35328 c:\windows\winsxs\x86_sti.inf_31bf3856ad364e35_6.0.6002.18005_none_5bca4a74dde86c1f\usbscan.sys
    + 2008-01-21 02:23 . 2008-01-21 02:23 14848 c:\windows\winsxs\x86_sti.inf_31bf3856ad364e35_6.0.6002.18005_none_5bca4a74dde86c1f\scsiscan.sys
    + 2009-08-11 11:00 . 2009-04-11 04:39 11776 c:\windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6002.18005_none_a627020ee70bbf15\sffp_sd.sys
    + 2009-08-11 11:00 . 2009-04-11 04:39 12288 c:\windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6002.18005_none_a627020ee70bbf15\sffp_mmc.sys
    + 2008-01-21 02:23 . 2008-01-21 02:23 13312 c:\windows\winsxs\x86_sffdisk.inf_31bf3856ad364e35_6.0.6002.18005_none_a627020ee70bbf15\sffdisk.sys
    + 2006-11-02 12:34 . 2006-11-02 12:34 11368 c:\windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.0.6002.18005_none_59a829d65550e411\MsMpLics.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 58936 c:\windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.0.6002.18005_none_59a829d65550e411\MpRtPlug.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 90680 c:\windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.0.6002.18005_none_59a829d65550e411\MpOAV.dll
    + 2006-11-02 12:34 . 2006-11-02 12:34 16488 c:\windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.0.6002.18005_none_59a829d65550e411\MpAsDesc.dll
    + 2009-08-11 11:00 . 2009-04-11 04:19 89088 c:\windows\winsxs\x86_sdbus.inf_31bf3856ad364e35_6.0.6002.18005_none_73ce35cfc778dd26\sdbus.sys
    + 2009-08-11 11:01 . 2009-04-11 06:32 82408 c:\windows\winsxs\x86_sbp2.inf_31bf3856ad364e35_6.0.6002.18005_none_47241df8f34504ba\sbp2port.sys
    + 2009-08-11 11:00 . 2009-03-30 04:42 32768 c:\windows\winsxs\x86_regsvcs_b03f5f7f11d50a3a_6.0.6002.18005_none_ea0ad48568496bd5\RegSvcs.exe
    + 2009-08-11 11:00 . 2009-03-30 04:42 53248 c:\windows\winsxs\x86_regasm_b03f5f7f11d50a3a_6.0.6002.18005_none_16efa9df15d67325\RegAsm.exe
    + 2009-08-11 11:00 . 2009-04-11 06:28 69632 c:\windows\winsxs\x86_pnpxassoc_31bf3856ad364e35_6.0.6002.18005_none_346f5d3f6c9701f6\PNPXAssoc.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 17408 c:\windows\winsxs\x86_ntprint.inf_31bf3856ad364e35_6.0.6002.18005_none_3cec160db7d4ac84\I386\PJLMON.DLL
    + 2008-01-21 02:24 . 2008-01-21 02:24 17920 c:\windows\winsxs\x86_networking-mpssvc-svc_31bf3856ad364e35_6.0.6002.18005_none_9bffb484c4fe88e5\wfapigp.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 64000 c:\windows\winsxs\x86_networking-mpssvc-svc_31bf3856ad364e35_6.0.6002.18005_none_9bffb484c4fe88e5\mpsdrv.sys
    + 2008-01-21 02:24 . 2008-01-21 02:24 87552 c:\windows\winsxs\x86_networking-mpssvc-svc_31bf3856ad364e35_6.0.6002.18005_none_9bffb484c4fe88e5\icfupgd.dll
    + 2009-08-11 11:00 . 2009-04-11 04:46 15872 c:\windows\winsxs\x86_netrndis.inf_31bf3856ad364e35_6.0.6002.18005_none_c9ae083642ee6e54\usb8023x.sys
    + 2009-08-11 11:00 . 2009-04-11 04:46 33280 c:\windows\winsxs\x86_netrndis.inf_31bf3856ad364e35_6.0.6002.18005_none_c9ae083642ee6e54\rndismpx.sys
    + 2008-01-21 02:24 . 2008-01-21 02:24 16896 c:\windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.0.6002.18005_none_6862e2e7643773d9\SharedReg12.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 16896 c:\windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.0.6002.18005_none_8199f0814373a5b3\sbscmp20_mscorwks.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 16896 c:\windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.0.6002.18005_none_54ad0b7a61344e8c\sbscmp20_mscorlib.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 16896 c:\windows\winsxs\x86_netfx-sbscmp10_dll_31bf3856ad364e35_6.0.6002.18005_none_76f179ae021db881\sbscmp10.dll
    + 2009-08-11 11:01 . 2009-03-30 04:42 85320 c:\windows\winsxs\x86_netfx-perfcounter_dll_b03f5f7f11d50a3a_6.0.6002.18005_none_29b27e22fffa4776\PerfCounter.dll
    + 2009-08-11 11:01 . 2009-03-30 04:42 97592 c:\windows\winsxs\x86_netfx-ngen_exe_b03f5f7f11d50a3a_6.0.6002.18005_none_779867b84af56065\ngen.exe
    + 2009-08-11 11:00 . 2009-03-30 04:42 79696 c:\windows\winsxs\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_6.0.6002.18005_none_3d7a6880ab163624\NETFXSBS10.exe
    + 2009-08-11 11:01 . 2009-03-30 04:42 66368 c:\windows\winsxs\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_6.0.6002.18005_none_1fd1ab49e8ca6ebb\mscorsvw.exe
    + 2009-08-11 11:01 . 2009-03-30 04:42 74048 c:\windows\winsxs\x86_netfx-mscorsec_dll_b03f5f7f11d50a3a_6.0.6002.18005_none_118cda1df5183636\mscorsec.dll
    + 2009-08-11 11:01 . 2009-03-30 04:42 93504 c:\windows\winsxs\x86_netfx-mscormmc_dll_rtm_31bf3856ad364e35_6.0.6002.18005_none_a96e1e1ec6870b85\mscormmc.dll
    + 2009-08-11 11:01 . 2009-03-30 04:42 90960 c:\windows\winsxs\x86_netfx-mscorld_dll_b03f5f7f11d50a3a_6.0.6002.18005_none_c2ba992d4a006fcd\mscorld.dll
    + 2009-08-11 11:00 . 2009-03-30 04:42 80720 c:\windows\winsxs\x86_netfx-mscories_dll_31bf3856ad364e35_6.0.6002.18005_none_c00e966deeec7579\mscories.dll
    + 2009-08-11 11:00 . 2009-03-30 04:42 43344 c:\windows\winsxs\x86_netfx-mscorie_dll_b03f5f7f11d50a3a_6.0.6002.18005_none_ea720753707d6a51\mscorie.dll
    + 2009-08-11 11:01 . 2009-03-30 04:42 80208 c:\windows\winsxs\x86_netfx-mscordbc_dll_b03f5f7f11d50a3a_6.0.6002.18005_none_6ccb593bc60a1852\mscordbc.dll
    + 2009-08-11 11:00 . 2009-03-30 04:42 15688 c:\windows\winsxs\x86_netfx-fusion_dll_b03f5f7f11d50a3a_6.0.6002.18005_none_02ace91f0aebe7d3\fusion.dll
    + 2009-08-11 11:00 . 2009-03-30 04:42 33080 c:\windows\winsxs\x86_netfx-dw_b03f5f7f11d50a3a_6.0.6002.18005_none_cd77f4151b8ac157\dw20.exe
    + 2009-08-11 11:00 . 2009-03-30 04:42 93512 c:\windows\winsxs\x86_netfx-dfshim_dll_31bf3856ad364e35_6.0.6002.18005_none_7a6b6f7c5a1bb639\dfshim.dll
    + 2009-08-11 11:01 . 2009-03-30 04:42 59720 c:\windows\winsxs\x86_netfx-dfdll_dll_b03f5f7f11d50a3a_6.0.6002.18005_none_882bc28c54dfc639\dfdll.dll
    + 2009-08-11 11:00 . 2009-03-30 04:42 32064 c:\windows\winsxs\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_6.0.6002.18005_none_e59ba05e346044a2\cvtres.exe
    + 2009-08-11 11:01 . 2009-03-30 04:42 77112 c:\windows\winsxs\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.0.6002.18005_none_fe5428b22d6c0e79\csc.exe
    + 2009-08-11 11:01 . 2009-03-30 04:42 86360 c:\windows\winsxs\x86_netfx-corperfmonext_dll_b03f5f7f11d50a3a_6.0.6002.18005_none_b2c317a7c345a801\CORPerfMonExt.dll
    + 2009-08-11 11:00 . 2009-03-30 04:42 30528 c:\windows\winsxs\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.0.6002.18005_none_c4c45c1c8c9acff0\aspnet_wp.exe
    + 2009-08-11 11:00 . 2009-03-30 04:42 31048 c:\windows\winsxs\x86_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.0.6002.18005_none_80f871a1c32de056\aspnet_state.exe
    + 2009-08-11 11:00 . 2009-03-30 04:42 30024 c:\windows\winsxs\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.0.6002.18005_none_120341a3224c03b8\aspnet_regiis.exe
    + 2009-08-11 11:00 . 2009-03-30 04:42 30552 c:\windows\winsxs\x86_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.0.6002.18005_none_dd85cceefd0a877e\Aspnet_perf.dll
    + 2009-08-11 11:00 . 2009-03-30 04:42 94544 c:\windows\winsxs\x86_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.0.6002.18005_none_909e22e3d3759899\MmcAspExt.dll
    + 2009-08-11 11:00 . 2009-03-30 04:42 14168 c:\windows\winsxs\x86_netfx-aspnet_isapi_dll_b03f5f7f11d50a3a_6.0.6002.18005_none_dd58f4996955bca7\aspnet_isapi.dll
    + 2009-08-11 11:00 . 2009-03-30 04:42 18760 c:\windows\winsxs\x86_netfx-aspnet_filter_dll_b03f5f7f11d50a3a_6.0.6002.18005_none_d52bb06f58344ba9\aspnet_filter.dll
    + 2009-08-11 11:00 . 2009-03-30 04:42 55616 c:\windows\winsxs\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_6.0.6002.18005_none_c512442c6b4566d7\AppLaunch.exe
    + 2009-08-11 11:01 . 2009-03-30 04:42 95544 c:\windows\winsxs\x86_netfx-_vc_assembly_linker_dll_b03f5f7f11d50a3a_6.0.6002.18005_none_38d775cdebe1fba0\alink.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 20024 c:\windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\viaide.sys
    + 2009-08-11 11:00 . 2009-04-11 06:32 43496 c:\windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\pciidex.sys
    + 2009-08-11 11:00 . 2009-04-11 06:32 14312 c:\windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\pciide.sys
    + 2009-08-11 11:00 . 2009-04-11 06:32 27112 c:\windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\msahci.sys
    + 2008-01-21 02:23 . 2008-01-21 02:23 17976 c:\windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\intelide.sys
    + 2008-01-21 02:23 . 2008-01-21 02:23 19000 c:\windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\cmdide.sys
    + 2009-08-11 11:00 . 2009-04-11 06:32 19944 c:\windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
    + 2008-01-21 02:23 . 2008-01-21 02:23 17976 c:\windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\amdide.sys
    + 2008-01-21 02:23 . 2008-01-21 02:23 17464 c:\windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\aliide.sys
    + 2009-08-11 11:00 . 2009-04-11 06:32 93160 c:\windows\winsxs\x86_msdsm.inf_31bf3856ad364e35_6.0.6002.18005_none_cc32bbc0d8ad5cc9\msdsm.sys
    + 2009-08-11 11:00 . 2009-03-30 04:42 69632 c:\windows\winsxs\x86_msbuild_b03f5f7f11d50a3a_6.0.6002.18005_none_810e9dd9b189c19e\MSBuild.exe
    + 2009-08-11 11:00 . 2009-04-11 06:28 40960 c:\windows\winsxs\x86_microsoft.windows.h..uetooth-driverclass_31bf3856ad364e35_6.1.6002.18005_none_4eff3095feca167f\bthserv.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 45568 c:\windows\winsxs\x86_microsoft.windows.h..uetooth-driverclass_31bf3856ad364e35_6.1.6002.18005_none_4eff3095feca167f\bthci.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 20992 c:\windows\winsxs\x86_microsoft-windows-wsd-challengecomponent_31bf3856ad364e35_6.0.6002.18005_none_2663224fa076d2c5\wsdchngr.dll
    + 2009-08-11 11:00 . 2009-02-25 01:16 90112 c:\windows\winsxs\x86_microsoft-windows-wpfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_568243ff806b0777\WindowsBase.resources.dll
    + 2009-08-11 11:00 . 2009-02-25 01:16 10240 c:\windows\winsxs\x86_microsoft-windows-wpfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_568243ff806b0777\UIAutomationTypes.resources.dll
    + 2009-08-11 11:00 . 2009-02-25 01:16 12288 c:\windows\winsxs\x86_microsoft-windows-wpfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_568243ff806b0777\UIAutomationClientsideProviders.resources.dll
    + 2009-08-11 11:00 . 2009-02-25 01:16 61440 c:\windows\winsxs\x86_microsoft-windows-wpfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_568243ff806b0777\System.Speech.resources.dll
    + 2009-08-11 11:00 . 2009-02-25 01:16 28672 c:\windows\winsxs\x86_microsoft-windows-wpfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_568243ff806b0777\System.Printing.resources.dll
    + 2009-08-11 11:00 . 2009-02-25 01:16 40960 c:\windows\winsxs\x86_microsoft-windows-wpfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_568243ff806b0777\ReachFramework.resources.dll
    + 2009-08-11 11:00 . 2009-02-25 01:16 53248 c:\windows\winsxs\x86_microsoft-windows-wpfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_568243ff806b0777\PresentationBuildTasks.resources.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 94720 c:\windows\winsxs\x86_microsoft-windows-wpd-portabledeviceapi_31bf3856ad364e35_6.0.6002.18005_none_4cec3f51e92bbb79\PortableDeviceClassExtension.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 47104 c:\windows\winsxs\x86_microsoft-windows-wmiperf_31bf3856ad364e35_6.0.6002.18005_none_a1858d34af79a11c\WmiPerfInst.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 91136 c:\windows\winsxs\x86_microsoft-windows-wmiperf_31bf3856ad364e35_6.0.6002.18005_none_a1858d34af79a11c\WmiPerfClass.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 61952 c:\windows\winsxs\x86_microsoft-windows-wmi-text-encoding_31bf3856ad364e35_6.0.6002.18005_none_bb6ce01939326381\wmi2xml.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 36864 c:\windows\winsxs\x86_microsoft-windows-wmi-snmp-provider_31bf3856ad364e35_6.0.6002.18005_none_aca6f795c3e189c2\snmpthrd.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 35840 c:\windows\winsxs\x86_microsoft-windows-wmi-krnlprov-provider_31bf3856ad364e35_6.0.6002.18005_none_e59c3d0bf238b906\KrnlProv.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 83968 c:\windows\winsxs\x86_microsoft-windows-wmi-core_31bf3856ad364e35_6.0.6002.18005_none_bb3f7c211cba6b3f\wmiutils.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 74752 c:\windows\winsxs\x86_microsoft-windows-wmi-core_31bf3856ad364e35_6.0.6002.18005_none_bb3f7c211cba6b3f\WMICOOKR.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 49152 c:\windows\winsxs\x86_microsoft-windows-wmi-core_31bf3856ad364e35_6.0.6002.18005_none_bb3f7c211cba6b3f\wbemsvc.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 30208 c:\windows\winsxs\x86_microsoft-windows-wmi-core_31bf3856ad364e35_6.0.6002.18005_none_bb3f7c211cba6b3f\wbemprox.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 37888 c:\windows\winsxs\x86_microsoft-windows-wmi-core_31bf3856ad364e35_6.0.6002.18005_none_bb3f7c211cba6b3f\unsecapp.exe
    + 2009-08-11 11:00 . 2009-04-11 06:28 57856 c:\windows\winsxs\x86_microsoft-windows-wmi-core_31bf3856ad364e35_6.0.6002.18005_none_bb3f7c211cba6b3f\NCProv.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 19968 c:\windows\winsxs\x86_microsoft-windows-wmi-core_31bf3856ad364e35_6.0.6002.18005_none_bb3f7c211cba6b3f\mofcomp.exe
    + 2009-08-11 11:00 . 2009-04-11 06:28 90112 c:\windows\winsxs\x86_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.0.6002.18005_none_a29e34dbf412e9da\WmiApRpl.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 77824 c:\windows\winsxs\x86_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.0.6002.18005_none_a29e34dbf412e9da\WinMgmt.exe
    + 2009-08-11 11:00 . 2009-04-11 06:28 68096 c:\windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6002.18005_none_9e2fbb5f0207ec84\wlanhlp.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 64512 c:\windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6002.18005_none_9e2fbb5f0207ec84\wlanapi.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 15181 c:\windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6002.18005_none_9e2fbb5f0207ec84\gatherWirelessInfo.vbs
    + 2009-08-11 11:00 . 2009-04-11 06:28 83456 c:\windows\winsxs\x86_microsoft-windows-wlangpclient_31bf3856ad364e35_6.0.6002.18005_none_ba90c039cdbb04a6\wlgpclnt.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 31232 c:\windows\winsxs\x86_microsoft-windows-whea-troubleshooter_31bf3856ad364e35_6.0.6002.18005_none_b84486b94895774d\whealogr.dll
    + 2009-08-11 11:01 . 2009-04-11 06:28 61440 c:\windows\winsxs\x86_microsoft-windows-webdavredir-davclient_31bf3856ad364e35_6.0.6002.18005_none_95b8e24b4f6105d0\davclnt.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 69120 c:\windows\winsxs\x86_microsoft-windows-wcn-config-registrar_31bf3856ad364e35_6.0.6002.18005_none_2f082cdcbf0b91f1\fdWCN.dll
    + 2009-08-11 11:00 . 2009-02-18 18:41 38760 c:\windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_4538a9dc2994090c\WsatConfig.resources.dll
    + 2009-08-11 11:00 . 2009-02-18 18:41 36864 c:\windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_4538a9dc2994090c\System.ServiceModel.Install.Resources.dll
    + 2009-08-11 11:00 . 2009-02-18 18:41 12288 c:\windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_4538a9dc2994090c\System.IO.Log.Resources.dll
    + 2009-08-11 11:00 . 2009-02-18 18:41 57344 c:\windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_4538a9dc2994090c\System.IdentityModel.Selectors.Resources.dll
    + 2009-08-11 11:00 . 2009-02-18 18:41 65536 c:\windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_4538a9dc2994090c\System.IdentityModel.Resources.dll
    + 2009-08-11 11:00 . 2009-02-18 18:41 17256 c:\windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_4538a9dc2994090c\SMSvcHost.resources.dll
    + 2009-08-11 11:00 . 2009-02-18 18:41 34672 c:\windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_4538a9dc2994090c\ServiceModelReg.resources.dll
    + 2009-08-11 11:00 . 2009-02-18 18:41 19456 c:\windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_4538a9dc2994090c\Microsoft.Transactions.Bridge.Resources.dll
    + 2009-08-11 11:00 . 2009-02-18 18:41 42856 c:\windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_fr-fr_4538a9dc2994090c\ComSvcConfig.resources.dll
    + 2009-08-11 11:00 . 2009-04-11 04:22 33280 c:\windows\winsxs\x86_microsoft-windows-watchdog_31bf3856ad364e35_6.0.6002.18005_none_62546148a69ddcfd\watchdog.sys
    + 2006-11-02 08:48 . 2006-11-02 09:46 41984 c:\windows\winsxs\x86_microsoft-windows-wab-core_31bf3856ad364e35_6.0.6002.18005_none_570ee68146eaef3c\wabimp.dll
    + 2006-11-02 08:48 . 2006-11-02 09:45 66048 c:\windows\winsxs\x86_microsoft-windows-wab-app_31bf3856ad364e35_6.0.6002.18005_none_4494d68cd4b469ae\wabmig.exe
    + 2006-11-02 08:48 . 2006-11-02 09:46 33280 c:\windows\winsxs\x86_microsoft-windows-wab-app_31bf3856ad364e35_6.0.6002.18005_none_4494d68cd4b469ae\wabfind.dll
    + 2008-01-21 02:25 . 2008-01-21 02:25 32768 c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.0.6002.18005_none_a23e523a31a1ed4c\wups2.dll
    + 2008-01-21 02:25 . 2008-01-21 02:25 43008 c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.0.6002.18005_none_a23e523a31a1ed4c\wuauclt.exe
    + 2006-11-02 12:34 . 2006-11-02 12:34 12800 c:\windows\winsxs\x86_microsoft-windows-w..sition-coreservices_31bf3856ad364e35_6.0.6002.18005_none_347fb41db0752753\wiatrace.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 32768 c:\windows\winsxs\x86_microsoft-windows-w..sition-coreservices_31bf3856ad364e35_6.0.6002.18005_none_347fb41db0752753\wiarpc.dll
    + 2008-01-21 02:25 . 2008-01-21 02:25 23040 c:\windows\winsxs\x86_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_7.0.6002.18005_none_884f8c864562464f\wups.dll
    + 2008-01-21 02:25 . 2008-01-21 02:25 80384 c:\windows\winsxs\x86_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_7.0.6002.18005_none_884f8c864562464f\wudriver.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 13312 c:\windows\winsxs\x86_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.0.6002.18005_none_cc50ee6baa2997a1\WsmRes.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 54784 c:\windows\winsxs\x86_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.0.6002.18005_none_cc50ee6baa2997a1\WsmProv.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 30720 c:\windows\winsxs\x86_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.0.6002.18005_none_cc50ee6baa2997a1\WSManHTTPConfig.exe
    + 2008-01-21 02:24 . 2008-01-21 02:24 69120 c:\windows\winsxs\x86_microsoft-windows-vssapi_31bf3856ad364e35_6.0.6002.18005_none_d6d2575c7ee3769a\vsstrace.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 19968 c:\windows\winsxs\x86_microsoft-windows-vssapi_31bf3856ad364e35_6.0.6002.18005_none_d6d2575c7ee3769a\eventcls.dll
    + 2008-01-21 02:25 . 2008-01-21 02:25 19968 c:\windows\winsxs\x86_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.0.6002.18005_none_6cd64babf7d06785\vdsldr.exe
    + 2008-01-21 02:25 . 2008-01-21 02:25 37888 c:\windows\winsxs\x86_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.0.6002.18005_none_6cd64babf7d06785\vds_ps.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 20480 c:\windows\winsxs\x86_microsoft-windows-version_31bf3856ad364e35_6.0.6002.18005_none_16e9c83b4e078740\version.dll
    + 2009-08-11 11:01 . 2009-04-11 06:27 57856 c:\windows\winsxs\x86_microsoft-windows-v..ck-uninstallremoval_31bf3856ad364e35_6.0.6002.18005_none_825070d3d8da2dcc\compcln.exe
    + 2009-08-11 11:00 . 2009-04-11 06:28 98816 c:\windows\winsxs\x86_microsoft-windows-userpowermanagement_31bf3856ad364e35_6.0.6002.18005_none_a505176cf9fa2abd\powrprof.dll
    + 2009-08-11 11:00 . 2009-04-11 04:42 25856 c:\windows\winsxs\x86_microsoft-windows-usbcamd_31bf3856ad364e35_6.0.6002.18005_none_a173da9c755cd9a9\USBCAMD2.sys
    + 2009-08-11 11:00 . 2009-04-11 04:42 25856 c:\windows\winsxs\x86_microsoft-windows-usbcamd_31bf3856ad364e35_6.0.6002.18005_none_a173da9c755cd9a9\USBCAMD.sys
    + 2006-11-02 08:58 . 2006-11-02 09:46 34816 c:\windows\winsxs\x86_microsoft-windows-unimodem-config_31bf3856ad364e35_6.0.6002.18005_none_f6ed1a9a1bcc8805\uicom.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 15360 c:\windows\winsxs\x86_microsoft-windows-unimodem-config_31bf3856ad364e35_6.0.6002.18005_none_f6ed1a9a1bcc8805\serialui.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 39424 c:\windows\winsxs\x86_microsoft-windows-trustedinstaller_31bf3856ad364e35_6.0.6002.18005_none_92f8ac904a488147\TrustedInstaller.exe
    + 2009-08-11 11:00 . 2009-04-11 06:27 44032 c:\windows\winsxs\x86_microsoft-windows-trustedinstaller_31bf3856ad364e35_6.0.6002.18005_none_92f8ac904a488147\cbsra.exe
    + 2009-08-11 11:00 . 2009-04-11 06:28 38400 c:\windows\winsxs\x86_microsoft-windows-terminalservices-theme_31bf3856ad364e35_6.0.6002.18005_none_d7d188e877f12210\TSTheme.exe
    + 2009-08-11 11:01 . 2009-04-11 06:28 71168 c:\windows\winsxs\x86_microsoft-windows-telnet-server-tlntsvr_31bf3856ad364e35_6.0.6002.18005_none_c0b01f5fedf47482\tlntsvr.exe
    + 2009-08-11 11:01 . 2009-04-11 06:28 70656 c:\windows\winsxs\x86_microsoft-windows-telnet-client_31bf3856ad364e35_6.0.6002.18005_none_ba1d0a71222c35d2\telnet.exe
    + 2009-08-11 11:00 . 2009-04-11 04:45 72192 c:\windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6002.18005_none_ec294157d9377403\tdx.sys
    + 2008-01-21 02:24 . 2008-01-21 02:24 22528 c:\windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6002.18005_none_63710ee88c7b7604\netiougc.exe
    + 2008-01-21 02:24 . 2008-01-21 02:24 49664 c:\windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6002.18005_none_63710ee88c7b7604\netiomig.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 17920 c:\windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.0.6002.18005_none_34b26cb64bffedff\ROUTE.EXE
    + 2006-11-02 08:58 . 2006-11-02 09:45 27136 c:\windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.0.6002.18005_none_34b26cb64bffedff\NETSTAT.EXE
    + 2006-11-02 08:58 . 2006-11-02 09:45 11264 c:\windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.0.6002.18005_none_34b26cb64bffedff\MRINFO.EXE
    + 2006-11-02 08:58 . 2006-11-02 09:45 10240 c:\windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.0.6002.18005_none_34b26cb64bffedff\finger.exe
    + 2006-11-02 08:58 . 2006-11-02 09:44 19968 c:\windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.0.6002.18005_none_34b26cb64bffedff\ARP.EXE
    + 2009-08-11 11:00 . 2009-04-11 06:28 47104 c:\windows\winsxs\x86_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.0.6002.18005_none_199d015da1ba0131\NBMapTIP.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 53248 c:\windows\winsxs\x86_microsoft-windows-t..s-clientactivexcore_31bf3856ad364e35_6.0.6002.18005_none_31d980c8c2ca01c9\tsgqec.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 67584 c:\windows\winsxs\x86_microsoft-windows-t..rvices-registryapis_31bf3856ad364e35_6.0.6002.18005_none_a63da0de1f1d789f\regapi.dll
    + 2006-11-02 12:35 . 2006-11-02 12:35 68096 c:\windows\winsxs\x86_microsoft-windows-t..platform-input-core_31bf3856ad364e35_6.0.6002.18005_none_d2fbc584d9efb14a\TabSvc.dll
    + 2006-11-02 12:35 . 2006-11-02 12:35 19456 c:\windows\winsxs\x86_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.0.6002.18005_none_41978c01c3760094\TabIpsps.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 69120 c:\windows\winsxs\x86_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.0.6002.18005_none_41978c01c3760094\IpsPlugin.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 42496 c:\windows\winsxs\x86_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.0.6002.18005_none_41978c01c3760094\IpsMigrationPlugin.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 66048 c:\windows\winsxs\x86_microsoft-windows-t..nalservices-sysprep_31bf3856ad364e35_6.0.6002.18005_none_33850f5d456366c5\tssysprep.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 63488 c:\windows\winsxs\x86_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_6.0.6002.18005_none_4fc7c6a11e395b4a\tscupgrd.exe
    + 2009-08-11 11:00 . 2009-04-11 06:28 19456 c:\windows\winsxs\x86_microsoft-windows-t..mework-msctfmonitor_31bf3856ad364e35_6.0.6002.18005_none_87278fc545db0c65\MsCtfMonitor.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 85504 c:\windows\winsxs\x86_microsoft-windows-t..esframework-msctfui_31bf3856ad364e35_6.0.6002.18005_none_92f60bbcd34865d1\msctfui.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 10752 c:\windows\winsxs\x86_microsoft-windows-t..chxreadingstringime_31bf3856ad364e35_6.0.6002.18005_none_11a0c8d6ee137a2f\CHxReadingStringIME.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 31232 c:\windows\winsxs\x86_microsoft-windows-t..cesframework-msimtf_31bf3856ad364e35_6.0.6002.18005_none_d370fd68e7be1c7e\msimtf.dll
    + 2009-08-11 11:01 . 2009-04-11 06:28 84992 c:\windows\winsxs\x86_microsoft-windows-t..cesframework-msctfp_31bf3856ad364e35_6.0.6002.18005_none_ccc8d878ec130fe3\msctfp.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 84992 c:\windows\winsxs\x86_microsoft-windows-t..ces-serverlicensing_31bf3856ad364e35_6.0.6002.18005_none_f3b4efea329a398a\mstlsapi.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 91648 c:\windows\winsxs\x86_microsoft-windows-t..-platform-libraries_31bf3856ad364e35_6.0.6002.18005_none_ec5c63f1986ff65e\IPHLPAPI.DLL
    + 2008-01-21 02:25 . 2008-01-21 02:25 14848 c:\windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6002.18005_none_48cb48f3b060c975\srdelayed.exe
    + 2008-01-21 02:25 . 2008-01-21 02:25 40960 c:\windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6002.18005_none_48cb48f3b060c975\srclient.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 11776 c:\windows\winsxs\x86_microsoft-windows-sysprep-spwinsat_31bf3856ad364e35_6.0.6002.18005_none_551ffa0d7aa481b0\spwinsat.dll
    + 2009-08-11 11:01 . 2009-04-11 06:28 26112 c:\windows\winsxs\x86_microsoft-windows-syshiper_31bf3856ad364e35_6.0.6002.18005_none_77fb27ec5025e18b\syshiper.exe
    + 2009-08-11 11:00 . 2009-04-11 04:42 52992 c:\windows\winsxs\x86_microsoft-windows-streamclass_31bf3856ad364e35_6.0.6002.18005_none_60500ebd34c47ac8\stream.sys
    + 2009-08-11 11:00 . 2009-04-11 06:28 55808 c:\windows\winsxs\x86_microsoft-windows-storprop_31bf3856ad364e35_6.0.6002.18005_none_283e2d832e0b80a9\Storprop.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 28160 c:\windows\winsxs\x86_microsoft-windows-spp-main_31bf3856ad364e35_6.0.6002.18005_none_e6326fcda9fe9b59\sxproxy.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 99328 c:\windows\winsxs\x86_microsoft-windows-speechengine_31bf3856ad364e35_6.0.6002.18005_none_f0a9964297040c1c\spsrx.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 43520 c:\windows\winsxs\x86_microsoft-windows-speechcommon_31bf3856ad364e35_6.0.6002.18005_none_d7edc1a2cfccb087\SCGMigPlugin.dll
    + 2006-11-02 12:34 . 2006-11-02 12:34 16384 c:\windows\winsxs\x86_microsoft-windows-speech-userexperience_31bf3856ad364e35_6.0.6002.18005_none_1df5691748ee6b08\SpeechUXPS.DLL
    + 2009-08-11 11:00 . 2009-04-11 06:28 50688 c:\windows\winsxs\x86_microsoft-windows-snmp-winsnmp-api_31bf3856ad364e35_6.0.6002.18005_none_e238f61dbfc43dba\wsnmp32.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 47616 c:\windows\winsxs\x86_microsoft-windows-snmp-agent-service_31bf3856ad364e35_6.0.6002.18005_none_f9205a735564a418\snmp.exe
    + 2009-08-11 11:00 . 2009-04-11 06:28 64000 c:\windows\winsxs\x86_microsoft-windows-smss_31bf3856ad364e35_6.0.6002.18005_none_ae26210916536b06\smss.exe
    + 2009-08-11 11:00 . 2009-04-11 04:15 98816 c:\windows\winsxs\x86_microsoft-windows-smbserver-common_31bf3856ad364e35_6.0.6002.18005_none_05c1a7400d48e203\srvnet.sys
    + 2009-08-11 11:00 . 2009-04-11 06:28 83456 c:\windows\winsxs\x86_microsoft-windows-smbhelperclasses_31bf3856ad364e35_6.0.6002.18005_none_ec289e8bd3444ca6\SMBHelperClass.dll
    + 2009-08-11 11:00 . 2009-04-11 04:14 79360 c:\windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.0.6002.18005_none_8cc66ea786e7ac42\mrxsmb20.sys
    + 2009-08-11 11:00 . 2009-04-11 06:28 95232 c:\windows\winsxs\x86_microsoft-windows-smartcardsubsystem_31bf3856ad364e35_6.0.6002.18005_none_19e8b8b06714b3ae\SCardSvr.dll
    + 2006-11-02 08:43 . 2006-11-02 09:46 66560 c:\windows\winsxs\x86_microsoft-windows-smartcardsubsystem_31bf3856ad364e35_6.0.6002.18005_none_19e8b8b06714b3ae\SCardDlg.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 40448 c:\windows\winsxs\x86_microsoft-windows-smartcardsubsystem_31bf3856ad364e35_6.0.6002.18005_none_19e8b8b06714b3ae\certprop.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 11776 c:\windows\winsxs\x86_microsoft-windows-sidebar_31bf3856ad364e35_6.0.6002.18005_none_d0c824c923c9e622\sbunattend.exe
    + 2006-11-02 12:35 . 2006-11-02 12:35 66048 c:\windows\winsxs\x86_microsoft-windows-sidebar_31bf3856ad364e35_6.0.6002.18005_none_d0c824c923c9e622\sbdrop.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 79872 c:\windows\winsxs\x86_microsoft-windows-shmig_31bf3856ad364e35_6.0.6002.18005_none_6189f2a77440c81c\shmig.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 62976 c:\windows\winsxs\x86_microsoft-windows-setup-component_31bf3856ad364e35_6.0.6002.18005_none_3417f75aaa6413e3\windeploy.exe
    + 2008-01-21 02:24 . 2008-01-21 02:24 47616 c:\windows\winsxs\x86_microsoft-windows-setup-component_31bf3856ad364e35_6.0.6002.18005_none_3417f75aaa6413e3\wdsutil.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 94720 c:\windows\winsxs\x86_microsoft-windows-setup-component_31bf3856ad364e35_6.0.6002.18005_none_3417f75aaa6413e3\sysprep.exe
    + 2008-01-21 02:24 . 2008-01-21 02:24 54272 c:\windows\winsxs\x86_microsoft-windows-setup-component_31bf3856ad364e35_6.0.6002.18005_none_3417f75aaa6413e3\spprgrss.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 42496 c:\windows\winsxs\x86_microsoft-windows-setup-component_31bf3856ad364e35_6.0.6002.18005_none_3417f75aaa6413e3\oobeldr.exe
    + 2008-01-21 02:24 . 2008-01-21 02:24 31232 c:\windows\winsxs\x86_microsoft-windows-setup-component_31bf3856ad364e35_6.0.6002.18005_none_3417f75aaa6413e3\diagER.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 52736 c:\windows\winsxs\x86_microsoft-windows-setup-component_31bf3856ad364e35_6.0.6002.18005_none_3417f75aaa6413e3\audit.exe
    + 2009-08-11 11:00 . 2009-04-11 06:28 13312 c:\windows\winsxs\x86_microsoft-windows-servicepackcoordinator_31bf3856ad364e35_6.0.6002.18005_none_36ac9b2124b2bf26\spcmsg.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 69632 c:\windows\winsxs\x86_microsoft-windows-sendmail_31bf3856ad364e35_6.0.6002.18005_none_5cd4f36d1924f929\sendmail.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 61440 c:\windows\winsxs\x86_microsoft-windows-securitycenter-core_31bf3856ad364e35_6.0.6002.18005_none_1c2bd6beaf3aa18d\wscsvc.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 17920 c:\windows\winsxs\x86_microsoft-windows-securitycenter-core_31bf3856ad364e35_6.0.6002.18005_none_1c2bd6beaf3aa18d\wscisvif.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 33280 c:\windows\winsxs\x86_microsoft-windows-securitycenter-core_31bf3856ad364e35_6.0.6002.18005_none_1c2bd6beaf3aa18d\wscapi.dll
    + 2009-08-11 11:01 . 2009-04-11 06:28 67584 c:\windows\winsxs\x86_microsoft-windows-security-licensing-wmi_31bf3856ad364e35_6.0.6002.18005_none_50382e6ff6c7e8f5\slwmi.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 12288 c:\windows\winsxs\x86_microsoft-windows-security-licensing-wga_31bf3856ad364e35_6.0.6002.18005_none_5032e2f3f6cc83e3\slwga.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 42496 c:\windows\winsxs\x86_microsoft-windows-security-licensing-slc_31bf3856ad364e35_6.0.6002.18005_none_5062f685f6a7c614\slcinst.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 29184 c:\windows\winsxs\x86_microsoft-windows-search-profilenotify_31bf3856ad364e35_7.0.6002.18005_none_da55184c8a60e444\wsepno.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 36864 c:\windows\winsxs\x86_microsoft-windows-scripting_31bf3856ad364e35_6.0.6002.18005_none_4a53cc21fd7bbcc7\wshcon.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 32768 c:\windows\winsxs\x86_microsoft-windows-scripting_31bf3856ad364e35_6.0.6002.18005_none_4a53cc21fd7bbcc7\dispex.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 88064 c:\windows\winsxs\x86_microsoft-windows-scanprofiles_31bf3856ad364e35_6.0.6002.18005_none_4952ad655043b399\wiascanprofiles.dll
    + 2008-01-21 02:23 . 2008-01-21 02:23 98816 c:\windows\winsxs\x86_microsoft-windows-safedocs-main_31bf3856ad364e35_6.0.6002.18005_none_26f5355863ea5f18\sdshext.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 60928 c:\windows\winsxs\x86_microsoft-windows-s..ty-licensing-slc-ux_31bf3856ad364e35_6.0.6002.18005_none_8c636822b2598b6a\SLUINotify.dll
    + 2009-08-11 11:00 . 2009-02-18 18:39 92918 c:\windows\winsxs\x86_microsoft-windows-s..ity-licensing-tools_31bf3856ad364e35_6.0.6002.18005_none_c7357f7a65060ad7\slmgr.vbs
    + 2009-08-11 11:00 . 2009-04-11 06:28 90112 c:\windows\winsxs\x86_microsoft-windows-s..ing-shell-extension_31bf3856ad364e35_6.0.6002.18005_none_0c6d503021655122\wshext.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 79872 c:\windows\winsxs\x86_microsoft-windows-s..entication-usermode_31bf3856ad364e35_6.0.6002.18005_none_3c0d3c3f7176376a\authz.dll
    + 2009-08-11 11:00 . 2009-04-11 04:46 15872 c:\windows\winsxs\x86_microsoft-windows-rndis-usb-microport_31bf3856ad364e35_6.0.6002.18005_none_c6d83e044fcd06f5\usb8023.sys
    + 2009-08-11 11:00 . 2009-04-11 04:46 33280 c:\windows\winsxs\x86_microsoft-windows-rndis-miniport_31bf3856ad364e35_6.0.6002.18005_none_e31a28b989072805\RNDISMP.sys
    + 2006-11-02 08:57 . 2006-11-02 09:46 14848 c:\windows\winsxs\x86_microsoft-windows-rmcast_31bf3856ad364e35_6.0.6002.18005_none_5669453d850ccabc\wshrm.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 69632 c:\windows\winsxs\x86_microsoft-windows-rastapi_31bf3856ad364e35_6.0.6002.18005_none_10cfa36576fecc90\rastapi.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 36352 c:\windows\winsxs\x86_microsoft-windows-rasrtutils_31bf3856ad364e35_6.0.6002.18005_none_0f010d1ce79c5ae9\rtutils.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 29696 c:\windows\winsxs\x86_microsoft-windows-rasifmon_31bf3856ad364e35_6.0.6002.18005_none_ccbb42deea504b23\ifmon.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 47616 c:\windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.0.6002.18005_none_610bb87d5da7583b\cmutil.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 14336 c:\windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.0.6002.18005_none_610bb87d5da7583b\cmstplua.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 84992 c:\windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.0.6002.18005_none_610bb87d5da7583b\cmstp.exe
    + 2008-01-21 02:24 . 2008-01-21 02:24 26112 c:\windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.0.6002.18005_none_610bb87d5da7583b\cmpbk32.dll
    + 2009-08-11 11:00 . 2009-04-11 06:27 49152 c:\windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.0.6002.18005_none_610bb87d5da7583b\cmmon32.exe
    + 2008-01-21 02:24 . 2008-01-21 02:24 56320 c:\windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.0.6002.18005_none_610bb87d5da7583b\cmmigr.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 32768 c:\windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.0.6002.18005_none_610bb87d5da7583b\cmlua.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 72704 c:\windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.0.6002.18005_none_610bb87d5da7583b\cmdl32.exe
    + 2008-01-21 02:24 . 2008-01-21 02:24 31232 c:\windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.0.6002.18005_none_610bb87d5da7583b\cmcfg32.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 39424 c:\windows\winsxs\x86_microsoft-windows-rasclienttools_31bf3856ad364e35_6.0.6002.18005_none_713248d4a5d30dec\rasphone.exe
    + 2009-08-11 11:00 . 2009-04-11 06:27 16896 c:\windows\winsxs\x86_microsoft-windows-rasclienttools_31bf3856ad364e35_6.0.6002.18005_none_713248d4a5d30dec\rasdial.exe
    + 2008-01-21 02:24 . 2008-01-21 02:24 62464 c:\windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6002.18005_none_0fcbe0ed77911065\wanarp.sys
    + 2006-11-02 08:58 . 2006-11-02 09:46 22016 c:\windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6002.18005_none_0fcbe0ed77911065\rasser.dll
    + 2006-11-02 08:58 . 2006-11-02 09:46 32768 c:\windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6002.18005_none_0fcbe0ed77911065\rasmxs.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 52736 c:\windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6002.18005_none_0fcbe0ed77911065\rasdiag.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 81408 c:\windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6002.18005_none_0fcbe0ed77911065\rascfg.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 49664 c:\windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6002.18005_none_0fcbe0ed77911065\ndproxy.sys
    + 2008-01-21 02:24 . 2008-01-21 02:24 20992 c:\windows\winsxs\x86_microsoft-windows-rasbase_31bf3856ad364e35_6.0.6002.18005_none_0fcbe0ed77911065\ndistapi.sys
    + 2009-08-11 11:00 . 2009-04-11 04:46 69120 c:\windows\winsxs\x86_microsoft-windows-rasbase-rassstp_31bf3856ad364e35_6.0.6002.18005_none_9bbd28fee50e4840\rassstp.sys
    + 2009-08-11 11:00 . 2009-04-11 04:46 41472 c:\windows\winsxs\x86_microsoft-windows-rasbase-raspppoe_31bf3856ad364e35_6.0.6002.18005_none_581efd2c97b9a460\raspppoe.sys
    + 2009-08-11 11:01 . 2009-04-11 06:27 61952 c:\windows\winsxs\x86_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_6.0.6002.18005_none_337fad0927d14431\reg.exe
    + 2006-11-02 08:57 . 2006-11-02 09:46 13824 c:\windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6002.18005_none_b036e19c54c66d2f\wshqos.dll
    + 2006-11-02 08:57 . 2006-11-02 09:46 33280 c:\windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6002.18005_none_b036e19c54c66d2f\traffic.dll
    + 2006-11-02 08:57 . 2006-11-02 09:46 15360 c:\windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6002.18005_none_b036e19c54c66d2f\pacerprf.dll
    + 2009-08-11 11:00 . 2009-04-11 04:45 72192 c:\windows\winsxs\x86_microsoft-windows-qos_31bf3856ad364e35_6.0.6002.18005_none_b036e19c54c66d2f\pacer.sys
    + 2009-08-11 11:00 . 2009-04-11 06:32 50664 c:\windows\winsxs\x86_microsoft-windows-pshed_31bf3856ad364e35_6.0.6002.18005_none_5dde5c5c2a365a60\PSHED.DLL
    + 2008-01-21 02:24 . 2008-01-21 02:24 29184 c:\windows\winsxs\x86_microsoft-windows-profsvc_31bf3856ad364e35_6.0.6002.18005_none_fd9cd0792fced6f5\profprov.dll
    + 2008-01-21 02:25 . 2008-01-21 02:25 24064 c:\windows\winsxs\x86_microsoft-windows-processmodellibraries_31bf3856ad364e35_6.0.6002.18005_none_dc87d5dda8042659\wbhstipm.dll
    + 2008-01-21 02:25 . 2008-01-21 02:25 22528 c:\windows\winsxs\x86_microsoft-windows-processmodellibraries_31bf3856ad364e35_6.0.6002.18005_none_dc87d5dda8042659\wbhst_pm.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 47616 c:\windows\winsxs\x86_microsoft-windows-processmodellibraries_31bf3856ad364e35_6.0.6002.18005_none_dc87d5dda8042659\w3wphost.dll
    + 2008-01-21 02:25 . 2008-01-21 02:25 15872 c:\windows\winsxs\x86_microsoft-windows-processmodellibraries_31bf3856ad364e35_6.0.6002.18005_none_dc87d5dda8042659\w3tp.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 19968 c:\windows\winsxs\x86_microsoft-windows-processmodel_31bf3856ad364e35_6.0.6002.18005_none_b8ad073aa1e5201e\w3wp.exe
    + 2009-08-11 11:00 . 2009-04-11 06:28 52224 c:\windows\winsxs\x86_microsoft-windows-processmodel_31bf3856ad364e35_6.0.6002.18005_none_b8ad073aa1e5201e\apphostsvc.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 97792 c:\windows\winsxs\x86_microsoft-windows-printing-oleprn_31bf3856ad364e35_6.0.6002.18005_none_7d1255665c646ab2\oleprn.dll
    + 2009-08-11 11:00 . 2009-04-11 06:27 33280 c:\windows\winsxs\x86_microsoft-windows-pnputil_31bf3856ad364e35_6.0.6002.18005_none_ff4f3b9db9a951ba\PnPutil.exe
    + 2006-11-02 08:33 . 2006-11-02 09:46 53248 c:\windows\winsxs\x86_microsoft-windows-pnphotplugui_31bf3856ad364e35_6.0.6002.18005_none_eaccaa9547e03a1f\hotplug.dll
    + 2009-08-11 11:00 . 2009-04-11 06:27 26112 c:\windows\winsxs\x86_microsoft-windows-pnphotplugui_31bf3856ad364e35_6.0.6002.18005_none_eaccaa9547e03a1f\DeviceEject.exe
    + 2008-01-21 02:23 . 2008-01-21 02:23 42496 c:\windows\winsxs\x86_microsoft-windows-pnpdevicemanager_31bf3856ad364e35_6.0.6002.18005_none_15c2137e1ca283f9\dmocx.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 46592 c:\windows\winsxs\x86_microsoft-windows-performancetoolsgui_31bf3856ad364e35_6.0.6002.18005_none_9df537379e15bb5c\pdhui.dll
    + 2009-08-11 11:00 . 2009-04-11 06:32 54248 c:\windows\winsxs\x86_microsoft-windows-partitionmanager_31bf3856ad364e35_6.0.6002.18005_none_e3878c97b7915bdf\partmgr.sys
    + 2008-01-21 02:25 . 2008-01-21 02:25 66048 c:\windows\winsxs\x86_microsoft-windows-p..topeeradhocmeetings_31bf3856ad364e35_6.0.6002.18005_none_ac334ecffd43e504\WinCollabElev.dll
    + 2008-01-21 02:25 . 2008-01-21 02:25 20480 c:\windows\winsxs\x86_microsoft-windows-p..topeeradhocmeetings_31bf3856ad364e35_6.0.6002.18005_none_ac334ecffd43e504\WinCollabDecorator.dll
    + 2008-01-21 02:25 . 2008-01-21 02:25 56320 c:\windows\winsxs\x86_microsoft-windows-p..topeeradhocmeetings_31bf3856ad364e35_6.0.6002.18005_none_ac334ecffd43e504\WinCollabContacts.dll
    + 2009-08-11 11:00 . 2009-04-11 06:27 58368 c:\windows\winsxs\x86_microsoft-windows-p..tomizationsnonwinpe_31bf3856ad364e35_6.0.6002.18005_none_cdba626f8c588d30\PnPUnattend.exe
    + 2008-01-21 02:25 . 2008-01-21 02:25 39424 c:\windows\winsxs\x86_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_6.0.6002.18005_none_8cbddeb9c585058e\wpnpinst.exe
    + 2009-08-11 11:00 . 2009-04-11 06:28 15360 c:\windows\winsxs\x86_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_6.0.6002.18005_none_8cbddeb9c585058e\inetppui.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 96256 c:\windows\winsxs\x86_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_6.0.6002.18005_none_b5c807ab2d93d829\PlaMig.dll
    + 2006-11-02 09:15 . 2006-11-02 09:45 61440 c:\windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.0.6002.18005_none_f1eef3487a8e01f0\ntprint.exe
    + 2006-11-02 08:35 . 2006-11-02 09:46 35840 c:\windows\winsxs\x86_microsoft-windows-p..ormancebasecounters_31bf3856ad364e35_6.0.6002.18005_none_335eb6cf5a3b9de4\perfproc.dll
    + 2006-11-02 08:35 . 2006-11-02 09:46 28672 c:\windows\winsxs\x86_microsoft-windows-p..ormancebasecounters_31bf3856ad364e35_6.0.6002.18005_none_335eb6cf5a3b9de4\perfos.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 19968 c:\windows\winsxs\x86_microsoft-windows-p..ormancebasecounters_31bf3856ad364e35_6.0.6002.18005_none_335eb6cf5a3b9de4\perfnet.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 31744 c:\windows\winsxs\x86_microsoft-windows-p..ormancebasecounters_31bf3856ad364e35_6.0.6002.18005_none_335eb6cf5a3b9de4\perfdisk.dll
    + 2006-11-02 08:35 . 2006-11-02 09:46 39424 c:\windows\winsxs\x86_microsoft-windows-p..ormancebasecounters_31bf3856ad364e35_6.0.6002.18005_none_335eb6cf5a3b9de4\perfctrs.dll
    + 2008-01-21 02:24 . 2008-01-21 02:24 37888 c:\windows\winsxs\x86_microsoft-windows-p..ooler-networkclient_31bf3856ad364e35_6.0.6002.18005_none_3b5eb3c56e0bcf3e\printcom.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 26112 c:\windows\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6002.18005_none_2d991295d888a8b3\printfilterpipelineprxy.dll
    + 2006-11-02 08:35 . 2006-11-02 09:45 39936 c:\windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.0.6002.18005_none_630ef3dcfbf6e9a4\typeperf.exe
    + 2006-11-02 08:35 . 2006-11-02 09:45 37376 c:\windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.0.6002.18005_none_630ef3dcfbf6e9a4\relog.exe
    + 2009-08-11 11:00 . 2009-04-11 06:27 57344 c:\windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.0.6002.18005_none_630ef3dcfbf6e9a4\logman.exe
    + 2006-11-02 08:35 . 2006-11-02 09:45 17408 c:\windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.0.6002.18005_none_630ef3dcfbf6e9a4\diskperf.exe
    + 2006-11-02 09:15 . 2006-11-02 09:45 60416 c:\windows\winsxs\x86_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.0.6002.18005_none_d83fb8abf30e1638\printui.exe
    + 2008-01-21 02:24 . 2008-01-21 02:24 64512 c:\windows\winsxs\x86_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.0.6002.18005_none_d83fb8abf30e1638\findnetprinters.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 88576 c:\windows\winsxs\x86_microsoft-windows-ole-automation-legacy_31bf3856ad364e35_6.0.6002.18005_none_3bff339efed611ca\olepro32.dll
    + 2009-08-11 11:00 . 2009-04-11 06:27 35840 c:\windows\winsxs\x86_microsoft-windows-ocsetup_31bf3856ad364e35_6.0.6002.18005_none_e568ab025c6992bf\ocsetup.exe
    + 2009-08-11 11:00 . 2009-04-11 06:28 22016 c:\windows\winsxs\x86_microsoft-windows-o..inefiles-win32-apis_31bf3856ad364e35_6.0.6002.18005_none_ad5672dcf647053c\cscdll.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 31744 c:\windows\winsxs\x86_microsoft-windows-o..inefiles-win32-apis_31bf3856ad364e35_6.0.6002.18005_none_ad5672dcf647053c\cscapi.dll
    + 2009-08-11 11:00 . 2009-04-11 06:28 17408 c:\windows\winsxs\x86_microsoft-windows-ntvdm-vdmdbg_31bf3856ad364e35_6.0.6002.18005_none_50b897cb80d4ae0e\vdmdbg.dll
    + 2006-11-02 06:25 . 2006-09-18 21:43 13312 c:\windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.0.6002.18005_none_fff8f2266fafa2e8\win87em.dll
    + 2006-11-02 07:10 . 2006-11-02 07:10 12704 c:\windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.0.6002.18005_none_fff8f2266fafa2e8\WFWNET.DRV
    + 2008-01-21 02:24 . 2008-01-21 02:24 41984 c:\windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.0.6002.18005_none_fff8f2266fafa2e8\vdmredir.dll
    + 2006-11-02 07:10 . 2006-11-02 07:10 47840 c:\windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.0.6002.18005_none_fff8f2266fafa2e8\USER.EXE
    + 2006-11-02 07:10 . 2006-11-02 07:10 13888 c:\windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.0.6002.18005_none_fff8f2266fafa2e8\TOOLHELP.DLL
    + 2006-11-02 06:25 . 2006-09-18 21:43 18896 c:\windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.0.6002.18005_none_fff8f2266fafa2e8\sysedit.exe
    + 2006-11-02 07:09 . 2006-11-02 07:09 11753 c:\windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.0.6002.18005_none_fff8f2266fafa2e8\setver.exe
    + 2006-11-02 06:25 . 2006-09-18 21:43 46592 c:\windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.0.6002.18005_none_fff8f2266fafa2e8\pmspl.dll
    + 2006-11-02 07:10 . 2006-11-02 07:10 24064 c:\windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.0.6002.18005_none_fff8f2266fafa2e8\OLESVR.DLL
    + 2006-11-02 06:25
    a c 327 8 Sécurité
    11 Août 2009 17:41:36

    Ça a marché cette fois mais le rapport est incomplet.

    Pour me transmettre les rapports :
  • Clique sur ce lien : http://www.cijoint.fr/
  • Clique sur Parcourir... et cherche le fichier du rapport que tu souhaites me transmettre.
  • Clique sur Ouvrir.
  • Clique sur Cliquez ici pour déposer le fichier.
  • Un lien de cette forme, hxxp://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt, est ajouté dans la page.
  • Copie ce lien dans ta réponse.
    12 Août 2009 14:08:22

    Désolé, j'avais deja posté la reponse hier soir, mais je viens de m'appercevoir que ça n'a pas du marcher...
    Je sais pas si c'est normal, mais quand je tape dans le cadre de texte "reponse", le texte ne s'affiche pas avant un grand moment ...
    enfin bon voila à nouveau le lien "ci-joint".

    http://www.cijoint.fr/cjlink.php?file=cj200908/cij6Btpi...
    a c 327 8 Sécurité
    12 Août 2009 16:57:50

    Ton PC va mieux ?
    12 Août 2009 18:52:39

    Franchement ça va beaucoup mieux, mais j'ai l'impression qu'il y a encore quelques problemes de lenteur
    Par exemple, sur le forum, la page fige en permanence.

    Mais sinon compte tenu de l'etat dans lequel il etait il y a peu, c'est vraiment mieux, j'ai bien cru à un moment que j'etais bon pour un formatage.

    Y'a il encore des soucis selon toi ?
    Ou encore aurais tu des conseils à me donner pour ma protection, car Bitdefender n'a pas etait des plus efficace apparement.
    a c 327 8 Sécurité
    12 Août 2009 18:56:15

    Tu as réessayé le Kaspersky Online Scanner ?
    13 Août 2009 10:04:50

    Désolé, mais c'est toujours le meme probleme avec Kaspersky ...
    Impossible de faire l'analyse.
    Y'a pas d'autre solution ?
    a c 327 8 Sécurité
    14 Août 2009 13:28:32

    1/

  • Désinstalle HijackThis.

  • Télécharge ToolsCleaner2 sur ton Bureau.
  • Clique droit sur ToolsCleaner2.exe et choisis Exécuter en tant qu'administrateur.
  • Clique sur Recherche et laisse le scan agir.
  • Clique sur Suppression pour finaliser.
  • Tu peux, si tu le souhaites, te servir des Options Facultatives.
  • Clique sur Quitter pour obtenir le rapport.
  • Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).


    2/

  • Télécharge et installe CCleaner Slim.
  • Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....
  • Va dans Nettoyeur, choisis Analyser. Une fois terminé, lance le nettoyage.
    15 Août 2009 11:38:32

    J'ai bien effectué la manip avec TCleaner, mais impossible d'obtrenir un rapport !

    Impossible de créer le fichier TCleaner.txt - Acces refusé

    Par contre pas de probleme avec Ccleaner.

    Un petit detail que je n'arrive pas à regler, et je ne sais pas si c'est important :

    A chaque demarrage de l'ordinateur le centre de sécurité est inactif - je l'active, tout les voyant passent au vert, mais l'icone en bas à droite demeure Rouge " Alerte Centre de Sécurité"
    Et si je clique dessus je rentre dans le centre de sécurité ou tout est vert ???

    Et Franchement c'est toujours tres laborieux de taper un message sur le forum. Je suis obligé de taper à l'aveugle de changer de page d'attendre et finalement de voir mon texte .
    a c 327 8 Sécurité
    15 Août 2009 15:51:37

    Je pense qu'une réinstallation système serait une bonne idée vu tes soucis.
    Tom's guide dans le monde
    • Allemagne
    • Italie
    • Irlande
    • Royaume Uni
    • Etats Unis
    Suivre Tom's Guide
    Inscrivez-vous à la Newsletter
    • ajouter à twitter
    • ajouter à facebook
    • ajouter un flux RSS