System information for \\XPSP2-5C6F3D5C9:
Uptime: Error reading uptime
Kernel version: Microsoft Windows XP, Uniprocessor Free
Product type: Professional
Product version: 5.1
Service pack: 2
Kernel build number: 2600
Registered organization: XPSP2
Registered owner: Admin
Install date: 07/07/2008, 18:05:32
Activation status: Error reading status
IE version: 8.0000
System root: C:\WINDOWS
Processors: 1
Processor speed: 1.2 GHz
Processor type: AMD Athlon
Physical memory: 512 MB
Video driver: RADEON 9250 - Secondary
Volume Type Format Label Size Free Free
A: Removable 0.0%
C: Fixed NTFS 76.32 GB 50.02 GB 65.5%
D: CD-ROM 0.0%
E: CD-ROM 0.0%
F: CD-ROM 0.0%
C:\WINDOWS\prefetch\layout.ini -->01/06/2009 20:29:25
C:\WINDOWS\prefetch\NTOSBOOT-B00DFAAD.pf -->01/06/2009 19:44:01
C:\WINDOWS\System32\drivers\GEARAspiWDM.sys -->19/03/2009 16:32:48
C:\WINDOWS\System32\drivers\fssfltr_tdi.sys -->08/12/2008 18:01:56
C:\WINDOWS\System32\drivers\pcouffin.sys -->09/07/2008 15:00:32
C:\WINDOWS\System32\drivers\cmudax3.sys -->03/03/2008 18:25:22
C:\WINDOWS\System32\drivers\epfwtdir.sys -->30/01/2008 12:38:08
C:\WINDOWS\System32\drivers\easdrv.sys -->30/01/2008 12:35:56
C:\WINDOWS\System32\drivers\eamon.sys -->30/01/2008 12:35:30
C:\WINDOWS\System32\wpa.dbl -->31/05/2009 19:42:47
C:\WINDOWS\System32\perfh00C.dat -->29/03/2009 09:04:30
C:\WINDOWS\System32\perfh009.dat -->29/03/2009 09:04:30
C:\WINDOWS\System32\perfc00C.dat -->29/03/2009 09:04:30
C:\WINDOWS\System32\perfc009.dat -->29/03/2009 09:04:30
C:\WINDOWS\System32\PerfStringBackup.INI -->29/03/2009 09:04:29
C:\WINDOWS\System32\ieframe.dll.mui -->08/03/2009 14:18:02
C:\WINDOWS\System32\msrating.dll.mui -->08/03/2009 14:17:46
C:\WINDOWS\System32\mshta.exe.mui -->08/03/2009 14:17:30
C:\WINDOWS\System32\ie4uinit.exe.mui -->08/03/2009 14:16:06
C:\WINDOWS\System32\advpack.dll.mui -->08/03/2009 14:16:06
C:\WINDOWS\System32\iedkcs32.dll.mui -->08/03/2009 14:15:48
C:\WINDOWS\System32\iedkcs32.dll -->08/03/2009 14:09:26
C:\WINDOWS\System32\mshtml.dll -->08/03/2009 04:41:16
C:\WINDOWS\System32\ieframe.dll -->08/03/2009 04:39:48
C:\WINDOWS\System32\html.iec -->08/03/2009 04:35:10
C:\WINDOWS\System32\wininet.dll -->08/03/2009 04:34:58
C:\WINDOWS\System32\urlmon.dll -->08/03/2009 04:34:56
C:\WINDOWS\System32\inetcpl.cpl -->08/03/2009 04:34:52
C:\WINDOWS\System32\WinFXDocObj.exe -->08/03/2009 04:34:48
C:\WINDOWS\System32\webcheck.dll -->08/03/2009 04:34:48
C:\WINDOWS\System32\licmgr10.dll -->08/03/2009 04:34:30
C:\WINDOWS\System32\url.dll -->08/03/2009 04:34:28
C:\WINDOWS\System32\occache.dll -->08/03/2009 04:34:18
C:\WINDOWS\System32\msrating.dll -->08/03/2009 04:34:18
C:\WINDOWS\0.log -->01/06/2009 19:42:35
C:\WINDOWS\wiadebug.log -->01/06/2009 19:42:30
C:\WINDOWS\WindowsUpdate.log -->01/06/2009 19:42:26
C:\WINDOWS\wiaservc.log -->01/06/2009 19:42:23
C:\WINDOWS\bootstat.dat -->01/06/2009 19:41:58
C:\WINDOWS\SchedLgU.Txt -->31/05/2009 20:46:41
C:\WINDOWS\win.ini -->28/05/2009 09:02:39
C:\WINDOWS\system.ini -->28/05/2009 09:02:39
C:\WINDOWS\IE4 Error Log.txt -->27/05/2009 11:11:23
C:\WINDOWS\wmsetup.log -->07/05/2009 17:34:33
C:\WINDOWS\Thumbs.db -->02/05/2009 18:11:21
C:\WINDOWS\setupapi.log -->21/04/2009 15:31:46
C:\WINDOWS\setupact.log -->21/04/2009 15:31:44
C:\WINDOWS\king-uninstall.exe -->16/04/2009 15:06:43
C:\WINDOWS\spupdsvc.log -->09/04/2009 21:49:53
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 384F-4815
Répertoire de C:\WINDOWS
09/04/2009 21:47 <REP> $hf_mig$
11/07/2008 22:43 <REP> $NtUninstallKB909394$
09/07/2008 14:56 <REP> $NtUninstallKB926239$
09/07/2008 14:56 <REP> $NtUninstallMSCompPackV1$
06/09/2008 18:05 <REP> $NtUninstallQ828026$
11/10/2008 21:52 <REP> $NtUninstallWIC$
09/07/2008 14:55 <REP> $NtUninstallWMFDist11$
09/07/2008 14:55 <REP> $NtUninstallWudf01000$
09/04/2009 21:45 <REP> ie8
26/04/2009 16:41 <REP> inf
26/04/2009 16:41 <REP> Installer
09/04/2009 21:47 <REP> msdownld.tmp
02/05/2009 18:11 7 168 Thumbs.db
02/10/2001 18:17 49 102 winnt.bmp
02/10/2001 18:17 49 102 winnt256.bmp
4 fichier(s) 106 121 octets
12 Rép(s) 53 703 954 432 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 384F-4815
Répertoire de C:\WINDOWS\system32
09/04/2009 21:47 <REP> dllcache
7 fichier(s) 4 721 octets
1 Rép(s) 53 703 950 336 octets libres
winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Unsigned
tcpip.sys
Verified: Unsigned
ndis.sys
Verified: Signed
null.sys
Verified: Signed
userinit.exe
kernel32.dll
ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright © 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com
------------------------------------------------------------------------------
explorer.exe pid: 1712
Command line: C:\WINDOWS\Explorer.EXE
Base Size Version Path
0x63000000 0xe6000 8.00.6001.18702 C:\WINDOWS\system32\WININET.dll
0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x1a400000 0x132000 8.00.6001.18702 C:\WINDOWS\system32\urlmon.dll
0x5dca0000 0x1e8000 8.00.6001.18702 C:\WINDOWS\system32\iertutil.dll
0x58b50000 0x9a000 5.82.2900.2649 C:\WINDOWS\system32\comctl32.dll
0x76f80000 0x7f000 2001.12.4414.0258 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
0x661c0000 0x21d000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
0x68ef0000 0xf1000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GrooveUtil.DLL
0x78130000 0x9b000 8.00.50727.1801 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1801_x-ww_5eed8217\MSVCR80.dll
0x68ff0000 0x7000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GrooveNew.DLL
0x7c630000 0x1b000 8.00.50727.0042 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\ATL80.DLL
0x65e30000 0x37000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
0x748f0000 0x130000 8.50.2162.0000 C:\WINDOWS\system32\msxml3.dll
0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
0x01cf0000 0x2c6000 3.01.4000.2435 C:\WINDOWS\system32\msi.dll
0x02080000 0xa91000 8.00.6001.18702 C:\WINDOWS\system32\ieframe.dll
0x02c70000 0x3d000 8.00.6001.18702 C:\WINDOWS\system32\webcheck.dll
0x746e0000 0x8f000 6.00.2800.1599 C:\WINDOWS\system32\MLANG.dll
0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\WPDShServiceObj.dll
0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceTypes.dll
0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll
0x10000000 0x7000 1.00.0004.0730 C:\Program Files\Orange HSS\Launcher\Inactivity.Dll
0x7c340000 0x56000 7.10.3052.0004 C:\WINDOWS\system32\MSVCR71.dll
0x66b40000 0x17d000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GR326C~1.DLL
0x03870000 0x5b000 9.01.0000.0163 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
0x03260000 0x4c000 9.01.0000.0163 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
0x038d0000 0x1a5000 12.00.4518.1014 C:\Program Files\Microsoft Office\Office12\1036\GrooveIntlResource.dll
0x03100000 0x2d000 C:\Program Files\WinRAR\rarext.dll
0x22000000 0x2e000 3.00.0630.0000 C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll
0x03e80000 0x9e000 4.00.0004.0112 C:\PROGRA~1\VSO\COPYTO~1\CTCDSH~1.DLL
0x4b4f0000 0x86000 5.41.0015.1509 C:\WINDOWS\system32\MSFTEDIT.DLL
0x00a70000 0xf000 1.01.0000.0001 C:\Program Files\PandoBar\SrchAstt\1.bin\P4SRCHAS.DLL
0x00ff0000 0xc000 3.00.0000.0001 C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll
0x785e0000 0x11d000 9.00.21022.0008 C:\Program Files\EoRezo\EoAdv\mfc90.dll
0x78520000 0xa3000 9.00.21022.0008 C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\MSVCR90.dll
0x78e20000 0x2a000 9.00.21022.0008 C:\Program Files\EoRezo\EoAdv\ATL90.DLL
0x6bd10000 0x10000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\msohevi.dll
ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright © 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com
------------------------------------------------------------------------------
winlogon.exe pid: 1040
Command line: winlogon.exe
Base Size Version Path
0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe
0x58b50000 0x9a000 5.82.2900.2649 C:\WINDOWS\system32\COMCTL32.dll
0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x10000000 0x17000 6.14.0010.4105 C:\WINDOWS\system32\Ati2evxx.dll
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
0x76f80000 0x7f000 2001.12.4414.0258 C:\WINDOWS\system32\CLBCATQ.DLL
0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
Contenu de Downloaded Program Files
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 384F-4815
Répertoire de C:\WINDOWS\Downloaded Program Files
17/04/2009 11:29 <REP> .
17/04/2009 11:29 <REP> ..
07/07/2008 18:01 65 desktop.ini
20/06/2006 15:44 379 704 MsnPUpld.dll
19/06/2006 14:40 393 MsnPUpld.inf
20/06/2006 15:44 117 560 PURen-us.dll
09/01/2007 08:30 110 592 PURfr-fr.dll
5 fichier(s) 608 314 octets
Total des fichiers listés :
5 fichier(s) 608 314 octets
2 Rép(s) 53 703 684 096 octets libres
Recherche de rootkit! (Merci S!Ri)
Recherche d'infections connues
Export des clefs sensibles..
Liste des fichiers en exception sur le pare-feu XP SP2
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\\Program Files\\Orange HSS\\Connectivity\\ConnectivityManager.exe"="C:\\Program Files\\Orange HSS\\Connectivity\\ConnectivityManager.exe:*:enabled:CSS"
"C:\\Program Files\\VideoLink Pro\\Engine.exe"="C:\\Program Files\\VideoLink Pro\\Engine.exe:*:Enabled:VideoLink Engine"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
Export de la clef SharedTaskScheduler
[sharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
exports des policies
REGEDIT4
[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-01 23:00:37
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40]
"khjeh"=hex:20,02,00,00,7e,c8,3a,97,a7,04,d1,b5,9a,e9,4d,c0,10,d1,6c,17,da,..
"hj34z0"=hex:8c,5e,13,bc,25,b5,5b,b4,45,8d,7b,63,4a,ef,dc,c3,6a,ed,85,fe,1a,..
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden services: 0
hidden files: 0
Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)
Process list by traversal of KiWaitListHead
4 - System
192 - spoolsv.exe
288 - AppleMobileDevi
320 - ctfmon.exe
332 - mDNSResponder.e
368 - wcescomm.exe
376 - ekrn.exe
460 - alg.exe
524 - AlertModule.exe
544 - GoogleToolbarNo
564 - iooeu.exe
576 - fsssvc.exe
620 - rapimgr.exe
636 - FTRTSVC.exe
696 - HPZipm12.exe
708 - SeaPort.exe
752 - svchost.exe
1016 - csrss.exe
1040 - winlogon.exe
1088 - services.exe
1100 - lsass.exe
1300 - svchost.exe
1352 - svchost.exe
1544 - svchost.exe
1600 - svchost.exe
1628 - wlcomm.exe
1640 - ati2evxx.exe
1712 - explorer.exe
1812 - SystrayApp.exe
1840 - Launcher.exe
1904 - fsui.exe
1956 - msnmsgr.exe
2268 - Deskboard.exe
2276 - ConnectivityMan
2312 - CoreCom.exe
2508 - firefox.exe
2616 - OraConfigRecove
2624 - FTCOMModule.exe
2820 - wmiprvse.exe
3720 - cmd.exe
Total number of processes = 40
NOTE: Under WinXP, this will not show all processes.
KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)
Driver/Module list by traversal of PsLoadedModuleList
804D7000 - \WINDOWS\system32\ntoskrnl.exe
806EC000 - \WINDOWS\system32\hal.dll
F899F000 - \WINDOWS\system32\KDCOM.DLL
F88AF000 - \WINDOWS\system32\BOOTVID.dll
F8458000 - d347bus.sys
F8429000 - ACPI.sys
F89A1000 - \WINDOWS\system32\DRIVERS\WMILIB.SYS
F8418000 - pci.sys
F849F000 - isapnp.sys
F84AF000 - ohci1394.sys
F84BF000 - \WINDOWS\system32\DRIVERS\1394BUS.SYS
F8A67000 - pciide.sys
F871F000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
F84CF000 - MountMgr.sys
F83F9000 - ftdisk.sys
F89A3000 - dmload.sys
F83D3000 - dmio.sys
F8727000 - PartMgr.sys
F84DF000 - VolSnap.sys
F83BB000 -
F8394000 - fasttx2k.sys
F837C000 - \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
F89A5000 - d347prt.sys
F8355000 - aftx2k.sys
F84EF000 - disk.sys
F84FF000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
F8336000 - fltMgr.sys
F8324000 - sr.sys
F850F000 - PxHelp20.sys
F830D000 - KSecDD.sys
F8280000 - Ntfs.sys
F8253000 - NDIS.sys
F872F000 - nv_agp.sys
F8238000 - Mup.sys
F854F000 - \SystemRoot\system32\DRIVERS\amdk7.sys
F8767000 - \SystemRoot\system32\DRIVERS\usbohci.sys
F786F000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
F876F000 - \SystemRoot\system32\DRIVERS\usbehci.sys
F7858000 - \SystemRoot\system32\DRIVERS\NVENET.sys
F855F000 - \SystemRoot\system32\drivers\nvax.sys
F856F000 - \SystemRoot\system32\DRIVERS\R8139n51.SYS
F7700000 - \SystemRoot\system32\drivers\cmudax3.sys
F76DC000 - \SystemRoot\system32\drivers\portcls.sys
F857F000 - \SystemRoot\system32\drivers\drmk.sys
F76B9000 - \SystemRoot\system32\drivers\ks.sys
F858F000 - \SystemRoot\system32\DRIVERS\imapi.sys
F859F000 - \SystemRoot\system32\DRIVERS\cdrom.sys
F85AF000 - \SystemRoot\system32\DRIVERS\redbook.sys
F85BF000 - \SystemRoot\System32\Drivers\GEARAspiWDM.sys
F85CF000 - \SystemRoot\system32\DRIVERS\nic1394.sys
F75DE000 - \SystemRoot\system32\DRIVERS\ati2mtag.sys
F75CA000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
F87BF000 - \SystemRoot\system32\DRIVERS\fdc.sys
F75B9000 - \SystemRoot\system32\DRIVERS\serial.sys
F895B000 - \SystemRoot\system32\DRIVERS\serenum.sys
F75A5000 - \SystemRoot\system32\DRIVERS\parport.sys
F8B1B000 - \SystemRoot\system32\DRIVERS\audstub.sys
F85DF000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
F8963000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
F74EE000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
F85EF000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
F85FF000 - \SystemRoot\system32\DRIVERS\raspptp.sys
F87DF000 - \SystemRoot\system32\DRIVERS\TDI.SYS
F74DD000 - \SystemRoot\system32\DRIVERS\psched.sys
F860F000 - \SystemRoot\system32\DRIVERS\msgpc.sys
F87EF000 - \SystemRoot\system32\DRIVERS\ptilink.sys
F87FF000 - \SystemRoot\system32\DRIVERS\raspti.sys
F861F000 - \SystemRoot\system32\DRIVERS\odysseyIM3.sys
F862F000 - \SystemRoot\System32\Drivers\pcouffin.sys
F7484000 - \SystemRoot\system32\DRIVERS\rdpdr.sys
F863F000 - \SystemRoot\system32\DRIVERS\termdd.sys
F8817000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
F8827000 - \SystemRoot\system32\DRIVERS\mouclass.sys
F89AB000 - \SystemRoot\system32\DRIVERS\swenum.sys
F7450000 - \SystemRoot\system32\DRIVERS\update.sys
F898F000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
F864F000 - \SystemRoot\system32\DRIVERS\usbhub.sys
F89AF000 - \SystemRoot\system32\DRIVERS\USBD.SYS
F865F000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F7395000 - \SystemRoot\system32\drivers\nvapu.sys
F72B0000 - \SystemRoot\system32\drivers\nvmcp.sys
F729F000 - \SystemRoot\system32\drivers\nvarm.sys
F8877000 - \SystemRoot\system32\DRIVERS\flpydisk.sys
F89BD000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F8B76000 - \SystemRoot\System32\Drivers\Null.SYS
F89C1000 - \SystemRoot\System32\Drivers\Beep.SYS
F889F000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
F88A7000 - \SystemRoot\System32\drivers\vga.sys
F89C5000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F89C9000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F8777000 - \SystemRoot\System32\Drivers\Msfs.SYS
F8787000 - \SystemRoot\System32\Drivers\Npfs.SYS
F896B000 - \SystemRoot\system32\DRIVERS\rasacd.sys
B6F69000 - \SystemRoot\system32\DRIVERS\ipsec.sys
B6F11000 - \SystemRoot\system32\DRIVERS\tcpip.sys
B6EE9000 - \SystemRoot\system32\DRIVERS\netbt.sys
B6EC8000 - \SystemRoot\system32\DRIVERS\ipnat.sys
F86BF000 - \SystemRoot\system32\DRIVERS\epfwtdir.sys
F86CF000 - \SystemRoot\system32\DRIVERS\wanarp.sys
B6EA6000 - \SystemRoot\System32\drivers\afd.sys
F86DF000 - \SystemRoot\system32\DRIVERS\arp1394.sys
F86EF000 - \SystemRoot\system32\DRIVERS\netbios.sys
B6E7B000 - \SystemRoot\system32\DRIVERS\rdbss.sys
B6E0C000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys
F86FF000 - \SystemRoot\System32\Drivers\Fips.SYS
F870F000 - \SystemRoot\system32\DRIVERS\easdrv.sys
F87AF000 - \SystemRoot\system32\DRIVERS\usbccgp.sys
F898B000 - \SystemRoot\system32\DRIVERS\hidusb.sys
F7585000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
F744C000 - \SystemRoot\system32\DRIVERS\kbdhid.sys
F7448000 - \SystemRoot\system32\DRIVERS\mouhid.sys
F7575000 - \SystemRoot\System32\Drivers\Cdfs.SYS
B6D2C000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F89CF000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F742C000 - \SystemRoot\System32\drivers\Dxapi.sys
F87D7000 - \SystemRoot\System32\watchdog.sys
BF9C1000 - \SystemRoot\System32\drivers\dxg.sys
F8A99000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9D3000 - \SystemRoot\System32\ati2dvag.dll
BFA0B000 - \SystemRoot\System32\ati2cqag.dll
BFA45000 - \SystemRoot\System32\ati3duag.dll
BFC68000 - \SystemRoot\System32\ativvaxx.dll
B6D74000 - \SystemRoot\system32\DRIVERS\fssfltr_tdi.sys
B6BC8000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
F8A09000 - \SystemRoot\System32\Drivers\ParVdm.SYS
B691F000 - \SystemRoot\system32\DRIVERS\eamon.sys
B66ED000 - \SystemRoot\system32\DRIVERS\srv.sys
B66B0000 - \SystemRoot\system32\drivers\wdmaud.sys
B6897000 - \SystemRoot\system32\drivers\sysaudio.sys
F87F7000 - \??\C:\WINDOWS\system32\PCANDIS5.SYS
B5724000 - \SystemRoot\System32\Drivers\Fastfat.SYS
F8A4B000 - \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mbr.sys
F8B22000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys
Total number of drivers = 134
Liste des programmes installes
Acoustica Mixcraft 4.2
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Reader 9.1 - Français
Adobe Shockwave Player
AiO_Scan_CDA
AiOSoftwareNPI
Apple Mobile Device Support
Apple Software Update
Archiveur WinRAR
ATI - Utilitaire de désinstallation du logiciel
ATI Control Panel
ATI Display Driver
ATI HydraVision
Audacity 1.2.6
Bonjour
BufferChm
C-Media PCI Audio
C4100
c4100_Help
Choice Guard
CleanUp!
ConvertXtoDVD 3.1.3.40c
Correctif pour le Lecteur Windows Media [Voir Q828026 pour plus d'informations]
Correctif Windows XP - KB885836
CP_CalendarTemplates1
cp_OnlineProjectsConfig
CP_Package_Basic1
CP_Panorama1Config
cp_PosterPrintConfig
CueTour
CustomerResearchQFolder
D-Link AirPlus G+ Wireless Adapter Utility
DAEMON Tools
Destinations
DeviceManagementQFolder
DocProc
DocProcQFolder
DocumentViewer
DocumentViewerQFolder
doPDF 6.1 printer
eoEngine 9.1
ESET NOD32 Antivirus
eSupportQFolder
Favorit
Fax_CDA
Firebird SQL Server - MAGIX Edition
FullDPAppQFolder
Google Toolbar for Internet Explorer
Hotfix for Windows XP (KB909394)
Hotfix for Windows XP (KB926239)
HP Customer Participation Program 7.0
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Photosmart Premier Software 6.5
HP Photosmart, Officejet and Deskjet 7.0.A
HP Software Update
HP Solution Center 7.0
HPPhotoSmartExpress
HPProductAssistant
InstantShareDevices
InstantShareDevicesMFC
iTunes
Junk Mail filter update
K-Lite Codec Pack 2.80 Full
king.com (remove only)
livebox
Ma-Config.com
MarketResearch
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 French Language Pack
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0
Microsoft ActiveSync
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Access MUI (French) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (French) 2007
Microsoft Office Groove MUI (French) 2007
Microsoft Office InfoPath MUI (French) 2007
Microsoft Office Live Add-in 1.3
Microsoft Office OneNote MUI (French) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (French) 2007
Microsoft Office PowerPoint MUI (French) 2007
Microsoft Office Proof (Arabic) 2007
Microsoft Office Proof (Dutch) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (French) 2007
Microsoft Office Publisher MUI (French) 2007
Microsoft Office Shared MUI (French) 2007
Microsoft Office Word MUI (French) 2007
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft Software Update for Web Folders (French) 12
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Mise à jour pour Windows Internet Explorer 8 (KB968220)
Mise à jour pour Windows XP (KB898461)
Mozilla Firefox (2.0.0.20)
MSVCRT
MSXML 4.0 SP2 Parser and SDK
Navigateur Orange
NewCopy_CDA
NVIDIA Drivers
NvMixer
OCR Software by I.R.I.S 7.0
OLYMPUS Master 2
OLYMPUS muvee theaterPack
Orange - Logiciels Internet
Pando
Pando Toolbar
PanoStandAlone
PCI Audio Driver
Philips ToUcam Pro Camera
PhotoGallery
ProductContextNPI
Qui Veut Gagner Des Millions
QuickTime
RandMap
Readme
Safari
Scan
ScannerCopy
Segoe UI
SkinsHP1
Skype™ 4.0
SlideShow
SmartShopper
SoftwareUpdate 1.0
SolutionCenter
Sonic_PrimoSDK
SpywareBlaster v3.5.1
Status
Text-To-Speech-Runtime
Toolbox
TrayApp
Unload
VideoLAN VLC media player 0.8.6
VideoLink Pro
VSO CopyToDVD 4
WebFldrs XP
WebReg
Windows Genuine Advantage Validation Tool (KB892130)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 384F-4815
Répertoire de C:\Program Files
26/04/2009 16:40 <REP> .
26/04/2009 16:40 <REP> ..
30/03/2009 22:38 <REP> Adobe
09/03/2009 16:14 <REP> Apple Software Update
09/07/2008 14:41 <REP> ATI Technologies
06/02/2009 00:00 <REP> Audacity
08/03/2009 11:35 <REP> Bonjour
09/07/2008 16:22 <REP> C-Media PCI Audio
07/07/2008 17:59 <REP> ComPlus Applications
09/07/2008 14:34 <REP> D-Link
09/07/2008 15:05 <REP> D-Tools
31/12/2008 00:14 <REP> Eidos Interactive
24/04/2009 12:00 <REP> eMule
20/04/2009 19:48 <REP> EoRezo
09/07/2008 14:52 <REP> ESET
17/02/2009 18:36 <REP> Fichiers communs
21/02/2009 00:01 <REP> Google
22/11/2008 13:42 <REP> Hewlett-Packard
22/11/2008 13:49 <REP> HP
09/04/2009 21:49 <REP> Internet Explorer
26/04/2009 16:40 <REP> iPod
26/04/2009 16:41 <REP> iTunes
09/07/2008 14:54 <REP> K-Lite Codec Pack
09/07/2008 15:58 <REP> ma-config.com
09/01/2009 10:12 <REP> Microsoft
11/07/2008 22:43 <REP> Microsoft ActiveSync
07/07/2008 18:04 <REP> microsoft frontpage
09/07/2008 15:13 <REP> Microsoft Office
09/01/2009 10:12 <REP> Microsoft Office Outlook Connector
09/01/2009 10:12 <REP> Microsoft Silverlight
11/10/2008 21:53 <REP> Microsoft SQL Server Compact Edition
09/01/2009 10:11 <REP> Microsoft Sync Framework
09/07/2008 15:13 <REP> Microsoft Visual Studio
09/07/2008 15:13 <REP> Microsoft Works
09/07/2008 15:12 <REP> Microsoft.NET
07/07/2008 18:00 <REP> Movie Maker
01/06/2009 22:37 <REP> Mozilla Firefox
09/07/2008 15:13 <REP> MSBuild
07/07/2008 17:58 <REP> MSN Gaming Zone
04/10/2008 16:45 <REP> MSXML 4.0
07/07/2008 18:00 <REP> NetMeeting
17/02/2009 20:49 <REP> NOS
04/10/2008 16:46 <REP> OLYMPUS
11/07/2008 22:26 <REP> Orange HSS
07/07/2008 18:04 <REP> Outlook Express
19/09/2008 18:19 <REP> Pando Networks
19/09/2008 18:19 <REP> PandoBar
11/07/2008 22:34 <REP> Philips ToUcam Camera
23/03/2009 10:53 <REP> QuickTime
09/07/2008 15:46 <REP> RegCleaner
08/03/2009 11:46 <REP> Safari
11/07/2008 22:22 <REP> SAGEM
11/07/2008 22:21 <REP> Securitoo
07/07/2008 18:01 <REP> Services en ligne
19/09/2008 18:19 <REP> SmartShopper
24/11/2008 21:12 <REP> Softland
09/07/2008 15:54 <REP> SpywareBlaster
09/07/2008 14:53 <REP> VideoLAN
23/03/2009 10:52 <REP> VideoLink Pro
29/10/2008 21:53 <REP> VSO
21/02/2009 11:28 <REP> Windows Live
09/01/2009 10:08 <REP> Windows Live SkyDrive
09/07/2008 14:55 <REP> Windows Media Player
07/07/2008 17:58 <REP> Windows NT
09/07/2008 15:04 <REP> WinRAR
13/03/2009 15:22 <REP> xerox
0 fichier(s) 0 octets
66 Rép(s) 53 703 258 112 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 384F-4815
Répertoire de C:\Program Files\fichiers communs
17/02/2009 18:36 <REP> .
17/02/2009 18:36 <REP> ..
30/03/2009 22:38 <REP> Adobe
26/07/2008 10:31 <REP> Apple
09/07/2008 15:13 <REP> DESIGNER
11/07/2008 22:24 <REP> France Telecom
22/11/2008 13:41 <REP> Hewlett-Packard
22/11/2008 13:45 <REP> HP
09/07/2008 16:14 <REP> InstallShield
21/02/2009 11:24 <REP> Microsoft Shared
07/07/2008 18:00 <REP> MSSoap
04/10/2008 16:49 <REP> muvee Technologies
09/07/2008 16:15 <REP> NVIDIA Shared
07/07/2008 19:54 <REP> ODBC
07/07/2008 18:00 <REP> Services
11/07/2008 22:35 <REP> Smith Micro Shared
22/11/2008 13:46 <REP> Sonic Shared
07/07/2008 19:54 <REP> SpeechEngines
29/10/2008 21:53 <REP> Symantec Shared
09/01/2009 10:12 <REP> System
11/10/2008 21:46 <REP> Windows Live
0 fichier(s) 0 octets
21 Rép(s) 53 703 258 112 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 384F-4815
Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders
09/07/2008 15:09 <REP> .
09/07/2008 15:09 <REP> ..
09/07/2008 15:09 <REP> 1036
26/10/2006 19:49 970 528 MSONSEXT.DLL
26/10/2006 20:12 40 256 MSOSV.DLL
03/06/1999 12:09 122 937 MSOWS409.DLL
07/03/2001 07:00 127 033 MSOWS40c.DLL
4 fichier(s) 1 260 754 octets
3 Rép(s) 53 703 258 112 octets libres
c:\Documents and Settings\Administrateur\Application Data\inst.exe
c:\Documents and Settings\Administrateur\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdate.exe
c:\Documents and Settings\Administrateur\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
c:\Documents and Settings\Administrateur\Application Data\EoRezo\SoftwareUpdate\unins000.exe
c:\Documents and Settings\Administrateur\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
c:\Documents and Settings\Administrateur\Application Data\Microsoft\Services Windows Live\Raccourci Galerie de Photos Windows Live.exe
c:\Documents and Settings\Administrateur\Application Data\Microsoft\Services Windows Live\Raccourci Windows Live Messenger.exe
c:\Documents and Settings\Administrateur\Bureau\ATF-Cleaner.exe
c:\Documents and Settings\Administrateur\Bureau\kinginstaller.exe
c:\Documents and Settings\Administrateur\Bureau\PandoSetup.exe
c:\Documents and Settings\Administrateur\Bureau\wlsetup-all.exe
c:\Documents and Settings\Administrateur\Bureau\wlsetup-web.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\catchme.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\diff.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\dumphive.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\FilesInfoCmd.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\find2.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\Fport.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\grep.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\gzip.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\KProcCheck.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\LFiles.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\LISTDLLS.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\mbr.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\md5sums.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\Psinfo.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\pslist.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\sigcheck.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\streams.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\swreg.exe
c:\Documents and Settings\Administrateur\Bureau\DiagHelp\tar.exe
c:\Documents and Settings\Administrateur\Local Settings\Application Data\iooeu.exe
c:\Documents and Settings\Administrateur\Mes documents\Firefox Setup 2.0.0.20.exe
c:\Documents and Settings\Administrateur\Mes documents\installation_ie8msn-xp.exe
c:\Documents and Settings\Administrateur\Mes documents\PandoSetup.exe
c:\Documents and Settings\Administrateur\Mes documents\dossier divers\iTunesSetup.exe
c:\Documents and Settings\Administrateur\Mes documents\dossier divers\WLinstaller.exe
c:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
c:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\DifXInstall32.exe
c:\Documents and Settings\Administrateur\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll
c:\Documents and Settings\Administrateur\Application Data\Microsoft\Services Windows Live\Services Windows Live.dll
c:\Documents and Settings\Administrateur\Local Settings\Application Data\king.com\enginemm.dll
c:\Documents and Settings\Administrateur\Local Settings\Application Data\king.com\enginemp.dll
c:\Documents and Settings\Administrateur\Local Settings\Application Data\king.com\regality\dll\bass.dll
c:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\Brands\FT01\en-US\wlmbrand.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
c:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\DIFxAPI.dll
c:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspi.dll
