Aller au contenu

Ogon

Membres
 Afficher le profil  Afficher son activité

  • Compteur de contenus

    18

  • Inscription

  • Dernière visite

 Type de contenu 

Tout ce qui a été posté par Ogon

  1. Ogon
    je te remercie pour ton aide, bonne continuation, sérieux c'est géniale ce que vous faites. merci beaucoup Dommage qu'on ai pas trouvé de solutions alternatives.. à bientôt peut être (sur une autre branche du forum j espère ) Ogon
  2. Ogon
    coucou thanos, je viens d'essayer le redémarrage en mode sans échec (j'ai essayé 3 fois) j'ai beau tapoté f8 en continu, la fenêtre qui propose les options dons le sans échec n' apparait même plus... (avant elle apparaissait mais je ne pouvais rien sélectionner) la première fois quej ai redemaré j'ai eu un message d erreur a l ouverture du bureau qui me disait que le fichier /c utilsateurs etc temp/delus.exe (je n ai pas noté le chemin exact), je ne sais pas si c'est en rapport direct~~ (windows s'est ensuite ouvert normalement) est ce qu'on pourrait tenté de faire qqch pour le son? (c est actuellement m'a priorité :~X ) je te remercie ogon
  3. Ogon
    pour copié coller : ouverture et fermeture du clipboard avec succès , il a l'air de n'y avoir aucun problème
  4. Ogon
    Salut Thanos, le programme de désinstallation m affiche un message d'erreur "vous devez fermer tous vos programmes pour que cela fonctionne" ensuite quand je clique "ok" ca continue et s'achève normalement mais lorsque je tente d'installer antivir c'est toujours le même message, vous possédez déjà une version etc~~ je réessaye donc en vérifiant que tout les programmes soit bien fermé et pareil il me dit que je dois fermé les programmes, j'imagine que ca bloque sur un faux programme inexistant
  5. Ogon
    ce soir je suis pas là alors je te souhaite une excellente soirée et à demain pour de nouvelles aventures n'hesite pas à postez tout ce qui pourrait etre utile bonne soirée encore merci
  6. Ogon
    antivir me dit qu'il y a déjà un programme (antivir) non compatible instalé etc son setup me propose de remplacer l ancienne par la nouvelle je dit ok puis il me dit 3 sec après : Setup peux valider une configuration existante lors d une mise a niveau les profils existants et les taches planifiées ne peuvent toutefois pas etre validés. Veuillez créer vos profils et taches spécifiques, le cas échéants. la licence est validée automatiquement. souzhaitez vous accepter la configuration existante? oui/non j'ai essayé les deux, il me dit que l ordinateur va redémarrer, il ne ce passe rien, je redémarre moi meme, lorsque l ordi s allume (bureau) il reprend depuis l'etape un : voulez vous remplacez etc donc ca ne marche pas : /
  7. Ogon
    alors, control c control v marche pas pareil pour selection souri et le message d'erreur varie selon le programme malware bit : run time error 372: failed to load control 'vbalgrid' from vbalsgrid6.ocx Your version of vbalsgrid must be outdated. make sure you are using the version of the control that was provided with your application pour antivir:
  8. Ogon
    ca réagit pas quand je clique sur windows update le système de sécurité (par feu) non plus, presque tout les système de config dans le panneau de de config ne marchent pas
  9. Ogon
    je te remercie
  10. Ogon
    Non , pas de cd : (, je sais meme pas quel version c'est une autre solution? ps: Xp ca c est sur
  11. Ogon
    Salut Thanos, le nettoyage est il terminé? si c'est le cas j'aurais besoin d'aide car j'ai encore tout un tas de problème concernant les fonctionnalités de bases... je n ai toujours pas de son je ne peux pas déplacer de fichier copier coller ne marche toujours pas (sauf heureusement pour le logfile de combofix^^) les programmes ne peuvent toujours pas être installé les fenêtres ne s affichent toujours pas dans la barre de taches~~ en faite je crois que le virus s'est attaqué à mes paramètres windows. que puis je faire ?
  12. Ogon
    voilà le dernier résultat (le démarrage est toujours aussi lent) ComboFix 10-04-30.01 - Dozr 31.05.2010 3:06.3.1 - x86 Lancé depuis: c:\documents and settings\Dozr.XPSP2-6FD77EF47\Bureau\Ogon.exe Commutateurs utilisés :: c:\documents and settings\Dozr.XPSP2-6FD77EF47\Bureau\CFScript.txt file zipped: c:\windows\system32\drivers\cdrom.sys file zipped: c:\windows\system32\run.cmd . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\drivers\cdrom.sys c:\windows\system32\run.cmd c:\windows\system32\drivers\cdrom.sys . . . manque!! . --------------- FCopy --------------- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Bureau\cdrom.sys --> c:\windows\system32\drivers\cdrom.sys . ((((((((((((((((((((((((((((( Fichiers créés du 2010-04-28 au 2010-05-31 )))))))))))))))))))))))))))))))))))) . 2010-05-31 00:09 . 2010-05-31 00:26 -------- dc----w- C:\Ogon2609O 2010-05-30 22:49 . 2010-05-30 23:09 -------- dc----w- C:\Ogon 2010-05-30 00:37 . 2010-05-30 00:37 -------- d-----w- c:\program files\Panda Security 2010-05-30 00:09 . 2010-05-30 00:09 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes 2010-05-30 00:09 . 2008-06-10 17:02 34296 ----a-w- c:\windows\system32\drivers\mbamcatchme.sys 2010-05-30 00:09 . 2008-06-10 17:02 15864 ----a-w- c:\windows\system32\drivers\mbam.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-05-30 22:41 . 2008-06-30 02:32 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy 2010-05-30 00:09 . 2010-04-29 22:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-04-28 22:22 . 2010-04-28 22:22 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Estsoft 2010-04-28 22:21 . 2008-06-30 06:37 -------- d-----w- c:\program files\ESTsoft 2010-04-25 21:24 . 2008-07-10 20:01 168921 -c--a-w- c:\windows\War3Unin.dat 2010-04-23 18:51 . 2010-04-22 09:56 1 ----a-w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2010-04-22 09:56 . 2010-04-22 09:56 -------- d-----w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\OpenOffice.org 2010-04-22 09:50 . 2008-07-13 21:42 18304 -c--a-w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-04-21 18:09 . 2010-04-21 18:09 -------- d-----w- c:\program files\OpenOffice.org 3 2010-04-12 20:39 . 2010-04-12 20:39 -------- d-----w- c:\program files\Image-Line 2010-04-12 20:38 . 2010-04-12 20:38 -------- d-----w- c:\program files\Steinberg 2010-04-12 11:35 . 2008-07-03 19:26 -------- d-----w- c:\program files\Java 2010-04-12 11:34 . 2010-04-12 11:34 152576 ----a-w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\Sun\Java\jre1.6.0_17\lzma.dll 2010-04-12 11:32 . 2010-04-12 11:32 79488 ----a-w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2010-03-28 13:24 . 2001-08-24 12:00 80800 ----a-w- c:\windows\system32\perfc00C.dat 2010-03-28 13:24 . 2001-08-24 12:00 500894 ----a-w- c:\windows\system32\perfh00C.dat . ------- Sigcheck ------- [-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\atapi.sys [-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys [-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\atapi.sys [-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\drivers\atapi.sys [-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\asyncmac.sys [-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\asyncmac.sys [-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\drivers\asyncmac.sys [-] 2001-08-24 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys [-] 2001-08-24 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys [-] 2008-04-14 . 16813155807C6881F4BFBF6657424659 . 25216 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\kbdclass.sys [-] 2004-08-19 . E798705E8DC7FAB596EF6BFDF167E007 . 25216 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\kbdclass.sys [-] 2004-08-19 . E798705E8DC7FAB596EF6BFDF167E007 . 25216 . . [5.1.2600.2180] . . c:\windows\system32\drivers\kbdclass.sys [-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ndis.sys [-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys [-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys [-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ntfs.sys [-] 2007-02-09 . 05AB81909514BFD69CBB1F2C147CF6B9 . 574976 . . [5.1.2600.3081] . . c:\windows\SoftwareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\SP2QFE\ntfs.sys [-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . c:\windows\SoftwareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\SP2GDR\ntfs.sys [-] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ntfs.sys [-] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ntfs.sys [-] 2001-08-24 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys [-] 2001-08-24 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys [-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys [-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys [-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\tcpip.sys [7] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\drivers\tcpip.sys [7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys [-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\tcpip.sys [7] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\SP2GDR\tcpip.sys [7] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\SP2QFE\tcpip.sys [-] 2006-02-14 . 667192A11DB19F36624119C0DD4DE4F2 . 359808 . . [5.1.2600.2827] . . c:\windows\$NtUninstallKB951748$\tcpip.sys [-] 2008-04-14 . 06B54A7B1EF7CB16BFD0E208D343FA71 . 77824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\browser.dll [7] 2004-08-19 . 75AC49029966BFFEA09F96C1C194F684 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\browser.dll [7] 2004-08-19 . 75AC49029966BFFEA09F96C1C194F684 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\browser.dll [-] 2008-04-14 . 91E6024D6D4DCDECDB36C43ECF9BBECB . 13312 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\lsass.exe [7] 2004-08-19 . 259AF82A0932EEA4F316F92DB94707B6 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe [7] 2004-08-19 . 259AF82A0932EEA4F316F92DB94707B6 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lsass.exe [-] 2008-04-14 . BE0CB143FA427D93440DED18DB8C918B . 198144 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\netman.dll [7] 2006-03-09 . 0D55724D88488BBFC53BC2EA219240F3 . 197632 . . [5.1.2600.2743] . . c:\windows\system32\netman.dll [-] 2008-04-14 . BAA0B6E647C1AD593E9BAE5CC31BCFFB . 409088 . . [6.7.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\qmgr.dll [7] 2004-08-19 . 659F7B6C502051BFA37910614B225548 . 382464 . . [6.6.2600.2180] . . c:\windows\system32\qmgr.dll [7] 2004-08-19 . 659F7B6C502051BFA37910614B225548 . 382464 . . [6.6.2600.2180] . . c:\windows\system32\dllcache\qmgr.dll [7] 2009-02-09 . F83B964469D230F445613C44DF9FE25D . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll [7] 2009-02-09 . 0203B1AAD358F206CB0A3C1F93CCE17A . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\rpcss.dll [7] 2009-02-09 . 5620353B93DD08016674E4FEE280190B . 399360 . . [5.1.2600.3520] . . c:\windows\system32\rpcss.dll [7] 2009-02-09 . 5620353B93DD08016674E4FEE280190B . 399360 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\rpcss.dll [7] 2009-02-09 . BA1EF616F55210820F6462D033088497 . 401408 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\rpcss.dll [-] 2008-04-14 . 3D65EB82E1FA6DB15A33E024C9E03CAB . 399360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\rpcss.dll [7] 2006-03-09 . CB7D37602638369A516757E994CBB31D . 397824 . . [5.1.2600.2726] . . c:\windows\$NtUninstallKB956572$\rpcss.dll [7] 2009-02-09 . C3FB1D70CB88722267949694BA51759E . 111104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\services.exe [7] 2009-02-09 . 62789101F9C2401ED598AA2CDE7450C0 . 111104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe [7] 2009-02-09 . 9D6BF82FE50D55F20F8E10E0F6653886 . 111104 . . [5.1.2600.3520] . . c:\windows\system32\services.exe [7] 2009-02-09 . 9D6BF82FE50D55F20F8E10E0F6653886 . 111104 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\services.exe [7] 2009-02-09 . 51A24094F076961A7FF73E5F7E991D68 . 111104 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\services.exe [-] 2008-04-14 . 54CB50058851D95E56EC70D09F70857F . 109056 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\services.exe [7] 2004-08-19 . 63DCDE1A0D86EEB8924D6738FF616EAD . 108544 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB956572$\services.exe [-] 2008-04-14 . 460E4CE148BD07218DA0B6A3D31885A9 . 57856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\spoolsv.exe [7] 2006-03-09 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe [-] 2008-04-14 . DD73D6B9F6B4CB630CF35B438B540174 . 512000 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\winlogon.exe [7] 2004-08-19 . 123EEA158F74D0F67A51DCDF065D1091 . 506368 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [7] 2004-08-19 . 123EEA158F74D0F67A51DCDF065D1091 . 506368 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe [-] 2008-04-14 . B4AA331468315B6A174C3F0D5B3BC135 . 617472 . . [5.82] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\comctl32.dll [-] 2008-04-14 . F92E6BEA9349D49341383F8403B4DFE5 . 1054208 . . [6.0] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\asms\60\msft\windows\common\controls\comctl32.dll [7] 2006-08-25 . E6F5355AFDEA32240B61EEA930D8A749 . 561664 . . [5.82] . . c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\SP1QFE\comctl32.dll [7] 2006-08-25 . 9724ECD4529AF317DD5BD6194EB6428C . 925184 . . [6.0] . . c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\SP1QFE\asms\60\msft\windows\common\controls\comctl32.dll [7] 2006-08-25 . 5BBCD65CFD7610F36BCA96B72BBAED4B . 617472 . . [5.82] . . c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\SP2QFE\comctl32.dll [7] 2006-08-25 . 47ABF878B9AEC81B23BA5F89DE597B3A . 1054208 . . [6.0] . . c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\SP2QFE\asms\60\msft\windows\common\controls\comctl32.dll [7] 2004-08-19 . 7D3AA1F0E765054CB5F30114F2DB6888 . 611328 . . [5.82] . . c:\windows\system32\comctl32.dll [7] 2004-08-19 . 7D3AA1F0E765054CB5F30114F2DB6888 . 611328 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll [-] 2008-04-14 . 7A6D0B71035E123FDDA2156A25578AD3 . 62464 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\cryptsvc.dll [7] 2004-08-19 . CD73133EB24C572019944001FAD1B8D9 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\cryptsvc.dll [7] 2004-08-19 . CD73133EB24C572019944001FAD1B8D9 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\cryptsvc.dll [7] 2008-07-07 20:31 . A5B1B7C76134329AA7547F6E6DA35410 . 253952 . . [2001.12.4414.320] . . c:\windows\system32\es.dll [7] 2008-07-07 20:31 . A5B1B7C76134329AA7547F6E6DA35410 . 253952 . . [2001.12.4414.320] . . c:\windows\system32\dllcache\es.dll [7] 2008-07-07 20:28 . EC16AE9B37EACF871629227A3F3913FD . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3GDR\es.dll [7] 2008-07-07 20:24 . 157F9C595FD0D10502497DC4C1348D17 . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll [7] 2008-07-07 20:18 . 74ECF4DDC685BD3249CAB323405FCC49 . 253952 . . [2001.12.4414.320] . . c:\windows\$hf_mig$\KB950974\SP2QFE\es.dll [-] 2008-04-14 02:33 . 9FD4A0615BF3E9388A46EDF8774C7294 . 246272 . . [2001.12.4414.701] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\es.dll [7] 2006-03-09 08:24 . D9CDB9380E0EFC9E97CC589B5F484B94 . 243200 . . [2001.12.4414.308] . . c:\windows\$NtUninstallKB950974$\es.dll [-] 2008-04-14 . 0469B73DB32E5520F342C5E163AA3CCA . 110080 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\imm32.dll [7] 2004-08-19 . E55DAFA1A354BD5CB69151563DC9748A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll [7] 2004-08-19 . E55DAFA1A354BD5CB69151563DC9748A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\imm32.dll [7] 2009-03-21 . 534040750B9E70B156A98F5D0E8F6D2A . 1051136 . . [5.1.2600.3541] . . c:\windows\system32\kernel32.dll [7] 2009-03-21 . 534040750B9E70B156A98F5D0E8F6D2A . 1051136 . . [5.1.2600.3541] . . c:\windows\system32\dllcache\kernel32.dll [7] 2009-03-21 . 98F08549604D090B6B2514AF845F329F . 1054720 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3GDR\kernel32.dll [7] 2009-03-21 . C3AF0EEE26B59484E674673E3016AAB7 . 1056768 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll [7] 2009-03-21 . 2087E2764822A8D93A4CA7FA0FED35E8 . 1054208 . . [5.1.2600.3541] . . c:\windows\$hf_mig$\KB959426\SP2QFE\kernel32.dll [-] 2008-04-14 . 3AC8886DFA5AB641417DF4D3B7F5512E . 1054720 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\kernel32.dll [7] 2007-04-16 . 62E3F0E9ABFCBCEE62C51546F622C455 . 1051136 . . [5.1.2600.3119] . . c:\windows\SoftwareDistribution\Download\4a30d9e5adbf7a3398756dd0ea6f4e72\SP2QFE\kernel32.dll [7] 2007-04-16 . 6F1FE2AE7B22EB9CED1BFF533C9455EA . 1049600 . . [5.1.2600.3119] . . c:\windows\SoftwareDistribution\Download\4a30d9e5adbf7a3398756dd0ea6f4e72\SP2GDR\kernel32.dll [7] 2004-08-19 . C88F74591579DBDE273C61312B2D3886 . 1048576 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB959426$\kernel32.dll [-] 2008-04-14 . 5C64008E661307C4A3C3C25D9086CDE7 . 19968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\linkinfo.dll [7] 2006-03-09 . 8D9A075C065DFE1228688D10155D6624 . 19968 . . [5.1.2600.2751] . . c:\windows\system32\linkinfo.dll [-] 2008-04-14 . 982B2C204337C3B12211E1E1D9BA8C9C . 22016 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\lpk.dll [7] 2004-08-19 . 3236A6A1650E6C055FD5E87D7C4A05AD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\lpk.dll [7] 2004-08-19 . 3236A6A1650E6C055FD5E87D7C4A05AD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lpk.dll [7] 2009-02-20 . D5F02ACCD671A99D15F59DA56B2EA3EC . 3088896 . . [6.00.2900.3527] . . c:\windows\system32\mshtml.dll [7] 2009-02-20 . D5F02ACCD671A99D15F59DA56B2EA3EC . 3088896 . . [6.00.2900.3527] . . c:\windows\system32\dllcache\mshtml.dll [7] 2009-02-20 . EB1C22D91F6363367656872ED813DAB5 . 3089408 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3GDR\mshtml.dll [7] 2009-02-20 . BAE9A8994957EF57BB429A7E5688EC80 . 3089408 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3QFE\mshtml.dll [7] 2008-08-20 . EB2B003122AA714FE93979CFA4EEAA55 . 3088384 . . [6.00.2900.3429] . . c:\windows\$NtUninstallKB963027$\mshtml.dll [7] 2008-08-20 . E1772442035064C97BA6B4D60BDA1BB9 . 3088896 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3GDR\mshtml.dll [7] 2008-08-20 . 4229C8960DE4DC5B6C326E2B65175E9F . 3088896 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3QFE\mshtml.dll [-] 2008-04-21 . FEACD6E84244125550219C6795348FDE . 3080704 . . [6.00.2900.3354] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp2gdr\mshtml.dll [-] 2008-04-21 . 57BC3BE475F34AE089878A016C2CA46E . 3087872 . . [6.00.2900.3354] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp2qfe\mshtml.dll [-] 2008-04-21 . 840E79E91BCCD80B2FC3CCAD2C60B35A . 3087872 . . [6.00.2900.5583] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3gdr\mshtml.dll [-] 2008-04-21 . B3CD09A5DBD2A569ADFA8654E3C8879D . 3088384 . . [6.00.2900.5583] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3qfe\mshtml.dll [-] 2008-04-14 . C4153F037157C7BE7C54FD88887F027D . 3066880 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\mshtml.dll [7] 2006-04-21 . 6DF21BA445B9491943853290B0AAC74F . 3077120 . . [6.00.2900.2883] . . c:\windows\$NtUninstallKB956390$\mshtml.dll [-] 2008-04-14 . 3891413139EAABFEFE9B0CA49B5CD395 . 343040 . . [7.0.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\msvcrt.dll [-] 2008-04-14 . D33CD21D476C3A07DD88F83850A17432 . 343040 . . [7.0.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\asms\70\msft\windows\mswincrt\msvcrt.dll [7] 2004-08-19 . B89F48FDFD6C3312B92D5D633C23F075 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\msvcrt.dll [7] 2004-08-19 . B89F48FDFD6C3312B92D5D633C23F075 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\dllcache\msvcrt.dll [7] 2008-06-20 . 58AF8498C62E1E1DAB5AE59C6E08C180 . 247808 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\mswsock.dll [7] 2008-06-20 . C759B3790D3BA760C52E218EF4886DAC . 247808 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll [7] 2008-06-20 . 8A52DE10680A40ECD04FA2C0FBC34190 . 247808 . . [5.1.2600.3394] . . c:\windows\system32\mswsock.dll [7] 2008-06-20 . 8A52DE10680A40ECD04FA2C0FBC34190 . 247808 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\mswsock.dll [7] 2008-06-20 . 4138FBDEDBC6FEAD215BB4C4B102F7DE . 247808 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\mswsock.dll [-] 2008-04-14 . 196CCC3FDD21665DCAA9F83FFC03B41A . 247808 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\mswsock.dll [7] 2004-08-19 . 6FA2DDF70DC9B762EBF8920F89B6BEA3 . 247808 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB951748$\mswsock.dll [-] 2008-04-14 . 04821179C3171554C1BD1F9888A113E2 . 407040 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\netlogon.dll [7] 2004-08-19 . D4CFAC76926C24E32B7F25A35C31BC6E . 407040 . . [5.1.2600.2180] . . c:\windows\system32\netlogon.dll [7] 2004-08-19 . D4CFAC76926C24E32B7F25A35C31BC6E . 407040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\netlogon.dll [7] 2009-02-10 . BEF458B8424553279E95E250D1E0CE7E . 2191232 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe [7] 2009-02-09 . 4183ED119200F8520F5E834498AFB927 . 2182528 . . [5.1.2600.3520] . . c:\windows\Driver Cache\i386\ntoskrnl.exe [7] 2009-02-09 . 4183ED119200F8520F5E834498AFB927 . 2182528 . . [5.1.2600.3520] . . c:\windows\system32\ntoskrnl.exe [7] 2009-02-09 . 4183ED119200F8520F5E834498AFB927 . 2182528 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\ntoskrnl.exe [7] 2009-02-09 . B55AA66BC9269BC5257B915FFDAA790B . 2188160 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\ntoskrnl.exe [7] 2009-02-09 . AB896577F35CF5FED7A9F87D3C3205ED . 2191104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntoskrnl.exe [7] 2008-08-14 . D79210549BBF09B7638E860440504299 . 2191232 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe [7] 2008-08-14 . 449566D74B5C261A3A54AA216F0C532B . 2182400 . . [5.1.2600.3427] . . c:\windows\$NtUninstallKB956572$\ntoskrnl.exe [7] 2008-08-14 . C6649255E51F145B6E15C505AB68E459 . 2188032 . . [5.1.2600.3427] . . c:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe [7] 2008-08-14 . C8D4D5974F9671DA0A37175650912960 . 2191232 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe [-] 2008-04-14 . 099D639DA1EF6968D4E41795BB507E6B . 2191104 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ntoskrnl.exe [7] 2007-02-28 . 8E244108562E0E452EB68DFF64CB08A9 . 2184192 . . [5.1.2600.3093] . . c:\windows\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\SP2QFE\ntoskrnl.exe [7] 2007-02-28 . 7D6D19AAC51A4325F6039F083C22303C . 2182400 . . [5.1.2600.3093] . . c:\windows\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\SP2GDR\ntoskrnl.exe [7] 2006-03-09 . 63729DD0F2AAE36CC52B89C05505146C . 2181376 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB956841$\ntoskrnl.exe [-] 2008-04-14 . 9F2C862E39BF8E8FC51C3F6A6BCEB415 . 17408 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\powrprof.dll [7] 2004-08-19 . 29D5E58FB089C41898A81BD4C8970F22 . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll [7] 2004-08-19 . 29D5E58FB089C41898A81BD4C8970F22 . 17408 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\powrprof.dll [-] 2008-04-14 . 973B36634C544948C663E8269AA1B3A3 . 187392 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\scecli.dll [7] 2004-08-19 . 58D439F6EF73A2D9288B204E819F4BBD . 186368 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll [7] 2004-08-19 . 58D439F6EF73A2D9288B204E819F4BBD . 186368 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\scecli.dll [-] 2008-04-14 . 9A4E7ECBB5B7FB86F3B926AB039F4FEC . 5120 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\sfc.dll [7] 2004-08-19 . BB695F18354B38CFF693E67EE7A30C22 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll [7] 2004-08-19 . BB695F18354B38CFF693E67EE7A30C22 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfc.dll [-] 2008-04-14 . E4BDF223CD75478BF44567B4D5C2634D . 14336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\svchost.exe [7] 2004-08-19 . 2979B03D5382A602623C0535B16AB9C0 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe [7] 2004-08-19 . 2979B03D5382A602623C0535B16AB9C0 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\svchost.exe [-] 2008-04-14 . 8E5231171AD6595FF002E848CC54FCD7 . 249856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\tapisrv.dll [7] 2006-03-09 . 720DA0C9DB8996AD9B7F5164B2242DAA . 249344 . . [5.1.2600.2716] . . c:\windows\system32\tapisrv.dll [7] 2006-03-09 . 720DA0C9DB8996AD9B7F5164B2242DAA . 249344 . . [5.1.2600.2716] . . c:\windows\system32\dllcache\tapisrv.dll [-] 2008-04-14 . E853F84D3CE2FAA2A802E33CF89AC023 . 579584 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\user32.dll [7] 2007-03-08 . 4D88AAF39ADABFE45958EA1384E2C4FF . 579072 . . [5.1.2600.3099] . . c:\windows\SoftwareDistribution\Download\807aa275a612b3508a3d1d613bbf6226\SP2QFE\user32.dll [7] 2007-03-08 . 753354F594809A9B96F73999B435A533 . 578560 . . [5.1.2600.3099] . . c:\windows\SoftwareDistribution\Download\807aa275a612b3508a3d1d613bbf6226\SP2GDR\user32.dll [7] 2006-03-09 . 0DF75FB73F705B011630159A43D7C354 . 578048 . . [5.1.2600.2622] . . c:\windows\system32\user32.dll [-] 2008-04-14 . E74DDB12188C2FF57A78624DBF7332FC . 26624 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\userinit.exe [7] 2004-08-19 . 84717891F0734C611721F56C60B5FBC3 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe [7] 2004-08-19 . 84717891F0734C611721F56C60B5FBC3 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\userinit.exe [7] 2009-02-20 . AD9AB4386AE234EA5C8EED51CD934C44 . 672256 . . [6.00.2900.3527] . . c:\windows\system32\wininet.dll [7] 2009-02-20 . AD9AB4386AE234EA5C8EED51CD934C44 . 672256 . . [6.00.2900.3527] . . c:\windows\system32\dllcache\wininet.dll [7] 2009-02-20 . 273B84C3C339341F917D7DDAD0722F51 . 670208 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3GDR\wininet.dll [7] 2009-02-20 . 8EAE861274F3E0C00C10C871371A1A8E . 671744 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3QFE\wininet.dll [7] 2008-08-20 . AEF39AC3BCBAFE971155D0073191B5A6 . 671744 . . [6.00.2900.3429] . . c:\windows\$NtUninstallKB963027$\wininet.dll [7] 2008-08-20 . 50D19E569C83A9C1AE7EFAEF6A93BC50 . 670208 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3GDR\wininet.dll [7] 2008-08-20 . 96D50ACA60DA22ADBD253F2825C98D1A . 670720 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3QFE\wininet.dll [-] 2008-04-21 . 355A69CC05045428CE6B9E6BFBD4B74B . 663552 . . [6.00.2900.3354] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp2gdr\wininet.dll [-] 2008-04-21 . F2F343D7ED0223645BA773B840EB4993 . 670720 . . [6.00.2900.3354] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp2qfe\wininet.dll [-] 2008-04-21 . 7AF7D7D178F2863E7E7C880B55C88B76 . 670208 . . [6.00.2900.5583] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3gdr\wininet.dll [-] 2008-04-21 . 82B3264706B9921C67B196319FDA51DE . 670720 . . [6.00.2900.5583] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3qfe\wininet.dll [-] 2008-04-14 . 4A6E04EA20F48D750D9BFED8600D516B . 670208 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\wininet.dll [7] 2006-04-12 . 241DBC4C2714B2F39AFDED49459ED420 . 667648 . . [6.00.2900.2861] . . c:\windows\$NtUninstallKB956390$\wininet.dll [-] 2008-04-14 . FB836F9E62D82904C983AD21296A5D9C . 82432 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ws2_32.dll [7] 2006-08-16 . 7279695B154A49550F675A985265B00A . 70656 . . [5.1.2600.1886] . . c:\windows\SoftwareDistribution\Download\b3d62539e3338b3e6aca7b80247f201f\SP1QFE\ws2_32.dll [7] 2006-05-19 . 93307E5F8389A7474511DC51165694E5 . 70656 . . [5.1.2600.1847] . . c:\windows\SoftwareDistribution\Download\be96031e349de0228a58a3a562a48caf\SP1QFE\ws2_32.dll [7] 2004-08-19 . EED74B969B2CA1ACC558FF60FB420E28 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll [7] 2004-08-19 . EED74B969B2CA1ACC558FF60FB420E28 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2_32.dll [-] 2008-04-14 . F2317622D29F9FF0F88AEECD5F60F0DD . 1037824 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\explorer.exe [7] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\SP2GDR\explorer.exe [7] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\SP2QFE\explorer.exe [7] 2004-08-19 . 2A7BD330924252A2FD80344FC949BB72 . 1036288 . . [6.00.2900.2180] . . c:\windows\explorer.exe [7] 2004-08-19 . 2A7BD330924252A2FD80344FC949BB72 . 1036288 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\explorer.exe [-] 2008-04-14 . 6ED29124A1C83BD0CF6B26BD01CA6F6F . 171520 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\srsvc.dll [7] 2004-08-19 . CE978404558CE2D82896AC2032F06DBF . 171008 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll [7] 2004-08-19 . CE978404558CE2D82896AC2032F06DBF . 171008 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\srsvc.dll [-] 2008-04-14 . 02DA31AB433A6C1110A736C85701DECA . 13824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\wscntfy.exe [7] 2004-08-19 . 8558905BA81F6EFAAF9667139BB117DD . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe [7] 2004-08-19 . 8558905BA81F6EFAAF9667139BB117DD . 13824 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\wscntfy.exe [-] 2008-04-14 . F92A87FDDA0C11C8604FBC2B864FA726 . 129024 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\xmlprov.dll [7] 2004-08-19 . 912591E2055E26566D1CB54092A7E8B0 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll [7] 2004-08-19 . 912591E2055E26566D1CB54092A7E8B0 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\xmlprov.dll [-] 2008-04-14 . 4EC800BDF80521B0207BD2301DFC7D14 . 56320 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\eventlog.dll [7] 2004-08-19 . 49B1376885340BF9EA0D99F71557B59A . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll [7] 2004-08-19 . 49B1376885340BF9EA0D99F71557B59A . 55808 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\eventlog.dll [-] 2008-04-14 . E17C85D5B5CF477638433B851A98499E . 1571840 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\sfcfiles.dll [-] 2006-03-09 . E51172E3C82D76FCC02001D0FF41A1A1 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll [-] 2008-04-14 . 59DC5BB82E4C8E0B3EADCFDBC44BA6E4 . 15360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ctfmon.exe [7] 2004-08-19 . 64E41E8FEE655B03E3F19DED21BA5118 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe [7] 2004-08-19 . 64E41E8FEE655B03E3F19DED21BA5118 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ctfmon.exe [-] 2008-04-14 . B9F20D71E5B6CE89A7A94B38351FDBDC . 135680 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\shsvcs.dll [7] 2006-12-19 . D7DFBD1EFA149EC158363B974DAE0C6B . 135168 . . [6.00.2900.3051] . . c:\windows\SoftwareDistribution\Download\749a2072c695f57087c10474c2640179\SP2GDR\shsvcs.dll [7] 2006-12-19 . 1839CDF416A5AA8BF2EFE377F57452CC . 135680 . . [6.00.2900.3051] . . c:\windows\SoftwareDistribution\Download\749a2072c695f57087c10474c2640179\SP2QFE\shsvcs.dll [7] 2004-08-19 . ABA25E49F6589FD73F1143FDC39A6B46 . 135168 . . [6.00.2900.2180] . . c:\windows\system32\shsvcs.dll [7] 2004-08-19 . ABA25E49F6589FD73F1143FDC39A6B46 . 135168 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\shsvcs.dll [-] 2008-04-14 . E598D81197E2E0EC42A0C55772BB00E8 . 59904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\regsvc.dll [7] 2004-08-19 . B6F76CE10953A141545A0D01F1776885 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\regsvc.dll [7] 2004-08-19 . B6F76CE10953A141545A0D01F1776885 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regsvc.dll [-] 2008-04-14 . 55F5C5C1BE1A78E285033E432BA01597 . 194560 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\schedsvc.dll [7] 2004-08-19 . A65E74CC5831CED5762AA16033ED20EE . 193024 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll [7] 2004-08-19 . A65E74CC5831CED5762AA16033ED20EE . 193024 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\schedsvc.dll [-] 2008-04-14 . EA9E0DB8684CEF2FD3BADD671DF5A112 . 71680 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ssdpsrv.dll [7] 2004-08-19 . DCB185C829538971E47AFFE77BA138C3 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\ssdpsrv.dll [7] 2004-08-19 . DCB185C829538971E47AFFE77BA138C3 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ssdpsrv.dll [-] 2008-04-14 . 710BC85A8C22626EE094439E3EA0D38C . 297984 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\termsrv.dll [7] 2004-08-19 . 78F90C3E230AD122BCB116ABAD5FEFE9 . 297984 . . [5.1.2600.2180] . . c:\windows\system32\termsrv.dll [7] 2004-08-19 . 78F90C3E230AD122BCB116ABAD5FEFE9 . 297984 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\termsrv.dll [-] 2008-04-14 . F36C9F78FC902C8DCE4D3B576BB0435A . 176640 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\appmgmts.dll [7] 2004-08-19 . 7E9D138DC991BCCE6E6026CD74E69CC4 . 176640 . . [5.1.2600.2180] . . c:\windows\system32\appmgmts.dll [7] 2004-08-19 . 7E9D138DC991BCCE6E6026CD74E69CC4 . 176640 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\appmgmts.dll [7] 2001-08-24 . E4ABC1212B70BB03D35E60681C447210 . 12032 . . [5.1.2600.0] . . c:\windows\system32\dllcache\acpiec.sys [7] 2001-08-24 . E4ABC1212B70BB03D35E60681C447210 . 12032 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys [-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\aec.sys [7] 2005-05-27 21:14 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\dllcache\aec.sys [7] 2005-05-27 21:14 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\drivers\aec.sys [-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\agp440.sys [7] 2004-08-03 . 2C428FA0C3E3A01ED93C9B2A27D8D4BB . 42368 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0021\DriverFiles\i386\AGP440.SYS [7] 2004-08-03 . 2C428FA0C3E3A01ED93C9B2A27D8D4BB . 42368 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\agp440.sys [7] 2004-08-03 . 2C428FA0C3E3A01ED93C9B2A27D8D4BB . 42368 . . [5.1.2600.2180] . . c:\windows\system32\drivers\AGP440.SYS [-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ip6fw.sys [7] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ip6fw.sys [7] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ip6fw.sys [-] 2008-04-14 02:33 . CE21FE79AD3B913A79E0C742BED6BF85 . 927504 . . [4.1.0.61] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\mfc40u.dll [7] 2006-11-01 19:18 . FCD58951B3B2392007E0EE34D2CF944F . 927504 . . [4.1.0.61] . . c:\windows\SoftwareDistribution\Download\514c80746ae952e9ebadfb936253a166\SP2QFE\mfc40u.dll [7] 2001-08-24 12:00 . E1A34560BF6CE7C703BB67EC4FA70F43 . 924432 . . [4.1.6140] . . c:\windows\system32\mfc40u.dll [7] 2001-08-24 12:00 . E1A34560BF6CE7C703BB67EC4FA70F43 . 924432 . . [4.1.6140] . . c:\windows\system32\dllcache\mfc40u.dll [-] 2008-04-14 . E67A66A3781C1A483F0F8992664CBE0D . 33792 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\msgsvc.dll [7] 2004-08-19 . DE71362123E81D268088E78543752576 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\msgsvc.dll [7] 2004-08-19 . DE71362123E81D268088E78543752576 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\msgsvc.dll [7] 2006-03-09 11:48 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\system32\mspmsnsv.dll [7] 2006-03-09 11:48 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\system32\dllcache\mspmsnsv.dll [7] 2009-02-10 . F751E041E682F53EAF34F7FAEA78994D . 2068096 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntkrnlpa.exe [7] 2009-02-09 . 663D7167ED065786EC9DCFF2569A39F7 . 2059776 . . [5.1.2600.3520] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe [7] 2009-02-09 . 663D7167ED065786EC9DCFF2569A39F7 . 2059776 . . [5.1.2600.3520] . . c:\windows\system32\ntkrnlpa.exe [7] 2009-02-09 . 663D7167ED065786EC9DCFF2569A39F7 . 2059776 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\ntkrnlpa.exe [7] 2009-02-09 . 0150FE5C1E07F8AE422FEC6C8E8A0C98 . 2065024 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\ntkrnlpa.exe [7] 2009-02-09 . ED5E20AE4AC5A63A4FF43FFE704A5153 . 2068224 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe [7] 2008-08-14 . 755B50949D0DBC0F0136B0DB58765331 . 2068096 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe [7] 2008-08-14 . F9720D61DF1E3E47614C4FC891F3FE44 . 2059776 . . [5.1.2600.3427] . . c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe [7] 2008-08-14 . DCBC1A6D150B5EE1BD6257186157B0F3 . 2065024 . . [5.1.2600.3427] . . c:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe [7] 2008-08-14 . 8DA71F1900721E1E4FCB5B02D55FB771 . 2068096 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe [-] 2008-04-14 . B71A8F101CEFAF82FC5EC16130A54A3F . 2067968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ntkrnlpa.exe [7] 2007-02-28 . A1D5231403329478AE4FE2778C55C77F . 2059648 . . [5.1.2600.3093] . . c:\windows\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\SP2GDR\ntkrnlpa.exe [7] 2007-02-28 . 7A56A64EB50399613587E90292DD2AAB . 2061440 . . [5.1.2600.3093] . . c:\windows\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\SP2QFE\ntkrnlpa.exe [7] 2006-05-09 . 73FA9C95D235844A36968C7852C7DBDD . 2058880 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe [-] 2008-04-14 02:33 . 037D92B3A7853A183FCAB77FB1D13D6C . 438272 . . [5.1.2400.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ntmssvc.dll [7] 2004-08-19 15:09 . 951543FFB84012D13F4CB09DA2EACE96 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\ntmssvc.dll [7] 2004-08-19 15:09 . 951543FFB84012D13F4CB09DA2EACE96 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\dllcache\ntmssvc.dll [-] 2008-04-14 . BD8166A495B02308F364B36249475F22 . 186368 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\upnphost.dll [7] 2007-02-05 . 385DB2591BF11955F26E0A97728B1B31 . 185344 . . [5.1.2600.3077] . . c:\windows\SoftwareDistribution\Download\c14099cb3cd0d3c3eb07f3570fc9d034\SP2QFE\upnphost.dll [7] 2007-02-05 . 96B3C690ED82E36E04C130F916E3AE91 . 185344 . . [5.1.2600.3077] . . c:\windows\SoftwareDistribution\Download\c14099cb3cd0d3c3eb07f3570fc9d034\SP2GDR\upnphost.dll [7] 2004-08-19 . 0B6A726C2DE9BBB80A48459F0C318F44 . 185344 . . [5.1.2600.2180] . . c:\windows\system32\upnphost.dll [7] 2004-08-19 . 0B6A726C2DE9BBB80A48459F0C318F44 . 185344 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\upnphost.dll [-] 2008-04-14 . 4BB396EA6CAA50F2208078602549F2F2 . 367616 . . [5.3.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\dsound.dll [7] 2004-08-19 . 7FD6E3D4918514565DF553BE693E3034 . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dsound.dll [7] 2004-08-19 . 7FD6E3D4918514565DF553BE693E3034 . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dllcache\dsound.dll . ((((((((((((((((((((((((((((( SnapShot@2010-05-30_23.04.10 ))))))))))))))))))))))))))))))))))))))))) . + 2010-05-31 01:11 . 2010-05-31 01:11 16384 c:\windows\temp\Perflib_Perfdata_454.dat - 2010-05-30 23:02 . 2010-05-30 23:02 16384 c:\windows\Temp\Perflib_Perfdata_454.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-12-11 20992] "SoundMan"="SOUNDMAN.EXE" [2003-06-10 55296] "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-08-11 81920] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) "NoStrCmpLogical"= 0 (0x0) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "DisablePagingExecutive"=dword:00000001 "SecondLevelDataCache"=dword:00000200 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\Program\\BitTorrent\\bittorrent.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "d:\\Program\\Warcraft III\\Frozen Throne.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:sc port "6112:UDP"= 6112:UDP:sc port 2 "56971:TCP"= 56971:TCP:Pando Media Booster "56971:UDP"= 56971:UDP:Pando Media Booster "1034:TCP"= 1034:TCP:Akamai NetSession Interface "5000:UDP"= 5000:UDP:Akamai NetSession Interface S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-12-22 691696] S3 EL910;3Com 3CSOHO100B-TX PCI;c:\windows\system32\DRIVERS\EL910N51.sys [2002-05-29 38400] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uInternet Connection Wizard,ShellNext = hxxp://www.google.fr/ uInternet Settings,ProxyServer = http=127.0.0.1:5555 uInternet Settings,ProxyOverride = <local> uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s TCP: {0664E60F-49FA-4364-9A7E-BDB9548B9B6B} = 192.168.1.1 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-05-31 03:13 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x823721F8]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0xf8579fc3 \Driver\ACPI -> ACPI.sys @ 0xf83e0cb8 \Driver\atapi -> 0x823721f8 IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0094 ParseProcedure -> ntoskrnl.exe @ 0x8056f08e \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0094 ParseProcedure -> ntoskrnl.exe @ 0x8056f08e NDIS: 3Com 3C910 Integrated Fast Ethernet Controller (3CSOHO100B-TX C -> SendCompleteHandler -> NDIS.sys @ 0xf8281af9 PacketIndicateHandler -> NDIS.sys @ 0xf828cb21 SendHandler -> NDIS.sys @ 0xf8281938 Warning: possible MBR rootkit infection ! user & kernel MBR OK ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(616) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(664) d:\program\MouseWare\System\LgWndHk.dll . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\Ati2evxx.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\Ati2evxx.exe c:\windows\SOUNDMAN.EXE d:\program\MouseWare\system\em_exec.exe d:\program\Warcraft III\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe c:\program files\OpenOffice.org 3\program\soffice.exe c:\program files\OpenOffice.org 3\program\soffice.bin . ************************************************************************** . Heure de fin: 2010-05-31 03:16:58 - La machine a redémarré ComboFix-quarantined-files.txt 2010-05-31 01:16 ComboFix2.txt 2010-05-31 00:26 ComboFix3.txt 2010-05-30 23:09 Avant-CF: 3'619'270'656 octets libres Après-CF: 3'617'730'560 octets libres - - End Of File - - 7BB0A0BBBDED4300E4914B61529C0B8B
  13. Ogon
    ok merci super
  14. Ogon
    voila voila je ne pouvais pas déplacer mes fichiers comme sur l exemple, j ai donc utiliser "ouvrir avec" pour le script, j imagine que ca ne change rien merci pour ton aide : ComboFix 10-04-30.01 - Dozr 31.05.2010 2:13.2.1 - x86 Lancé depuis: c:\documents and settings\Dozr.XPSP2-6FD77EF47\Bureau\Ogon.exe Commutateurs utilisés :: c:\documents and settings\Dozr.XPSP2-6FD77EF47\Bureau\CFScript.txt FILE :: "c:\windows\system32\GameMon.des" file zipped: c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\ESTsoft\ALUpdate\ALZIP\newfile\TEMP\ALZip752.exe file zipped: c:\program files\owcstp16.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\ESTsoft\ALUpdate\ALZIP\newfile\TEMP\ALZip752.exe c:\program files\owcstp16.dll c:\windows\system32\GameMon.des c:\windows\system32\drivers\cdrom.sys . . . est infecté!! . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ANTIVIRUPGRADESERVICE -------\Legacy_GARENAPENGINE -------\Legacy_XDVA143 -------\Legacy_XDVA332 -------\Service_AntiVirUpgradeService -------\Service_GarenaPEngine -------\Service_npggsvc -------\Service_XDva143 -------\Service_XDva332 ((((((((((((((((((((((((((((( Fichiers créés du 2010-04-28 au 2010-05-31 )))))))))))))))))))))))))))))))))))) . 2010-05-30 22:49 . 2010-05-30 23:09 -------- dc----w- C:\Ogon 2010-05-30 00:37 . 2010-05-30 00:37 -------- d-----w- c:\program files\Panda Security 2010-05-30 00:09 . 2010-05-30 00:09 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes 2010-05-30 00:09 . 2008-06-10 17:02 34296 ----a-w- c:\windows\system32\drivers\mbamcatchme.sys 2010-05-30 00:09 . 2008-06-10 17:02 15864 ----a-w- c:\windows\system32\drivers\mbam.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-05-30 22:41 . 2008-06-30 02:32 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy 2010-05-30 00:09 . 2010-04-29 22:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-04-28 22:22 . 2010-04-28 22:22 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Estsoft 2010-04-28 22:21 . 2008-06-30 06:37 -------- d-----w- c:\program files\ESTsoft 2010-04-25 21:24 . 2008-07-10 20:01 168921 -c--a-w- c:\windows\War3Unin.dat 2010-04-23 18:51 . 2010-04-22 09:56 1 ----a-w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2010-04-22 09:56 . 2010-04-22 09:56 -------- d-----w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\OpenOffice.org 2010-04-22 09:50 . 2008-07-13 21:42 18304 -c--a-w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-04-21 18:09 . 2010-04-21 18:09 -------- d-----w- c:\program files\OpenOffice.org 3 2010-04-12 20:39 . 2010-04-12 20:39 -------- d-----w- c:\program files\Image-Line 2010-04-12 20:38 . 2010-04-12 20:38 -------- d-----w- c:\program files\Steinberg 2010-04-12 11:35 . 2008-07-03 19:26 -------- d-----w- c:\program files\Java 2010-04-12 11:34 . 2010-04-12 11:34 152576 ----a-w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\Sun\Java\jre1.6.0_17\lzma.dll 2010-04-12 11:32 . 2010-04-12 11:32 79488 ----a-w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2010-03-28 13:24 . 2001-08-24 12:00 80800 ----a-w- c:\windows\system32\perfc00C.dat 2010-03-28 13:24 . 2001-08-24 12:00 500894 ----a-w- c:\windows\system32\perfh00C.dat . (((((((((((((((((((((((((((((((((((((((((( SR_Search )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ------- Sigcheck ------- [-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\atapi.sys [-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys [-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\atapi.sys [-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\drivers\atapi.sys [-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\asyncmac.sys [-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\asyncmac.sys [-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\drivers\asyncmac.sys [-] 2001-08-24 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys [-] 2001-08-24 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys [-] 2008-04-14 . 16813155807C6881F4BFBF6657424659 . 25216 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\kbdclass.sys [-] 2004-08-19 . E798705E8DC7FAB596EF6BFDF167E007 . 25216 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\kbdclass.sys [-] 2004-08-19 . E798705E8DC7FAB596EF6BFDF167E007 . 25216 . . [5.1.2600.2180] . . c:\windows\system32\drivers\kbdclass.sys [-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ndis.sys [-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys [-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys [-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ntfs.sys [-] 2007-02-09 . 05AB81909514BFD69CBB1F2C147CF6B9 . 574976 . . [5.1.2600.3081] . . c:\windows\SoftwareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\SP2QFE\ntfs.sys [-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . c:\windows\SoftwareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\SP2GDR\ntfs.sys [-] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ntfs.sys [-] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ntfs.sys [-] 2001-08-24 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys [-] 2001-08-24 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys [-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys [-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys [-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\tcpip.sys [-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\drivers\tcpip.sys [-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys [-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\tcpip.sys [-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\SP2GDR\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\SP2QFE\tcpip.sys [-] 2006-02-14 . 667192A11DB19F36624119C0DD4DE4F2 . 359808 . . [5.1.2600.2827] . . c:\windows\$NtUninstallKB951748$\tcpip.sys [-] 2008-04-14 . 06B54A7B1EF7CB16BFD0E208D343FA71 . 77824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\browser.dll [-] 2004-08-19 . 75AC49029966BFFEA09F96C1C194F684 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\browser.dll [-] 2004-08-19 . 75AC49029966BFFEA09F96C1C194F684 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\browser.dll [-] 2008-04-14 . 91E6024D6D4DCDECDB36C43ECF9BBECB . 13312 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\lsass.exe [-] 2004-08-19 . 259AF82A0932EEA4F316F92DB94707B6 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe [-] 2004-08-19 . 259AF82A0932EEA4F316F92DB94707B6 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lsass.exe [-] 2008-04-14 . BE0CB143FA427D93440DED18DB8C918B . 198144 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\netman.dll [-] 2006-03-09 . 0D55724D88488BBFC53BC2EA219240F3 . 197632 . . [5.1.2600.2743] . . c:\windows\system32\netman.dll [-] 2008-04-14 . BAA0B6E647C1AD593E9BAE5CC31BCFFB . 409088 . . [6.7.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\qmgr.dll [-] 2004-08-19 . 659F7B6C502051BFA37910614B225548 . 382464 . . [6.6.2600.2180] . . c:\windows\system32\qmgr.dll [-] 2004-08-19 . 659F7B6C502051BFA37910614B225548 . 382464 . . [6.6.2600.2180] . . c:\windows\system32\dllcache\qmgr.dll [-] 2009-02-09 . F83B964469D230F445613C44DF9FE25D . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll [-] 2009-02-09 . 0203B1AAD358F206CB0A3C1F93CCE17A . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\rpcss.dll [-] 2009-02-09 . 5620353B93DD08016674E4FEE280190B . 399360 . . [5.1.2600.3520] . . c:\windows\system32\rpcss.dll [-] 2009-02-09 . 5620353B93DD08016674E4FEE280190B . 399360 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\rpcss.dll [-] 2009-02-09 . BA1EF616F55210820F6462D033088497 . 401408 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\rpcss.dll [-] 2008-04-14 . 3D65EB82E1FA6DB15A33E024C9E03CAB . 399360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\rpcss.dll [-] 2006-03-09 . CB7D37602638369A516757E994CBB31D . 397824 . . [5.1.2600.2726] . . c:\windows\$NtUninstallKB956572$\rpcss.dll [-] 2009-02-09 . C3FB1D70CB88722267949694BA51759E . 111104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\services.exe [-] 2009-02-09 . 62789101F9C2401ED598AA2CDE7450C0 . 111104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe [-] 2009-02-09 . 9D6BF82FE50D55F20F8E10E0F6653886 . 111104 . . [5.1.2600.3520] . . c:\windows\system32\services.exe [-] 2009-02-09 . 9D6BF82FE50D55F20F8E10E0F6653886 . 111104 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\services.exe [-] 2009-02-09 . 51A24094F076961A7FF73E5F7E991D68 . 111104 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\services.exe [-] 2008-04-14 . 54CB50058851D95E56EC70D09F70857F . 109056 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\services.exe [-] 2004-08-19 . 63DCDE1A0D86EEB8924D6738FF616EAD . 108544 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB956572$\services.exe [-] 2008-04-14 . 460E4CE148BD07218DA0B6A3D31885A9 . 57856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\spoolsv.exe [-] 2006-03-09 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe [-] 2008-04-14 . DD73D6B9F6B4CB630CF35B438B540174 . 512000 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\winlogon.exe [-] 2004-08-19 . 123EEA158F74D0F67A51DCDF065D1091 . 506368 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [-] 2004-08-19 . 123EEA158F74D0F67A51DCDF065D1091 . 506368 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe [-] 2008-04-14 . B4AA331468315B6A174C3F0D5B3BC135 . 617472 . . [5.82] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\comctl32.dll [-] 2008-04-14 . F92E6BEA9349D49341383F8403B4DFE5 . 1054208 . . [6.0] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\asms\60\msft\windows\common\controls\comctl32.dll [-] 2006-08-25 . E6F5355AFDEA32240B61EEA930D8A749 . 561664 . . [5.82] . . c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\SP1QFE\comctl32.dll [-] 2006-08-25 . 9724ECD4529AF317DD5BD6194EB6428C . 925184 . . [6.0] . . c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\SP1QFE\asms\60\msft\windows\common\controls\comctl32.dll [-] 2006-08-25 . 5BBCD65CFD7610F36BCA96B72BBAED4B . 617472 . . [5.82] . . c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\SP2QFE\comctl32.dll [-] 2006-08-25 . 47ABF878B9AEC81B23BA5F89DE597B3A . 1054208 . . [6.0] . . c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\SP2QFE\asms\60\msft\windows\common\controls\comctl32.dll [-] 2004-08-19 . 7D3AA1F0E765054CB5F30114F2DB6888 . 611328 . . [5.82] . . c:\windows\system32\comctl32.dll [-] 2004-08-19 . 7D3AA1F0E765054CB5F30114F2DB6888 . 611328 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll [-] 2008-04-14 . 7A6D0B71035E123FDDA2156A25578AD3 . 62464 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\cryptsvc.dll [-] 2004-08-19 . CD73133EB24C572019944001FAD1B8D9 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\cryptsvc.dll [-] 2004-08-19 . CD73133EB24C572019944001FAD1B8D9 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\cryptsvc.dll [-] 2008-07-07 20:31 . A5B1B7C76134329AA7547F6E6DA35410 . 253952 . . [2001.12.4414.320] . . c:\windows\system32\es.dll [-] 2008-07-07 20:31 . A5B1B7C76134329AA7547F6E6DA35410 . 253952 . . [2001.12.4414.320] . . c:\windows\system32\dllcache\es.dll [-] 2008-07-07 20:28 . EC16AE9B37EACF871629227A3F3913FD . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3GDR\es.dll [-] 2008-07-07 20:24 . 157F9C595FD0D10502497DC4C1348D17 . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll [-] 2008-07-07 20:18 . 74ECF4DDC685BD3249CAB323405FCC49 . 253952 . . [2001.12.4414.320] . . c:\windows\$hf_mig$\KB950974\SP2QFE\es.dll [-] 2008-04-14 02:33 . 9FD4A0615BF3E9388A46EDF8774C7294 . 246272 . . [2001.12.4414.701] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\es.dll [-] 2006-03-09 08:24 . D9CDB9380E0EFC9E97CC589B5F484B94 . 243200 . . [2001.12.4414.308] . . c:\windows\$NtUninstallKB950974$\es.dll [-] 2008-04-14 . 0469B73DB32E5520F342C5E163AA3CCA . 110080 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\imm32.dll [-] 2004-08-19 . E55DAFA1A354BD5CB69151563DC9748A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll [-] 2004-08-19 . E55DAFA1A354BD5CB69151563DC9748A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\imm32.dll [-] 2009-03-21 . 534040750B9E70B156A98F5D0E8F6D2A . 1051136 . . [5.1.2600.3541] . . c:\windows\system32\kernel32.dll [-] 2009-03-21 . 534040750B9E70B156A98F5D0E8F6D2A . 1051136 . . [5.1.2600.3541] . . c:\windows\system32\dllcache\kernel32.dll [-] 2009-03-21 . 98F08549604D090B6B2514AF845F329F . 1054720 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3GDR\kernel32.dll [-] 2009-03-21 . C3AF0EEE26B59484E674673E3016AAB7 . 1056768 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll [-] 2009-03-21 . 2087E2764822A8D93A4CA7FA0FED35E8 . 1054208 . . [5.1.2600.3541] . . c:\windows\$hf_mig$\KB959426\SP2QFE\kernel32.dll [-] 2008-04-14 . 3AC8886DFA5AB641417DF4D3B7F5512E . 1054720 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\kernel32.dll [-] 2007-04-16 . 62E3F0E9ABFCBCEE62C51546F622C455 . 1051136 . . [5.1.2600.3119] . . c:\windows\SoftwareDistribution\Download\4a30d9e5adbf7a3398756dd0ea6f4e72\SP2QFE\kernel32.dll [-] 2007-04-16 . 6F1FE2AE7B22EB9CED1BFF533C9455EA . 1049600 . . [5.1.2600.3119] . . c:\windows\SoftwareDistribution\Download\4a30d9e5adbf7a3398756dd0ea6f4e72\SP2GDR\kernel32.dll [-] 2004-08-19 . C88F74591579DBDE273C61312B2D3886 . 1048576 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB959426$\kernel32.dll [-] 2008-04-14 . 5C64008E661307C4A3C3C25D9086CDE7 . 19968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\linkinfo.dll [-] 2006-03-09 . 8D9A075C065DFE1228688D10155D6624 . 19968 . . [5.1.2600.2751] . . c:\windows\system32\linkinfo.dll [-] 2008-04-14 . 982B2C204337C3B12211E1E1D9BA8C9C . 22016 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\lpk.dll [-] 2004-08-19 . 3236A6A1650E6C055FD5E87D7C4A05AD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\lpk.dll [-] 2004-08-19 . 3236A6A1650E6C055FD5E87D7C4A05AD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lpk.dll [-] 2009-02-20 . D5F02ACCD671A99D15F59DA56B2EA3EC . 3088896 . . [6.00.2900.3527] . . c:\windows\system32\mshtml.dll [-] 2009-02-20 . D5F02ACCD671A99D15F59DA56B2EA3EC . 3088896 . . [6.00.2900.3527] . . c:\windows\system32\dllcache\mshtml.dll [-] 2009-02-20 . EB1C22D91F6363367656872ED813DAB5 . 3089408 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3GDR\mshtml.dll [-] 2009-02-20 . BAE9A8994957EF57BB429A7E5688EC80 . 3089408 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3QFE\mshtml.dll [-] 2008-08-20 . EB2B003122AA714FE93979CFA4EEAA55 . 3088384 . . [6.00.2900.3429] . . c:\windows\$NtUninstallKB963027$\mshtml.dll [-] 2008-08-20 . E1772442035064C97BA6B4D60BDA1BB9 . 3088896 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3GDR\mshtml.dll [-] 2008-08-20 . 4229C8960DE4DC5B6C326E2B65175E9F . 3088896 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3QFE\mshtml.dll [-] 2008-04-21 . FEACD6E84244125550219C6795348FDE . 3080704 . . [6.00.2900.3354] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp2gdr\mshtml.dll [-] 2008-04-21 . 57BC3BE475F34AE089878A016C2CA46E . 3087872 . . [6.00.2900.3354] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp2qfe\mshtml.dll [-] 2008-04-21 . 840E79E91BCCD80B2FC3CCAD2C60B35A . 3087872 . . [6.00.2900.5583] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3gdr\mshtml.dll [-] 2008-04-21 . B3CD09A5DBD2A569ADFA8654E3C8879D . 3088384 . . [6.00.2900.5583] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3qfe\mshtml.dll [-] 2008-04-14 . C4153F037157C7BE7C54FD88887F027D . 3066880 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\mshtml.dll [-] 2006-04-21 . 6DF21BA445B9491943853290B0AAC74F . 3077120 . . [6.00.2900.2883] . . c:\windows\$NtUninstallKB956390$\mshtml.dll [-] 2008-04-14 . 3891413139EAABFEFE9B0CA49B5CD395 . 343040 . . [7.0.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\msvcrt.dll [-] 2008-04-14 . D33CD21D476C3A07DD88F83850A17432 . 343040 . . [7.0.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\asms\70\msft\windows\mswincrt\msvcrt.dll [-] 2004-08-19 . B89F48FDFD6C3312B92D5D633C23F075 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\msvcrt.dll [-] 2004-08-19 . B89F48FDFD6C3312B92D5D633C23F075 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\dllcache\msvcrt.dll [-] 2008-06-20 . 58AF8498C62E1E1DAB5AE59C6E08C180 . 247808 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\mswsock.dll [-] 2008-06-20 . C759B3790D3BA760C52E218EF4886DAC . 247808 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll [-] 2008-06-20 . 8A52DE10680A40ECD04FA2C0FBC34190 . 247808 . . [5.1.2600.3394] . . c:\windows\system32\mswsock.dll [-] 2008-06-20 . 8A52DE10680A40ECD04FA2C0FBC34190 . 247808 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\mswsock.dll [-] 2008-06-20 . 4138FBDEDBC6FEAD215BB4C4B102F7DE . 247808 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\mswsock.dll [-] 2008-04-14 . 196CCC3FDD21665DCAA9F83FFC03B41A . 247808 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\mswsock.dll [-] 2004-08-19 . 6FA2DDF70DC9B762EBF8920F89B6BEA3 . 247808 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB951748$\mswsock.dll [-] 2008-04-14 . 04821179C3171554C1BD1F9888A113E2 . 407040 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\netlogon.dll [-] 2004-08-19 . D4CFAC76926C24E32B7F25A35C31BC6E . 407040 . . [5.1.2600.2180] . . c:\windows\system32\netlogon.dll [-] 2004-08-19 . D4CFAC76926C24E32B7F25A35C31BC6E . 407040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\netlogon.dll [-] 2009-02-10 . BEF458B8424553279E95E250D1E0CE7E . 2191232 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe [-] 2009-02-09 . 4183ED119200F8520F5E834498AFB927 . 2182528 . . [5.1.2600.3520] . . c:\windows\Driver Cache\i386\ntoskrnl.exe [-] 2009-02-09 . 4183ED119200F8520F5E834498AFB927 . 2182528 . . [5.1.2600.3520] . . c:\windows\system32\ntoskrnl.exe [-] 2009-02-09 . 4183ED119200F8520F5E834498AFB927 . 2182528 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\ntoskrnl.exe [-] 2009-02-09 . B55AA66BC9269BC5257B915FFDAA790B . 2188160 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\ntoskrnl.exe [-] 2009-02-09 . AB896577F35CF5FED7A9F87D3C3205ED . 2191104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntoskrnl.exe [-] 2008-08-14 . D79210549BBF09B7638E860440504299 . 2191232 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe [-] 2008-08-14 . 449566D74B5C261A3A54AA216F0C532B . 2182400 . . [5.1.2600.3427] . . c:\windows\$NtUninstallKB956572$\ntoskrnl.exe [-] 2008-08-14 . C6649255E51F145B6E15C505AB68E459 . 2188032 . . [5.1.2600.3427] . . c:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe [-] 2008-08-14 . C8D4D5974F9671DA0A37175650912960 . 2191232 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe [-] 2008-04-14 . 099D639DA1EF6968D4E41795BB507E6B . 2191104 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ntoskrnl.exe [-] 2007-02-28 . 8E244108562E0E452EB68DFF64CB08A9 . 2184192 . . [5.1.2600.3093] . . c:\windows\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\SP2QFE\ntoskrnl.exe [-] 2007-02-28 . 7D6D19AAC51A4325F6039F083C22303C . 2182400 . . [5.1.2600.3093] . . c:\windows\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\SP2GDR\ntoskrnl.exe [-] 2006-03-09 . 63729DD0F2AAE36CC52B89C05505146C . 2181376 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB956841$\ntoskrnl.exe [-] 2008-04-14 . 9F2C862E39BF8E8FC51C3F6A6BCEB415 . 17408 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\powrprof.dll [-] 2004-08-19 . 29D5E58FB089C41898A81BD4C8970F22 . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll [-] 2004-08-19 . 29D5E58FB089C41898A81BD4C8970F22 . 17408 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\powrprof.dll [-] 2008-04-14 . 973B36634C544948C663E8269AA1B3A3 . 187392 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\scecli.dll [-] 2004-08-19 . 58D439F6EF73A2D9288B204E819F4BBD . 186368 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll [-] 2004-08-19 . 58D439F6EF73A2D9288B204E819F4BBD . 186368 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\scecli.dll [-] 2008-04-14 . 9A4E7ECBB5B7FB86F3B926AB039F4FEC . 5120 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\sfc.dll [-] 2004-08-19 . BB695F18354B38CFF693E67EE7A30C22 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll [-] 2004-08-19 . BB695F18354B38CFF693E67EE7A30C22 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfc.dll [-] 2008-04-14 . E4BDF223CD75478BF44567B4D5C2634D . 14336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\svchost.exe [-] 2004-08-19 . 2979B03D5382A602623C0535B16AB9C0 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe [-] 2004-08-19 . 2979B03D5382A602623C0535B16AB9C0 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\svchost.exe [-] 2008-04-14 . 8E5231171AD6595FF002E848CC54FCD7 . 249856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\tapisrv.dll [-] 2006-03-09 . 720DA0C9DB8996AD9B7F5164B2242DAA . 249344 . . [5.1.2600.2716] . . c:\windows\system32\tapisrv.dll [-] 2006-03-09 . 720DA0C9DB8996AD9B7F5164B2242DAA . 249344 . . [5.1.2600.2716] . . c:\windows\system32\dllcache\tapisrv.dll [-] 2008-04-14 . E853F84D3CE2FAA2A802E33CF89AC023 . 579584 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\user32.dll [-] 2007-03-08 . 4D88AAF39ADABFE45958EA1384E2C4FF . 579072 . . [5.1.2600.3099] . . c:\windows\SoftwareDistribution\Download\807aa275a612b3508a3d1d613bbf6226\SP2QFE\user32.dll [-] 2007-03-08 . 753354F594809A9B96F73999B435A533 . 578560 . . [5.1.2600.3099] . . c:\windows\SoftwareDistribution\Download\807aa275a612b3508a3d1d613bbf6226\SP2GDR\user32.dll [-] 2006-03-09 . 0DF75FB73F705B011630159A43D7C354 . 578048 . . [5.1.2600.2622] . . c:\windows\system32\user32.dll [-] 2008-04-14 . E74DDB12188C2FF57A78624DBF7332FC . 26624 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\userinit.exe [-] 2004-08-19 . 84717891F0734C611721F56C60B5FBC3 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe [-] 2004-08-19 . 84717891F0734C611721F56C60B5FBC3 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\userinit.exe [-] 2009-02-20 . AD9AB4386AE234EA5C8EED51CD934C44 . 672256 . . [6.00.2900.3527] . . c:\windows\system32\wininet.dll [-] 2009-02-20 . AD9AB4386AE234EA5C8EED51CD934C44 . 672256 . . [6.00.2900.3527] . . c:\windows\system32\dllcache\wininet.dll [-] 2009-02-20 . 273B84C3C339341F917D7DDAD0722F51 . 670208 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3GDR\wininet.dll [-] 2009-02-20 . 8EAE861274F3E0C00C10C871371A1A8E . 671744 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3QFE\wininet.dll [-] 2008-08-20 . AEF39AC3BCBAFE971155D0073191B5A6 . 671744 . . [6.00.2900.3429] . . c:\windows\$NtUninstallKB963027$\wininet.dll [-] 2008-08-20 . 50D19E569C83A9C1AE7EFAEF6A93BC50 . 670208 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3GDR\wininet.dll [-] 2008-08-20 . 96D50ACA60DA22ADBD253F2825C98D1A . 670720 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3QFE\wininet.dll [-] 2008-04-21 . 355A69CC05045428CE6B9E6BFBD4B74B . 663552 . . [6.00.2900.3354] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp2gdr\wininet.dll [-] 2008-04-21 . F2F343D7ED0223645BA773B840EB4993 . 670720 . . [6.00.2900.3354] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp2qfe\wininet.dll [-] 2008-04-21 . 7AF7D7D178F2863E7E7C880B55C88B76 . 670208 . . [6.00.2900.5583] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3gdr\wininet.dll [-] 2008-04-21 . 82B3264706B9921C67B196319FDA51DE . 670720 . . [6.00.2900.5583] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3qfe\wininet.dll [-] 2008-04-14 . 4A6E04EA20F48D750D9BFED8600D516B . 670208 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\wininet.dll [-] 2006-04-12 . 241DBC4C2714B2F39AFDED49459ED420 . 667648 . . [6.00.2900.2861] . . c:\windows\$NtUninstallKB956390$\wininet.dll [-] 2008-04-14 . FB836F9E62D82904C983AD21296A5D9C . 82432 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ws2_32.dll [-] 2006-08-16 . 7279695B154A49550F675A985265B00A . 70656 . . [5.1.2600.1886] . . c:\windows\SoftwareDistribution\Download\b3d62539e3338b3e6aca7b80247f201f\SP1QFE\ws2_32.dll [-] 2006-05-19 . 93307E5F8389A7474511DC51165694E5 . 70656 . . [5.1.2600.1847] . . c:\windows\SoftwareDistribution\Download\be96031e349de0228a58a3a562a48caf\SP1QFE\ws2_32.dll [-] 2004-08-19 . EED74B969B2CA1ACC558FF60FB420E28 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll [-] 2004-08-19 . EED74B969B2CA1ACC558FF60FB420E28 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2_32.dll [-] 2008-04-14 . F2317622D29F9FF0F88AEECD5F60F0DD . 1037824 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\explorer.exe [-] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\SP2GDR\explorer.exe [-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\SP2QFE\explorer.exe [-] 2004-08-19 . 2A7BD330924252A2FD80344FC949BB72 . 1036288 . . [6.00.2900.2180] . . c:\windows\explorer.exe [-] 2004-08-19 . 2A7BD330924252A2FD80344FC949BB72 . 1036288 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\explorer.exe [-] 2008-04-14 . 6ED29124A1C83BD0CF6B26BD01CA6F6F . 171520 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\srsvc.dll [-] 2004-08-19 . CE978404558CE2D82896AC2032F06DBF . 171008 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll [-] 2004-08-19 . CE978404558CE2D82896AC2032F06DBF . 171008 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\srsvc.dll [-] 2008-04-14 . 02DA31AB433A6C1110A736C85701DECA . 13824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\wscntfy.exe [-] 2004-08-19 . 8558905BA81F6EFAAF9667139BB117DD . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe [-] 2004-08-19 . 8558905BA81F6EFAAF9667139BB117DD . 13824 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\wscntfy.exe [-] 2008-04-14 . F92A87FDDA0C11C8604FBC2B864FA726 . 129024 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\xmlprov.dll [-] 2004-08-19 . 912591E2055E26566D1CB54092A7E8B0 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll [-] 2004-08-19 . 912591E2055E26566D1CB54092A7E8B0 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\xmlprov.dll [-] 2008-04-14 . 4EC800BDF80521B0207BD2301DFC7D14 . 56320 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\eventlog.dll [-] 2004-08-19 . 49B1376885340BF9EA0D99F71557B59A . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll [-] 2004-08-19 . 49B1376885340BF9EA0D99F71557B59A . 55808 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\eventlog.dll [-] 2008-04-14 . E17C85D5B5CF477638433B851A98499E . 1571840 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\sfcfiles.dll [-] 2006-03-09 . E51172E3C82D76FCC02001D0FF41A1A1 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll [-] 2008-04-14 . 59DC5BB82E4C8E0B3EADCFDBC44BA6E4 . 15360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ctfmon.exe [-] 2004-08-19 . 64E41E8FEE655B03E3F19DED21BA5118 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe [-] 2004-08-19 . 64E41E8FEE655B03E3F19DED21BA5118 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ctfmon.exe [-] 2008-04-14 . B9F20D71E5B6CE89A7A94B38351FDBDC . 135680 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\shsvcs.dll [-] 2006-12-19 . D7DFBD1EFA149EC158363B974DAE0C6B . 135168 . . [6.00.2900.3051] . . c:\windows\SoftwareDistribution\Download\749a2072c695f57087c10474c2640179\SP2GDR\shsvcs.dll [-] 2006-12-19 . 1839CDF416A5AA8BF2EFE377F57452CC . 135680 . . [6.00.2900.3051] . . c:\windows\SoftwareDistribution\Download\749a2072c695f57087c10474c2640179\SP2QFE\shsvcs.dll [-] 2004-08-19 . ABA25E49F6589FD73F1143FDC39A6B46 . 135168 . . [6.00.2900.2180] . . c:\windows\system32\shsvcs.dll [-] 2004-08-19 . ABA25E49F6589FD73F1143FDC39A6B46 . 135168 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\shsvcs.dll [-] 2008-04-14 . E598D81197E2E0EC42A0C55772BB00E8 . 59904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\regsvc.dll [-] 2004-08-19 . B6F76CE10953A141545A0D01F1776885 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\regsvc.dll [-] 2004-08-19 . B6F76CE10953A141545A0D01F1776885 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regsvc.dll [-] 2008-04-14 . 55F5C5C1BE1A78E285033E432BA01597 . 194560 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\schedsvc.dll [-] 2004-08-19 . A65E74CC5831CED5762AA16033ED20EE . 193024 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll [-] 2004-08-19 . A65E74CC5831CED5762AA16033ED20EE . 193024 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\schedsvc.dll [-] 2008-04-14 . EA9E0DB8684CEF2FD3BADD671DF5A112 . 71680 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ssdpsrv.dll [-] 2004-08-19 . DCB185C829538971E47AFFE77BA138C3 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\ssdpsrv.dll [-] 2004-08-19 . DCB185C829538971E47AFFE77BA138C3 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ssdpsrv.dll [-] 2008-04-14 . 710BC85A8C22626EE094439E3EA0D38C . 297984 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\termsrv.dll [-] 2004-08-19 . 78F90C3E230AD122BCB116ABAD5FEFE9 . 297984 . . [5.1.2600.2180] . . c:\windows\system32\termsrv.dll [-] 2004-08-19 . 78F90C3E230AD122BCB116ABAD5FEFE9 . 297984 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\termsrv.dll [-] 2008-04-14 . F36C9F78FC902C8DCE4D3B576BB0435A . 176640 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\appmgmts.dll [-] 2004-08-19 . 7E9D138DC991BCCE6E6026CD74E69CC4 . 176640 . . [5.1.2600.2180] . . c:\windows\system32\appmgmts.dll [-] 2004-08-19 . 7E9D138DC991BCCE6E6026CD74E69CC4 . 176640 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\appmgmts.dll [-] 2001-08-24 . E4ABC1212B70BB03D35E60681C447210 . 12032 . . [5.1.2600.0] . . c:\windows\system32\dllcache\acpiec.sys [-] 2001-08-24 . E4ABC1212B70BB03D35E60681C447210 . 12032 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys [-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\aec.sys [-] 2005-05-27 21:14 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\dllcache\aec.sys [-] 2005-05-27 21:14 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\drivers\aec.sys [-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\agp440.sys [-] 2004-08-03 . 2C428FA0C3E3A01ED93C9B2A27D8D4BB . 42368 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0021\DriverFiles\i386\AGP440.SYS [-] 2004-08-03 . 2C428FA0C3E3A01ED93C9B2A27D8D4BB . 42368 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\agp440.sys [-] 2004-08-03 . 2C428FA0C3E3A01ED93C9B2A27D8D4BB . 42368 . . [5.1.2600.2180] . . c:\windows\system32\drivers\AGP440.SYS [-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ip6fw.sys [-] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ip6fw.sys [-] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ip6fw.sys [-] 2008-04-14 02:33 . CE21FE79AD3B913A79E0C742BED6BF85 . 927504 . . [4.1.0.61] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\mfc40u.dll [-] 2006-11-01 19:18 . FCD58951B3B2392007E0EE34D2CF944F . 927504 . . [4.1.0.61] . . c:\windows\SoftwareDistribution\Download\514c80746ae952e9ebadfb936253a166\SP2QFE\mfc40u.dll [-] 2001-08-24 12:00 . E1A34560BF6CE7C703BB67EC4FA70F43 . 924432 . . [4.1.6140] . . c:\windows\system32\mfc40u.dll [-] 2001-08-24 12:00 . E1A34560BF6CE7C703BB67EC4FA70F43 . 924432 . . [4.1.6140] . . c:\windows\system32\dllcache\mfc40u.dll [-] 2008-04-14 . E67A66A3781C1A483F0F8992664CBE0D . 33792 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\msgsvc.dll [-] 2004-08-19 . DE71362123E81D268088E78543752576 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\msgsvc.dll [-] 2004-08-19 . DE71362123E81D268088E78543752576 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\msgsvc.dll [-] 2006-03-09 11:48 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\system32\mspmsnsv.dll [-] 2006-03-09 11:48 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\system32\dllcache\mspmsnsv.dll [-] 2009-02-10 . F751E041E682F53EAF34F7FAEA78994D . 2068096 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntkrnlpa.exe [-] 2009-02-09 . 663D7167ED065786EC9DCFF2569A39F7 . 2059776 . . [5.1.2600.3520] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe [-] 2009-02-09 . 663D7167ED065786EC9DCFF2569A39F7 . 2059776 . . [5.1.2600.3520] . . c:\windows\system32\ntkrnlpa.exe [-] 2009-02-09 . 663D7167ED065786EC9DCFF2569A39F7 . 2059776 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\ntkrnlpa.exe [-] 2009-02-09 . 0150FE5C1E07F8AE422FEC6C8E8A0C98 . 2065024 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\ntkrnlpa.exe [-] 2009-02-09 . ED5E20AE4AC5A63A4FF43FFE704A5153 . 2068224 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe [-] 2008-08-14 . 755B50949D0DBC0F0136B0DB58765331 . 2068096 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe [-] 2008-08-14 . F9720D61DF1E3E47614C4FC891F3FE44 . 2059776 . . [5.1.2600.3427] . . c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe [-] 2008-08-14 . DCBC1A6D150B5EE1BD6257186157B0F3 . 2065024 . . [5.1.2600.3427] . . c:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe [-] 2008-08-14 . 8DA71F1900721E1E4FCB5B02D55FB771 . 2068096 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe [-] 2008-04-14 . B71A8F101CEFAF82FC5EC16130A54A3F . 2067968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ntkrnlpa.exe [-] 2007-02-28 . A1D5231403329478AE4FE2778C55C77F . 2059648 . . [5.1.2600.3093] . . c:\windows\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\SP2GDR\ntkrnlpa.exe [-] 2007-02-28 . 7A56A64EB50399613587E90292DD2AAB . 2061440 . . [5.1.2600.3093] . . c:\windows\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\SP2QFE\ntkrnlpa.exe [-] 2006-05-09 . 73FA9C95D235844A36968C7852C7DBDD . 2058880 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe [-] 2008-04-14 02:33 . 037D92B3A7853A183FCAB77FB1D13D6C . 438272 . . [5.1.2400.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ntmssvc.dll [-] 2004-08-19 15:09 . 951543FFB84012D13F4CB09DA2EACE96 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\ntmssvc.dll [-] 2004-08-19 15:09 . 951543FFB84012D13F4CB09DA2EACE96 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\dllcache\ntmssvc.dll [-] 2008-04-14 . BD8166A495B02308F364B36249475F22 . 186368 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\upnphost.dll [-] 2007-02-05 . 385DB2591BF11955F26E0A97728B1B31 . 185344 . . [5.1.2600.3077] . . c:\windows\SoftwareDistribution\Download\c14099cb3cd0d3c3eb07f3570fc9d034\SP2QFE\upnphost.dll [-] 2007-02-05 . 96B3C690ED82E36E04C130F916E3AE91 . 185344 . . [5.1.2600.3077] . . c:\windows\SoftwareDistribution\Download\c14099cb3cd0d3c3eb07f3570fc9d034\SP2GDR\upnphost.dll [-] 2004-08-19 . 0B6A726C2DE9BBB80A48459F0C318F44 . 185344 . . [5.1.2600.2180] . . c:\windows\system32\upnphost.dll [-] 2004-08-19 . 0B6A726C2DE9BBB80A48459F0C318F44 . 185344 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\upnphost.dll [-] 2008-04-14 . 4BB396EA6CAA50F2208078602549F2F2 . 367616 . . [5.3.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\dsound.dll [-] 2004-08-19 . 7FD6E3D4918514565DF553BE693E3034 . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dsound.dll [-] 2004-08-19 . 7FD6E3D4918514565DF553BE693E3034 . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dllcache\dsound.dll . ((((((((((((((((((((((((((((( SnapShot@2010-05-30_23.04.10 ))))))))))))))))))))))))))))))))))))))))) . + 2010-05-31 00:19 . 2010-05-31 00:19 16384 c:\windows\temp\Perflib_Perfdata_450.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-12-11 20992] "SoundMan"="SOUNDMAN.EXE" [2003-06-10 55296] "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-08-11 81920] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nlsf"="move" [X] "Config"="c:\windows\system32\run.cmd" [2006-02-14 248] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) "NoStrCmpLogical"= 0 (0x0) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "DisablePagingExecutive"=dword:00000001 "SecondLevelDataCache"=dword:00000200 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\Program\\BitTorrent\\bittorrent.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "d:\\Program\\Warcraft III\\Frozen Throne.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:sc port "6112:UDP"= 6112:UDP:sc port 2 "56971:TCP"= 56971:TCP:Pando Media Booster "56971:UDP"= 56971:UDP:Pando Media Booster "1034:TCP"= 1034:TCP:Akamai NetSession Interface "5000:UDP"= 5000:UDP:Akamai NetSession Interface S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-12-22 691696] S3 EL910;3Com 3CSOHO100B-TX PCI;c:\windows\system32\DRIVERS\EL910N51.sys [2002-05-29 38400] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uInternet Connection Wizard,ShellNext = hxxp://www.google.fr/ uInternet Settings,ProxyServer = http=127.0.0.1:5555 uInternet Settings,ProxyOverride = <local> uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s TCP: {0664E60F-49FA-4364-9A7E-BDB9548B9B6B} = 192.168.1.1 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-05-31 02:21 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x823711F8]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0xf8579fc3 \Driver\ACPI -> ACPI.sys @ 0xf83e0cb8 \Driver\atapi -> 0x823711f8 IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0094 ParseProcedure -> ntoskrnl.exe @ 0x8056f08e \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0094 ParseProcedure -> ntoskrnl.exe @ 0x8056f08e NDIS: 3Com 3C910 Integrated Fast Ethernet Controller (3CSOHO100B-TX C -> SendCompleteHandler -> NDIS.sys @ 0xf8281af9 PacketIndicateHandler -> NDIS.sys @ 0xf828cb21 SendHandler -> NDIS.sys @ 0xf8281938 Warning: possible MBR rootkit infection ! user & kernel MBR OK ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(616) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(1812) d:\program\MouseWare\System\LgWndHk.dll . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\Ati2evxx.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\Ati2evxx.exe c:\windows\SOUNDMAN.EXE d:\program\MouseWare\system\em_exec.exe d:\program\Warcraft III\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe c:\program files\OpenOffice.org 3\program\soffice.exe c:\program files\OpenOffice.org 3\program\soffice.bin . ************************************************************************** . Heure de fin: 2010-05-31 02:25:59 - La machine a redémarré ComboFix-quarantined-files.txt 2010-05-31 00:25 ComboFix2.txt 2010-05-30 23:09 Avant-CF: 3'630'186'496 octets libres Après-CF: 3'621'220'352 octets libres - - End Of File - - C45A40414E563903B7E8F77F7A998485
  15. Ogon
    merci je suis là encore un moment , tu reste co tard ce soir? ps: le son marche pas non plus...
  16. Ogon
    thanos je te remercie vraiment beaucoup beaucoup : ) voila le logfile ComboFix 10-04-30.01 - Dozr 31.05.2010 0:54.1.1 - x86 Lancé depuis: c:\documents and settings\Dozr.XPSP2-6FD77EF47\Bureau\Ogon.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\1073109.exe c:\windows\system32\1107125.exe c:\windows\system32\1113078.exe c:\windows\system32\22185750.exe c:\windows\system32\Iasex.dll c:\windows\system32\muzapp.exe c:\windows\system32\drivers\cdrom.sys . . . est infecté!! . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_6TO4 -------\Legacy_IAS -------\Legacy_NPF -------\Service_Ias ((((((((((((((((((((((((((((( Fichiers créés du 2010-04-28 au 2010-05-30 )))))))))))))))))))))))))))))))))))) . 2010-05-30 00:37 . 2010-05-30 00:37 -------- d-----w- c:\program files\Panda Security 2010-05-30 00:09 . 2010-05-30 00:09 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes 2010-05-30 00:09 . 2008-06-10 17:02 34296 ----a-w- c:\windows\system32\drivers\mbamcatchme.sys 2010-05-30 00:09 . 2008-06-10 17:02 15864 ----a-w- c:\windows\system32\drivers\mbam.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-05-30 22:41 . 2008-06-30 02:32 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy 2010-05-30 00:09 . 2010-04-29 22:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-04-28 22:22 . 2010-04-28 22:22 6868368 ----a-w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\ESTsoft\ALUpdate\ALZIP\newfile\TEMP\ALZip752.exe 2010-04-28 22:22 . 2010-04-28 22:22 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Estsoft 2010-04-28 22:21 . 2008-06-30 06:37 -------- d-----w- c:\program files\ESTsoft 2010-04-25 21:24 . 2008-07-10 20:01 168921 -c--a-w- c:\windows\War3Unin.dat 2010-04-23 18:51 . 2010-04-22 09:56 1 ----a-w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2010-04-22 09:56 . 2010-04-22 09:56 -------- d-----w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\OpenOffice.org 2010-04-22 09:50 . 2008-07-13 21:42 18304 -c--a-w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-04-21 18:09 . 2010-04-21 18:09 -------- d-----w- c:\program files\OpenOffice.org 3 2010-04-12 20:39 . 2010-04-12 20:39 -------- d-----w- c:\program files\Image-Line 2010-04-12 20:38 . 2010-04-12 20:38 -------- d-----w- c:\program files\Steinberg 2010-04-12 11:35 . 2008-07-03 19:26 -------- d-----w- c:\program files\Java 2010-04-12 11:34 . 2010-04-12 11:34 152576 ----a-w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\Sun\Java\jre1.6.0_17\lzma.dll 2010-04-12 11:32 . 2010-04-12 11:32 79488 ----a-w- c:\documents and settings\Dozr.XPSP2-6FD77EF47\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2010-03-28 13:24 . 2001-08-24 12:00 80800 ----a-w- c:\windows\system32\perfc00C.dat 2010-03-28 13:24 . 2001-08-24 12:00 500894 ----a-w- c:\windows\system32\perfh00C.dat 2003-03-21 11:37 . 2003-03-21 11:37 16056 -c--a-w- c:\program files\owcstp16.dll . ------- Sigcheck ------- [-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\atapi.sys [-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys [-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\atapi.sys [-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\drivers\atapi.sys [-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\asyncmac.sys [-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\asyncmac.sys [-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\drivers\asyncmac.sys [-] 2001-08-24 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys [-] 2001-08-24 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys [-] 2008-04-14 . 16813155807C6881F4BFBF6657424659 . 25216 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\kbdclass.sys [-] 2004-08-19 . E798705E8DC7FAB596EF6BFDF167E007 . 25216 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\kbdclass.sys [-] 2004-08-19 . E798705E8DC7FAB596EF6BFDF167E007 . 25216 . . [5.1.2600.2180] . . c:\windows\system32\drivers\kbdclass.sys [-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ndis.sys [-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys [-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys [-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ntfs.sys [-] 2007-02-09 . 05AB81909514BFD69CBB1F2C147CF6B9 . 574976 . . [5.1.2600.3081] . . c:\windows\SoftwareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\SP2QFE\ntfs.sys [-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . c:\windows\SoftwareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\SP2GDR\ntfs.sys [-] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ntfs.sys [-] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ntfs.sys [-] 2001-08-24 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys [-] 2001-08-24 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys [-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys [-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys [-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\tcpip.sys [-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\drivers\tcpip.sys [-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys [-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\tcpip.sys [-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\SP2GDR\tcpip.sys [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\SP2QFE\tcpip.sys [-] 2006-02-14 . 667192A11DB19F36624119C0DD4DE4F2 . 359808 . . [5.1.2600.2827] . . c:\windows\$NtUninstallKB951748$\tcpip.sys [-] 2008-04-14 . 06B54A7B1EF7CB16BFD0E208D343FA71 . 77824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\browser.dll [-] 2004-08-19 . 75AC49029966BFFEA09F96C1C194F684 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\browser.dll [-] 2004-08-19 . 75AC49029966BFFEA09F96C1C194F684 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\browser.dll [-] 2008-04-14 . 91E6024D6D4DCDECDB36C43ECF9BBECB . 13312 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\lsass.exe [-] 2004-08-19 . 259AF82A0932EEA4F316F92DB94707B6 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe [-] 2004-08-19 . 259AF82A0932EEA4F316F92DB94707B6 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lsass.exe [-] 2008-04-14 . BE0CB143FA427D93440DED18DB8C918B . 198144 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\netman.dll [-] 2006-03-09 . 0D55724D88488BBFC53BC2EA219240F3 . 197632 . . [5.1.2600.2743] . . c:\windows\system32\netman.dll [-] 2008-04-14 . BAA0B6E647C1AD593E9BAE5CC31BCFFB . 409088 . . [6.7.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\qmgr.dll [-] 2004-08-19 . 659F7B6C502051BFA37910614B225548 . 382464 . . [6.6.2600.2180] . . c:\windows\system32\qmgr.dll [-] 2004-08-19 . 659F7B6C502051BFA37910614B225548 . 382464 . . [6.6.2600.2180] . . c:\windows\system32\dllcache\qmgr.dll [-] 2009-02-09 . F83B964469D230F445613C44DF9FE25D . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll [-] 2009-02-09 . 0203B1AAD358F206CB0A3C1F93CCE17A . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\rpcss.dll [-] 2009-02-09 . 5620353B93DD08016674E4FEE280190B . 399360 . . [5.1.2600.3520] . . c:\windows\system32\rpcss.dll [-] 2009-02-09 . 5620353B93DD08016674E4FEE280190B . 399360 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\rpcss.dll [-] 2009-02-09 . BA1EF616F55210820F6462D033088497 . 401408 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\rpcss.dll [-] 2008-04-14 . 3D65EB82E1FA6DB15A33E024C9E03CAB . 399360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\rpcss.dll [-] 2006-03-09 . CB7D37602638369A516757E994CBB31D . 397824 . . [5.1.2600.2726] . . c:\windows\$NtUninstallKB956572$\rpcss.dll [-] 2009-02-09 . C3FB1D70CB88722267949694BA51759E . 111104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\services.exe [-] 2009-02-09 . 62789101F9C2401ED598AA2CDE7450C0 . 111104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe [-] 2009-02-09 . 9D6BF82FE50D55F20F8E10E0F6653886 . 111104 . . [5.1.2600.3520] . . c:\windows\system32\services.exe [-] 2009-02-09 . 9D6BF82FE50D55F20F8E10E0F6653886 . 111104 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\services.exe [-] 2009-02-09 . 51A24094F076961A7FF73E5F7E991D68 . 111104 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\services.exe [-] 2008-04-14 . 54CB50058851D95E56EC70D09F70857F . 109056 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\services.exe [-] 2004-08-19 . 63DCDE1A0D86EEB8924D6738FF616EAD . 108544 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB956572$\services.exe [-] 2008-04-14 . 460E4CE148BD07218DA0B6A3D31885A9 . 57856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\spoolsv.exe [-] 2006-03-09 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe [-] 2008-04-14 . DD73D6B9F6B4CB630CF35B438B540174 . 512000 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\winlogon.exe [-] 2004-08-19 . 123EEA158F74D0F67A51DCDF065D1091 . 506368 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [-] 2004-08-19 . 123EEA158F74D0F67A51DCDF065D1091 . 506368 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe [-] 2008-04-14 . B4AA331468315B6A174C3F0D5B3BC135 . 617472 . . [5.82] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\comctl32.dll [-] 2008-04-14 . F92E6BEA9349D49341383F8403B4DFE5 . 1054208 . . [6.0] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\asms\60\msft\windows\common\controls\comctl32.dll [-] 2006-08-25 . E6F5355AFDEA32240B61EEA930D8A749 . 561664 . . [5.82] . . c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\SP1QFE\comctl32.dll [-] 2006-08-25 . 9724ECD4529AF317DD5BD6194EB6428C . 925184 . . [6.0] . . c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\SP1QFE\asms\60\msft\windows\common\controls\comctl32.dll [-] 2006-08-25 . 5BBCD65CFD7610F36BCA96B72BBAED4B . 617472 . . [5.82] . . c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\SP2QFE\comctl32.dll [-] 2006-08-25 . 47ABF878B9AEC81B23BA5F89DE597B3A . 1054208 . . [6.0] . . c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\SP2QFE\asms\60\msft\windows\common\controls\comctl32.dll [-] 2004-08-19 . 7D3AA1F0E765054CB5F30114F2DB6888 . 611328 . . [5.82] . . c:\windows\system32\comctl32.dll [-] 2004-08-19 . 7D3AA1F0E765054CB5F30114F2DB6888 . 611328 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll [-] 2008-04-14 . 7A6D0B71035E123FDDA2156A25578AD3 . 62464 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\cryptsvc.dll [-] 2004-08-19 . CD73133EB24C572019944001FAD1B8D9 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\cryptsvc.dll [-] 2004-08-19 . CD73133EB24C572019944001FAD1B8D9 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\cryptsvc.dll [-] 2008-07-07 20:31 . A5B1B7C76134329AA7547F6E6DA35410 . 253952 . . [2001.12.4414.320] . . c:\windows\system32\es.dll [-] 2008-07-07 20:31 . A5B1B7C76134329AA7547F6E6DA35410 . 253952 . . [2001.12.4414.320] . . c:\windows\system32\dllcache\es.dll [-] 2008-07-07 20:28 . EC16AE9B37EACF871629227A3F3913FD . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3GDR\es.dll [-] 2008-07-07 20:24 . 157F9C595FD0D10502497DC4C1348D17 . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll [-] 2008-07-07 20:18 . 74ECF4DDC685BD3249CAB323405FCC49 . 253952 . . [2001.12.4414.320] . . c:\windows\$hf_mig$\KB950974\SP2QFE\es.dll [-] 2008-04-14 02:33 . 9FD4A0615BF3E9388A46EDF8774C7294 . 246272 . . [2001.12.4414.701] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\es.dll [-] 2006-03-09 08:24 . D9CDB9380E0EFC9E97CC589B5F484B94 . 243200 . . [2001.12.4414.308] . . c:\windows\$NtUninstallKB950974$\es.dll [-] 2008-04-14 . 0469B73DB32E5520F342C5E163AA3CCA . 110080 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\imm32.dll [-] 2004-08-19 . E55DAFA1A354BD5CB69151563DC9748A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll [-] 2004-08-19 . E55DAFA1A354BD5CB69151563DC9748A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\imm32.dll [-] 2009-03-21 . 534040750B9E70B156A98F5D0E8F6D2A . 1051136 . . [5.1.2600.3541] . . c:\windows\system32\kernel32.dll [-] 2009-03-21 . 534040750B9E70B156A98F5D0E8F6D2A . 1051136 . . [5.1.2600.3541] . . c:\windows\system32\dllcache\kernel32.dll [-] 2009-03-21 . 98F08549604D090B6B2514AF845F329F . 1054720 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3GDR\kernel32.dll [-] 2009-03-21 . C3AF0EEE26B59484E674673E3016AAB7 . 1056768 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll [-] 2009-03-21 . 2087E2764822A8D93A4CA7FA0FED35E8 . 1054208 . . [5.1.2600.3541] . . c:\windows\$hf_mig$\KB959426\SP2QFE\kernel32.dll [-] 2008-04-14 . 3AC8886DFA5AB641417DF4D3B7F5512E . 1054720 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\kernel32.dll [-] 2007-04-16 . 62E3F0E9ABFCBCEE62C51546F622C455 . 1051136 . . [5.1.2600.3119] . . c:\windows\SoftwareDistribution\Download\4a30d9e5adbf7a3398756dd0ea6f4e72\SP2QFE\kernel32.dll [-] 2007-04-16 . 6F1FE2AE7B22EB9CED1BFF533C9455EA . 1049600 . . [5.1.2600.3119] . . c:\windows\SoftwareDistribution\Download\4a30d9e5adbf7a3398756dd0ea6f4e72\SP2GDR\kernel32.dll [-] 2004-08-19 . C88F74591579DBDE273C61312B2D3886 . 1048576 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB959426$\kernel32.dll [-] 2008-04-14 . 5C64008E661307C4A3C3C25D9086CDE7 . 19968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\linkinfo.dll [-] 2006-03-09 . 8D9A075C065DFE1228688D10155D6624 . 19968 . . [5.1.2600.2751] . . c:\windows\system32\linkinfo.dll [-] 2008-04-14 . 982B2C204337C3B12211E1E1D9BA8C9C . 22016 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\lpk.dll [-] 2004-08-19 . 3236A6A1650E6C055FD5E87D7C4A05AD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\lpk.dll [-] 2004-08-19 . 3236A6A1650E6C055FD5E87D7C4A05AD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lpk.dll [-] 2009-02-20 . D5F02ACCD671A99D15F59DA56B2EA3EC . 3088896 . . [6.00.2900.3527] . . c:\windows\system32\mshtml.dll [-] 2009-02-20 . D5F02ACCD671A99D15F59DA56B2EA3EC . 3088896 . . [6.00.2900.3527] . . c:\windows\system32\dllcache\mshtml.dll [-] 2009-02-20 . EB1C22D91F6363367656872ED813DAB5 . 3089408 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3GDR\mshtml.dll [-] 2009-02-20 . BAE9A8994957EF57BB429A7E5688EC80 . 3089408 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3QFE\mshtml.dll [-] 2008-08-20 . EB2B003122AA714FE93979CFA4EEAA55 . 3088384 . . [6.00.2900.3429] . . c:\windows\$NtUninstallKB963027$\mshtml.dll [-] 2008-08-20 . E1772442035064C97BA6B4D60BDA1BB9 . 3088896 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3GDR\mshtml.dll [-] 2008-08-20 . 4229C8960DE4DC5B6C326E2B65175E9F . 3088896 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3QFE\mshtml.dll [-] 2008-04-21 . FEACD6E84244125550219C6795348FDE . 3080704 . . [6.00.2900.3354] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp2gdr\mshtml.dll [-] 2008-04-21 . 57BC3BE475F34AE089878A016C2CA46E . 3087872 . . [6.00.2900.3354] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp2qfe\mshtml.dll [-] 2008-04-21 . 840E79E91BCCD80B2FC3CCAD2C60B35A . 3087872 . . [6.00.2900.5583] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3gdr\mshtml.dll [-] 2008-04-21 . B3CD09A5DBD2A569ADFA8654E3C8879D . 3088384 . . [6.00.2900.5583] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3qfe\mshtml.dll [-] 2008-04-14 . C4153F037157C7BE7C54FD88887F027D . 3066880 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\mshtml.dll [-] 2006-04-21 . 6DF21BA445B9491943853290B0AAC74F . 3077120 . . [6.00.2900.2883] . . c:\windows\$NtUninstallKB956390$\mshtml.dll [-] 2008-04-14 . 3891413139EAABFEFE9B0CA49B5CD395 . 343040 . . [7.0.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\msvcrt.dll [-] 2008-04-14 . D33CD21D476C3A07DD88F83850A17432 . 343040 . . [7.0.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\asms\70\msft\windows\mswincrt\msvcrt.dll [-] 2004-08-19 . B89F48FDFD6C3312B92D5D633C23F075 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\msvcrt.dll [-] 2004-08-19 . B89F48FDFD6C3312B92D5D633C23F075 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\dllcache\msvcrt.dll [-] 2008-06-20 . 58AF8498C62E1E1DAB5AE59C6E08C180 . 247808 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\mswsock.dll [-] 2008-06-20 . C759B3790D3BA760C52E218EF4886DAC . 247808 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll [-] 2008-06-20 . 8A52DE10680A40ECD04FA2C0FBC34190 . 247808 . . [5.1.2600.3394] . . c:\windows\system32\mswsock.dll [-] 2008-06-20 . 8A52DE10680A40ECD04FA2C0FBC34190 . 247808 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\mswsock.dll [-] 2008-06-20 . 4138FBDEDBC6FEAD215BB4C4B102F7DE . 247808 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\mswsock.dll [-] 2008-04-14 . 196CCC3FDD21665DCAA9F83FFC03B41A . 247808 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\mswsock.dll [-] 2004-08-19 . 6FA2DDF70DC9B762EBF8920F89B6BEA3 . 247808 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB951748$\mswsock.dll [-] 2008-04-14 . 04821179C3171554C1BD1F9888A113E2 . 407040 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\netlogon.dll [-] 2004-08-19 . D4CFAC76926C24E32B7F25A35C31BC6E . 407040 . . [5.1.2600.2180] . . c:\windows\system32\netlogon.dll [-] 2004-08-19 . D4CFAC76926C24E32B7F25A35C31BC6E . 407040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\netlogon.dll [-] 2009-02-10 . BEF458B8424553279E95E250D1E0CE7E . 2191232 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe [-] 2009-02-09 . 4183ED119200F8520F5E834498AFB927 . 2182528 . . [5.1.2600.3520] . . c:\windows\Driver Cache\i386\ntoskrnl.exe [-] 2009-02-09 . 4183ED119200F8520F5E834498AFB927 . 2182528 . . [5.1.2600.3520] . . c:\windows\system32\ntoskrnl.exe [-] 2009-02-09 . 4183ED119200F8520F5E834498AFB927 . 2182528 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\ntoskrnl.exe [-] 2009-02-09 . B55AA66BC9269BC5257B915FFDAA790B . 2188160 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\ntoskrnl.exe [-] 2009-02-09 . AB896577F35CF5FED7A9F87D3C3205ED . 2191104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntoskrnl.exe [-] 2008-08-14 . D79210549BBF09B7638E860440504299 . 2191232 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe [-] 2008-08-14 . 449566D74B5C261A3A54AA216F0C532B . 2182400 . . [5.1.2600.3427] . . c:\windows\$NtUninstallKB956572$\ntoskrnl.exe [-] 2008-08-14 . C6649255E51F145B6E15C505AB68E459 . 2188032 . . [5.1.2600.3427] . . c:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe [-] 2008-08-14 . C8D4D5974F9671DA0A37175650912960 . 2191232 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe [-] 2008-04-14 . 099D639DA1EF6968D4E41795BB507E6B . 2191104 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ntoskrnl.exe [-] 2007-02-28 . 8E244108562E0E452EB68DFF64CB08A9 . 2184192 . . [5.1.2600.3093] . . c:\windows\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\SP2QFE\ntoskrnl.exe [-] 2007-02-28 . 7D6D19AAC51A4325F6039F083C22303C . 2182400 . . [5.1.2600.3093] . . c:\windows\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\SP2GDR\ntoskrnl.exe [-] 2006-03-09 . 63729DD0F2AAE36CC52B89C05505146C . 2181376 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB956841$\ntoskrnl.exe [-] 2008-04-14 . 9F2C862E39BF8E8FC51C3F6A6BCEB415 . 17408 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\powrprof.dll [-] 2004-08-19 . 29D5E58FB089C41898A81BD4C8970F22 . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll [-] 2004-08-19 . 29D5E58FB089C41898A81BD4C8970F22 . 17408 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\powrprof.dll [-] 2008-04-14 . 973B36634C544948C663E8269AA1B3A3 . 187392 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\scecli.dll [-] 2004-08-19 . 58D439F6EF73A2D9288B204E819F4BBD . 186368 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll [-] 2004-08-19 . 58D439F6EF73A2D9288B204E819F4BBD . 186368 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\scecli.dll [-] 2008-04-14 . 9A4E7ECBB5B7FB86F3B926AB039F4FEC . 5120 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\sfc.dll [-] 2004-08-19 . BB695F18354B38CFF693E67EE7A30C22 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll [-] 2004-08-19 . BB695F18354B38CFF693E67EE7A30C22 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfc.dll [-] 2008-04-14 . E4BDF223CD75478BF44567B4D5C2634D . 14336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\svchost.exe [-] 2004-08-19 . 2979B03D5382A602623C0535B16AB9C0 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe [-] 2004-08-19 . 2979B03D5382A602623C0535B16AB9C0 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\svchost.exe [-] 2008-04-14 . 8E5231171AD6595FF002E848CC54FCD7 . 249856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\tapisrv.dll [-] 2006-03-09 . 720DA0C9DB8996AD9B7F5164B2242DAA . 249344 . . [5.1.2600.2716] . . c:\windows\system32\tapisrv.dll [-] 2006-03-09 . 720DA0C9DB8996AD9B7F5164B2242DAA . 249344 . . [5.1.2600.2716] . . c:\windows\system32\dllcache\tapisrv.dll [-] 2008-04-14 . E853F84D3CE2FAA2A802E33CF89AC023 . 579584 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\user32.dll [-] 2007-03-08 . 4D88AAF39ADABFE45958EA1384E2C4FF . 579072 . . [5.1.2600.3099] . . c:\windows\SoftwareDistribution\Download\807aa275a612b3508a3d1d613bbf6226\SP2QFE\user32.dll [-] 2007-03-08 . 753354F594809A9B96F73999B435A533 . 578560 . . [5.1.2600.3099] . . c:\windows\SoftwareDistribution\Download\807aa275a612b3508a3d1d613bbf6226\SP2GDR\user32.dll [-] 2006-03-09 . 0DF75FB73F705B011630159A43D7C354 . 578048 . . [5.1.2600.2622] . . c:\windows\system32\user32.dll [-] 2008-04-14 . E74DDB12188C2FF57A78624DBF7332FC . 26624 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\userinit.exe [-] 2004-08-19 . 84717891F0734C611721F56C60B5FBC3 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe [-] 2004-08-19 . 84717891F0734C611721F56C60B5FBC3 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\userinit.exe [-] 2009-02-20 . AD9AB4386AE234EA5C8EED51CD934C44 . 672256 . . [6.00.2900.3527] . . c:\windows\system32\wininet.dll [-] 2009-02-20 . AD9AB4386AE234EA5C8EED51CD934C44 . 672256 . . [6.00.2900.3527] . . c:\windows\system32\dllcache\wininet.dll [-] 2009-02-20 . 273B84C3C339341F917D7DDAD0722F51 . 670208 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3GDR\wininet.dll [-] 2009-02-20 . 8EAE861274F3E0C00C10C871371A1A8E . 671744 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3QFE\wininet.dll [-] 2008-08-20 . AEF39AC3BCBAFE971155D0073191B5A6 . 671744 . . [6.00.2900.3429] . . c:\windows\$NtUninstallKB963027$\wininet.dll [-] 2008-08-20 . 50D19E569C83A9C1AE7EFAEF6A93BC50 . 670208 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3GDR\wininet.dll [-] 2008-08-20 . 96D50ACA60DA22ADBD253F2825C98D1A . 670720 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3QFE\wininet.dll [-] 2008-04-21 . 355A69CC05045428CE6B9E6BFBD4B74B . 663552 . . [6.00.2900.3354] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp2gdr\wininet.dll [-] 2008-04-21 . F2F343D7ED0223645BA773B840EB4993 . 670720 . . [6.00.2900.3354] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp2qfe\wininet.dll [-] 2008-04-21 . 7AF7D7D178F2863E7E7C880B55C88B76 . 670208 . . [6.00.2900.5583] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3gdr\wininet.dll [-] 2008-04-21 . 82B3264706B9921C67B196319FDA51DE . 670720 . . [6.00.2900.5583] . . c:\windows\SoftwareDistribution\Download\f13b1130c899601342787d172211ab01\sp3qfe\wininet.dll [-] 2008-04-14 . 4A6E04EA20F48D750D9BFED8600D516B . 670208 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\wininet.dll [-] 2006-04-12 . 241DBC4C2714B2F39AFDED49459ED420 . 667648 . . [6.00.2900.2861] . . c:\windows\$NtUninstallKB956390$\wininet.dll [-] 2008-04-14 . FB836F9E62D82904C983AD21296A5D9C . 82432 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ws2_32.dll [-] 2006-08-16 . 7279695B154A49550F675A985265B00A . 70656 . . [5.1.2600.1886] . . c:\windows\SoftwareDistribution\Download\b3d62539e3338b3e6aca7b80247f201f\SP1QFE\ws2_32.dll [-] 2006-05-19 . 93307E5F8389A7474511DC51165694E5 . 70656 . . [5.1.2600.1847] . . c:\windows\SoftwareDistribution\Download\be96031e349de0228a58a3a562a48caf\SP1QFE\ws2_32.dll [-] 2004-08-19 . EED74B969B2CA1ACC558FF60FB420E28 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll [-] 2004-08-19 . EED74B969B2CA1ACC558FF60FB420E28 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2_32.dll [-] 2008-04-14 . F2317622D29F9FF0F88AEECD5F60F0DD . 1037824 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\explorer.exe [-] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\SP2GDR\explorer.exe [-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\aa7b28efbf5e224a2f6b995008501967\SP2QFE\explorer.exe [-] 2004-08-19 . 2A7BD330924252A2FD80344FC949BB72 . 1036288 . . [6.00.2900.2180] . . c:\windows\explorer.exe [-] 2004-08-19 . 2A7BD330924252A2FD80344FC949BB72 . 1036288 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\explorer.exe [-] 2008-04-14 . 6ED29124A1C83BD0CF6B26BD01CA6F6F . 171520 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\srsvc.dll [-] 2004-08-19 . CE978404558CE2D82896AC2032F06DBF . 171008 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll [-] 2004-08-19 . CE978404558CE2D82896AC2032F06DBF . 171008 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\srsvc.dll [-] 2008-04-14 . 02DA31AB433A6C1110A736C85701DECA . 13824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\wscntfy.exe [-] 2004-08-19 . 8558905BA81F6EFAAF9667139BB117DD . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe [-] 2004-08-19 . 8558905BA81F6EFAAF9667139BB117DD . 13824 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\wscntfy.exe [-] 2008-04-14 . F92A87FDDA0C11C8604FBC2B864FA726 . 129024 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\xmlprov.dll [-] 2004-08-19 . 912591E2055E26566D1CB54092A7E8B0 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll [-] 2004-08-19 . 912591E2055E26566D1CB54092A7E8B0 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\xmlprov.dll [-] 2008-04-14 . 4EC800BDF80521B0207BD2301DFC7D14 . 56320 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\eventlog.dll [-] 2004-08-19 . 49B1376885340BF9EA0D99F71557B59A . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll [-] 2004-08-19 . 49B1376885340BF9EA0D99F71557B59A . 55808 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\eventlog.dll [-] 2008-04-14 . E17C85D5B5CF477638433B851A98499E . 1571840 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\sfcfiles.dll [-] 2006-03-09 . E51172E3C82D76FCC02001D0FF41A1A1 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll [-] 2008-04-14 . 59DC5BB82E4C8E0B3EADCFDBC44BA6E4 . 15360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ctfmon.exe [-] 2004-08-19 . 64E41E8FEE655B03E3F19DED21BA5118 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe [-] 2004-08-19 . 64E41E8FEE655B03E3F19DED21BA5118 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ctfmon.exe [-] 2008-04-14 . B9F20D71E5B6CE89A7A94B38351FDBDC . 135680 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\shsvcs.dll [-] 2006-12-19 . D7DFBD1EFA149EC158363B974DAE0C6B . 135168 . . [6.00.2900.3051] . . c:\windows\SoftwareDistribution\Download\749a2072c695f57087c10474c2640179\SP2GDR\shsvcs.dll [-] 2006-12-19 . 1839CDF416A5AA8BF2EFE377F57452CC . 135680 . . [6.00.2900.3051] . . c:\windows\SoftwareDistribution\Download\749a2072c695f57087c10474c2640179\SP2QFE\shsvcs.dll [-] 2004-08-19 . ABA25E49F6589FD73F1143FDC39A6B46 . 135168 . . [6.00.2900.2180] . . c:\windows\system32\shsvcs.dll [-] 2004-08-19 . ABA25E49F6589FD73F1143FDC39A6B46 . 135168 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\shsvcs.dll [-] 2008-04-14 . E598D81197E2E0EC42A0C55772BB00E8 . 59904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\regsvc.dll [-] 2004-08-19 . B6F76CE10953A141545A0D01F1776885 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\regsvc.dll [-] 2004-08-19 . B6F76CE10953A141545A0D01F1776885 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regsvc.dll [-] 2008-04-14 . 55F5C5C1BE1A78E285033E432BA01597 . 194560 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\schedsvc.dll [-] 2004-08-19 . A65E74CC5831CED5762AA16033ED20EE . 193024 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll [-] 2004-08-19 . A65E74CC5831CED5762AA16033ED20EE . 193024 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\schedsvc.dll [-] 2008-04-14 . EA9E0DB8684CEF2FD3BADD671DF5A112 . 71680 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ssdpsrv.dll [-] 2004-08-19 . DCB185C829538971E47AFFE77BA138C3 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\ssdpsrv.dll [-] 2004-08-19 . DCB185C829538971E47AFFE77BA138C3 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ssdpsrv.dll [-] 2008-04-14 . 710BC85A8C22626EE094439E3EA0D38C . 297984 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\termsrv.dll [-] 2004-08-19 . 78F90C3E230AD122BCB116ABAD5FEFE9 . 297984 . . [5.1.2600.2180] . . c:\windows\system32\termsrv.dll [-] 2004-08-19 . 78F90C3E230AD122BCB116ABAD5FEFE9 . 297984 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\termsrv.dll [-] 2008-04-14 . F36C9F78FC902C8DCE4D3B576BB0435A . 176640 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\appmgmts.dll [-] 2004-08-19 . 7E9D138DC991BCCE6E6026CD74E69CC4 . 176640 . . [5.1.2600.2180] . . c:\windows\system32\appmgmts.dll [-] 2004-08-19 . 7E9D138DC991BCCE6E6026CD74E69CC4 . 176640 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\appmgmts.dll [-] 2001-08-24 . E4ABC1212B70BB03D35E60681C447210 . 12032 . . [5.1.2600.0] . . c:\windows\system32\dllcache\acpiec.sys [-] 2001-08-24 . E4ABC1212B70BB03D35E60681C447210 . 12032 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys [-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\aec.sys [-] 2005-05-27 21:14 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\dllcache\aec.sys [-] 2005-05-27 21:14 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\drivers\aec.sys [-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\agp440.sys [-] 2004-08-03 . 2C428FA0C3E3A01ED93C9B2A27D8D4BB . 42368 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0021\DriverFiles\i386\AGP440.SYS [-] 2004-08-03 . 2C428FA0C3E3A01ED93C9B2A27D8D4BB . 42368 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\agp440.sys [-] 2004-08-03 . 2C428FA0C3E3A01ED93C9B2A27D8D4BB . 42368 . . [5.1.2600.2180] . . c:\windows\system32\drivers\AGP440.SYS [-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ip6fw.sys [-] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ip6fw.sys [-] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ip6fw.sys [-] 2008-04-14 02:33 . CE21FE79AD3B913A79E0C742BED6BF85 . 927504 . . [4.1.0.61] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\mfc40u.dll [-] 2006-11-01 19:18 . FCD58951B3B2392007E0EE34D2CF944F . 927504 . . [4.1.0.61] . . c:\windows\SoftwareDistribution\Download\514c80746ae952e9ebadfb936253a166\SP2QFE\mfc40u.dll [-] 2001-08-24 12:00 . E1A34560BF6CE7C703BB67EC4FA70F43 . 924432 . . [4.1.6140] . . c:\windows\system32\mfc40u.dll [-] 2001-08-24 12:00 . E1A34560BF6CE7C703BB67EC4FA70F43 . 924432 . . [4.1.6140] . . c:\windows\system32\dllcache\mfc40u.dll [-] 2008-04-14 . E67A66A3781C1A483F0F8992664CBE0D . 33792 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\msgsvc.dll [-] 2004-08-19 . DE71362123E81D268088E78543752576 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\msgsvc.dll [-] 2004-08-19 . DE71362123E81D268088E78543752576 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\msgsvc.dll [-] 2006-03-09 11:48 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\system32\mspmsnsv.dll [-] 2006-03-09 11:48 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\system32\dllcache\mspmsnsv.dll [-] 2009-02-10 . F751E041E682F53EAF34F7FAEA78994D . 2068096 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntkrnlpa.exe [-] 2009-02-09 . 663D7167ED065786EC9DCFF2569A39F7 . 2059776 . . [5.1.2600.3520] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe [-] 2009-02-09 . 663D7167ED065786EC9DCFF2569A39F7 . 2059776 . . [5.1.2600.3520] . . c:\windows\system32\ntkrnlpa.exe [-] 2009-02-09 . 663D7167ED065786EC9DCFF2569A39F7 . 2059776 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\ntkrnlpa.exe [-] 2009-02-09 . 0150FE5C1E07F8AE422FEC6C8E8A0C98 . 2065024 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\ntkrnlpa.exe [-] 2009-02-09 . ED5E20AE4AC5A63A4FF43FFE704A5153 . 2068224 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe [-] 2008-08-14 . 755B50949D0DBC0F0136B0DB58765331 . 2068096 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe [-] 2008-08-14 . F9720D61DF1E3E47614C4FC891F3FE44 . 2059776 . . [5.1.2600.3427] . . c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe [-] 2008-08-14 . DCBC1A6D150B5EE1BD6257186157B0F3 . 2065024 . . [5.1.2600.3427] . . c:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe [-] 2008-08-14 . 8DA71F1900721E1E4FCB5B02D55FB771 . 2068096 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe [-] 2008-04-14 . B71A8F101CEFAF82FC5EC16130A54A3F . 2067968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ntkrnlpa.exe [-] 2007-02-28 . A1D5231403329478AE4FE2778C55C77F . 2059648 . . [5.1.2600.3093] . . c:\windows\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\SP2GDR\ntkrnlpa.exe [-] 2007-02-28 . 7A56A64EB50399613587E90292DD2AAB . 2061440 . . [5.1.2600.3093] . . c:\windows\SoftwareDistribution\Download\47cec0c462f6cbdcf7ca5941c1ec0b4a\SP2QFE\ntkrnlpa.exe [-] 2006-05-09 . 73FA9C95D235844A36968C7852C7DBDD . 2058880 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe [-] 2008-04-14 02:33 . 037D92B3A7853A183FCAB77FB1D13D6C . 438272 . . [5.1.2400.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\ntmssvc.dll [-] 2004-08-19 15:09 . 951543FFB84012D13F4CB09DA2EACE96 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\ntmssvc.dll [-] 2004-08-19 15:09 . 951543FFB84012D13F4CB09DA2EACE96 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\dllcache\ntmssvc.dll [-] 2008-04-14 . BD8166A495B02308F364B36249475F22 . 186368 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\upnphost.dll [-] 2007-02-05 . 385DB2591BF11955F26E0A97728B1B31 . 185344 . . [5.1.2600.3077] . . c:\windows\SoftwareDistribution\Download\c14099cb3cd0d3c3eb07f3570fc9d034\SP2QFE\upnphost.dll [-] 2007-02-05 . 96B3C690ED82E36E04C130F916E3AE91 . 185344 . . [5.1.2600.3077] . . c:\windows\SoftwareDistribution\Download\c14099cb3cd0d3c3eb07f3570fc9d034\SP2GDR\upnphost.dll [-] 2004-08-19 . 0B6A726C2DE9BBB80A48459F0C318F44 . 185344 . . [5.1.2600.2180] . . c:\windows\system32\upnphost.dll [-] 2004-08-19 . 0B6A726C2DE9BBB80A48459F0C318F44 . 185344 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\upnphost.dll [-] 2008-04-14 . 4BB396EA6CAA50F2208078602549F2F2 . 367616 . . [5.3.2600.5512] . . c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\dsound.dll [-] 2004-08-19 . 7FD6E3D4918514565DF553BE693E3034 . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dsound.dll [-] 2004-08-19 . 7FD6E3D4918514565DF553BE693E3034 . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dllcache\dsound.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-12-11 20992] "SoundMan"="SOUNDMAN.EXE" [2003-06-10 55296] "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-08-11 81920] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nlsf"="move" [X] "Config"="c:\windows\system32\run.cmd" [2006-02-14 248] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) "NoStrCmpLogical"= 0 (0x0) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "DisablePagingExecutive"=dword:00000001 "SecondLevelDataCache"=dword:00000200 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\Program\\BitTorrent\\bittorrent.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "d:\\Program\\Warcraft III\\Frozen Throne.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:sc port "6112:UDP"= 6112:UDP:sc port 2 "56971:TCP"= 56971:TCP:Pando Media Booster "56971:UDP"= 56971:UDP:Pando Media Booster "1034:TCP"= 1034:TCP:Akamai NetSession Interface "5000:UDP"= 5000:UDP:Akamai NetSession Interface R2 AntiVirUpgradeService;Avira Upgrade Service;c:\windows\TEMP\AVSETUP_49f43897\basic\avupgsvc.exe [x] R3 GarenaPEngine;GarenaPEngine;c:\docume~1\DOZR~1.XPS\LOCALS~1\Temp\AIL22.tmp [x] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-02-24 3432444] R3 XDva143;XDva143;c:\windows\system32\XDva143.sys [x] R3 XDva332;XDva332;c:\windows\system32\XDva332.sys [x] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-12-22 691696] S3 EL910;3Com 3CSOHO100B-TX PCI;c:\windows\system32\DRIVERS\EL910N51.sys [2002-05-29 38400] . Contenu du dossier 'Tâches planifiées' . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uInternet Connection Wizard,ShellNext = hxxp://www.google.fr/ uInternet Settings,ProxyServer = http=127.0.0.1:5555 uInternet Settings,ProxyOverride = <local> uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s TCP: {0664E60F-49FA-4364-9A7E-BDB9548B9B6B} = 192.168.1.1 . - - - - ORPHELINS SUPPRIMES - - - - AddRemove-HijackThis - d:\downloads\HijackThis.exe AddRemove-InstallShield_{C20CE592-B0F8-4D20-BF31-0151CA6331A6} - c:\program files\InstallShield Installation Information\{C20CE592-B0F8-4D20-BF31-0151CA6331A6}\setup.exe AddRemove-{C20CE592-B0F8-4D20-BF31-0151CA6331A6} - c:\program files\InstallShield Installation Information\{C20CE592-B0F8-4D20-BF31-0151CA6331A6}\Setup.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-05-31 01:04 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x823DF1F8]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0xf8579fc3 \Driver\ACPI -> ACPI.sys @ 0xf83e0cb8 \Driver\atapi -> 0x823df1f8 IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0094 ParseProcedure -> ntoskrnl.exe @ 0x8056f08e \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0094 ParseProcedure -> ntoskrnl.exe @ 0x8056f08e NDIS: 3Com 3C910 Integrated Fast Ethernet Controller (3CSOHO100B-TX C -> SendCompleteHandler -> NDIS.sys @ 0xf8281af9 PacketIndicateHandler -> NDIS.sys @ 0xf828cb21 SendHandler -> NDIS.sys @ 0xf8281938 Warning: possible MBR rootkit infection ! user & kernel MBR OK ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\GarenaPEngine] "ImagePath"="\??\c:\docume~1\DOZR~1.XPS\LOCALS~1\Temp\AIL22.tmp" [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(616) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(576) d:\program\MouseWare\System\LgWndHk.dll . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\Ati2evxx.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\Ati2evxx.exe c:\windows\SOUNDMAN.EXE d:\program\MouseWare\system\em_exec.exe d:\program\Warcraft III\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe c:\program files\OpenOffice.org 3\program\soffice.exe c:\program files\OpenOffice.org 3\program\soffice.bin . ************************************************************************** . Heure de fin: 2010-05-31 01:09:03 - La machine a redémarré ComboFix-quarantined-files.txt 2010-05-30 23:09 Avant-CF: 3'754'082'304 octets libres Après-CF: 3'571'359'744 octets libres WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect - - End Of File - - 4B9BFD121FA39A3569A67BCBD9D37685 c long :~)
  17. Ogon
    alors non ce n etait pas des emoticones mais une vidéo streaming sur laquelle j ai cliqué et pouf le tour etait joué download et install~~ j'ai couper l'utilisation des proxy comme mentionné. je vais tenter la base de registre maintenant et le fichier aleatoire , est ce que c'est utile sans le mode sans echec? help ~~ je trouve pas l'application ni le dossier local dans aucun de mes dossier applications data, si tu as le chemin exact peut etre que ca m aidera, je peux pas faire de recherches....
  18. Ogon
    Bonjour à tous et à toute ,hier j'ai été infesté par un malware ou virus nommé antispyware soft, ce virus consiste a bloquer toute ouverture d'application en les considérant comme virus, Je précise que je n'ai pas d'antivirus et qu'il m est à l'heure actuelle impossible d'installer un quelconque programme sur mon ordinateur Je vais maintenant tenter de vous faire un résumé de mes actions d'hier après infection: plus aucun programme ne pouvait être lancé + fenêtre intempestives d'alertes de la part de ce virus , j'ai donc redémarrer l'ordinateur, à l'ouverture de windows, j'ai rapidement ouvert le gestionnaire de taches (pour tenter d'atteindre les processus) ,avant que le virus ne ce mette en action, ce qui a (étrangement) fait disparaitre l'application du virus. J'ai pu donc faire un nettoyage avec Ccleaner et une analyse avec spybot s&d , spybot a trouvé 5 infection et les a nettoyé. Suite à ca j'ai tenter d'installer divers programmes comme malware bit, antivir , scanner onlines... mais aucune application ne peut être installer, (par contre je peux lancer ce que je possède c est a dire ccleaner et spybot). j'ai donc fouiller mon registre à la recherche des termes avgroupe et avsoft, j'ai effacé les entrées que j ai trouvé mais cela n'a rien changé...Le virus n'a plus l'air d'etre actif par contre les symptomes suivants sont toujours la: je ne peux pas faire de recherches avec l'outils de recherche windows, les fenetres que j'ouvres ne s affichent pas dans ma bar de taches windows (en bas) Mon ordinateur met un bout de temps à afficher le bureau après le chargement de windows je ne peux installer aucun programme (ni antivirus) les application du programme antispyware sont absentes dans les processus... ah oui je ne peux pas faire de démarrage en mode sans échec... -_-'' c la cata la . après avoir tapoter f8 les choix s affichent mais je ne peux faire aucun mouvements ni choix (les fleches ne marchent pas ni enter) alors voilà je suis dans de beaux draps et je m en remet à vous en ésperant que vous trouverez des solutions à mes problèmes... ci dessous: la caverne d'halibaba Mon rapport Hijackthis (v2.0.2) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:41:30, on 30.05.2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\ctfmon.exe D:\Program\Spybot - Search & Destroy\TeaTimer.exe D:\Program\MouseWare\system\em_exec.exe C:\WINDOWS\system32\rundll32.exe D:\Program\Warcraft III\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe C:\Program Files\OpenOffice.org 3\program\soffice.exe C:\Program Files\OpenOffice.org 3\program\soffice.bin C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\Explorer.EXE D:\Program\firefox.exe D:\Downloads\Iexplorer.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.live.com/sphome.aspx R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program\SPYBOT~1\SDHelper.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [spybotSD TeaTimer] D:\Program\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [hivew] C:\WINDOWS\system32\rundll32.exe C:\DOCUME~1\DOZR~1.XPS\LOCALS~1\Temp\4725859921don.dll,Set1 O4 - HKUS\S-1-5-21-507921405-2111687655-839522115-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-507921405-2111687655-839522115-1003\..\Run: [spybotSD TeaTimer] D:\Program\Spybot - Search & Destroy\TeaTimer.exe (User '?') O4 - HKUS\S-1-5-21-507921405-2111687655-839522115-1003\..\Run: [hivew] C:\WINDOWS\system32\rundll32.exe C:\DOCUME~1\DOZR~1.XPS\LOCALS~1\Temp\4725859921don.dll,Set1 (User '?') O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User '?') O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'Default user') O4 - S-1-5-21-507921405-2111687655-839522115-1003 Startup: My_AutoWarkey_Script.lnk = D:\Program\Warcraft III\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe (User '?') O4 - S-1-5-21-507921405-2111687655-839522115-1003 Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User '?') O4 - Startup: My_AutoWarkey_Script.lnk = D:\Program\Warcraft III\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Program\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Program\SPYBOT~1\SDHelper.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O17 - HKLM\System\CCS\Services\Tcpip\..\{0664E60F-49FA-4364-9A7E-BDB9548B9B6B}: NameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{0664E60F-49FA-4364-9A7E-BDB9548B9B6B}: NameServer = 192.168.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{0664E60F-49FA-4364-9A7E-BDB9548B9B6B}: NameServer = 192.168.1.1 O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing) O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing) O23 - Service: Avira Upgrade Service (AntiVirUpgradeService) - Unknown owner - C:\WINDOWS\TEMP\AVSETUP_49f43897\basic\avupgsvc.exe (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing) -- End of file - 5991 bytes merci 1000 fois Ogon
×
×
  • Créer...