Pitits problèmes

Syberio · le 9 juin 2007

Bonjour,

depouis quelques temps, je souffre de gros problèmes de connexion dus à un trojan que je ne cesse d'éffacer via avg 7.5 et avast, sans grand succès.

je me dis qu'avec votre aide je pourrais efin m'en débarrasser...

a propos, antivir ne l'a pas trouvé pendant le scan en sans échec

voici le fameux raport hijackthis:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 02:52:17, on 09.06.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

c:\windows\system32\drivers\services.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\RTHDCPL.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\WINDOWS\system32\ElkCtrl.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Propriétaire\Bureau\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\ETcall.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect

O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot

O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

O4 - Global Startup: Logitech SetPoint.lnk = ?

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1179948593140

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1181062549765

O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe

O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe

O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe

O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe

O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe

O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe

O23 - Service: Windows Services Control - FileZilla Project - c:\windows\system32\drivers\services.exe

O23 - Service: Session Manager Subsystem (Windows Smss) - Unknown owner - C:\WINDOWS\system32\drivers\etc\smss.exe (file missing)

O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

--

End of file - 9114 bytes

Merci d'avance pour votre aide

Thanos · le 9 juin 2007

salut

Est ce que tu peux poster le rapport d'AVG AS stp? si tu ne le trouve pas, il est ici > C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Reports

Poste ce rapport stp >

Télécharge et lance DiagHelp comme montré dans ce tutoriel> http://www.malekal.com/DiagHelp/DiagHelp.php

Ne lance que l'option 1 et poste le rapport stp.Attention: n'oublie pas d'appuyer sur une touche lorsque cela te sera demandé à la fin du rapport Catchme.

Syberio · le 9 juin 2007

bizarre, chez moi DiagHelp ne se comporte pas du tout comme dans le tuto...

il me sort ceci:

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-09 11:50:15

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden files ...

scan completed successfully

hidden files: 0

pour le rapport avg il arrive, j'ai du relancer un scan.

Edit : voici le rapport avg, il n'a trouvé que des cookies, et pas le trojan.iroffer comme par deux fois deja.

---------------------------------------------------------

AVG Anti-Spyware - Rapport d'analyse

---------------------------------------------------------

+ Créé à: 12:11:09 09.06.2007

+ Résultat de l'analyse:

:mozilla.275:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.

:mozilla.307:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.68:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.72:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.87:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.212:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.

:mozilla.214:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.

:mozilla.215:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.

:mozilla.219:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.

:mozilla.196:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.

:mozilla.197:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.

:mozilla.198:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.

:mozilla.115:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.

:mozilla.28:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.

:mozilla.279:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Com : Nettoyé.

:mozilla.91:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.

:mozilla.92:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.

:mozilla.93:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.

:mozilla.61:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.

:mozilla.90:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.

:mozilla.193:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.

:mozilla.51:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.

:mozilla.52:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.

:mozilla.53:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.

:mozilla.54:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.

:mozilla.318:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.

:mozilla.319:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.

:mozilla.209:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.

:mozilla.145:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.

:mozilla.159:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Paypal : Nettoyé.

:mozilla.428:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Planetactive : Nettoyé.

:mozilla.385:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Questionmarket : Nettoyé.

:mozilla.386:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Questionmarket : Nettoyé.

:mozilla.387:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.

:mozilla.388:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.

:mozilla.389:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.

:mozilla.390:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.

:mozilla.391:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.

:mozilla.392:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.

:mozilla.111:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

:mozilla.112:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

:mozilla.113:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

:mozilla.321:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.

:mozilla.322:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.

:mozilla.66:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.

:mozilla.67:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.

:mozilla.69:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.

:mozilla.70:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.

:mozilla.71:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.

:mozilla.116:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.

:mozilla.117:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.

:mozilla.77:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Tribalfusion : Nettoyé.

:mozilla.131:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.

:mozilla.132:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.

:mozilla.133:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.

:mozilla.355:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Webtrends : Nettoyé.

:mozilla.47:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.

:mozilla.48:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.

:mozilla.49:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.

:mozilla.50:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.

:mozilla.364:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.

:mozilla.365:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.

:mozilla.366:C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\g5jvdym0.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.

Fin du rapport

Modifié le 9 juin 2007 par Syberio

Syberio · le 9 juin 2007

et voilà maintenant le rapport définitif de chez diaghelp:

DiagHelp version v1.1.1 - http://www.malekal.com

excute le 09.06.2007 à 12:13:37.39

Liste des derniers fichies modifies/crees dans windir\system32

C:\WINDOWS\System32/drivers\services.xml -->09.06.2007 11:40:10

C:\WINDOWS\System32/drivers\lvuvc.hs -->09.06.2007 11:38:53

C:\WINDOWS\System32/drivers\NSDriver.sys -->04.06.2007 15:18:48

C:\WINDOWS\System32/drivers\AWRTRD.sys -->04.06.2007 15:17:02

C:\WINDOWS\System32/drivers\AWRTPD.sys -->04.06.2007 15:14:56

C:\WINDOWS\System32/drivers\Msft_Kernel_LMouFilt_01005.Wdf -->23.05.2007 23:09:56

C:\WINDOWS\System32/drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf -->23.05.2007 23:09:54

C:\WINDOWS\System32\wpa.dbl -->09.06.2007 11:41:03

C:\WINDOWS\System32\nvapps.xml -->09.06.2007 11:40:21

C:\WINDOWS\System32\vsconfig.xml -->09.06.2007 11:38:58

C:\WINDOWS\System32\Thumbs.db -->07.06.2007 23:03:28

C:\WINDOWS\System32\FNTCACHE.DAT -->05.06.2007 23:00:33

C:\WINDOWS\System32\uxtheme.dll -->05.06.2007 19:26:11

C:\WINDOWS\System32\SIntfNT.dll -->29.05.2007 20:58:02

C:\WINDOWS\System32\SIntf32.dll -->29.05.2007 20:58:02

C:\WINDOWS\System32\SIntf16.dll -->29.05.2007 20:58:02

C:\WINDOWS\System32\lvcoinst.log -->28.05.2007 18:18:05

C:\WINDOWS\System32\lhacm.acm -->26.05.2007 16:05:22

C:\WINDOWS\System32\perfh00C.dat -->26.05.2007 10:10:24

C:\WINDOWS\System32\perfh009.dat -->26.05.2007 10:10:24

C:\WINDOWS\System32\perfc00C.dat -->26.05.2007 10:10:24

C:\WINDOWS\System32\perfc009.dat -->26.05.2007 10:10:24

C:\WINDOWS\System32\PerfStringBackup.INI -->26.05.2007 03:27:42

C:\WINDOWS\System32\MSWINSCK.OCX -->25.05.2007 17:48:57

C:\WINDOWS\System32\exec1.ini -->25.05.2007 07:29:00

C:\WINDOWS\System32\exec1.exe -->25.05.2007 07:25:31

C:\WINDOWS\System32\zllictbl.dat -->24.05.2007 18:55:03

C:\WINDOWS\System32\h323log.txt -->24.05.2007 04:48:39

C:\WINDOWS\System32\nscompat.tlb -->23.05.2007 23:52:01

C:\WINDOWS\System32\amcompat.tlb -->23.05.2007 23:52:01

C:\WINDOWS\System32\msinet.ocx -->23.05.2007 23:49:09

C:\WINDOWS\System32\comdlg32.ocx -->23.05.2007 23:49:09

C:\WINDOWS.log -->09.06.2007 11:40:11

C:\WINDOWS\WindowsUpdate.log -->09.06.2007 11:40:10

C:\WINDOWS\wiaservc.log -->09.06.2007 11:40:10

C:\WINDOWS\wiadebug.log -->09.06.2007 11:40:10

C:\WINDOWS\bootstat.dat -->09.06.2007 11:38:55

C:\WINDOWS\SchedLgU.Txt -->09.06.2007 11:38:10

C:\WINDOWS\Thumbs.db -->09.06.2007 02:45:47

C:\WINDOWS\ntbtlog.txt -->09.06.2007 02:40:13

C:\WINDOWS\Lic.xxx -->09.06.2007 01:05:58

C:\WINDOWS\BlendSettings.ini -->09.06.2007 00:51:54

C:\WINDOWS\QTFont.qfn -->08.06.2007 19:25:33

C:\WINDOWS\wmsetup.log -->05.06.2007 19:34:30

C:\WINDOWS\BricoPackUninst.txt -->05.06.2007 19:26:11

C:\WINDOWS\BricoPackUninst.cmd -->05.06.2007 19:26:11

C:\WINDOWS\BricoPackFoldersDelete.cmd -->05.06.2007 19:26:11

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est DCFF-8F95

Répertoire de C:\WINDOWS\system32

05.08.2004 14:00 6'144 csrss.exe

1 fichier(s) 6'144 octets

0 Rép(s) 62'112'374'784 octets libres

Contenu de Downloaded Program Files

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est DCFF-8F95

Répertoire de C:\WINDOWS\Downloaded Program Files

05.06.2007 18:55 <REP> .

05.06.2007 18:55 <REP> ..

23.05.2007 20:54 65 desktop.ini

16.04.2007 22:50 295 muweb.inf

26.05.2005 04:19 291 wuweb.inf

3 fichier(s) 651 octets

Total des fichiers listés :

3 fichier(s) 651 octets

2 Rép(s) 62'112'374'784 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..

Liste des fichiers en exception sur le pare-feu XP SP2

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"

"C:\\WINDOWS\\system32\\drivers\\etc\\smss.exe"="C:\\WINDOWS\\system32\\drivers\\etc\\smss.exe:*:Enabled:Bittorrent Program"

"C:\\WINDOWS\\system32\\drivers\\services.exe"="C:\\WINDOWS\\system32\\drivers\\services.exe:*:Enabled:Bittorrent Program"

"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

"C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe:*:Enabled:TrueVector Service"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Export de la clef SharedTaskScheduler

[sharedTaskScheduler]

"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"

"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

Rechercher adresses sensibles dans le fichier HOSTS...

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net

Rootkit scan 2007-06-09 12:13:48

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden files ...

scan completed successfully

hidden files: 0

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System

356 - ashServ.exe

728 - LVPrcSrv.exe

760 - csrss.exe

784 - winlogon.exe

828 - services.exe

840 - lsass.exe

1004 - svchost.exe

1052 - svchost.exe

1148 - svchost.exe

1260 - ashDisp.exe

1268 - svchost.exe

1312 - svchost.exe

1324 - vsmon.exe

1344 - firefox.exe

1552 - aawservice.exe

1584 - guard.exe

1592 - explorer.exe

1656 - nvsvc32.exe

1960 - services.exe

2556 - avgas.exe

2576 - zlclient.exe

2628 - LVCOMSX.EXE

2672 - iPodService.exe

2704 - ElkCtrl.exe

2884 - msnmsgr.exe

2924 - ashMaiSv.exe

3008 - ashWebSv.exe

3048 - ctfmon.exe

3104 - RTHDCPL.exe

3332 - SetPoint.exe

3360 - alg.exe

3896 - KHALMNPR.exe

3992 - UberIcon Manage

8500 - cmd.exe

9932 - wmiprvse.exe

Total number of processes = 36

NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\ntkrnlpa.exe

806E2000 - \WINDOWS\system32\hal.dll

BADA8000 - \WINDOWS\system32\KDCOM.DLL

BACB8000 - \WINDOWS\system32\BOOTVID.dll

BA778000 - ACPI.sys

BADAA000 - \WINDOWS\system32\DRIVERS\WMILIB.SYS

BA767000 - pci.sys

BA8A8000 - isapnp.sys

BA8B8000 - ohci1394.sys

BA8C8000 - \WINDOWS\system32\DRIVERS\1394BUS.SYS

BAE70000 - pciide.sys

BAB28000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

BA8D8000 - MountMgr.sys

BA748000 - ftdisk.sys

BAB30000 - PartMgr.sys

BA8E8000 - VolSnap.sys

BA730000 - atapi.sys

BA716000 - nvata.sys

BA8F8000 - disk.sys

BA908000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

BA6F6000 - fltMgr.sys

BA6DF000 - KSecDD.sys

BA652000 - Ntfs.sys

BA625000 - NDIS.sys

BA611000 - srescan.sys

BA5F6000 - Mup.sys

BAA18000 - \SystemRoot\system32\DRIVERS\AmdK8.sys

BABB0000 - \SystemRoot\system32\DRIVERS\usbohci.sys

BA575000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS

BABB8000 - \SystemRoot\system32\DRIVERS\usbehci.sys

BAA28000 - \SystemRoot\system32\DRIVERS\imapi.sys

BAA38000 - \SystemRoot\system32\DRIVERS\cdrom.sys

BAA48000 - \SystemRoot\system32\DRIVERS\redbook.sys

BA552000 - \SystemRoot\system32\DRIVERS\ks.sys

BABC0000 - \SystemRoot\System32\Drivers\GEARAspiWDM.sys

BA52D000 - \SystemRoot\system32\DRIVERS\HDAudBus.sys

BAA58000 - \SystemRoot\system32\DRIVERS\nvnetbus.sys

BA411000 - \SystemRoot\system32\DRIVERS\NVNRM.SYS

BA041000 - \SystemRoot\system32\DRIVERS\nv4_mini.sys

BA02D000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

BABC8000 - \SystemRoot\system32\DRIVERS\fdc.sys

BA01C000 - \SystemRoot\system32\DRIVERS\serial.sys

BAD74000 - \SystemRoot\system32\DRIVERS\serenum.sys

BA008000 - \SystemRoot\system32\DRIVERS\parport.sys

BAA68000 - \SystemRoot\system32\DRIVERS\i8042prt.sys

BAD78000 - \SystemRoot\system32\DRIVERS\L8042Kbd.sys

BABD0000 - \SystemRoot\system32\DRIVERS\kbdclass.sys

BAFA1000 - \SystemRoot\system32\DRIVERS\audstub.sys

BAAC8000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys

BAD7C000 - \SystemRoot\system32\DRIVERS\ndistapi.sys

B9FC2000 - \SystemRoot\system32\DRIVERS\ndiswan.sys

BAAD8000 - \SystemRoot\system32\DRIVERS\raspppoe.sys

BAAE8000 - \SystemRoot\system32\DRIVERS\raspptp.sys

BABD8000 - \SystemRoot\system32\DRIVERS\TDI.SYS

B9F89000 - \SystemRoot\system32\DRIVERS\psched.sys

BAAF8000 - \SystemRoot\system32\DRIVERS\msgpc.sys

BABE0000 - \SystemRoot\system32\DRIVERS\ptilink.sys

BABE8000 - \SystemRoot\system32\DRIVERS\raspti.sys

BAB08000 - \SystemRoot\system32\DRIVERS\termdd.sys

BABF0000 - \SystemRoot\system32\DRIVERS\mouclass.sys

BADD0000 - \SystemRoot\system32\DRIVERS\swenum.sys

B9F55000 - \SystemRoot\system32\DRIVERS\update.sys

BAD88000 - \SystemRoot\system32\DRIVERS\mssmbios.sys

BAB18000 - \SystemRoot\System32\Drivers\NDProxy.SYS

BA948000 - \SystemRoot\system32\DRIVERS\usbhub.sys

BADD4000 - \SystemRoot\system32\DRIVERS\USBD.SYS

B9A08000 - \SystemRoot\system32\drivers\RtkHDAud.sys

B99E6000 - \SystemRoot\system32\drivers\portcls.sys

BA968000 - \SystemRoot\system32\drivers\drmk.sys

BA978000 - \SystemRoot\system32\DRIVERS\NVENETFD.sys

BABF8000 - \SystemRoot\system32\DRIVERS\flpydisk.sys

BADDA000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS

BAF3B000 - \SystemRoot\System32\Drivers\Null.SYS

BADDC000 - \SystemRoot\System32\Drivers\Beep.SYS

BAF46000 - \SystemRoot\System32\DRIVERS\AvgAsCln.sys

BAC08000 - \SystemRoot\System32\drivers\vga.sys

BADDE000 - \SystemRoot\System32\Drivers\mnmdd.SYS

BADE0000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys

BAC10000 - \SystemRoot\System32\Drivers\Msfs.SYS

BAC18000 - \SystemRoot\System32\Drivers\Npfs.SYS

BAD5C000 - \SystemRoot\system32\DRIVERS\rasacd.sys

B7838000 - \SystemRoot\system32\DRIVERS\ipsec.sys

B77E0000 - \SystemRoot\system32\DRIVERS\tcpip.sys

BA9B8000 - \SystemRoot\System32\Drivers\aswTdi.SYS

B77BF000 - \SystemRoot\system32\DRIVERS\ipnat.sys

B7797000 - \SystemRoot\system32\DRIVERS\netbt.sys

BA9C8000 - \SystemRoot\system32\DRIVERS\wanarp.sys

B7738000 - \SystemRoot\System32\vsdatant.sys

B76EE000 - \SystemRoot\System32\drivers\afd.sys

BA9D8000 - \SystemRoot\system32\DRIVERS\netbios.sys

BAC20000 - \SystemRoot\System32\Drivers\SCDEmu.SYS

B7623000 - \SystemRoot\system32\DRIVERS\rdbss.sys

B758C000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys

BA9F8000 - \SystemRoot\System32\Drivers\Fips.SYS

BAF68000 - \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys

BAC30000 - \SystemRoot\System32\Drivers\Aavmker4.SYS

BAC38000 - \SystemRoot\system32\DRIVERS\usbccgp.sys

B9E95000 - \SystemRoot\system32\DRIVERS\lvuvcflt.sys

B9E91000 - \SystemRoot\system32\DRIVERS\hidusb.sys

BAA78000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

BAC40000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

B73B9000 - \??\C:\WINDOWS\system32\drivers\lvmvdrv.sys

BAA88000 - \SystemRoot\system32\drivers\lvusbsta.sys

B72B7000 - \SystemRoot\system32\DRIVERS\lvuvc.sys

B728D000 - \SystemRoot\system32\DRIVERS\LVMJPEG.SYS

B70A2000 - \SystemRoot\system32\DRIVERS\lvpopflt.sys

BAA98000 - \SystemRoot\system32\drivers\usbaudio.sys

B6E90000 - \??\C:\WINDOWS\system32\drivers\Lvckap.sys

BAC48000 - \SystemRoot\system32\DRIVERS\LHidFilt.Sys

BAAA8000 - \SystemRoot\system32\DRIVERS\WDFLDR.SYS

B6DED000 - \SystemRoot\system32\DRIVERS\Wdf01000.sys

B99D6000 - \SystemRoot\system32\DRIVERS\mouhid.sys

BAC50000 - \SystemRoot\system32\DRIVERS\LMouFilt.Sys

B6DDC000 - \SystemRoot\System32\Drivers\Udfs.SYS

B6DA1000 - \SystemRoot\System32\Drivers\dump_atapi.sys

BAE2A000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS

BF800000 - \SystemRoot\System32\win32k.sys

B7730000 - \SystemRoot\System32\drivers\Dxapi.sys

BAC60000 - \SystemRoot\System32\watchdog.sys

BF9C3000 - \SystemRoot\System32\drivers\dxg.sys

BAFE2000 - \SystemRoot\System32\drivers\dxgthk.sys

BF9D5000 - \SystemRoot\System32\nv4_disp.dll

BFFA0000 - \SystemRoot\System32\ATMFD.DLL

B60B9000 - \SystemRoot\system32\DRIVERS\ndisuio.sys

B44AA000 - \SystemRoot\System32\Drivers\Fastfat.SYS

B4494000 - \SystemRoot\System32\Drivers\aswMon2.SYS

B42EF000 - \SystemRoot\system32\drivers\wdmaud.sys

B457D000 - \SystemRoot\system32\drivers\sysaudio.sys

B3FA8000 - \SystemRoot\system32\DRIVERS\mrxdav.sys

BAE52000 - \SystemRoot\System32\Drivers\ParVdm.SYS

B3EDE000 - \SystemRoot\system32\DRIVERS\srv.sys

BAC00000 - \??\C:\WINDOWS\system32\drivers\LVPrcMon.sys

B3AFA000 - \SystemRoot\System32\Drivers\aswRdr.SYS

B3972000 - \SystemRoot\System32\Drivers\HTTP.sys

BACA0000 - \??\C:\WINDOWS\system32\Drivers\ET5Drv.sys

B0B6B000 - \SystemRoot\system32\drivers\kmixer.sys

BAEA5000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 137

Liste des programmes installes

a-squared Free 3.0

Ad-Aware 2007

Adobe Flash Player ActiveX

Adobe Flash Player Plugin

Adobe Reader 6.0.1

Adobe Shockwave Player

Archiveur WinRAR

avast! Antivirus

AVG Anti-Spyware 7.5

Azureus

Canon Camera Access Library

Canon Camera Support Core Library

Canon Camera Window DC_DV 5 for ZoomBrowser EX

Canon Camera Window DC_DV 6 for ZoomBrowser EX

Canon Camera Window MC 6 for ZoomBrowser EX

Canon G.726 WMP-Decoder

CANON iMAGE GATEWAY Task for ZoomBrowser EX

Canon Internet Library for ZoomBrowser EX

Canon MovieEdit Task for ZoomBrowser EX

Canon RAW Image Task for ZoomBrowser EX

Canon RemoteCapture Task for ZoomBrowser EX

Canon Utilities ZoomBrowser EX

CDDRV_Installer

Correctif pour Windows XP (KB914440)

Correctif pour Windows XP (KB935448)

Correctif Windows XP - KB873339

Correctif Windows XP - KB885835

Correctif Windows XP - KB885836

Correctif Windows XP - KB886185

Correctif Windows XP - KB887472

Correctif Windows XP - KB888302

Correctif Windows XP - KB890859

Correctif Windows XP - KB891781

Diablo II

EasyTune5

EVEREST Ultimate Edition v4.00

High Definition Audio - KB888111

HijackThis 2.0.0

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows XP (KB915800)

Hotfix for Windows XP (KB915865)

Hotfix for Windows XP (KB926239)

iPod for Windows 2006-06-28

iTunes

Java SE Runtime Environment 6 Update 1

K-Lite Codec Pack 3.1.0 Standard

KhalSetup

Lecteur Windows Media 11

LimeWire PRO 4.12.3

Logiciel QuickCam de Logitech

Logitech SetPoint

Messenger Plus! Live

Microsoft .NET Framework 2.0

Microsoft .NET Framework 2.0 Language Pack - FRA

Microsoft .NET Framework 3.0

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

Microsoft National Language Support Downlevel APIs

Microsoft Office Access MUI (French) 2007

Microsoft Office Excel MUI (French) 2007

Microsoft Office InfoPath MUI (French) 2007

Microsoft Office Outlook MUI (French) 2007

Microsoft Office PowerPoint MUI (French) 2007

Microsoft Office Professional Plus 2007

Microsoft Office Proof (Arabic) 2007

Microsoft Office Proof (Dutch) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (French) 2007

Microsoft Office Publisher MUI (French) 2007

Microsoft Office Shared MUI (French) 2007

Microsoft Office Word MUI (French) 2007

Microsoft Software Update for Web Folders (French) 12

Microsoft User-Mode Driver Framework Feature Pack 1.0

Mise à jour de sécurité pour Lecteur Windows Media (KB911564)

Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)

Mise à jour de sécurité pour Lecteur Windows Media 9 (KB917734)

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)

Mise à jour de sécurité pour Windows XP (KB890046)

Mise à jour de sécurité pour Windows XP (KB893756)

Mise à jour de sécurité pour Windows XP (KB896358)

Mise à jour de sécurité pour Windows XP (KB896423)

Mise à jour de sécurité pour Windows XP (KB896428)

Mise à jour de sécurité pour Windows XP (KB899587)

Mise à jour de sécurité pour Windows XP (KB899591)

Mise à jour de sécurité pour Windows XP (KB900725)

Mise à jour de sécurité pour Windows XP (KB901017)

Mise à jour de sécurité pour Windows XP (KB901214)

Mise à jour de sécurité pour Windows XP (KB902400)

Mise à jour de sécurité pour Windows XP (KB904706)

Mise à jour de sécurité pour Windows XP (KB905414)

Mise à jour de sécurité pour Windows XP (KB905749)

Mise à jour de sécurité pour Windows XP (KB908519)

Mise à jour de sécurité pour Windows XP (KB911562)

Mise à jour de sécurité pour Windows XP (KB911927)

Mise à jour de sécurité pour Windows XP (KB913580)

Mise à jour de sécurité pour Windows XP (KB914388)

Mise à jour de sécurité pour Windows XP (KB914389)

Mise à jour de sécurité pour Windows XP (KB917344)

Mise à jour de sécurité pour Windows XP (KB917422)

Mise à jour de sécurité pour Windows XP (KB917953)

Mise à jour de sécurité pour Windows XP (KB918118)

Mise à jour de sécurité pour Windows XP (KB918439)

Mise à jour de sécurité pour Windows XP (KB919007)

Mise à jour de sécurité pour Windows XP (KB920213)

Mise à jour de sécurité pour Windows XP (KB920670)

Mise à jour de sécurité pour Windows XP (KB920683)

Mise à jour de sécurité pour Windows XP (KB920685)

Mise à jour de sécurité pour Windows XP (KB922819)

Mise à jour de sécurité pour Windows XP (KB923191)

Mise à jour de sécurité pour Windows XP (KB923414)

Mise à jour de sécurité pour Windows XP (KB923689)

Mise à jour de sécurité pour Windows XP (KB923694)

Mise à jour de sécurité pour Windows XP (KB923789)

Mise à jour de sécurité pour Windows XP (KB923980)

Mise à jour de sécurité pour Windows XP (KB924191)

Mise à jour de sécurité pour Windows XP (KB924270)

Mise à jour de sécurité pour Windows XP (KB924496)

Mise à jour de sécurité pour Windows XP (KB924667)

Mise à jour de sécurité pour Windows XP (KB925902)

Mise à jour de sécurité pour Windows XP (KB926255)

Mise à jour de sécurité pour Windows XP (KB926436)

Mise à jour de sécurité pour Windows XP (KB927779)

Mise à jour de sécurité pour Windows XP (KB927802)

Mise à jour de sécurité pour Windows XP (KB928255)

Mise à jour de sécurité pour Windows XP (KB928843)

Mise à jour de sécurité pour Windows XP (KB930178)

Mise à jour de sécurité pour Windows XP (KB931261)

Mise à jour de sécurité pour Windows XP (KB931768)

Mise à jour de sécurité pour Windows XP (KB931784)

Mise à jour de sécurité pour Windows XP (KB932168)

Mise à jour pour Windows XP (KB894391)

Mise à jour pour Windows XP (KB898461)

Mise à jour pour Windows XP (KB900485)

Mise à jour pour Windows XP (KB904942)

Mise à jour pour Windows XP (KB908531)

Mise à jour pour Windows XP (KB910437)

Mise à jour pour Windows XP (KB911280)

Mise à jour pour Windows XP (KB916595)

Mise à jour pour Windows XP (KB920872)

Mise à jour pour Windows XP (KB922582)

Mise à jour pour Windows XP (KB925720)

Mise à jour pour Windows XP (KB927891)

Mise à jour pour Windows XP (KB930916)

Mise à jour pour Windows XP (KB931836)

Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA

Mozilla Firefox (2.0.0.4)

Mozilla Thunderbird (2.0.0.0)

MSXML 4.0 SP2 (KB927978)

MSXML 6.0 Parser (KB927977)

Nero 7 Premium

neroxml

NVIDIA Drivers

Oblivion

Pack Vista Inspirat 2 1.0

Package de pilotes Windows - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)

PowerISO

Programme de gestion Camera de Logitech

QuickTime

Realtek High Definition Audio Driver

Security Update for CAPICOM (KB931906)

Security Update for Excel 2007 (KB934670)

Security Update for Microsoft .NET Framework 2.0 (KB917283)

Security Update for Office 2007 (KB934062)

Security Update pour Microsoft .NET Framework 2.0 (KB922770)

TeamSpeak 2 RC2

Update for Office 2007 (KB932080)

Update for Office 2007 (KB933688)

Update for Office 2007 (KB934393)

Update for Outlook 2007 Junk Email Filter (KB934655)

Update for Word 2007 (KB934173)

WebFldrs XP

Windows Communication Foundation

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Imaging Component

Windows Installer 3.1 (KB893803)

Windows Internet Explorer 7

Windows Live Messenger

Windows Media Format 11 runtime

Windows Media Player 11

Windows Presentation Foundation

Windows Workflow Foundation

World of Warcraft

Wow Cartographe 1.07

XML Paper Specification Shared Components Pack 1.0

ZoneAlarm Pro

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est DCFF-8F95

Répertoire de C:\Program Files

09.06.2007 02:46 <REP> .

09.06.2007 02:46 <REP> ..

23.05.2007 21:16 <REP> Adobe

23.05.2007 21:34 <REP> Alwil Software

09.06.2007 00:53 <REP> a-squared Free

23.05.2007 22:51 <REP> Azureus

28.05.2007 18:07 <REP> Canon

23.05.2007 21:04 <REP> DIFX

08.06.2007 16:12 <REP> Fichiers communs

23.05.2007 21:16 <REP> Gigabyte

23.05.2007 23:16 <REP> Grisoft

24.05.2007 21:14 <REP> Internet Explorer

29.05.2007 22:28 <REP> iPod

23.05.2007 23:10 <REP> iTunes

23.05.2007 22:55 <REP> Java

27.05.2007 11:43 <REP> K-Lite Codec Pack

25.05.2007 18:30 <REP> Lavalys

08.06.2007 16:14 <REP> Lavasoft

07.06.2007 23:01 <REP> LimeWire

26.05.2007 19:07 <REP> Logitech

07.06.2007 23:01 <REP> Messenger

07.06.2007 00:58 <REP> Messenger Plus! Live

27.05.2007 13:45 <REP> Microsoft CAPICOM 2.1.0.2

23.05.2007 20:55 <REP> microsoft frontpage

25.05.2007 18:00 <REP> Microsoft Office

25.05.2007 18:00 <REP> Microsoft Works

25.05.2007 17:59 <REP> Microsoft.NET

05.06.2007 19:27 <REP> Movie Maker

03.06.2007 01:08 <REP> Mozilla Firefox

23.05.2007 22:53 <REP> Mozilla Thunderbird

23.05.2007 22:54 <REP> MSBuild

23.05.2007 20:52 <REP> MSN

23.05.2007 20:53 <REP> MSN Gaming Zone

07.06.2007 00:58 <REP> MSN Messenger

25.05.2007 19:12 <REP> MSXML 4.0

25.05.2007 18:18 <REP> Nero

23.05.2007 20:54 <REP> NetMeeting

23.05.2007 20:53 <REP> Online Services

05.06.2007 19:27 <REP> Outlook Express

25.05.2007 17:44 <REP> PowerISO

23.05.2007 23:10 <REP> QuickTime

23.05.2007 21:04 <REP> Realtek

23.05.2007 22:52 <REP> Reference Assemblies

23.05.2007 20:54 <REP> Services en ligne

26.05.2007 16:05 <REP> Teamspeak2_RC2

07.06.2007 00:58 <REP> Windows Live

07.06.2007 23:01 <REP> Windows Media Connect 2

23.05.2007 23:51 <REP> Windows Media Player

23.05.2007 20:53 <REP> Windows NT

23.05.2007 23:07 <REP> WinRAR

23.05.2007 20:55 <REP> xerox

23.05.2007 23:11 <REP> Zone Labs

0 fichier(s) 0 octets

52 Rép(s) 62'112'202'752 octets libres

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est DCFF-8F95

Répertoire de C:\Program Files\fichiers communs

08.06.2007 16:12 <REP> .

08.06.2007 16:12 <REP> ..

04.06.2007 19:05 <REP> Adobe

25.05.2007 18:19 <REP> Ahead

24.05.2007 18:49 <REP> Blizzard Entertainment

28.05.2007 18:06 <REP> Canon

25.05.2007 18:00 <REP> DESIGNER

29.05.2007 22:27 <REP> InstallShield

23.05.2007 22:55 <REP> Java

26.05.2007 19:08 <REP> logishrd

26.05.2007 19:10 <REP> Logitech

29.05.2007 21:30 <REP> Microsoft Shared

23.05.2007 20:54 <REP> MSSoap

24.05.2007 04:35 <REP> ODBC

07.06.2007 23:02 <REP> Services

24.05.2007 04:35 <REP> SpeechEngines

25.05.2007 17:57 <REP> System

08.06.2007 16:12 <REP> Wise Installation Wizard

0 fichier(s) 0 octets

18 Rép(s) 62'112'202'752 octets libres

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est DCFF-8F95

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

25.05.2007 17:58 <REP> .

25.05.2007 17:58 <REP> ..

25.05.2007 17:58 <REP> 1036

26.10.2006 19:49 970'528 MSONSEXT.DLL

03.06.1999 12:09 122'937 MSOWS409.DLL

07.03.2001 07:00 127'033 MSOWS40c.DLL

3 fichier(s) 1'220'498 octets

3 Rép(s) 62'112'202'752 octets libres

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est DCFF-8F95

Répertoire de C:\

12.05.2007 18:22 68'096 diff.exe

12.05.2007 18:22 103'424 grep.exe

2 fichier(s) 171'520 octets

0 Rép(s) 62'112'202'752 octets libres

c:\Documents and Settings\Administrateur\Local Settings\Temp\Download.exe

c:\Documents and Settings\Administrateur\Local Settings\Temp\esupdate.exe

c:\Documents and Settings\Administrateur\Local Settings\Temp\Getvlist.exe

c:\Documents and Settings\Administrateur\Local Settings\Temp\kavsign.exe

c:\Documents and Settings\Administrateur\Local Settings\Temp\kavss.exe

c:\Documents and Settings\Administrateur\Local Settings\Temp\MDownload.exe

c:\Documents and Settings\Administrateur\Local Settings\Temp\MWAVL.exe

c:\Documents and Settings\Administrateur\Local Settings\Temp\MWAVReg.EXE

c:\Documents and Settings\Administrateur\Local Settings\Temp\ScanningProcess.exe

c:\Documents and Settings\Administrateur\Local Settings\Temp\setpriv.exe

c:\Documents and Settings\Administrateur\Local Settings\Temp\unregx.exe

c:\Documents and Settings\Administrateur\Local Settings\Temp\viewtcp.exe

c:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.1.1.5\iTunesSetupAdmin.exe

c:\Documents and Settings\Propriétaire\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe

c:\Documents and Settings\Propriétaire\Application Data\Microsoft\Installer\{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}\ARPPRODUCTICON.exe

c:\Documents and Settings\Propriétaire\Application Data\Microsoft\Installer\{C89C8D86-4423-4A58-AA40-DD259ACE07C1}\ARPPRODUCTICON.exe

c:\Documents and Settings\Propriétaire\Bureau\HiJackThis_v2.exe

c:\Documents and Settings\Propriétaire\Bureau\DiagHelp\catchme.exe

c:\Documents and Settings\Propriétaire\Bureau\DiagHelp\diff.exe

c:\Documents and Settings\Propriétaire\Bureau\DiagHelp\dumphive.exe

c:\Documents and Settings\Propriétaire\Bureau\DiagHelp\FilesInfoCmd.exe

c:\Documents and Settings\Propriétaire\Bureau\DiagHelp\find2.exe

c:\Documents and Settings\Propriétaire\Bureau\DiagHelp\Fport.exe

c:\Documents and Settings\Propriétaire\Bureau\DiagHelp\grep.exe

c:\Documents and Settings\Propriétaire\Bureau\DiagHelp\KProcCheck.exe

c:\Documents and Settings\Propriétaire\Bureau\DiagHelp\LFiles.exe

c:\Documents and Settings\Propriétaire\Bureau\DiagHelp\LISTDLLS.exe

c:\Documents and Settings\Propriétaire\Bureau\DiagHelp\pslist.exe

c:\Documents and Settings\Propriétaire\Bureau\DiagHelp\streams.exe

c:\Documents and Settings\Propriétaire\Bureau\DiagHelp\swreg.exe

c:\Documents and Settings\Propriétaire\Local Settings\Application Data\WowAceUpdater\WowAceUpdater.exe_Url_js5zpxddbo2j4dhni033r112p1xileku

c:\Documents and Settings\Propriétaire\Local Settings\Application Data\WowAceUpdater\WowAceUpdater.exe_Url_rzdrim2w2axn4ah4ltu5dnh2hcxpeyi4

c:\Documents and Settings\Propriétaire\Local Settings\Application Data\WowAceUpdater\WowAceUpdater.exe_Url_t1tkuqivilmkoqy1zzll12du1ldrzlxl

c:\Documents and Settings\Propriétaire\Local Settings\Temp\1000053.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\200002c.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\AZ_11281.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\AZ_21218.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\AZ_21220.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\AZ_22775.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\AZ_35746.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\AZ_5533.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\AZ_56425.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\AZ_59502.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\AZ_795.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\d2l_Install.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\Download.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\esupdate.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\Getvlist.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\kavsign.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\kavss.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\MDownload.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\MWAVL.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\MWAVReg.EXE

c:\Documents and Settings\Propriétaire\Local Settings\Temp\ose00000.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\ScanningProcess.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\setpriv.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\unregx.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\viewtcp.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\AUG2005DXREDIST\DXSETUP.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\NeroDemo12518\NeroBar.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\NeroDemo12518\SetupX.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\NeroDemo12518\Redist\WindowsInstaller-KB884016-v2-x86.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\NeroDemo12518\Redist\wmfdist.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\NeroDemo12518\Redist\wmfdist95.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\NeroDemo12518\Redist\DirectX\dxsetup.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\NeroDemo12518\Setup\NeroDelTmp.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\nsj7.tmp\DivXComponentInstaller.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\pft1~tmp\setup.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\pft1~tmp\IDE\Win2K\sata_ide\nvuide.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temp\pft1~tmp\IDE\WinXP\sata_ide\nvuide.exe

c:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5MG7OQUR\200002c[1].exe

c:\Documents and Settings\Propriétaire\Mes documents\Azureus Downloads\pack-vista-inspirat-2-1.0.exe

c:\Documents and Settings\Propriétaire\Mes documents\Azureus Downloads\Adobe_Photoshop_CS3_v10.0_Extended_Incl.Keygen_READNFO_FRENCH-BS\totoshop\cracktro_totoshop.exe

c:\Documents and Settings\Propriétaire\Mes documents\Azureus Downloads\Adobe_Photoshop_CS3_v10.0_Extended_Incl.Keygen_READNFO_FRENCH-BS\totoshop\keygen.exe

c:\Documents and Settings\Propriétaire\Mes documents\Azureus Downloads\Adobe_Photoshop_CS3_v10.0_Extended_Incl.Keygen_READNFO_FRENCH-BS\totoshop\setup.exe

c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll

c:\Documents and Settings\All Users\Application Data\Nero\DrWeb\Drweb32.dll

c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

****** Fin du rapport DiagHelp

Thanos · le 9 juin 2007

Syberio, à la fin du rapport catchme, il faut appuyer sur une touche pour continuer le scan!! recommence stp > le pc devra redémarrer à un moment et le rapport s'affichera.

le rapport se nomme resultat.txt et se trouve ici > C:\

Edit: Ok je vois que tu as trouvé!!! je regare ton rapport

Modifié le 9 juin 2007 par charles ingals

Thanos · le 9 juin 2007

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

Redémarre ton ordinateur
Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
Choisis ton compte.

Déroule la liste des instructions ci-dessous :

Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
Appuie sur Y pour commencer le processus de nettoyage.
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

Syberio · le 9 juin 2007

rapport sdfix:

SDFix: Version 1.86

Run by Propri‚taire - 09.06.2007 - 12:43:12.45

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:

Checking Services:

Restoring Windows Registry Values

Restoring Windows Default Hosts File

Restoring Missing Security Center Service

Restoring Missing SharedAccess Service

Rebooting...

Normal Mode:

Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINDOWS\regedit.com - Deleted

Removing Temp Files...

ADS Check:

Checking if ADS is attached to system32 Folder

C:\WINDOWS\system32

No streams found.

Checking if ADS is attached to svchost.exe

C:\WINDOWS\system32\svchost.exe

No streams found.

Checking if ADS is attached to ntoskrnl.exe

C:\WINDOWS\system32\ntoskrnl.exe

No streams found.

Final Check:

Remaining Services:

------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"

"C:\\WINDOWS\\system32\\drivers\\etc\\smss.exe"="C:\\WINDOWS\\system32\\drivers\\etc\\smss.exe:*:Enabled:Bittorrent Program"

"C:\\WINDOWS\\system32\\drivers\\services.exe"="C:\\WINDOWS\\system32\\drivers\\services.exe:*:Enabled:Bittorrent Program"

"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

"C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe:*:Enabled:TrueVector Service"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:

---------------

Backups Folder: - C:\SDFix\backups\backups.zip

Listing Files with Hidden Attributes:

C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp

Listing User Accounts:

comptes d'utilisateurs de \\ATHLON64X26000

Administrateur HelpAssistant Invit‚

Propri‚taire SUPPORT_388945a0

La commande s'est termin‚e correctement.

Finished

rapport hijackthis:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:59:31, on 09.06.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

C:\Program Files\a-squared Free\a2service.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

c:\windows\system32\drivers\services.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\RTHDCPL.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\WINDOWS\system32\ElkCtrl.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Propriétaire\Bureau\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\ETcall.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect

O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot

O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

O4 - Global Startup: Logitech SetPoint.lnk = ?

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1179948593140

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1181062549765

O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe

O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe

O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe

O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe

O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe

O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe

O23 - Service: Windows Services Control - FileZilla Project - c:\windows\system32\drivers\services.exe

O23 - Service: Session Manager Subsystem (Windows Smss) - Unknown owner - C:\WINDOWS\system32\drivers\etc\smss.exe (file missing)

O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

--

End of file - 9227 bytes

Syberio · le 10 juin 2007

un petit up pas caché du tout ^^

Thanos · le 11 juin 2007

salut Syberio

Désolé de ne pas t'avoir répondu plus tôt!!

On va éliminer le malware à l'aide de ce programme >

Télécharge WinPFind3U.exesur ton bureau.

Double clique sur le fichier téléchargé : un dossier nommé WinPFind3U va apparaitre sur ton bureau.
Ouvre le dossier et double clique sur le fichier WinPFind3U.exe pour lancer le programme.
Sous le groupe Files Created Within sélectionne 60 days
Sous le groupe Files Modified Within sélectionne 60 days
Sous le groupe String Search sélectionne Non-Microsoft
Sous Additional Scans coche la case Reg- Security Settings
A présent clique sur le bouton Run Scan dans la barre d'outils
Lorsque le scan est terminé,le bloc-notes s'ouvre et affiche le rapport.
Clique sur le menu "Format" et assure toi que la case "Retour automatique à la ligne" ne soit pas cochée.
Copie/Colle le contenu du rapport dans ta prochaine réponse.

@+ tard

edit pour typo!

Modifié le 11 juin 2007 par charles ingals

Syberio · le 11 juin 2007

salut,

c'est pas grave, après tout je vais pas raler si ca prend quelques jours, c'est deja assez sympa de m'aider

et puis zone alarm est assez efficace (854 intrusions bloquées depuis que j'aio contracté cette saleté...) pour tenir jusqu'à résolution du problème...

enfin, assez blablaté, voici le rapport WinPFind3:

WinPFind3 logfile created on: 11.06.2007 18:43:54
WinPFind3U by OldTimer - Version 1.0.38 Folder = C:\Documents and Settings\Propriétaire\Bureau\WinPFind3u\

Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)

Internet Explorer (Version = 7.0.5730.11)

2.00 Gb Total Physical Memory | 1.46 Gb Available Physical Memory | 72.81% Memory free

3.85 Gb Paging File | 3.40 Gb Available in Paging File | 88.44% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 75.13 Gb Total Space | 58.99 Gb Free Space | 78.52% Space Free

Drive D: | 390.63 Gb Total Space | 258.53 Gb Free Space | 66.18% Space Free

Drive E: | 4.05 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free

F: Drive not present or media not loaded

Computer Name: ATHLON64X26000

Current User Name: Propriétaire

Logged in as Administrator.

Current Boot Mode: Normal

[Processes - Non-Microsoft Only]

a2service.exe -> %ProgramFiles%\a-squared Free\a2service.exe -> Emsi Software GmbH [Ver = 3.0.0.276 | Size = 423032 bytes | Modified Date = 05.06.2007 13:07:04 | Attr = ]

aawservice.exe -> %ProgramFiles%\Lavasoft\Ad-Aware 2007\aawservice.exe -> Lavasoft AB [Ver = 7, 0, 1, 2 | Size = 561152 bytes | Modified Date = 05.06.2007 17:23:28 | Attr = ]

ashdisp.exe -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 75392 bytes | Modified Date = 30.04.2007 17:42:48 | Attr = ]

ashmaisv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 243328 bytes | Modified Date = 30.04.2007 18:04:38 | Attr = ]

ashserv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 132736 bytes | Modified Date = 30.04.2007 17:42:40 | Attr = ]

ashwebsv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 345728 bytes | Modified Date = 30.04.2007 17:41:28 | Attr = ]

aswupdsv.exe -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 16512 bytes | Modified Date = 30.04.2007 17:29:56 | Attr = ]

avgas.exe -> %ProgramFiles%\Grisoft\AVG Anti-Spyware 7.5\avgas.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 50 | Size = 6266880 bytes | Modified Date = 23.05.2007 23:18:06 | Attr = ]

elkctrl.exe -> %System32%\ElkCtrl.exe -> Logitech Inc. [Ver = 8.5.0.1137 | Size = 262144 bytes | Modified Date = 01.11.2004 18:22:22 | Attr = ]

firefox.exe -> %ProgramFiles%\Mozilla Firefox\firefox.exe -> Mozilla Corporation [Ver = 1.8.1.4: 2007051502 | Size = 7637104 bytes | Modified Date = 31.05.2007 22:49:26 | Attr = ]

guard.exe -> %ProgramFiles%\Grisoft\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 28.09.2006 16:13:20 | Attr = ]

ipodservice.exe -> %ProgramFiles%\iPod\bin\iPodService.exe -> Apple Inc. [Ver = 7.1.1.5 | Size = 500800 bytes | Modified Date = 27.04.2007 11:25:52 | Attr = ]

ituneshelper.exe -> %ProgramFiles%\iTunes\iTunesHelper.exe -> Apple Inc. [Ver = 7.1.1.5 | Size = 257088 bytes | Modified Date = 27.04.2007 11:25:58 | Attr = ]

jusched.exe -> %ProgramFiles%\Java\jre1.6.0_01\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 83608 bytes | Modified Date = 14.03.2007 03:43:44 | Attr = ]

khalmnpr.exe -> %CommonProgramFiles%\Logitech\khalshared\KHALMNPR.exe -> Logitech Inc. [Ver = 3.30.152 | Size = 101136 bytes | Modified Date = 23.01.2007 15:44:00 | Attr = ]

lvcomsx.exe -> %System32%\LVCOMSX.EXE -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 221184 bytes | Modified Date = 28.07.2005 13:30:36 | Attr = ]

lvprcsrv.exe -> %CommonProgramFiles%\Logitech\LVMVFM\LVPrcSrv.exe -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 81920 bytes | Modified Date = 28.07.2005 13:37:24 | Attr = ]

nvsvc32.exe -> %System32%\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 159810 bytes | Modified Date = 22.10.2006 12:22:00 | Attr = ]

rthdcpl.exe -> %SystemRoot%\RTHDCPL.exe -> Realtek Semiconductor Corp. [Ver = 2.1.0.8 | Size = 16269312 bytes | Modified Date = 30.10.2006 05:49:54 | Attr = R ]

services.exe -> %System32%\drivers\services.exe -> FileZilla Project [Ver = 0, 9, 23, 0 | Size = 546816 bytes | Modified Date = 16.03.2007 18:03:18 | Attr = ]

setpoint.exe -> %ProgramFiles%\Logitech\SetPoint\SetPoint.exe -> Logitech Inc. [Ver = 3.30.165 | Size = 688128 bytes | Modified Date = 30.01.2007 01:52:06 | Attr = ]

ubericon manager.exe -> %SystemRoot%\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe -> [Ver = | Size = 180224 bytes | Modified Date = 21.05.2006 09:43:08 | Attr = ]

vsmon.exe -> %System32%\ZoneLabs\vsmon.exe -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 75568 bytes | Modified Date = 09.03.2007 00:01:58 | Attr = ]

winpfind3u.exe -> %UserDesktop%\WinPFind3u\WinPFind3U.exe -> OldTimer Tools [Ver = 1.0.38.0 | Size = 318976 bytes | Modified Date = 22.05.2007 18:27:40 | Attr = ]

zlclient.exe -> %ProgramFiles%\Zone Labs\ZoneAlarm\zlclient.exe -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 919280 bytes | Modified Date = 09.03.2007 00:02:00 | Attr = ]

[Win32 Services - Non-Microsoft Only]

(a2free) a-squared Free Service [Win32_Own | Auto | Running] -> %ProgramFiles%\a-squared Free\a2service.exe -> Emsi Software GmbH [Ver = 3.0.0.276 | Size = 423032 bytes | Modified Date = 05.06.2007 13:07:04 | Attr = ]

(aawservice) Ad-Aware 2007 Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Lavasoft\Ad-Aware 2007\aawservice.exe -> Lavasoft AB [Ver = 7, 0, 1, 2 | Size = 561152 bytes | Modified Date = 05.06.2007 17:23:28 | Attr = ]

(aswUpdSv) avast! iAVS4 Control Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 16512 bytes | Modified Date = 30.04.2007 17:29:56 | Attr = ]

(avast! Antivirus) avast! Antivirus [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 132736 bytes | Modified Date = 30.04.2007 17:42:40 | Attr = ]

(avast! Mail Scanner) avast! Mail Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 243328 bytes | Modified Date = 30.04.2007 18:04:38 | Attr = ]

(avast! Web Scanner) avast! Web Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 345728 bytes | Modified Date = 30.04.2007 17:41:28 | Attr = ]

(AVG Anti-Spyware Guard) AVG Anti-Spyware Guard [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 28.09.2006 16:13:20 | Attr = ]

(CCALib8) Canon Camera Access Library 8 [Win32_Own | Disabled | Stopped] -> %ProgramFiles%\Canon\CAL\CALMAIN.exe -> Canon Inc. [Ver = 8, 2, 0, 1 | Size = 96341 bytes | Modified Date = 30.03.2006 09:15:44 | Attr = ]

(dmadmin) Service d'administration du Gestionnaire de disque logique [Win32_Shared | On_Demand | Stopped] -> %System32%\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 225280 bytes | Modified Date = 05.08.2004 14:00:00 | Attr = ]

(idsvc) Windows CardSpace [Win32_Shared | Unknown | Stopped] -> -> File not found

(iPod Service) iPod Service [Win32_Own | On_Demand | Running] -> %ProgramFiles%\iPod\bin\iPodService.exe -> Apple Inc. [Ver = 7.1.1.5 | Size = 500800 bytes | Modified Date = 27.04.2007 11:25:52 | Attr = ]

(LVPrcSrv) Logitech Process Monitor [Win32_Own | Auto | Running] -> %CommonProgramFiles%\Logitech\LVMVFM\LVPrcSrv.exe -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 81920 bytes | Modified Date = 28.07.2005 13:37:24 | Attr = ]

(NBService) NBService [Win32_Own | Disabled | Stopped] -> %ProgramFiles%\Nero\Nero 7\Nero BackItUp\NBService.exe -> Nero AG [Ver = 2, 7, 3, 2 | Size = 774144 bytes | Modified Date = 15.01.2007 17:14:38 | Attr = ]

(NMIndexingService) NMIndexingService [Win32_Own | Disabled | Stopped] -> %CommonProgramFiles%\Ahead\Lib\NMIndexingService.exe -> Nero AG [Ver = 2,0,5,0 | Size = 271920 bytes | Modified Date = 12.03.2007 13:49:46 | Attr = ]

(NVSvc) NVIDIA Display Driver Service [Win32_Own | Auto | Running] -> %System32%\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 159810 bytes | Modified Date = 22.10.2006 12:22:00 | Attr = ]

(vsmon) TrueVector Internet Monitor [Win32_Own | Auto | Running] -> %System32%\ZoneLabs\vsmon.exe -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 75568 bytes | Modified Date = 09.03.2007 00:01:58 | Attr = ]

(Windows Services Control) Windows Services Control [Win32_Own | Auto | Running] -> %System32%\drivers\services.exe -> FileZilla Project [Ver = 0, 9, 23, 0 | Size = 546816 bytes | Modified Date = 16.03.2007 18:03:18 | Attr = ]

(Windows Smss) Session Manager Subsystem [Win32_Own | Auto | Stopped] -> %System32%\drivers\etc\smss.exe -> File not found

[Registry - Non-Microsoft Only]

< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

!AVG Anti-Spyware -> %ProgramFiles%\Grisoft\AVG Anti-Spyware 7.5\avgas.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 50 | Size = 6266880 bytes | Modified Date = 23.05.2007 23:18:06 | Attr = ]

Alcmtr -> %SystemRoot%\Alcmtr.exe -> Realtek Semiconductor Corp. [Ver = 1.6.0.2 | Size = 69632 bytes | Modified Date = 03.05.2005 04:43:28 | Attr = R ]

avast! -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 75392 bytes | Modified Date = 30.04.2007 17:42:48 | Attr = ]

EasyTuneV -> %ProgramFiles%\Gigabyte\ET5\ETcall.exe -> [Ver = 1, 0, 0, 1 | Size = 24576 bytes | Modified Date = 04.01.2007 17:05:26 | Attr = ]

iTunesHelper -> %ProgramFiles%\iTunes\iTunesHelper.exe -> Apple Inc. [Ver = 7.1.1.5 | Size = 257088 bytes | Modified Date = 27.04.2007 11:25:58 | Attr = ]

Kernel and Hardware Abstraction Layer -> %SystemRoot%\KHALMNPR.Exe -> Logitech Inc. [Ver = 3.30.152 | Size = 101136 bytes | Modified Date = 23.01.2007 15:44:00 | Attr = ]

LogitechCameraService(E) -> %System32%\ElkCtrl.exe -> Logitech Inc. [Ver = 8.5.0.1137 | Size = 262144 bytes | Modified Date = 01.11.2004 18:22:22 | Attr = ]

LogitechVideo[inspector] -> %ProgramFiles%\Logitech\Video\InstallHelper.exe -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 73728 bytes | Modified Date = 28.07.2005 13:09:50 | Attr = ]

LVCOMSX -> %System32%\LVCOMSX.EXE -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 221184 bytes | Modified Date = 28.07.2005 13:30:36 | Attr = ]

NeroFilterCheck -> %CommonProgramFiles%\Ahead\Lib\NeroCheck.exe -> Nero AG [Ver = 1, 0, 0, 6 | Size = 153136 bytes | Modified Date = 09.03.2007 18:53:56 | Attr = ]

NvCplDaemon -> %System32%\nvcpl.dll [RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup] -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 7700480 bytes | Modified Date = 22.10.2006 12:22:00 | Attr = ]

NvMediaCenter -> %System32%\nvmctray.dll [RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit] -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 86016 bytes | Modified Date = 22.10.2006 12:22:00 | Attr = ]

nwiz -> %System32%\nwiz.exe -> [Ver = | Size = 1622016 bytes | Modified Date = 22.10.2006 12:22:00 | Attr = ]

QuickTime Task -> %ProgramFiles%\QuickTime\qttask.exe -> Apple Inc. [Ver = 7.1.6 | Size = 282624 bytes | Modified Date = 27.04.2007 09:41:54 | Attr = ]

RTHDCPL -> %SystemRoot%\RTHDCPL.exe -> Realtek Semiconductor Corp. [Ver = 2.1.0.8 | Size = 16269312 bytes | Modified Date = 30.10.2006 05:49:54 | Attr = R ]

SkyTel -> %SystemRoot%\SkyTel.exe -> Realtek Semiconductor Corp. [Ver = 1.0.0.0 | Size = 2879488 bytes | Modified Date = 16.05.2006 04:04:26 | Attr = R ]

SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.6.0_01\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 83608 bytes | Modified Date = 14.03.2007 03:43:44 | Attr = ]

ZoneAlarm Client -> %ProgramFiles%\Zone Labs\ZoneAlarm\zlclient.exe -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 919280 bytes | Modified Date = 09.03.2007 00:02:00 | Attr = ]

< Run [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} -> %CommonProgramFiles%\Ahead\Lib\NMBgMonitor.exe -> Nero AG [Ver = 2,0,5,0 | Size = 153136 bytes | Modified Date = 12.03.2007 13:49:26 | Attr = ]

LogitechSoftwareUpdate -> %ProgramFiles%\Logitech\Video\ManifestEngine.exe -> Logitech Inc. [Ver = 8.4.6.1012 | Size = 196608 bytes | Modified Date = 18.01.2005 17:07:54 | Attr = ]

RocketDock -> %SystemRoot%\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe -> File not found

< Common Startup > -> C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage

%AllUsersStartup%\Logitech SetPoint.lnk -> %ProgramFiles%\Logitech\SetPoint\SetPoint.exe -> Logitech Inc. [Ver = 3.30.165 | Size = 688128 bytes | Modified Date = 30.01.2007 01:52:06 | Attr = ]

< User Startup > -> C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Démarrage

%UserStartup%\UberIcon.lnk -> %SystemRoot%\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe -> [Ver = | Size = 180224 bytes | Modified Date = 21.05.2006 09:43:08 | Attr = ]

< ShellExecuteHooks [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

{57B86673-276A-48B2-BAE7-C6DBB3020EB8} [HKLM] -> %ProgramFiles%\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll [AVG Anti-Spyware 7.5] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 73728 bytes | Modified Date = 28.09.2006 16:13:28 | Attr = ]

< SecurityProviders [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders

< Winlogon settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

< Winlogon settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

< CurrentVersion Policy Settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} -> 1 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} -> 1073741857 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} -> 32 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\dontdisplaylastusername -> 0 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticecaption -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticetext -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\shutdownwithoutlogon -> 1 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\undockwithoutlogon -> 1 ->

< CurrentVersion Policy Settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ -> ->

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ -> ->

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools -> 0 ->

< HOSTS File > (686 bytes) -> C:\WINDOWS\System32\drivers\etc\Hosts

127.0.0.1 localhost -> ->

< Internet Explorer Settings > ->

HKLM: Default_Page_URL -> http://go.microsoft.com/fwlink/?LinkId=69157 ->

HKLM: Main\\Default_Search_URL -> http://go.microsoft.com/fwlink/?LinkId=54896 ->

HKLM: Local Page -> %SystemRoot%\system32\blank.htm ->

HKLM: Search Page -> http://go.microsoft.com/fwlink/?LinkId=54896 ->

HKLM: Start Page -> http://go.microsoft.com/fwlink/?LinkId=69157 ->

HKLM: CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->

HKLM: SearchAssistant -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm ->

HKCU: Local Page -> C:\WINDOWS\system32\blank.htm ->

HKCU: Search Page -> http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch ->

HKCU: Start Page -> http://www.google.ch/ ->

HKCU: ProxyEnable -> 0 ->

< Trusted Sites > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\

msn.com [ - ] -> ->

< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> %ProgramFiles%\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [AcroIEHlprObj Class] -> Adobe Systems Incorporated [Ver = 6.0.1.2003110300 | Size = 54248 bytes | Modified Date = 03.11.2003 14:17:44 | Attr = ]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> %ProgramFiles%\Java\jre1.6.0_01\bin\ssv.dll [sSVHelper Class] -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 501400 bytes | Modified Date = 14.03.2007 03:43:40 | Attr = ]

{7E853D72-626A-48EC-A868-BA8D5E23E045} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found

< Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKLM] -> %ProgramFiles%\Java\jre1.6.0_01\bin\npjpi160_01.dll [MenuText: Console Java (Sun)] -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 132760 bytes | Modified Date = 14.03.2007 03:43:42 | Attr = ]

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKCU] -> %ProgramFiles%\Java\jre1.6.0_01\bin\ssv.dll [MenuText: Console Java (Sun)] -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 501400 bytes | Modified Date = 14.03.2007 03:43:40 | Attr = ]

{e2e2dd38-d088-4134-82b7-f2ba38496583} [HKLM] -> Reg Data - Key not found [MenuText: @xpsp3res.dll,-20001] -> File not found

< Internet Explorer Menu Extensions [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\

E&xporter vers Microsoft Excel -> -> File not found

< DNS Name Servers [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\

{0B614A95-6B20-4BF2-8464-46E18BE41C23} -> (NVIDIA nForce Networking Controller) ->

{10F7F75A-1D2C-4ECC-A225-E43214C24C80} -> (Carte réseau 1394) ->

{5A6C5CE7-068D-4216-B075-842855825BE4} -> () ->

< Protocol Handlers [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\

ipp -> Reg Data - Key not found -> File not found

msdaipp -> Reg Data - Key not found -> File not found

< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\

{6414512B-B978-451D-A0D8-FCFDF33E833C} -> WUWebControl Class - CodeBase = http://update.microsoft.com/windowsupdate/...b?1179948593140 ->

{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} -> MUWebControl Class - CodeBase = http://www.update.microsoft.com/microsoftu...b?1181062549765 ->

{8AD9C840-044E-11D1-B3E9-00805F499D93} -> Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab ->

{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} -> Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab ->

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -> Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab ->

[Registry - Additional Scans - Non-Microsoft Only]

< Security Settings > ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\FirstRunDisabled -> 1 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\AntiVirusDisableNotify -> 0 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\FirewallDisableNotify -> 0 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\UpdatesDisableNotify -> 0 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\AntiVirusOverride -> 0 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\FirewallOverride -> 0 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall\\DisableMonitoring -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\Type -> 32 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\Start -> 3 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\ErrorControl -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\ImagePath -> %SystemRoot%\system32\svchost.exe -k netsvcs ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\DisplayName -> Service de transfert intelligent en arrière-plan ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\DependOnService -> RpcSs; ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\DependOnGroup -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\ObjectName -> LocalSystem ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\Description -> Transfère des données entre les clients et les serveurs en tâche de fond. Si le service BITS est désactivé, les fonctionnalités telles que Windows Update ne fonctionneront pas correctement. ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\FailureActions ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Parameters\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Parameters\\ServiceDll -> C:\WINDOWS\system32\qmgr.dll ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Security\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Security\\Security ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Enum\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Enum\ -> Root\LEGACY_BITS00 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Enum\\Count -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Enum\\NextInstance -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\DependOnGroup -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\DependOnService -> Netman;WinMgmt; ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\Description -> Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\DisplayName -> Windows Firewall/Internet Connection Sharing (ICS) ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\ErrorControl -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\ImagePath -> %SystemRoot%\system32\svchost.exe -k netsvcs ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\ObjectName -> LocalSystem ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\Start -> 2 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\Type -> 32 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch\\Epoch -> 2312 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\\ServiceDll -> %SystemRoot%\System32\ipnathlp.dll ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\%windir%\system32\sessmgr.exe -> %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\%windir%\Network Diagnostic\xpnetdiag.exe -> %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msnmsgr.exe -> C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\livecall.exe -> C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\\EnableFirewall -> 0 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\\DoNotAllowExceptions -> 0 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\%windir%\system32\sessmgr.exe -> %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Azureus\Azureus.exe -> C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\drivers\etc\smss.exe -> C:\WINDOWS\system32\drivers\etc\smss.exe:*:Enabled:Bittorrent Program ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\drivers\services.exe -> C:\WINDOWS\system32\drivers\services.exe:*:Enabled:Bittorrent Program ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\iTunes\iTunes.exe -> C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\ZoneLabs\vsmon.exe -> C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:TrueVector Service ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\%windir%\Network Diagnostic\xpnetdiag.exe -> %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msnmsgr.exe -> C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\livecall.exe -> C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE -> C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\4000:TCP -> 4000:TCP:*:Enabled:Bittorrent ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\4001:TCP -> 4001:TCP:*:Enabled:Bittorrent ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\4002:TCP -> 4002:TCP:*:Enabled:Bittorrent ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\4003:TCP -> 4003:TCP:*:Enabled:Bittorrent ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\4004:TCP -> 4004:TCP:*:Enabled:Bittorrent ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\4005:TCP -> 4005:TCP:*:Enabled:Bittorrent ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\50021:TCP -> 50021:TCP:*:Enabled:Bittorrent ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\\ServiceUpgrade -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate\\All -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\ -> Root\LEGACY_SHAREDACCESS00 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\\Count -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\\NextInstance -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\Type -> 32 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\Start -> 2 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\ErrorControl -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\ImagePath -> %systemroot%\system32\svchost.exe -k netsvcs ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\DisplayName -> Mises à jour automatiques ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\ObjectName -> LocalSystem ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\Description -> Active le téléchargement et l'installation des mises à jour Windows. Si ce service est désactivé, cet ordinateur ne pourra pas utiliser la fonctionnalité des mises à jour automatiques ou le site Windows Update. ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters\\ServiceDll -> C:\WINDOWS\system32\wuauserv.dll ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Security\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Security\\Security ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\ -> Root\LEGACY_WUAUSERV00 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\\Count -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\\NextInstance -> 1 ->

[Files/Folders - Created Within 60 days]

AUTOEXEC.BAT -> %SystemDrive%\AUTOEXEC.BAT -> [Ver = | Size = 0 bytes | Created Date = 23.05.2007 19:55:35 | Attr = ]

boot.ini -> %SystemDrive%\boot.ini -> [Ver = | Size = 228 bytes | Created Date = 24.05.2007 03:30:59 | Attr = RHS]

CONFIG.SYS -> %SystemDrive%\CONFIG.SYS -> [Ver = | Size = 0 bytes | Created Date = 23.05.2007 19:55:35 | Attr = ]

diff.exe -> %SystemDrive%\diff.exe -> [Ver = | Size = 68096 bytes | Created Date = 09.06.2007 11:14:15 | Attr = ]

Documents and Settings -> %SystemDrive%\Documents and Settings -> [Folder | Created Date = 24.05.2007 03:32:04 | Attr = ]

grep.exe -> %SystemDrive%\grep.exe -> [Ver = | Size = 103424 bytes | Created Date = 09.06.2007 11:14:15 | Attr = ]

IO.SYS -> %SystemDrive%\IO.SYS -> [Ver = | Size = 0 bytes | Created Date = 23.05.2007 19:55:35 | Attr = RHS]

MSDOS.SYS -> %SystemDrive%\MSDOS.SYS -> [Ver = | Size = 0 bytes | Created Date = 23.05.2007 19:55:35 | Attr = RHS]

MSOCache -> %SystemDrive%\MSOCache -> [Folder | Created Date = 25.05.2007 16:57:09 | Attr = RH ]

NVIDIA -> %SystemDrive%\NVIDIA -> [Folder | Created Date = 29.05.2007 23:50:21 | Attr = ]

Program Files -> %ProgramFiles% -> [Folder | Created Date = 24.05.2007 03:35:10 | Attr = R ]

reboot.cmd -> %SystemDrive%\reboot.cmd -> [Ver = | Size = 853 bytes | Created Date = 09.06.2007 11:14:15 | Attr = ]

RECYCLER -> %SystemDrive%\RECYCLER -> [Folder | Created Date = 23.05.2007 20:19:38 | Attr = HS]

SDFix -> %SystemDrive%\SDFix -> [Folder | Created Date = 09.06.2007 11:36:31 | Attr = ]

System Volume Information -> %SystemDrive%\System Volume Information -> [Folder | Created Date = 20.08.1674 17:53:12 | Attr = HS]

WINDOWS -> %SystemRoot% -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

$hf_mig$ -> %SystemRoot%\$hf_mig$ -> [Folder | Created Date = 23.05.2007 20:33:23 | Attr = H ]

$MSI31Uninstall_KB893803v2$ -> %SystemRoot%\$MSI31Uninstall_KB893803v2$ -> [Folder | Created Date = 23.05.2007 20:33:15 | Attr = H ]

$NtServicePackUninstallIDNMitigationAPIs$ -> %SystemRoot%\$NtServicePackUninstallIDNMitigationAPIs$ -> [Folder | Created Date = 23.05.2007 22:34:03 | Attr = H ]

$NtServicePackUninstallNLSDownlevelMapping$ -> %SystemRoot%\$NtServicePackUninstallNLSDownlevelMapping$ -> [Folder | Created Date = 23.05.2007 22:33:54 | Attr = H ]

$NtUninstallKB873339$ -> %SystemRoot%\$NtUninstallKB873339$ -> [Folder | Created Date = 23.05.2007 21:20:04 | Attr = H ]

$NtUninstallKB885835$ -> %SystemRoot%\$NtUninstallKB885835$ -> [Folder | Created Date = 23.05.2007 21:20:27 | Attr = H ]

$NtUninstallKB885836$ -> %SystemRoot%\$NtUninstallKB885836$ -> [Folder | Created Date = 23.05.2007 21:20:14 | Attr = H ]

$NtUninstallKB886185$ -> %SystemRoot%\$NtUninstallKB886185$ -> [Folder | Created Date = 23.05.2007 21:20:11 | Attr = H ]

$NtUninstallKB887472$ -> %SystemRoot%\$NtUninstallKB887472$ -> [Folder | Created Date = 23.05.2007 21:20:20 | Attr = H ]

$NtUninstallKB888111WXPSP2$ -> %SystemRoot%\$NtUninstallKB888111WXPSP2$ -> [Folder | Created Date = 23.05.2007 20:04:35 | Attr = H ]

$NtUninstallKB888302$ -> %SystemRoot%\$NtUninstallKB888302$ -> [Folder | Created Date = 23.05.2007 21:20:17 | Attr = H ]

$NtUninstallKB890046$ -> %SystemRoot%\$NtUninstallKB890046$ -> [Folder | Created Date = 23.05.2007 22:35:18 | Attr = H ]

$NtUninstallKB890859$ -> %SystemRoot%\$NtUninstallKB890859$ -> [Folder | Created Date = 23.05.2007 21:20:38 | Attr = H ]

$NtUninstallKB891781$ -> %SystemRoot%\$NtUninstallKB891781$ -> [Folder | Created Date = 23.05.2007 21:20:24 | Attr = H ]

$NtUninstallKB893756$ -> %SystemRoot%\$NtUninstallKB893756$ -> [Folder | Created Date = 23.05.2007 21:20:46 | Attr = H ]

$NtUninstallKB894391$ -> %SystemRoot%\$NtUninstallKB894391$ -> [Folder | Created Date = 23.05.2007 21:20:56 | Attr = H ]

$NtUninstallKB896358$ -> %SystemRoot%\$NtUninstallKB896358$ -> [Folder | Created Date = 23.05.2007 21:20:43 | Attr = H ]

$NtUninstallKB896423$ -> %SystemRoot%\$NtUninstallKB896423$ -> [Folder | Created Date = 23.05.2007 21:20:54 | Attr = H ]

$NtUninstallKB896428$ -> %SystemRoot%\$NtUninstallKB896428$ -> [Folder | Created Date = 23.05.2007 21:20:31 | Attr = H ]

$NtUninstallKB898461$ -> %SystemRoot%\$NtUninstallKB898461$ -> [Folder | Created Date = 23.05.2007 20:33:23 | Attr = H ]

$NtUninstallKB899587$ -> %SystemRoot%\$NtUninstallKB899587$ -> [Folder | Created Date = 23.05.2007 21:20:51 | Attr = H ]

$NtUninstallKB899591$ -> %SystemRoot%\$NtUninstallKB899591$ -> [Folder | Created Date = 23.05.2007 21:20:49 | Attr = H ]

$NtUninstallKB900485$ -> %SystemRoot%\$NtUninstallKB900485$ -> [Folder | Created Date = 23.05.2007 21:21:45 | Attr = H ]

$NtUninstallKB900725$ -> %SystemRoot%\$NtUninstallKB900725$ -> [Folder | Created Date = 23.05.2007 21:21:16 | Attr = H ]

$NtUninstallKB901017$ -> %SystemRoot%\$NtUninstallKB901017$ -> [Folder | Created Date = 23.05.2007 21:21:07 | Attr = H ]

$NtUninstallKB901214$ -> %SystemRoot%\$NtUninstallKB901214$ -> [Folder | Created Date = 23.05.2007 21:20:35 | Attr = H ]

$NtUninstallKB902400$ -> %SystemRoot%\$NtUninstallKB902400$ -> [Folder | Created Date = 23.05.2007 21:21:01 | Attr = H ]

$NtUninstallKB904706$ -> %SystemRoot%\$NtUninstallKB904706$ -> [Folder | Created Date = 23.05.2007 21:21:24 | Attr = H ]

$NtUninstallKB904942$ -> %SystemRoot%\$NtUninstallKB904942$ -> [Folder | Created Date = 23.05.2007 21:22:15 | Attr = H ]

$NtUninstallKB905414$ -> %SystemRoot%\$NtUninstallKB905414$ -> [Folder | Created Date = 23.05.2007 21:21:10 | Attr = H ]

$NtUninstallKB905749$ -> %SystemRoot%\$NtUninstallKB905749$ -> [Folder | Created Date = 23.05.2007 21:21:13 | Attr = H ]

$NtUninstallKB908519$ -> %SystemRoot%\$NtUninstallKB908519$ -> [Folder | Created Date = 23.05.2007 21:21:27 | Attr = H ]

$NtUninstallKB908531$ -> %SystemRoot%\$NtUninstallKB908531$ -> [Folder | Created Date = 23.05.2007 21:21:47 | Attr = H ]

$NtUninstallKB910437$ -> %SystemRoot%\$NtUninstallKB910437$ -> [Folder | Created Date = 23.05.2007 21:21:21 | Attr = H ]

$NtUninstallKB911280$ -> %SystemRoot%\$NtUninstallKB911280$ -> [Folder | Created Date = 23.05.2007 21:22:12 | Attr = H ]

$NtUninstallKB911562$ -> %SystemRoot%\$NtUninstallKB911562$ -> [Folder | Created Date = 23.05.2007 21:21:41 | Attr = H ]

$NtUninstallKB911564$ -> %SystemRoot%\$NtUninstallKB911564$ -> [Folder | Created Date = 23.05.2007 21:21:37 | Attr = H ]

$NtUninstallKB911927$ -> %SystemRoot%\$NtUninstallKB911927$ -> [Folder | Created Date = 23.05.2007 21:21:29 | Attr = H ]

$NtUninstallKB913580$ -> %SystemRoot%\$NtUninstallKB913580$ -> [Folder | Created Date = 23.05.2007 21:22:06 | Attr = H ]

$NtUninstallKB914388$ -> %SystemRoot%\$NtUninstallKB914388$ -> [Folder | Created Date = 23.05.2007 21:22:18 | Attr = H ]

$NtUninstallKB914389$ -> %SystemRoot%\$NtUninstallKB914389$ -> [Folder | Created Date = 23.05.2007 21:21:58 | Attr = H ]

$NtUninstallKB914440$ -> %SystemRoot%\$NtUninstallKB914440$ -> [Folder | Created Date = 23.05.2007 22:33:14 | Attr = H ]

$NtUninstallKB915800$ -> %SystemRoot%\$NtUninstallKB915800$ -> [Folder | Created Date = 26.05.2007 02:27:08 | Attr = H ]

$NtUninstallKB915865$ -> %SystemRoot%\$NtUninstallKB915865$ -> [Folder | Created Date = 23.05.2007 22:33:45 | Attr = H ]

$NtUninstallKB916595$ -> %SystemRoot%\$NtUninstallKB916595$ -> [Folder | Created Date = 23.05.2007 21:22:35 | Attr = H ]

$NtUninstallKB917344$ -> %SystemRoot%\$NtUninstallKB917344$ -> [Folder | Created Date = 23.05.2007 21:22:01 | Attr = H ]

$NtUninstallKB917422$ -> %SystemRoot%\$NtUninstallKB917422$ -> [Folder | Created Date = 23.05.2007 21:22:21 | Attr = H ]

$NtUninstallKB917734_WMP9$ -> %SystemRoot%\$NtUninstallKB917734_WMP9$ -> [Folder | Created Date = 23.05.2007 21:21:54 | Attr = H ]

$NtUninstallKB917953$ -> %SystemRoot%\$NtUninstallKB917953$ -> [Folder | Created Date = 23.05.2007 21:22:09 | Attr = H ]

$NtUninstallKB918118$ -> %SystemRoot%\$NtUninstallKB918118$ -> [Folder | Created Date = 23.05.2007 21:23:51 | Attr = H ]

$NtUninstallKB918439$ -> %SystemRoot%\$NtUninstallKB918439$ -> [Folder | Created Date = 23.05.2007 21:22:03 | Attr = H ]

$NtUninstallKB919007$ -> %SystemRoot%\$NtUninstallKB919007$ -> [Folder | Created Date = 23.05.2007 21:22:38 | Attr = H ]

$NtUninstallKB920213$ -> %SystemRoot%\$NtUninstallKB920213$ -> [Folder | Created Date = 23.05.2007 22:35:21 | Attr = H ]

$NtUninstallKB920670$ -> %SystemRoot%\$NtUninstallKB920670$ -> [Folder | Created Date = 23.05.2007 21:22:24 | Attr = H ]

$NtUninstallKB920683$ -> %SystemRoot%\$NtUninstallKB920683$ -> [Folder | Created Date = 23.05.2007 21:22:27 | Attr = H ]

$NtUninstallKB920685$ -> %SystemRoot%\$NtUninstallKB920685$ -> [Folder | Created Date = 23.05.2007 21:22:41 | Attr = H ]

$NtUninstallKB920872$ -> %SystemRoot%\$NtUninstallKB920872$ -> [Folder | Created Date = 23.05.2007 21:22:45 | Attr = H ]

$NtUninstallKB922582$ -> %SystemRoot%\$NtUninstallKB922582$ -> [Folder | Created Date = 23.05.2007 21:22:32 | Attr = H ]

$NtUninstallKB922819$ -> %SystemRoot%\$NtUninstallKB922819$ -> [Folder | Created Date = 23.05.2007 21:23:01 | Attr = H ]

$NtUninstallKB923191$ -> %SystemRoot%\$NtUninstallKB923191$ -> [Folder | Created Date = 23.05.2007 21:22:54 | Attr = H ]

$NtUninstallKB923414$ -> %SystemRoot%\$NtUninstallKB923414$ -> [Folder | Created Date = 23.05.2007 21:22:48 | Attr = H ]

$NtUninstallKB923689$ -> %SystemRoot%\$NtUninstallKB923689$ -> [Folder | Created Date = 23.05.2007 21:23:30 | Attr = H ]

$NtUninstallKB923694$ -> %SystemRoot%\$NtUninstallKB923694$ -> [Folder | Created Date = 23.05.2007 21:23:18 | Attr = H ]

$NtUninstallKB923980$ -> %SystemRoot%\$NtUninstallKB923980$ -> [Folder | Created Date = 23.05.2007 21:23:12 | Attr = H ]

$NtUninstallKB924191$ -> %SystemRoot%\$NtUninstallKB924191$ -> [Folder | Created Date = 23.05.2007 21:22:58 | Attr = H ]

$NtUninstallKB924270$ -> %SystemRoot%\$NtUninstallKB924270$ -> [Folder | Created Date = 23.05.2007 21:23:04 | Attr = H ]

$NtUninstallKB924496$ -> %SystemRoot%\$NtUninstallKB924496$ -> [Folder | Created Date = 23.05.2007 21:22:51 | Attr = H ]

$NtUninstallKB924667$ -> %SystemRoot%\$NtUninstallKB924667$ -> [Folder | Created Date = 23.05.2007 21:23:46 | Attr = H ]

$NtUninstallKB925398_WMP64$ -> %SystemRoot%\$NtUninstallKB925398_WMP64$ -> [Folder | Created Date = 23.05.2007 21:23:24 | Attr = H ]

$NtUninstallKB925720$ -> %SystemRoot%\$NtUninstallKB925720$ -> [Folder | Created Date = 23.05.2007 22:32:06 | Attr = H ]

$NtUninstallKB925902$ -> %SystemRoot%\$NtUninstallKB925902$ -> [Folder | Created Date = 23.05.2007 22:32:14 | Attr = H ]

$NtUninstallKB926239$ -> %SystemRoot%\$NtUninstallKB926239$ -> [Folder | Created Date = 23.05.2007 21:49:50 | Attr = H ]

$NtUninstallKB926255$ -> %SystemRoot%\$NtUninstallKB926255$ -> [Folder | Created Date = 23.05.2007 21:23:15 | Attr = H ]

$NtUninstallKB926436$ -> %SystemRoot%\$NtUninstallKB926436$ -> [Folder | Created Date = 23.05.2007 21:23:55 | Attr = H ]

$NtUninstallKB927779$ -> %SystemRoot%\$NtUninstallKB927779$ -> [Folder | Created Date = 23.05.2007 21:23:48 | Attr = H ]

$NtUninstallKB927802$ -> %SystemRoot%\$NtUninstallKB927802$ -> [Folder | Created Date = 23.05.2007 21:23:43 | Attr = H ]

$NtUninstallKB927891$ -> %SystemRoot%\$NtUninstallKB927891$ -> [Folder | Created Date = 23.05.2007 22:36:05 | Attr = H ]

$NtUninstallKB928255$ -> %SystemRoot%\$NtUninstallKB928255$ -> [Folder | Created Date = 23.05.2007 21:23:35 | Attr = H ]

$NtUninstallKB928843$ -> %SystemRoot%\$NtUninstallKB928843$ -> [Folder | Created Date = 23.05.2007 21:23:40 | Attr = H ]

$NtUninstallKB929399$ -> %SystemRoot%\$NtUninstallKB929399$ -> [Folder | Created Date = 23.05.2007 22:32:30 | Attr = H ]

$NtUninstallKB929969$ -> %SystemRoot%\$NtUninstallKB929969$ -> [Folder | Created Date = 23.05.2007 21:23:32 | Attr = H ]

$NtUninstallKB930178$ -> %SystemRoot%\$NtUninstallKB930178$ -> [Folder | Created Date = 23.05.2007 22:32:40 | Attr = H ]

$NtUninstallKB930916$ -> %SystemRoot%\$NtUninstallKB930916$ -> [Folder | Created Date = 23.05.2007 22:35:25 | Attr = H ]

$NtUninstallKB931261$ -> %SystemRoot%\$NtUninstallKB931261$ -> [Folder | Created Date = 23.05.2007 22:32:43 | Attr = H ]

$NtUninstallKB931768$ -> %SystemRoot%\$NtUninstallKB931768$ -> [Folder | Created Date = 23.05.2007 22:35:29 | Attr = H ]

$NtUninstallKB931784$ -> %SystemRoot%\$NtUninstallKB931784$ -> [Folder | Created Date = 23.05.2007 22:32:34 | Attr = H ]

$NtUninstallKB931836$ -> %SystemRoot%\$NtUninstallKB931836$ -> [Folder | Created Date = 23.05.2007 21:23:58 | Attr = H ]

$NtUninstallKB932168$ -> %SystemRoot%\$NtUninstallKB932168$ -> [Folder | Created Date = 23.05.2007 22:35:11 | Attr = H ]

$NtUninstallKB935448$ -> %SystemRoot%\$NtUninstallKB935448$ -> [Folder | Created Date = 23.05.2007 22:35:14 | Attr = H ]

$NtUninstallMSCompPackV1$ -> %SystemRoot%\$NtUninstallMSCompPackV1$ -> [Folder | Created Date = 23.05.2007 21:49:45 | Attr = H ]

$NtUninstallWdf01005$ -> %SystemRoot%\$NtUninstallWdf01005$ -> [Folder | Created Date = 23.05.2007 22:09:48 | Attr = H ]

$NtUninstallWIC$ -> %SystemRoot%\$NtUninstallWIC$ -> [Folder | Created Date = 23.05.2007 21:51:52 | Attr = H ]

$NtUninstallWMFDist11$ -> %SystemRoot%\$NtUninstallWMFDist11$ -> [Folder | Created Date = 23.05.2007 21:49:06 | Attr = H ]

$NtUninstallwmp11$ -> %SystemRoot%\$NtUninstallwmp11$ -> [Folder | Created Date = 23.05.2007 21:49:28 | Attr = H ]

$NtUninstallWudf01000$ -> %SystemRoot%\$NtUninstallWudf01000$ -> [Folder | Created Date = 23.05.2007 21:48:52 | Attr = H ]

addins -> %SystemRoot%\addins -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

Alcmtr.exe -> %SystemRoot%\Alcmtr.exe -> Realtek Semiconductor Corp. [Ver = 1.6.0.2 | Size = 69632 bytes | Created Date = 23.05.2007 20:04:11 | Attr = R ]

alcwzrd.exe -> %SystemRoot%\alcwzrd.exe -> RealTek Semicoductor Corp. [Ver = 1.1.0.36 | Size = 2808832 bytes | Created Date = 23.05.2007 20:04:10 | Attr = R ]

AppPatch -> %SystemRoot%\AppPatch -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

assembly -> %SystemRoot%\assembly -> [Folder | Created Date = 23.05.2007 21:50:29 | Attr = R S]

BlendSettings.ini -> %SystemRoot%\BlendSettings.ini -> [Ver = | Size = 23 bytes | Created Date = 02.06.2007 16:45:23 | Attr = ]

bootstat.dat -> %SystemRoot%\bootstat.dat -> [Ver = | Size = 2048 bytes | Created Date = 23.05.2007 19:57:11 | Attr = S]

BricoPack Wallpaper.bmp -> %SystemRoot%\BricoPack Wallpaper.bmp -> [Ver = | Size = 5292054 bytes | Created Date = 05.06.2007 18:25:55 | Attr = ]

BricoPackFoldersDelete.cmd -> %SystemRoot%\BricoPackFoldersDelete.cmd -> [Ver = | Size = 6120 bytes | Created Date = 05.06.2007 18:23:51 | Attr = ]

BricoPacks -> %SystemRoot%\BricoPacks -> [Folder | Created Date = 05.06.2007 18:23:26 | Attr = ]

BricoPackUninst.cmd -> %SystemRoot%\BricoPackUninst.cmd -> [Ver = | Size = 64801 bytes | Created Date = 05.06.2007 18:26:11 | Attr = ]

Bulles de savon.bmp -> %SystemRoot%\Bulles de savon.bmp -> [Ver = | Size = 65978 bytes | Created Date = 23.05.2007 19:52:55 | Attr = ]

Cache -> %SystemRoot%\Cache -> [Folder | Created Date = 23.05.2007 20:15:53 | Attr = ]

Config -> %SystemRoot%\Config -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

config.ini -> %SystemRoot%\config.ini -> [Ver = | Size = 41 bytes | Created Date = 23.05.2007 22:49:29 | Attr = ]

Connection Wizard -> %SystemRoot%\Connection Wizard -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

control.ini -> %SystemRoot%\control.ini -> [Ver = | Size = 0 bytes | Created Date = 23.05.2007 19:55:35 | Attr = ]

Cursors -> %SystemRoot%\Cursors -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

Debug -> %SystemRoot%\Debug -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

desktop.ini -> %SystemRoot%\desktop.ini -> [Ver = | Size = 2 bytes | Created Date = 23.05.2007 19:54:20 | Attr = ]

DIIUnin.dat -> %SystemRoot%\DIIUnin.dat -> [Ver = | Size = 35662 bytes | Created Date = 29.05.2007 18:44:47 | Attr = ]

DIIUnin.exe -> %SystemRoot%\DIIUnin.exe -> Blizzard Entertainment [Ver = 1, 0, 0, 5 | Size = 102400 bytes | Created Date = 29.05.2007 18:44:44 | Attr = ]

DIIUnin.pif -> %SystemRoot%\DIIUnin.pif -> [Ver = | Size = 2829 bytes | Created Date = 29.05.2007 18:44:44 | Attr = ]

Downloaded Installations -> %SystemRoot%\Downloaded Installations -> [Folder | Created Date = 29.05.2007 21:27:53 | Attr = ]

Downloaded Program Files -> %SystemRoot%\Downloaded Program Files -> [Folder | Created Date = 23.05.2007 19:54:57 | Attr = S]

Driver Cache -> %SystemRoot%\Driver Cache -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

Fonts -> %SystemRoot%\Fonts -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = R S]

GPInstall.exe -> %SystemRoot%\GPInstall.exe -> Qsc [Ver = 5.0.3.32 | Size = 796672 bytes | Created Date = 28.05.2007 17:18:18 | Attr = ]

Granit vert.bmp -> %SystemRoot%\Granit vert.bmp -> [Ver = | Size = 26582 bytes | Created Date = 23.05.2007 19:52:56 | Attr = ]

Help -> %SystemRoot%\Help -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

ie7 -> %SystemRoot%\ie7 -> [Folder | Created Date = 23.05.2007 22:34:11 | Attr = H ]

ie7updates -> %SystemRoot%\ie7updates -> [Folder | Created Date = 24.05.2007 20:14:23 | Attr = ]

ime -> %SystemRoot%\ime -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

imsins.BAK -> %SystemRoot%\imsins.BAK -> [Ver = | Size = 1374 bytes | Created Date = 24.05.2007 03:35:15 | Attr = ]

inf -> %SystemRoot%\inf -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = H ]

Installer -> %SystemRoot%\Installer -> [Folder | Created Date = 24.05.2007 03:35:13 | Attr = HS]

Instexec.exe -> %SystemRoot%\Instexec.exe -> Logitech [Ver = 1, 0, 0, 16 | Size = 233536 bytes | Created Date = 26.05.2007 18:08:40 | Attr = R ]

Internet Logs -> %SystemRoot%\Internet Logs -> [Folder | Created Date = 23.05.2007 22:10:27 | Attr = ]

IsUninst.exe -> %SystemRoot%\IsUninst.exe -> InstallShield Software Corporation [Ver = 5, 50, 137, 0 | Size = 327168 bytes | Created Date = 23.05.2007 20:16:45 | Attr = ]

java -> %SystemRoot%\java -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

Jour de pêche.bmp -> %SystemRoot%\Jour de pêche.bmp -> [Ver = | Size = 17336 bytes | Created Date = 23.05.2007 19:52:56 | Attr = ]

KHALMNPR.Exe -> %SystemRoot%\KHALMNPR.Exe -> Logitech Inc. [Ver = 3.30.152 | Size = 101136 bytes | Created Date = 23.05.2007 22:09:27 | Attr = ]

Lic.xxx -> %SystemRoot%\Lic.xxx -> [Ver = | Size = 26 bytes | Created Date = 08.06.2007 23:55:43 | Attr = ]

logo1_.exe -> %SystemRoot%\logo1_.exe -> [Folder | Created Date = 09.06.2007 00:06:48 | Attr = ]

Media -> %SystemRoot%\Media -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

MicCal.exe -> %SystemRoot%\MicCal.exe -> Realtek Semiconductor Corp. [Ver = 1.1.1.6 | Size = 2157568 bytes | Created Date = 23.05.2007 20:04:12 | Attr = R ]

Microsoft.NET -> %SystemRoot%\Microsoft.NET -> [Folder | Created Date = 23.05.2007 21:50:12 | Attr = ]

mozver.dat -> %SystemRoot%\mozver.dat -> [Ver = | Size = 1550 bytes | Created Date = 23.05.2007 21:52:19 | Attr = ]

msagent -> %SystemRoot%\msagent -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

msapps -> %SystemRoot%\msapps -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

mui -> %SystemRoot%\mui -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

Mur de Santa Fe.bmp -> %SystemRoot%\Mur de Santa Fe.bmp -> [Ver = | Size = 65832 bytes | Created Date = 23.05.2007 19:52:56 | Attr = ]

NeroDigital.ini -> %SystemRoot%\NeroDigital.ini -> [Ver = | Size = 69 bytes | Created Date = 27.05.2007 10:15:06 | Attr = ]

network diagnostic -> %SystemRoot%\network diagnostic -> [Folder | Created Date = 23.05.2007 22:33:15 | Attr = ]

nsreg.dat -> %SystemRoot%\nsreg.dat -> [Ver = | Size = 0 bytes | Created Date = 23.05.2007 20:30:07 | Attr = ]

NV33681796.TMP -> %SystemRoot%\NV33681796.TMP -> [Folder | Created Date = 29.05.2007 23:50:56 | Attr = ]

nview -> %SystemRoot%\nview -> [Folder | Created Date = 23.05.2007 20:20:54 | Attr = ]

ODBCINST.INI -> %SystemRoot%\ODBCINST.INI -> [Ver = | Size = 4205 bytes | Created Date = 24.05.2007 03:35:13 | Attr = ]

Offline Web Pages -> %SystemRoot%\Offline Web Pages -> [Folder | Created Date = 23.05.2007 19:54:57 | Attr = R ]

pchealth -> %SystemRoot%\pchealth -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

PeerNet -> %SystemRoot%\PeerNet -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

Plume.bmp -> %SystemRoot%\Plume.bmp -> [Ver = | Size = 16730 bytes | Created Date = 23.05.2007 19:52:56 | Attr = ]

Prefetch -> %SystemRoot%\Prefetch -> [Folder | Created Date = 23.05.2007 20:01:53 | Attr = ]

Provisioning -> %SystemRoot%\Provisioning -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

pss -> %SystemRoot%\pss -> [Folder | Created Date = 03.06.2007 18:07:35 | Attr = ]

QTFont.for -> %SystemRoot%\QTFont.for -> [Ver = | Size = 1409 bytes | Created Date = 02.06.2007 10:13:10 | Attr = ]

QTFont.qfn -> %SystemRoot%\QTFont.qfn -> [Ver = | Size = 54156 bytes | Created Date = 02.06.2007 10:13:10 | Attr = H ]

Registration -> %SystemRoot%\Registration -> [Folder | Created Date = 23.05.2007 19:53:31 | Attr = ]

REGLOCS.OLD -> %SystemRoot%\REGLOCS.OLD -> [Ver = | Size = 8192 bytes | Created Date = 23.05.2007 19:58:12 | Attr = ]

repair -> %SystemRoot%\repair -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

Resources -> %SystemRoot%\Resources -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

Rhododendron.bmp -> %SystemRoot%\Rhododendron.bmp -> [Ver = | Size = 17362 bytes | Created Date = 23.05.2007 19:52:56 | Attr = ]

Rivière Sumida.bmp -> %SystemRoot%\Rivière Sumida.bmp -> [Ver = | Size = 26680 bytes | Created Date = 23.05.2007 19:52:56 | Attr = ]

Rosace bleue 16.bmp -> %SystemRoot%\Rosace bleue 16.bmp -> [Ver = | Size = 1272 bytes | Created Date = 23.05.2007 19:52:55 | Attr = ]

RTHDCPL.exe -> %SystemRoot%\RTHDCPL.exe -> Realtek Semiconductor Corp. [Ver = 2.1.0.8 | Size = 16269312 bytes | Created Date = 23.05.2007 20:04:13 | Attr = R ]

RTLCPL.exe -> %SystemRoot%\RTLCPL.exe -> Realtek Semiconductor Corp. [Ver = 1.0.1.64 | Size = 9709568 bytes | Created Date = 23.05.2007 20:04:18 | Attr = R ]

RtlExUpd.dll -> %SystemRoot%\RtlExUpd.dll -> Realtek Semiconductor Corp. [Ver = 1, 0, 0, 4 | Size = 499712 bytes | Created Date = 23.05.2007 20:04:50 | Attr = R ]

RtlUpd.exe -> %SystemRoot%\RtlUpd.exe -> Realtek Semiconductor Corp. [Ver = 2, 7, 0, 1 | Size = 1183744 bytes | Created Date = 23.05.2007 20:04:22 | Attr = R ]

rundl132.dll -> %SystemRoot%\rundl132.dll -> [Folder | Created Date = 09.06.2007 00:06:48 | Attr = ]

rundll16.exe -> %SystemRoot%\rundll16.exe -> [Folder | Created Date = 09.06.2007 00:06:48 | Attr = ]

security -> %SystemRoot%\security -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

SET3.tmp -> %SystemRoot%\SET3.tmp -> [Ver = | Size = 1014836 bytes | Created Date = 24.05.2007 03:33:01 | Attr = R ]

SET4.tmp -> %SystemRoot%\SET4.tmp -> [Ver = | Size = 1086058 bytes | Created Date = 24.05.2007 03:33:02 | Attr = R ]

SET8.tmp -> %SystemRoot%\SET8.tmp -> [Ver = | Size = 14043 bytes | Created Date = 24.05.2007 03:33:04 | Attr = R ]

SHELLNEW -> %SystemRoot%\SHELLNEW -> [Folder | Created Date = 25.05.2007 16:57:37 | Attr = ]

SkyTel.exe -> %SystemRoot%\SkyTel.exe -> Realtek Semiconductor Corp. [Ver = 1.0.0.0 | Size = 2879488 bytes | Created Date = 23.05.2007 20:04:23 | Attr = R ]

SoftwareDistribution -> %SystemRoot%\SoftwareDistribution -> [Folder | Created Date = 23.05.2007 20:01:54 | Attr = ]

SoundMan.exe -> %SystemRoot%\SoundMan.exe -> Realtek Semiconductor Corp. [Ver = 1, 0, 0, 30 | Size = 86016 bytes | Created Date = 23.05.2007 20:04:23 | Attr = R ]

srchasst -> %SystemRoot%\srchasst -> [Folder | Created Date = 23.05.2007 19:54:08 | Attr = ]

SxsCaPendDel -> %SystemRoot%\SxsCaPendDel -> [Folder | Created Date = 02.06.2007 11:56:32 | Attr = ]

system -> %SystemRoot%\system -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

system32 -> %System32% -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

Tasks -> %SystemRoot%\Tasks -> [Folder | Created Date = 23.05.2007 19:54:12 | Attr = S]

Tasse à café.bmp -> %SystemRoot%\Tasse à café.bmp -> [Ver = | Size = 17062 bytes | Created Date = 23.05.2007 19:52:55 | Attr = ]

Temp -> %SystemRoot%\Temp -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

Thumbs.db -> %SystemRoot%\Thumbs.db -> [Ver = | Size = 9216 bytes | Created Date = 07.06.2007 22:01:00 | Attr = HS]

@Alternate Data Stream - 0 bytes -> %SystemRoot%\Thumbs.db:encryptable ->

twain_32 -> %SystemRoot%\twain_32 -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

vb.ini -> %SystemRoot%\vb.ini -> [Ver = | Size = 36 bytes | Created Date = 23.05.2007 19:53:35 | Attr = ]

vbaddin.ini -> %SystemRoot%\vbaddin.ini -> [Ver = | Size = 37 bytes | Created Date = 23.05.2007 19:53:35 | Attr = ]

Vent de prairie.bmp -> %SystemRoot%\Vent de prairie.bmp -> [Ver = | Size = 65954 bytes | Created Date = 23.05.2007 19:52:56 | Attr = ]

WBEM -> %SystemRoot%\WBEM -> [Folder | Created Date = 23.05.2007 22:34:59 | Attr = ]

Web -> %SystemRoot%\Web -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = R ]

WindowsShell.Manifest -> %SystemRoot%\WindowsShell.Manifest -> [Ver = | Size = 749 bytes | Created Date = 23.05.2007 19:54:54 | Attr = RH ]

winnt.bmp -> %SystemRoot%\winnt.bmp -> [Ver = | Size = 49102 bytes | Created Date = 23.05.2007 19:54:20 | Attr = HS]

winnt256.bmp -> %SystemRoot%\winnt256.bmp -> [Ver = | Size = 49102 bytes | Created Date = 23.05.2007 19:54:20 | Attr = HS]

WinSxS -> %SystemRoot%\WinSxS -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

WMSysPr9.prx -> %SystemRoot%\WMSysPr9.prx -> [Ver = | Size = 316640 bytes | Created Date = 23.05.2007 19:55:32 | Attr = ]

Zapotec.bmp -> %SystemRoot%\Zapotec.bmp -> [Ver = | Size = 9522 bytes | Created Date = 23.05.2007 19:52:56 | Attr = ]

zts2.exe -> %SystemRoot%\zts2.exe -> [Folder | Created Date = 09.06.2007 00:06:48 | Attr = ]

desktop.ini -> %SystemRoot%\tasks\desktop.ini -> [Ver = | Size = 65 bytes | Created Date = 23.05.2007 19:54:12 | Attr = RH ]

SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [Ver = | Size = 6 bytes | Created Date = 23.05.2007 20:01:53 | Attr = H ]

$winnt$.inf -> %System32%\$winnt$.inf -> [Ver = | Size = 261 bytes | Created Date = 24.05.2007 03:30:57 | Attr = ]

1025 -> %System32%\1025 -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

1028 -> %System32%\1028 -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

1031 -> %System32%\1031 -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

1033 -> %System32%\1033 -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

1036 -> %System32%\1036 -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

1037 -> %System32%\1037 -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

1041 -> %System32%\1041 -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

1042 -> %System32%\1042 -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

1054 -> %System32%\1054 -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

2052 -> %System32%\2052 -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

3076 -> %System32%\3076 -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

3com_dmi -> %System32%\3com_dmi -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

actskin4.ocx -> %System32%\actskin4.ocx -> [Ver = 4, 2, 7, 3 | Size = 380928 bytes | Created Date = 23.05.2007 20:34:58 | Attr = ]

ALSndMgr.Cpl -> %System32%\ALSndMgr.Cpl -> Realtek Semiconductor Corp. [Ver = 1, 0, 0, 10 | Size = 299008 bytes | Created Date = 23.05.2007 20:04:10 | Attr = R ]

amcompat.tlb -> %System32%\amcompat.tlb -> [Ver = | Size = 16832 bytes | Created Date = 23.05.2007 19:55:33 | Attr = ]

aswBoot.exe -> %System32%\aswBoot.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 745600 bytes | Created Date = 23.05.2007 20:34:58 | Attr = ]

AUTOEXEC.NT -> %System32%\AUTOEXEC.NT -> [Ver = | Size = 1896 bytes | Created Date = 24.05.2007 03:34:55 | Attr = ]

AvastSS.scr -> %System32%\AvastSS.scr -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 95872 bytes | Created Date = 23.05.2007 20:35:01 | Attr = ]

bdco1.dll -> %System32%\bdco1.dll -> NVIDIA Corporation [Ver = 1.0 | Size = 11264 bytes | Created Date = 23.05.2007 20:04:13 | Attr = R ]

bdco1ins.dll -> %System32%\bdco1ins.dll -> NVIDIA Corporation [Ver = 1.0 | Size = 11264 bytes | Created Date = 23.05.2007 20:04:13 | Attr = R ]

bopomofo.uce -> %System32%\bopomofo.uce -> [Ver = | Size = 22984 bytes | Created Date = 23.05.2007 19:52:55 | Attr = ]

BuzzingBee.wav -> %System32%\BuzzingBee.wav -> [Ver = | Size = 146650 bytes | Created Date = 23.05.2007 20:05:56 | Attr = ]

camcpl.cpl -> %System32%\camcpl.cpl -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 360448 bytes | Created Date = 26.05.2007 18:07:32 | Attr = ]

CamCplRes.dll -> %System32%\CamCplRes.dll -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 323584 bytes | Created Date = 26.05.2007 18:07:33 | Attr = ]

CatRoot -> %System32%\CatRoot -> [Folder | Created Date = 24.05.2007 03:32:56 | Attr = ]

CatRoot2 -> %System32%\CatRoot2 -> [Folder | Created Date = 24.05.2007 03:32:56 | Attr = ]

cdplayer.exe.manifest -> %System32%\cdplayer.exe.manifest -> [Ver = | Size = 749 bytes | Created Date = 23.05.2007 19:54:54 | Attr = RH ]

ChCfg.exe -> %System32%\ChCfg.exe -> [Ver = | Size = 49152 bytes | Created Date = 23.05.2007 20:04:32 | Attr = R ]

Com -> %System32%\Com -> [Folder | Created Date = 23.05.2007 19:52:36 | Attr = ]

config -> %System32%\config -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

CONFIG.NT -> %System32%\CONFIG.NT -> [Ver = | Size = 3121 bytes | Created Date = 23.05.2007 19:55:35 | Attr = ]

CONFIG.TMP -> %System32%\CONFIG.TMP -> [Ver = | Size = 3072 bytes | Created Date = 24.05.2007 03:34:55 | Attr = ]

c_10006.nls -> %System32%\c_10006.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:03 | Attr = ]

c_10007.nls -> %System32%\c_10007.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:05 | Attr = ]

c_10010.nls -> %System32%\c_10010.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:34:59 | Attr = ]

c_10017.nls -> %System32%\c_10017.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:05 | Attr = ]

c_10029.nls -> %System32%\c_10029.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:34:59 | Attr = ]

c_10081.nls -> %System32%\c_10081.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:07 | Attr = ]

c_10082.nls -> %System32%\c_10082.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:34:59 | Attr = ]

c_20127.nls -> %System32%\c_20127.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:34:58 | Attr = ]

C_28594.NLS -> %System32%\C_28594.NLS -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:02 | Attr = ]

C_28595.NLS -> %System32%\C_28595.NLS -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:05 | Attr = ]

C_28597.NLS -> %System32%\C_28597.NLS -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:03 | Attr = ]

c_28599.nls -> %System32%\c_28599.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:08 | Attr = ]

c_28603.nls -> %System32%\c_28603.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:09 | Attr = ]

c_737.nls -> %System32%\c_737.nls -> [Ver = | Size = 66594 bytes | Created Date = 24.05.2007 03:35:03 | Attr = ]

c_852.nls -> %System32%\c_852.nls -> [Ver = | Size = 66594 bytes | Created Date = 24.05.2007 03:34:59 | Attr = ]

c_855.nls -> %System32%\c_855.nls -> [Ver = | Size = 66594 bytes | Created Date = 24.05.2007 03:35:01 | Attr = ]

c_857.nls -> %System32%\c_857.nls -> [Ver = | Size = 66594 bytes | Created Date = 24.05.2007 03:35:07 | Attr = ]

c_866.nls -> %System32%\c_866.nls -> [Ver = | Size = 66594 bytes | Created Date = 24.05.2007 03:35:01 | Attr = ]

c_869.nls -> %System32%\c_869.nls -> [Ver = | Size = 66594 bytes | Created Date = 24.05.2007 03:35:03 | Attr = ]

c_875.nls -> %System32%\c_875.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:03 | Attr = ]

desktop.ini -> %System32%\desktop.ini -> [Ver = | Size = 2 bytes | Created Date = 23.05.2007 19:54:20 | Attr = ]

dgrpsetu.dll -> %System32%\dgrpsetu.dll -> Digi International, Inc. [Ver = 2.3.7 | Size = 176157 bytes | Created Date = 24.05.2007 03:34:57 | Attr = ]

dgsetup.dll -> %System32%\dgsetup.dll -> Digi International [Ver = v3.7.3.0 | Size = 86044 bytes | Created Date = 24.05.2007 03:34:57 | Attr = ]

dhcp -> %System32%\dhcp -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

DirectX -> %System32%\DirectX -> [Folder | Created Date = 23.05.2007 19:54:38 | Attr = ]

dllcache -> %System32%\dllcache -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = RHS]

drivers -> %System32%\drivers -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

DRVSTORE -> %System32%\DRVSTORE -> [Folder | Created Date = 23.05.2007 20:04:29 | Attr = ]

ElkCtlPS.dll -> %System32%\ElkCtlPS.dll -> Logitech Inc. [Ver = 8.5.0.1137 | Size = 57344 bytes | Created Date = 26.05.2007 18:07:32 | Attr = ]

ElkCtrl.exe -> %System32%\ElkCtrl.exe -> Logitech Inc. [Ver = 8.5.0.1137 | Size = 262144 bytes | Created Date = 26.05.2007 18:07:32 | Attr = ]

emptyregdb.dat -> %System32%\emptyregdb.dat -> [Ver = | Size = 21892 bytes | Created Date = 23.05.2007 19:53:42 | Attr = ]

en-us -> %System32%\en-us -> [Folder | Created Date = 23.05.2007 21:52:59 | Attr = ]

EqnClass.Dll -> %System32%\EqnClass.Dll -> Equinox Systems Inc. [Ver = 5.0u(58) | Size = 103424 bytes | Created Date = 24.05.2007 03:34:57 | Attr = ]

exec1.exe -> %System32%\exec1.exe -> Lavalys, Inc. [Ver = 4.00.976 | Size = 2141544 bytes | Created Date = 23.05.2007 22:07:39 | Attr = ]

exec1.ini -> %System32%\exec1.ini -> [Ver = | Size = 68552 bytes | Created Date = 25.05.2007 06:29:00 | Attr = ]

export -> %System32%\export -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

fdco1.dll -> %System32%\fdco1.dll -> NVIDIA Corporation [Ver = 1.1 | Size = 201728 bytes | Created Date = 23.05.2007 20:04:15 | Attr = R ]

fdco1ins.dll -> %System32%\fdco1ins.dll -> NVIDIA Corporation [Ver = 1.1 | Size = 201728 bytes | Created Date = 23.05.2007 20:04:15 | Attr = R ]

ff_vfw.dll -> %System32%\ff_vfw.dll -> [Ver = | Size = 10752 bytes | Created Date = 27.05.2007 10:43:19 | Attr = ]

ff_vfw.dll.manifest -> %System32%\ff_vfw.dll.manifest -> [Ver = | Size = 547 bytes | Created Date = 27.05.2007 10:43:19 | Attr = ]

FNTCACHE.DAT -> %System32%\FNTCACHE.DAT -> [Ver = | Size = 189000 bytes | Created Date = 24.05.2007 03:32:03 | Attr = ]

fr-fr -> %System32%\fr-fr -> [Folder | Created Date = 23.05.2007 22:34:58 | Attr = ]

gb2312.uce -> %System32%\gb2312.uce -> [Ver = | Size = 24006 bytes | Created Date = 23.05.2007 19:52:55 | Attr = ]

hticons.dll -> %System32%\hticons.dll -> Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 44544 bytes | Created Date = 23.05.2007 19:53:00 | Attr = ]

hypertrm.dll -> %System32%\hypertrm.dll -> Hilgraeve, Inc. [Ver = 5.1.2600.2563 | Size = 354304 bytes | Created Date = 23.05.2007 19:52:40 | Attr = ]

ias -> %System32%\ias -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

icsxml -> %System32%\icsxml -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

ideograf.uce -> %System32%\ideograf.uce -> [Ver = | Size = 60458 bytes | Created Date = 23.05.2007 19:52:55 | Attr = ]

iifgfgf.dll -> %System32%\iifgfgf.dll -> [Folder | Created Date = 09.06.2007 00:06:48 | Attr = ]

IME -> %System32%\IME -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

inetsrv -> %System32%\inetsrv -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

InstExec.exe -> %System32%\InstExec.exe -> Logitech [Ver = 1, 0, 0, 16 | Size = 233536 bytes | Created Date = 26.05.2007 18:08:39 | Attr = R ]

InstExec.ini -> %System32%\InstExec.ini -> [Ver = | Size = 719 bytes | Created Date = 26.05.2007 18:08:39 | Attr = R ]

isrdbg32.dll -> %System32%\isrdbg32.dll -> Intel Corporation [Ver = 0.0 | Size = 32768 bytes | Created Date = 23.05.2007 19:53:56 | Attr = ]

java.exe -> %System32%\java.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 135168 bytes | Created Date = 23.05.2007 21:55:58 | Attr = ]

javacpl.cpl -> %System32%\javacpl.cpl -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 69632 bytes | Created Date = 23.05.2007 21:55:59 | Attr = ]

javaw.exe -> %System32%\javaw.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 135168 bytes | Created Date = 23.05.2007 21:55:59 | Attr = ]

javaws.exe -> %System32%\javaws.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 139264 bytes | Created Date = 23.05.2007 21:55:59 | Attr = ]

kanji_1.uce -> %System32%\kanji_1.uce -> [Ver = | Size = 6948 bytes | Created Date = 23.05.2007 19:52:55 | Attr = ]

kanji_2.uce -> %System32%\kanji_2.uce -> [Ver = | Size = 8484 bytes | Created Date = 23.05.2007 19:52:55 | Attr = ]

kemutb.dll -> %System32%\kemutb.dll -> Logitech Inc. [Ver = 3.30.165 | Size = 163840 bytes | Created Date = 23.05.2007 22:09:23 | Attr = ]

KemUtil.dll -> %System32%\KemUtil.dll -> Logitech Inc. [Ver = 3.30.165 | Size = 135168 bytes | Created Date = 23.05.2007 22:09:23 | Attr = ]

KemWnd.dll -> %System32%\KemWnd.dll -> Logitech Inc. [Ver = 3.30.165 | Size = 110592 bytes | Created Date = 23.05.2007 22:09:23 | Attr = ]

KemXML.dll -> %System32%\KemXML.dll -> Logitech Inc. [Ver = 3.30.165 | Size = 69632 bytes | Created Date = 23.05.2007 22:09:23 | Attr = ]

korean.uce -> %System32%\korean.uce -> [Ver = | Size = 12876 bytes | Created Date = 23.05.2007 19:52:55 | Attr = ]

Lang -> %System32%\Lang -> [Folder | Created Date = 23.05.2007 20:05:50 | Attr = ]

libeay32_0.9.6l.dll -> %System32%\libeay32_0.9.6l.dll -> [Ver = | Size = 796584 bytes | Created Date = 23.05.2007 22:11:21 | Attr = ]

LogFiles -> %System32%\LogFiles -> [Folder | Created Date = 23.05.2007 21:48:55 | Attr = ]

logonui.exe.manifest -> %System32%\logonui.exe.manifest -> [Ver = | Size = 488 bytes | Created Date = 23.05.2007 19:54:57 | Attr = RH ]

LoopyMusic.wav -> %System32%\LoopyMusic.wav -> [Ver = | Size = 940794 bytes | Created Date = 23.05.2007 20:05:56 | Attr = ]

lsdelete.exe -> %System32%\lsdelete.exe -> [Ver = | Size = 7680 bytes | Created Date = 13.04.2007 14:19:52 | Attr = ]

lvcodec2.dll -> %System32%\lvcodec2.dll -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 204800 bytes | Created Date = 26.05.2007 18:24:26 | Attr = R ]

lvcoinst.dll -> %System32%\lvcoinst.dll -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 110592 bytes | Created Date = 26.05.2007 18:24:26 | Attr = R ]

lvcoinst.ini -> %System32%\lvcoinst.ini -> [Ver = | Size = 10081 bytes | Created Date = 26.05.2007 18:24:26 | Attr = R ]

LVUI2.dll -> %System32%\LVUI2.dll -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 212992 bytes | Created Date = 26.05.2007 18:24:26 | Attr = R ]

LVUI2RC.dll -> %System32%\LVUI2RC.dll -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 376832 bytes | Created Date = 26.05.2007 18:24:26 | Attr = R ]

Macromed -> %System32%\Macromed -> [Folder | Created Date = 23.05.2007 19:54:08 | Attr = ]

Microsoft -> %System32%\Microsoft -> [Folder | Created Date = 23.05.2007 20:01:51 | Attr = S]

MsDtc -> %System32%\MsDtc -> [Folder | Created Date = 23.05.2007 19:52:37 | Attr = ]

msdtcprf.h -> %System32%\msdtcprf.h -> [Ver = | Size = 768 bytes | Created Date = 23.05.2007 19:52:53 | Attr = ]

msdtcprf.ini -> %System32%\msdtcprf.ini -> [Ver = | Size = 3914 bytes | Created Date = 23.05.2007 19:52:53 | Attr = ]

mui -> %System32%\mui -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

ncpa.cpl.manifest -> %System32%\ncpa.cpl.manifest -> [Ver = | Size = 749 bytes | Created Date = 23.05.2007 19:54:54 | Attr = RH ]

npp -> %System32%\npp -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

nscompat.tlb -> %System32%\nscompat.tlb -> [Ver = | Size = 23392 bytes | Created Date = 23.05.2007 19:55:33 | Attr = ]

nvapps.xml -> %System32%\nvapps.xml -> [Ver = | Size = 88556 bytes | Created Date = 23.05.2007 20:21:17 | Attr = ]

nvconrm.dll -> %System32%\nvconrm.dll -> NVIDIA Corporation [Ver = 1 , 0 , 0 , 35 | Size = 35840 bytes | Created Date = 23.05.2007 20:04:13 | Attr = R ]

nvdisp.nvu -> %System32%\nvdisp.nvu -> [Ver = | Size = 17056 bytes | Created Date = 23.05.2007 20:20:53 | Attr = ]

nvide.nvu -> %System32%\nvide.nvu -> [Ver = | Size = 1570 bytes | Created Date = 23.05.2007 20:06:30 | Attr = ]

nvnrm.nvu -> %System32%\nvnrm.nvu -> [Ver = | Size = 3903 bytes | Created Date = 23.05.2007 20:04:14 | Attr = ]

nvudisp.exe -> %System32%\nvudisp.exe -> NVIDIA Corporation [Ver = 1 , 0 , 1 , 55 | Size = 208896 bytes | Created Date = 23.05.2007 20:20:53 | Attr = ]

nvuide.exe -> %System32%\nvuide.exe -> NVIDIA Corporation [Ver = 1 , 0 , 1 , 56 | Size = 208896 bytes | Created Date = 23.05.2007 20:06:30 | Attr = ]

NVUNINST.EXE -> %System32%\NVUNINST.EXE -> NVIDIA Corporation [Ver = 1 , 0 , 1 , 56 | Size = 208896 bytes | Created Date = 23.05.2007 20:04:10 | Attr = ]

nvunrm.exe -> %System32%\nvunrm.exe -> NVIDIA Corporation [Ver = 1 , 0 , 1 , 56 | Size = 356352 bytes | Created Date = 23.05.2007 20:04:14 | Attr = ]

nwc.cpl.manifest -> %System32%\nwc.cpl.manifest -> [Ver = | Size = 749 bytes | Created Date = 23.05.2007 19:54:54 | Attr = RH ]

oobe -> %System32%\oobe -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

PerfStringBackup.INI -> %System32%\PerfStringBackup.INI -> [Ver = | Size = 1114066 bytes | Created Date = 24.05.2007 03:35:13 | Attr = ]

PreInstall -> %System32%\PreInstall -> [Folder | Created Date = 23.05.2007 20:33:25 | Attr = ]

QuickTime.qts -> %System32%\QuickTime.qts -> Apple Inc. [Ver = 7.1.6 | Size = 49152 bytes | Created Date = 27.04.2007 08:42:00 | Attr = ]

QuickTimeVR.qtx -> %System32%\QuickTimeVR.qtx -> Apple Inc. [Ver = 7.1.6 | Size = 65536 bytes | Created Date = 27.04.2007 08:42:00 | Attr = ]

ras -> %System32%\ras -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

ReinstallBackups -> %System32%\ReinstallBackups -> [Folder | Created Date = 23.05.2007 20:04:30 | Attr = ]

Repository.reg -> %System32%\Repository.reg -> [Ver = | Size = 1464 bytes | Created Date = 26.05.2007 18:24:26 | Attr = R ]

Restore -> %System32%\Restore -> [Folder | Created Date = 23.05.2007 19:53:56 | Attr = ]

RTCOM -> %System32%\RTCOM -> [Folder | Created Date = 23.05.2007 20:04:28 | Attr = ]

RTSndMgr.Cpl -> %System32%\RTSndMgr.Cpl -> Realtek Semiconductor Corp. [Ver = 1, 0, 0, 9 | Size = 282624 bytes | Created Date = 23.05.2007 20:04:21 | Attr = R ]

sapi.cpl.manifest -> %System32%\sapi.cpl.manifest -> [Ver = | Size = 749 bytes | Created Date = 23.05.2007 19:54:54 | Attr = RH ]

Setup -> %System32%\Setup -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

ShellExt -> %System32%\ShellExt -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

shiftjis.uce -> %System32%\shiftjis.uce -> [Ver = | Size = 16740 bytes | Created Date = 23.05.2007 19:52:55 | Attr = ]

SIntf16.dll -> %System32%\SIntf16.dll -> [Ver = | Size = 12067 bytes | Created Date = 29.05.2007 18:49:50 | Attr = ]

SIntf32.dll -> %System32%\SIntf32.dll -> [Ver = | Size = 17212 bytes | Created Date = 29.05.2007 18:49:50 | Attr = ]

SIntfNT.dll -> %System32%\SIntfNT.dll -> [Ver = | Size = 21840 bytes | Created Date = 29.05.2007 18:49:50 | Attr = ]

SoftwareDistribution -> %System32%\SoftwareDistribution -> [Folder | Created Date = 23.05.2007 20:31:13 | Attr = ]

spool -> %System32%\spool -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

spxcoins.dll -> %System32%\spxcoins.dll -> Perle Systems Ltd. [Ver = 1.0.0.0007 | Size = 24661 bytes | Created Date = 24.05.2007 03:34:57 | Attr = ]

subrange.uce -> %System32%\subrange.uce -> [Ver = | Size = 93702 bytes | Created Date = 23.05.2007 19:52:55 | Attr = ]

Thumbs.db -> %System32%\Thumbs.db -> [Ver = | Size = 5120 bytes | Created Date = 07.06.2007 22:03:27 | Attr = HS]

@Alternate Data Stream - 0 bytes -> %System32%\Thumbs.db:encryptable ->

tslabels.h -> %System32%\tslabels.h -> [Ver = | Size = 3286 bytes | Created Date = 23.05.2007 19:52:53 | Attr = ]

tslabels.ini -> %System32%\tslabels.ini -> [Ver = | Size = 27768 bytes | Created Date = 23.05.2007 19:52:53 | Attr = ]

usmt -> %System32%\usmt -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

usrlogon.cmd -> %System32%\usrlogon.cmd -> [Ver = | Size = 1263 bytes | Created Date = 23.05.2007 19:52:54 | Attr = ]

vatee.ax -> %System32%\vatee.ax -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 86016 bytes | Created Date = 26.05.2007 18:10:11 | Attr = R ]

vcmgcd32.dll -> %System32%\vcmgcd32.dll -> [Folder | Created Date = 09.06.2007 00:06:48 | Attr = ]

VLib.dll -> %System32%\VLib.dll -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 147456 bytes | Created Date = 26.05.2007 18:07:31 | Attr = ]

vsconfig.xml -> %System32%\vsconfig.xml -> [Ver = | Size = 52662 bytes | Created Date = 23.05.2007 22:11:16 | Attr = ]

vsdata.dll -> %System32%\vsdata.dll -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 83696 bytes | Created Date = 23.05.2007 22:10:26 | Attr = ]

vsdatant.sys -> %System32%\vsdatant.sys -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 394192 bytes | Created Date = 23.05.2007 22:11:16 | Attr = ]

vsinit.dll -> %System32%\vsinit.dll -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 157424 bytes | Created Date = 23.05.2007 22:10:26 | Attr = ]

vsmonapi.dll -> %System32%\vsmonapi.dll -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 104176 bytes | Created Date = 23.05.2007 22:11:16 | Attr = ]

vspubapi.dll -> %System32%\vspubapi.dll -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 276208 bytes | Created Date = 23.05.2007 22:11:16 | Attr = ]

vsregexp.dll -> %System32%\vsregexp.dll -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 71408 bytes | Created Date = 23.05.2007 22:11:21 | Attr = ]

vsutil.dll -> %System32%\vsutil.dll -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 472816 bytes | Created Date = 23.05.2007 22:10:26 | Attr = ]

vsutil_loc040c.dll -> %System32%\vsutil_loc040c.dll -> Zone Labs Inc. [Ver = 5.3.017.000 | Size = 54936 bytes | Created Date = 24.05.2007 17:54:45 | Attr = ]

vswmi.dll -> %System32%\vswmi.dll -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 46832 bytes | Created Date = 23.05.2007 22:11:17 | Attr = ]

vsxml.dll -> %System32%\vsxml.dll -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 100080 bytes | Created Date = 23.05.2007 22:11:17 | Attr = ]

VxLib.dll -> %System32%\VxLib.dll -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 155648 bytes | Created Date = 26.05.2007 18:07:31 | Attr = ]

VxLibRes.dll -> %System32%\VxLibRes.dll -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 40960 bytes | Created Date = 26.05.2007 18:07:29 | Attr = ]

wbem -> %System32%\wbem -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

WindowsLogon.manifest -> %System32%\WindowsLogon.manifest -> [Ver = | Size = 488 bytes | Created Date = 23.05.2007 19:54:57 | Attr = RH ]

wins -> %System32%\wins -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

wmimgmt.msc -> %System32%\wmimgmt.msc -> [Ver = | Size = 63488 bytes | Created Date = 23.05.2007 19:52:49 | Attr = ]

wpa.bak -> %System32%\wpa.bak -> [Ver = | Size = 13646 bytes | Created Date = 23.05.2007 20:04:50 | Attr = ]

wuaucpl.cpl.manifest -> %System32%\wuaucpl.cpl.manifest -> [Ver = | Size = 749 bytes | Created Date = 23.05.2007 19:54:54 | Attr = RH ]

xircom -> %System32%\xircom -> [Folder | Created Date = 23.05.2007 19:55:46 | Attr = ]

XPSViewer -> %System32%\XPSViewer -> [Folder | Created Date = 23.05.2007 21:53:00 | Attr = ]

zlcomm.dll -> %System32%\zlcomm.dll -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 83696 bytes | Created Date = 23.05.2007 22:11:20 | Attr = ]

zlcommdb.dll -> %System32%\zlcommdb.dll -> Zone Labs, LLC [Ver = 7.0.337.000 | Size = 71408 bytes | Created Date = 23.05.2007 22:11:20 | Attr = ]

zllictbl.dat -> %System32%\zllictbl.dat -> [Ver = | Size = 4212 bytes | Created Date = 23.05.2007 22:11:32 | Attr = H ]

ZoneLabs -> %System32%\ZoneLabs -> [Folder | Created Date = 23.05.2007 22:11:16 | Attr = ]

zpeng24.dll -> %System32%\zpeng24.dll -> Python Software Foundation [Ver = 2.4.2 | Size = 1087216 bytes | Created Date = 24.05.2007 17:54:31 | Attr = ]

big5.nls -> %System32%\dllcache\big5.nls -> [Ver = | Size = 66728 bytes | Created Date = 23.05.2007 19:55:58 | Attr = ]

bopomofo.nls -> %System32%\dllcache\bopomofo.nls -> [Ver = | Size = 82172 bytes | Created Date = 23.05.2007 19:55:58 | Attr = ]

cap7146.sys -> %System32%\dllcache\cap7146.sys -> Philips Semiconductors GmbH [Ver = 1.00 (XPClient.010817-1148) | Size = 54528 bytes | Created Date = 23.05.2007 19:56:03 | Attr = ]

chtskf.dll -> %System32%\dllcache\chtskf.dll -> [Ver = | Size = 173568 bytes | Created Date = 23.05.2007 19:56:04 | Attr = ]

c_10001.nls -> %System32%\dllcache\c_10001.nls -> [Ver = | Size = 162850 bytes | Created Date = 23.05.2007 19:55:58 | Attr = ]

c_10002.nls -> %System32%\dllcache\c_10002.nls -> [Ver = | Size = 195618 bytes | Created Date = 23.05.2007 19:55:58 | Attr = ]

c_10003.nls -> %System32%\dllcache\c_10003.nls -> [Ver = | Size = 177698 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_10004.nls -> %System32%\dllcache\c_10004.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_10005.nls -> %System32%\dllcache\c_10005.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_10006.nls -> %System32%\dllcache\c_10006.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:03 | Attr = ]

c_10007.nls -> %System32%\dllcache\c_10007.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:05 | Attr = ]

c_10008.nls -> %System32%\dllcache\c_10008.nls -> [Ver = | Size = 173602 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_10010.nls -> %System32%\dllcache\c_10010.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:34:59 | Attr = ]

c_10017.nls -> %System32%\dllcache\c_10017.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:05 | Attr = ]

c_10021.nls -> %System32%\dllcache\c_10021.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_10029.nls -> %System32%\dllcache\c_10029.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:34:59 | Attr = ]

c_10081.nls -> %System32%\dllcache\c_10081.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:07 | Attr = ]

c_10082.nls -> %System32%\dllcache\c_10082.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:34:59 | Attr = ]

c_1047.nls -> %System32%\dllcache\c_1047.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_1140.nls -> %System32%\dllcache\c_1140.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_1141.nls -> %System32%\dllcache\c_1141.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_1142.nls -> %System32%\dllcache\c_1142.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_1143.nls -> %System32%\dllcache\c_1143.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_1144.nls -> %System32%\dllcache\c_1144.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_1145.nls -> %System32%\dllcache\c_1145.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_1146.nls -> %System32%\dllcache\c_1146.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_1147.nls -> %System32%\dllcache\c_1147.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_1148.nls -> %System32%\dllcache\c_1148.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_1149.nls -> %System32%\dllcache\c_1149.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:55:59 | Attr = ]

c_1361.nls -> %System32%\dllcache\c_1361.nls -> [Ver = | Size = 189986 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20000.nls -> %System32%\dllcache\c_20000.nls -> [Ver = | Size = 180258 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20001.nls -> %System32%\dllcache\c_20001.nls -> [Ver = | Size = 186402 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20002.nls -> %System32%\dllcache\c_20002.nls -> [Ver = | Size = 173602 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20003.nls -> %System32%\dllcache\c_20003.nls -> [Ver = | Size = 185378 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20004.nls -> %System32%\dllcache\c_20004.nls -> [Ver = | Size = 180258 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20005.nls -> %System32%\dllcache\c_20005.nls -> [Ver = | Size = 187938 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20105.nls -> %System32%\dllcache\c_20105.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20106.nls -> %System32%\dllcache\c_20106.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20107.nls -> %System32%\dllcache\c_20107.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20108.nls -> %System32%\dllcache\c_20108.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20127.nls -> %System32%\dllcache\c_20127.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:34:58 | Attr = ]

c_20269.nls -> %System32%\dllcache\c_20269.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20273.nls -> %System32%\dllcache\c_20273.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20277.nls -> %System32%\dllcache\c_20277.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20278.nls -> %System32%\dllcache\c_20278.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:00 | Attr = ]

c_20280.nls -> %System32%\dllcache\c_20280.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20284.nls -> %System32%\dllcache\c_20284.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20285.nls -> %System32%\dllcache\c_20285.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20290.nls -> %System32%\dllcache\c_20290.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20297.nls -> %System32%\dllcache\c_20297.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20420.nls -> %System32%\dllcache\c_20420.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20423.nls -> %System32%\dllcache\c_20423.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20424.nls -> %System32%\dllcache\c_20424.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20833.nls -> %System32%\dllcache\c_20833.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20838.nls -> %System32%\dllcache\c_20838.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20871.nls -> %System32%\dllcache\c_20871.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20880.nls -> %System32%\dllcache\c_20880.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20924.nls -> %System32%\dllcache\c_20924.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20932.nls -> %System32%\dllcache\c_20932.nls -> [Ver = | Size = 180770 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20936.nls -> %System32%\dllcache\c_20936.nls -> [Ver = | Size = 173602 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_20949.nls -> %System32%\dllcache\c_20949.nls -> [Ver = | Size = 177698 bytes | Created Date = 23.05.2007 19:56:01 | Attr = ]

c_21025.nls -> %System32%\dllcache\c_21025.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:02 | Attr = ]

c_21027.nls -> %System32%\dllcache\c_21027.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:02 | Attr = ]

c_28594.nls -> %System32%\dllcache\c_28594.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:02 | Attr = ]

c_28595.nls -> %System32%\dllcache\c_28595.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:05 | Attr = ]

c_28596.nls -> %System32%\dllcache\c_28596.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:02 | Attr = ]

c_28597.nls -> %System32%\dllcache\c_28597.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:03 | Attr = ]

c_28599.nls -> %System32%\dllcache\c_28599.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:08 | Attr = ]

c_28603.nls -> %System32%\dllcache\c_28603.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:09 | Attr = ]

c_708.nls -> %System32%\dllcache\c_708.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:02 | Attr = ]

c_720.nls -> %System32%\dllcache\c_720.nls -> [Ver = | Size = 66594 bytes | Created Date = 23.05.2007 19:56:02 | Attr = ]

c_737.nls -> %System32%\dllcache\c_737.nls -> [Ver = | Size = 66594 bytes | Created Date = 24.05.2007 03:35:03 | Attr = ]

c_852.nls -> %System32%\dllcache\c_852.nls -> [Ver = | Size = 66594 bytes | Created Date = 24.05.2007 03:34:59 | Attr = ]

c_855.nls -> %System32%\dllcache\c_855.nls -> [Ver = | Size = 66594 bytes | Created Date = 24.05.2007 03:35:01 | Attr = ]

c_857.nls -> %System32%\dllcache\c_857.nls -> [Ver = | Size = 66594 bytes | Created Date = 24.05.2007 03:35:07 | Attr = ]

c_858.nls -> %System32%\dllcache\c_858.nls -> [Ver = | Size = 66594 bytes | Created Date = 23.05.2007 19:56:02 | Attr = ]

c_862.nls -> %System32%\dllcache\c_862.nls -> [Ver = | Size = 66594 bytes | Created Date = 23.05.2007 19:56:02 | Attr = ]

c_864.nls -> %System32%\dllcache\c_864.nls -> [Ver = | Size = 66594 bytes | Created Date = 23.05.2007 19:56:02 | Attr = ]

c_866.nls -> %System32%\dllcache\c_866.nls -> [Ver = | Size = 66594 bytes | Created Date = 24.05.2007 03:35:01 | Attr = ]

c_869.nls -> %System32%\dllcache\c_869.nls -> [Ver = | Size = 66594 bytes | Created Date = 24.05.2007 03:35:03 | Attr = ]

c_870.nls -> %System32%\dllcache\c_870.nls -> [Ver = | Size = 66082 bytes | Created Date = 23.05.2007 19:56:02 | Attr = ]

c_875.nls -> %System32%\dllcache\c_875.nls -> [Ver = | Size = 66082 bytes | Created Date = 24.05.2007 03:35:03 | Attr = ]

dgrpsetu.dll -> %System32%\dllcache\dgrpsetu.dll -> Digi International, Inc. [Ver = 2.3.7 | Size = 176157 bytes | Created Date = 24.05.2007 03:34:57 | Attr = ]

dgsetup.dll -> %System32%\dllcache\dgsetup.dll -> Digi International [Ver = v3.7.3.0 | Size = 86044 bytes | Created Date = 24.05.2007 03:34:57 | Attr = ]

eqnclass.dll -> %System32%\dllcache\eqnclass.dll -> Equinox Systems Inc. [Ver = 5.0u(58) | Size = 103424 bytes | Created Date = 24.05.2007 03:34:57 | Attr = ]

esucmd.dll -> %System32%\dllcache\esucmd.dll -> SEIKO EPSON CORP. [Ver = 1.00 | Size = 31744 bytes | Created Date = 23.05.2007 19:56:08 | Attr = ]

esuimgd.dll -> %System32%\dllcache\esuimgd.dll -> SEIKO EPSON CORP. [Ver = 1.00 | Size = 57856 bytes | Created Date = 23.05.2007 19:56:08 | Attr = ]

esunid.dll -> %System32%\dllcache\esunid.dll -> SEIKO EPSON CORP. [Ver = 1.00 | Size = 45568 bytes | Created Date = 23.05.2007 19:56:09 | Attr = ]

FP4.CAT -> %System32%\dllcache\FP4.CAT -> [Ver = | Size = 30983 bytes | Created Date = 24.05.2007 03:33:07 | Attr = ]

fpencode.dll -> %System32%\dllcache\fpencode.dll -> [Ver = | Size = 94208 bytes | Created Date = 23.05.2007 19:56:10 | Attr = ]

hanja.lex -> %System32%\dllcache\hanja.lex -> [Ver = | Size = 108827 bytes | Created Date = 23.05.2007 19:56:13 | Attr = ]

HPCRDP.CAT -> %System32%\dllcache\HPCRDP.CAT -> [Ver = | Size = 13497 bytes | Created Date = 24.05.2007 03:33:07 | Attr = ]

htrn_jis.dll -> %System32%\dllcache\htrn_jis.dll -> Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 13312 bytes | Created Date = 23.05.2007 19:53:00 | Attr = ]

hwxjpn.dll -> %System32%\dllcache\hwxjpn.dll -> [Ver = | Size = 13463552 bytes | Created Date = 23.05.2007 19:56:16 | Attr = ]

IASNT4.CAT -> %System32%\dllcache\IASNT4.CAT -> [Ver = | Size = 8599 bytes | Created Date = 24.05.2007 03:33:07 | Attr = ]

imekr.lex -> %System32%\dllcache\imekr.lex -> [Ver = | Size = 134339 bytes | Created Date = 23.05.2007 19:56:21 | Attr = ]

imjpinst.exe -> %System32%\dllcache\imjpinst.exe -> [Ver = | Size = 196665 bytes | Created Date = 23.05.2007 19:56:22 | Attr = ]

IMS.CAT -> %System32%\dllcache\IMS.CAT -> [Ver = | Size = 14043 bytes | Created Date = 24.05.2007 03:33:07 | Attr = ]

imscinst.exe -> %System32%\dllcache\imscinst.exe -> [Ver = | Size = 59392 bytes | Created Date = 23.05.2007 19:56:23 | Attr = ]

isrdbg32.dll -> %System32%\dllcache\isrdbg32.dll -> Intel Corporation [Ver = 0.0 | Size = 32768 bytes | Created Date = 23.05.2007 19:53:56 | Attr = ]

korwbrkr.lex -> %System32%\dllcache\korwbrkr.lex -> [Ver = | Size = 1158818 bytes | Created Date = 23.05.2007 19:56:27 | Attr = ]

ksc.nls -> %System32%\dllcache\ksc.nls -> [Ver = | Size = 47066 bytes | Created Date = 23.05.2007 19:56:28 | Attr = ]

ltts1033.lxa -> %System32%\dllcache\ltts1033.lxa -> [Ver = | Size = 643717 bytes | Created Date = 24.05.2007 03:35:11 | Attr = ]

MAPIMIG.CAT -> %System32%\dllcache\MAPIMIG.CAT -> [Ver = | Size = 399670 bytes | Created Date = 24.05.2007 03:33:07 | Attr = ]

mplayer2.exe -> %System32%\dllcache\mplayer2.exe -> [Ver = | Size = 4639 bytes | Created Date = 23.05.2007 19:54:06 | Attr = ]

msinfo.dll -> %System32%\dllcache\msinfo.dll -> [Ver = 7, 0, 0, 0 | Size = 381952 bytes | Created Date = 23.05.2007 19:53:57 | Attr = ]

MSMSGS.CAT -> %System32%\dllcache\MSMSGS.CAT -> [Ver = | Size = 9581 bytes | Created Date = 24.05.2007 03:33:07 | Attr = ]

msn7.cat -> %System32%\dllcache\msn7.cat -> [Ver = | Size = 19569 bytes | Created Date = 24.05.2007 03:33:07 | Attr = ]

msn9.cat -> %System32%\dllcache\msn9.cat -> [Ver = | Size = 11651 bytes | Created Date = 24.05.2007 03:33:07 | Attr = ]

MSTSWEB.CAT -> %System32%\dllcache\MSTSWEB.CAT -> [Ver = | Size = 7245 bytes | Created Date = 24.05.2007 03:33:07 | Attr = ]

MW770.CAT -> %System32%\dllcache\MW770.CAT -> [Ver = | Size = 37509 bytes | Created Date = 24.05.2007 03:33:07 | Attr = ]

nls302en.lex -> %System32%\dllcache\nls302en.lex -> [Ver = | Size = 4399505 bytes | Created Date = 23.05.2007 19:54:44 | Attr = ]

NT5.CAT -> %System32%\dllcache\NT5.CAT -> [Ver = | Size = 1897552 bytes | Created Date = 24.05.2007 03:33:06 | Attr = ]

NT5IIS.CAT -> %System32%\dllcache\NT5IIS.CAT -> [Ver = | Size = 809394 bytes | Created Date = 24.05.2007 03:33:06 | Attr = ]

NT5INF.CAT -> %System32%\dllcache\NT5INF.CAT -> [Ver = | Size = 526002 bytes | Created Date = 24.05.2007 03:33:06 | Attr = ]

NTPRINT.CAT -> %System32%\dllcache\NTPRINT.CAT -> [Ver = | Size = 1086058 bytes | Created Date = 24.05.2007 03:33:06 | Attr = ]

OEMBIOS.CAT -> %System32%\dllcache\OEMBIOS.CAT -> [Ver = | Size = 7407 bytes | Created Date = 24.05.2007 03:33:07 | Attr = ]

pinball.exe -> %System32%\dllcache\pinball.exe -> Cinematronics [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 284160 bytes | Created Date = 23.05.2007 19:52:40 | Attr = ]

pintlcsa.dll -> %System32%\dllcache\pintlcsa.dll -> [Ver = | Size = 175104 bytes | Created Date = 23.05.2007 19:56:35 | Attr = ]

prc.nls -> %System32%\dllcache\prc.nls -> [Ver = | Size = 83748 bytes | Created Date = 23.05.2007 19:56:37 | Attr = ]

prcp.nls -> %System32%\dllcache\prcp.nls -> [Ver = | Size = 83748 bytes | Created Date = 23.05.2007 19:56:37 | Attr = ]

r1033tts.lxa -> %System32%\dllcache\r1033tts.lxa -> [Ver = | Size = 605050 bytes | Created Date = 24.05.2007 03:35:11 | Attr = ]

rw330ext.dll -> %System32%\dllcache\rw330ext.dll -> RICOH Co., Ltd. [Ver = 5, 0, 2419, 1 | Size = 26624 bytes | Created Date = 23.05.2007 19:56:46 | Attr = ]

rwia001.dll -> %System32%\dllcache\rwia001.dll -> Ricoh Co., Ltd. [Ver = 5, 0, 2419, 1 | Size = 81408 bytes | Created Date = 23.05.2007 19:56:46 | Attr = ]

rwia330.dll -> %System32%\dllcache\rwia330.dll -> Ricoh Co., Ltd. [Ver = 5, 0, 2419, 1 | Size = 81408 bytes | Created Date = 23.05.2007 19:56:46 | Attr = ]

sam.sdf -> %System32%\dllcache\sam.sdf -> [Ver = | Size = 888 bytes | Created Date = 24.05.2007 03:35:12 | Attr = ]

sam.spd -> %System32%\dllcache\sam.spd -> [Ver = | Size = 1685606 bytes | Created Date = 24.05.2007 03:35:12 | Attr = ]

SP2.CAT -> %System32%\dllcache\SP2.CAT -> [Ver = | Size = 1014836 bytes | Created Date = 24.05.2007 03:33:06 | Attr = ]

spxcoins.dll -> %System32%\dllcache\spxcoins.dll -> Perle Systems Ltd. [Ver = 1.0.0.0007 | Size = 24661 bytes | Created Date = 24.05.2007 03:34:57 | Attr = ]

srframe.mmf -> %System32%\dllcache\srframe.mmf -> [Ver = | Size = 984 bytes | Created Date = 23.05.2007 19:54:15 | Attr = ]

startoc.cat -> %System32%\dllcache\startoc.cat -> [Ver = | Size = 168806 bytes | Created Date = 24.05.2007 03:33:07 | Attr = ]

wmerrenu.cat -> %System32%\dllcache\wmerrenu.cat -> [Ver = | Size = 7334 bytes | Created Date = 24.05.2007 03:33:07 | Attr = ]

xjis.nls -> %System32%\dllcache\xjis.nls -> [Ver = | Size = 28288 bytes | Created Date = 23.05.2007 19:57:08 | Attr = ]

aavmker4.sys -> %System32%\drivers\aavmker4.sys -> ALWIL Software [Ver = 4.7.997.0 | Size = 26888 bytes | Created Date = 23.05.2007 20:35:02 | Attr = ]

AmdK8.sys -> %System32%\drivers\AmdK8.sys -> Advanced Micro Devices [Ver = 1.3.2 (dnsrv(wmbla).060618-2337) | Size = 43520 bytes | Created Date = 23.05.2007 20:04:29 | Attr = ]

aswmon.sys -> %System32%\drivers\aswmon.sys -> ALWIL Software [Ver = 4.7.997.0 | Size = 85952 bytes | Created Date = 23.05.2007 20:35:01 | Attr = ]

aswmon2.sys -> %System32%\drivers\aswmon2.sys -> ALWIL Software [Ver = 4.7.997.0 | Size = 94552 bytes | Created Date = 23.05.2007 20:35:01 | Attr = ]

aswRdr.sys -> %System32%\drivers\aswRdr.sys -> ALWIL Software [Ver = 4.7.997.0 | Size = 23416 bytes | Created Date = 23.05.2007 20:35:03 | Attr = ]

aswTdi.sys -> %System32%\drivers\aswTdi.sys -> ALWIL Software [Ver = 4.7.997.0 | Size = 43176 bytes | Created Date = 23.05.2007 20:35:02 | Attr = ]

AvgAsCln.sys -> %System32%\drivers\AvgAsCln.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 23.05.2007 22:16:46 | Attr = ]

AWRTPD.sys -> %System32%\drivers\AWRTPD.sys -> Lavasoft AB [Ver = 1.0.0.134 | Size = 6272 bytes | Created Date = 04.06.2007 14:14:56 | Attr = ]

AWRTRD.sys -> %System32%\drivers\AWRTRD.sys -> Lavasoft AB [Ver = 7.0.1.2 | Size = 8320 bytes | Created Date = 04.06.2007 14:17:02 | Attr = ]

disdn -> %System32%\drivers\disdn -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

etc -> %System32%\drivers\etc -> [Folder | Created Date = 24.05.2007 03:27:00 | Attr = ]

L8042Kbd.sys -> %System32%\drivers\L8042Kbd.sys -> Logitech Inc. [Ver = 3.30.152.00 | Size = 20496 bytes | Created Date = 23.05.2007 22:09:27 | Attr = ]

LHidFilt.Sys -> %System32%\drivers\LHidFilt.Sys -> Logitech, Inc. [Ver = 3.30.152.00 | Size = 34576 bytes | Created Date = 23.05.2007 22:09:27 | Attr = ]

LMouFilt.Sys -> %System32%\drivers\LMouFilt.Sys -> Logitech, Inc. [Ver = 3.30.152.00 | Size = 33296 bytes | Created Date = 23.05.2007 22:09:27 | Attr = ]

lvmjpeg.sys -> %System32%\drivers\lvmjpeg.sys -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 142848 bytes | Created Date = 26.05.2007 18:24:26 | Attr = R ]

lvpopflt.sys -> %System32%\drivers\lvpopflt.sys -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 2008448 bytes | Created Date = 26.05.2007 18:24:33 | Attr = R ]

LVUSBSta.sys -> %System32%\drivers\LVUSBSta.sys -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 22528 bytes | Created Date = 26.05.2007 18:24:26 | Attr = R ]

lvuvc.hs -> %System32%\drivers\lvuvc.hs -> [Ver = | Size = 0 bytes | Created Date = 23.05.2007 21:48:31 | Attr = ]

lvuvc.sys -> %System32%\drivers\lvuvc.sys -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 1054848 bytes | Created Date = 26.05.2007 18:24:26 | Attr = R ]

lvuvcflt.sys -> %System32%\drivers\lvuvcflt.sys -> Logitech Inc. [Ver = 9.0.1.1070 | Size = 14080 bytes | Created Date = 26.05.2007 18:24:21 | Attr = R ]

MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf -> %System32%\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf -> [Ver = | Size = 0 bytes | Created Date = 23.05.2007 22:09:54 | Attr = H ]

Msft_Kernel_LMouFilt_01005.Wdf -> %System32%\drivers\Msft_Kernel_LMouFilt_01005.Wdf -> [Ver = | Size = 0 bytes | Created Date = 23.05.2007 22:09:56 | Attr = H ]

NSDriver.sys -> %System32%\drivers\NSDriver.sys -> Lavasoft AB [Ver = 1.0.0.0 | Size = 9344 bytes | Created Date = 04.06.2007 14:18:48 | Attr = ]

NVENETFD.sys -> %System32%\drivers\NVENETFD.sys -> NVIDIA Corporation [Ver = 1.00.03.06531 | Size = 57856 bytes | Created Date = 23.05.2007 20:04:15 | Attr = R ]

nvnetbus.sys -> %System32%\drivers\nvnetbus.sys -> NVIDIA Corporation [Ver = 1.00.03.06531 | Size = 19968 bytes | Created Date = 23.05.2007 20:04:13 | Attr = R ]

nvnrm.sys -> %System32%\drivers\nvnrm.sys -> NVIDIA Corporation [Ver = 1.00.02.06531 | Size = 1161088 bytes | Created Date = 23.05.2007 20:04:13 | Attr = R ]

nvphy.bin -> %System32%\drivers\nvphy.bin -> [Ver = | Size = 1428 bytes | Created Date = 23.05.2007 20:04:14 | Attr = R ]

nvsnpu.sys -> %System32%\drivers\nvsnpu.sys -> NVIDIA Corporation [Ver = 1.00.02.06531 | Size = 261632 bytes | Created Date = 23.05.2007 20:04:13 | Attr = R ]

nvtcp.sys -> %System32%\drivers\nvtcp.sys -> NVIDIA Corporation [Ver = 1.00.03.06531 | Size = 110592 bytes | Created Date = 23.05.2007 20:04:13 | Attr = R ]

RtkHDAud.Sys -> %System32%\drivers\RtkHDAud.Sys -> Realtek Semiconductor Corp. [Ver = 5.10.00.5319 built by: WinDDK | Size = 4394496 bytes | Created Date = 23.05.2007 20:04:21 | Attr = R ]

services.exe -> %System32%\drivers\services.exe -> FileZilla Project [Ver = 0, 9, 23, 0 | Size = 546816 bytes | Created Date = 23.05.2007 22:07:40 | Attr = ]

services.xml -> %System32%\drivers\services.xml -> [Ver = | Size = 7220 bytes | Created Date = 23.05.2007 22:07:40 | Attr = ]

StMp3Rec.sys -> %System32%\drivers\StMp3Rec.sys -> Generic [Ver = 1, 551, 0, 139 | Size = 38229 bytes | Created Date = 29.05.2007 21:28:51 | Attr = ]

UMDF -> %System32%\drivers\UMDF -> [Folder | Created Date = 23.05.2007 21:48:55 | Attr = ]

zlib1d.dll -> %System32%\drivers\zlib1d.dll -> [Ver = 1.2.3 | Size = 110592 bytes | Created Date = 23.05.2007 22:07:40 | Attr = ]

cygcrypt-0.dll -> %System32%\drivers\etc\cygcrypt-0.dll -> [Ver = | Size = 6656 bytes | Created Date = 23.05.2007 22:07:40 | Attr = ]

cygwin1.dll -> %System32%\drivers\etc\cygwin1.dll -> Red Hat [Ver = 1.5.22-cr-0x5f1 | Size = 1872347 bytes | Created Date = 23.05.2007 22:07:40 | Attr = ]

win32.dll -> %System32%\drivers\etc\win32.dll -> [Ver = | Size = 314 bytes | Created Date = 29.05.2007 20:00:35 | Attr = ]

win32.dll~ -> %System32%\drivers\etc\win32.dll~ -> [Ver = | Size = 284 bytes | Created Date = 29.05.2007 20:00:35 | Attr = ]

winnt32.dll -> %System32%\drivers\etc\winnt32.dll -> [Ver = | Size = 372 bytes | Created Date = 29.05.2007 20:01:34 | Attr = ]

winnt32.dll~ -> %System32%\drivers\etc\winnt32.dll~ -> [Ver = | Size = 372 bytes | Created Date = 29.05.2007 20:00:35 | Attr = ]

MsftWdf_user_01_00_00.Wdf -> %System32%\drivers\UMDF\MsftWdf_user_01_00_00.Wdf -> [Ver = | Size = 0 bytes | Created Date = 23.05.2007 21:48:55 | Attr = H ]

[Files/Folders - Modified Within 60 days]

AUTOEXEC.BAT -> %SystemDrive%\AUTOEXEC.BAT -> [Ver = | Size = 0 bytes | Modified Date = 23.05.2007 20:55:36 | Attr = ]

boot.ini -> %SystemDrive%\boot.ini -> [Ver = | Size = 228 bytes | Modified Date = 03.06.2007 19:09:06 | Attr = RHS]

CONFIG.SYS -> %SystemDrive%\CONFIG.SYS -> [Ver = | Size = 0 bytes | Modified Date = 23.05.2007 20:55:36 | Attr = ]

diff.exe -> %SystemDrive%\diff.exe -> [Ver = | Size = 68096 bytes | Modified Date = 12.05.2007 18:22:00 | Attr = ]

Documents and Settings -> %SystemDrive%\Documents and Settings -> [Folder | Modified Date = 09.06.2007 01:02:12 | Attr = ]

grep.exe -> %SystemDrive%\grep.exe -> [Ver = | Size = 103424 bytes | Modified Date = 12.05.2007 18:22:00 | Attr = ]

IO.SYS -> %SystemDrive%\IO.SYS -> [Ver = | Size = 0 bytes | Modified Date = 23.05.2007 20:55:36 | Attr = RHS]

MSDOS.SYS -> %SystemDrive%\MSDOS.SYS -> [Ver = | Size = 0 bytes | Modified Date = 23.05.2007 20:55:36 | Attr = RHS]

MSOCache -> %SystemDrive%\MSOCache -> [Folder | Modified Date = 25.05.2007 17:57:10 | Attr = RH ]

NVIDIA -> %SystemDrive%\NVIDIA -> [Folder | Modified Date = 30.05.2007 00:50:22 | Attr = ]

Program Files -> %ProgramFiles% -> [Folder | Modified Date = 09.06.2007 02:46:06 | Attr = R ]

reboot.cmd -> %SystemDrive%\reboot.cmd -> [Ver = | Size = 853 bytes | Modified Date = 12.05.2007 18:22:00 | Attr = ]

RECYCLER -> %SystemDrive%\RECYCLER -> [Folder | Modified Date = 23.05.2007 21:19:38 | Attr = HS]

SDFix -> %SystemDrive%\SDFix -> [Folder | Modified Date = 09.06.2007 12:51:38 | Attr = ]

System Volume Information -> %SystemDrive%\System Volume Information -> [Folder | Modified Date = 09.06.2007 00:50:46 | Attr = HS]

WINDOWS -> %SystemRoot% -> [Folder | Modified Date = 09.06.2007 12:45:06 | Attr = ]

$hf_mig$ -> %SystemRoot%\$hf_mig$ -> [Folder | Modified Date = 24.05.2007 21:13:50 | Attr = H ]

$MSI31Uninstall_KB893803v2$ -> %SystemRoot%\$MSI31Uninstall_KB893803v2$ -> [Folder | Modified Date = 23.05.2007 21:33:22 | Attr = H ]

$NtServicePackUninstallIDNMitigationAPIs$ -> %SystemRoot%\$NtServicePackUninstallIDNMitigationAPIs$ -> [Folder | Modified Date = 23.05.2007 23:34:04 | Attr = H ]

$NtServicePackUninstallNLSDownlevelMapping$ -> %SystemRoot%\$NtServicePackUninstallNLSDownlevelMapping$ -> [Folder | Modified Date = 23.05.2007 23:33:56 | Attr = H ]

$NtUninstallKB873339$ -> %SystemRoot%\$NtUninstallKB873339$ -> [Folder | Modified Date = 23.05.2007 22:20:06 | Attr = H ]

$NtUninstallKB885835$ -> %SystemRoot%\$NtUninstallKB885835$ -> [Folder | Modified Date = 23.05.2007 22:20:28 | Attr = H ]

$NtUninstallKB885836$ -> %SystemRoot%\$NtUninstallKB885836$ -> [Folder | Modified Date = 23.05.2007 22:20:16 | Attr = H ]

$NtUninstallKB886185$ -> %SystemRoot%\$NtUninstallKB886185$ -> [Folder | Modified Date = 23.05.2007 22:20:12 | Attr = H ]

$NtUninstallKB887472$ -> %SystemRoot%\$NtUninstallKB887472$ -> [Folder | Modified Date = 23.05.2007 22:20:22 | Attr = H ]

$NtUninstallKB888111WXPSP2$ -> %SystemRoot%\$NtUninstallKB888111WXPSP2$ -> [Folder | Modified Date = 23.05.2007 21:04:36 | Attr = H ]

$NtUninstallKB888302$ -> %SystemRoot%\$NtUninstallKB888302$ -> [Folder | Modified Date = 23.05.2007 22:20:18 | Attr = H ]

$NtUninstallKB890046$ -> %SystemRoot%\$NtUninstallKB890046$ -> [Folder | Modified Date = 23.05.2007 23:35:20 | Attr = H ]

$NtUninstallKB890859$ -> %SystemRoot%\$NtUninstallKB890859$ -> [Folder | Modified Date = 23.05.2007 22:20:42 | Attr = H ]

$NtUninstallKB891781$ -> %SystemRoot%\$NtUninstallKB891781$ -> [Folder | Modified Date = 23.05.2007 22:20:26 | Attr = H ]

$NtUninstallKB893756$ -> %SystemRoot%\$NtUninstallKB893756$ -> [Folder | Modified Date = 23.05.2007 22:20:48 | Attr = H ]

$NtUninstallKB894391$ -> %SystemRoot%\$NtUninstallKB894391$ -> [Folder | Modified Date = 23.05.2007 22:20:58 | Attr = H ]

$NtUninstallKB896358$ -> %SystemRoot%\$NtUninstallKB896358$ -> [Folder | Modified Date = 23.05.2007 22:20:46 | Attr = H ]

$NtUninstallKB896423$ -> %SystemRoot%\$NtUninstallKB896423$ -> [Folder | Modified Date = 23.05.2007 22:20:56 | Attr = H ]

$NtUninstallKB896428$ -> %SystemRoot%\$NtUninstallKB896428$ -> [Folder | Modified Date = 23.05.2007 22:20:34 | Attr = H ]

$NtUninstallKB898461$ -> %SystemRoot%\$NtUninstallKB898461$ -> [Folder | Modified Date = 23.05.2007 21:33:24 | Attr = H ]

$NtUninstallKB899587$ -> %SystemRoot%\$NtUninstallKB899587$ -> [Folder | Modified Date = 23.05.2007 22:20:54 | Attr = H ]

$NtUninstallKB899591$ -> %SystemRoot%\$NtUninstallKB899591$ -> [Folder | Modified Date = 23.05.2007 22:20:52 | Attr = H ]

$NtUninstallKB900485$ -> %SystemRoot%\$NtUninstallKB900485$ -> [Folder | Modified Date = 23.05.2007 22:21:48 | Attr = H ]

$NtUninstallKB900725$ -> %SystemRoot%\$NtUninstallKB900725$ -> [Folder | Modified Date = 23.05.2007 22:21:18 | Attr = H ]

$NtUninstallKB901017$ -> %SystemRoot%\$NtUninstallKB901017$ -> [Folder | Modified Date = 23.05.2007 22:21:10 | Attr = H ]

$NtUninstallKB901214$ -> %SystemRoot%\$NtUninstallKB901214$ -> [Folder | Modified Date = 23.05.2007 22:20:38 | Attr = H ]

$NtUninstallKB902400$ -> %SystemRoot%\$NtUninstallKB902400$ -> [Folder | Modified Date = 23.05.2007 22:21:04 | Attr = H ]

$NtUninstallKB904706$ -> %SystemRoot%\$NtUninstallKB904706$ -> [Folder | Modified Date = 23.05.2007 22:21:26 | Attr = H ]

$NtUninstallKB904942$ -> %SystemRoot%\$NtUninstallKB904942$ -> [Folder | Modified Date = 23.05.2007 22:22:18 | Attr = H ]

$NtUninstallKB905414$ -> %SystemRoot%\$NtUninstallKB905414$ -> [Folder | Modified Date = 23.05.2007 22:21:12 | Attr = H ]

$NtUninstallKB905749$ -> %SystemRoot%\$NtUninstallKB905749$ -> [Folder | Modified Date = 23.05.2007 22:21:16 | Attr = H ]

$NtUninstallKB908519$ -> %SystemRoot%\$NtUninstallKB908519$ -> [Folder | Modified Date = 23.05.2007 22:21:30 | Attr = H ]

$NtUninstallKB908531$ -> %SystemRoot%\$NtUninstallKB908531$ -> [Folder | Modified Date = 23.05.2007 22:21:50 | Attr = H ]

$NtUninstallKB910437$ -> %SystemRoot%\$NtUninstallKB910437$ -> [Folder | Modified Date = 23.05.2007 22:21:24 | Attr = H ]

$NtUninstallKB911280$ -> %SystemRoot%\$NtUninstallKB911280$ -> [Folder | Modified Date = 23.05.2007 22:22:14 | Attr = H ]

$NtUninstallKB911562$ -> %SystemRoot%\$NtUninstallKB911562$ -> [Folder | Modified Date = 23.05.2007 22:21:44 | Attr = H ]

$NtUninstallKB911564$ -> %SystemRoot%\$NtUninstallKB911564$ -> [Folder | Modified Date = 23.05.2007 22:21:40 | Attr = H ]

$NtUninstallKB911927$ -> %SystemRoot%\$NtUninstallKB911927$ -> [Folder | Modified Date = 23.05.2007 22:21:32 | Attr = H ]

$NtUninstallKB913580$ -> %SystemRoot%\$NtUninstallKB913580$ -> [Folder | Modified Date = 23.05.2007 22:22:08 | Attr = H ]

$NtUninstallKB914388$ -> %SystemRoot%\$NtUninstallKB914388$ -> [Folder | Modified Date = 23.05.2007 22:22:20 | Attr = H ]

$NtUninstallKB914389$ -> %SystemRoot%\$NtUninstallKB914389$ -> [Folder | Modified Date = 23.05.2007 22:22:00 | Attr = H ]

$NtUninstallKB914440$ -> %SystemRoot%\$NtUninstallKB914440$ -> [Folder | Modified Date = 23.05.2007 23:33:16 | Attr = H ]

$NtUninstallKB915800$ -> %SystemRoot%\$NtUninstallKB915800$ -> [Folder | Modified Date = 26.05.2007 03:27:10 | Attr = H ]

$NtUninstallKB915865$ -> %SystemRoot%\$NtUninstallKB915865$ -> [Folder | Modified Date = 23.05.2007 23:33:46 | Attr = H ]

$NtUninstallKB916595$ -> %SystemRoot%\$NtUninstallKB916595$ -> [Folder | Modified Date = 23.05.2007 22:22:38 | Attr = H ]

$NtUninstallKB917344$ -> %SystemRoot%\$NtUninstallKB917344$ -> [Folder | Modified Date = 23.05.2007 22:22:04 | Attr = H ]

$NtUninstallKB917422$ -> %SystemRoot%\$NtUninstallKB917422$ -> [Folder | Modified Date = 23.05.2007 22:22:24 | Attr = H ]

$NtUninstallKB917734_WMP9$ -> %SystemRoot%\$NtUninstallKB917734_WMP9$ -> [Folder | Modified Date = 23.05.2007 22:21:56 | Attr = H ]

$NtUninstallKB917953$ -> %SystemRoot%\$NtUninstallKB917953$ -> [Folder | Modified Date = 23.05.2007 22:22:12 | Attr = H ]

$NtUninstallKB918118$ -> %SystemRoot%\$NtUninstallKB918118$ -> [Folder | Modified Date = 23.05.2007 22:23:54 | Attr = H ]

$NtUninstallKB918439$ -> %SystemRoot%\$NtUninstallKB918439$ -> [Folder | Modified Date = 23.05.2007 22:22:06 | Attr = H ]

$NtUninstallKB919007$ -> %SystemRoot%\$NtUninstallKB919007$ -> [Folder | Modified Date = 23.05.2007 22:22:40 | Attr = H ]

$NtUninstallKB920213$ -> %SystemRoot%\$NtUninstallKB920213$ -> [Folder | Modified Date = 23.05.2007 23:35:24 | Attr = H ]

$NtUninstallKB920670$ -> %SystemRoot%\$NtUninstallKB920670$ -> [Folder | Modified Date = 23.05.2007 22:22:26 | Attr = H ]

$NtUninstallKB920683$ -> %SystemRoot%\$NtUninstallKB920683$ -> [Folder | Modified Date = 23.05.2007 22:22:30 | Attr = H ]

$NtUninstallKB920685$ -> %SystemRoot%\$NtUninstallKB920685$ -> [Folder | Modified Date = 23.05.2007 22:22:44 | Attr = H ]

$NtUninstallKB920872$ -> %SystemRoot%\$NtUninstallKB920872$ -> [Folder | Modified Date = 23.05.2007 22:22:48 | Attr = H ]

$NtUninstallKB922582$ -> %SystemRoot%\$NtUninstallKB922582$ -> [Folder | Modified Date = 23.05.2007 22:22:34 | Attr = H ]

$NtUninstallKB922819$ -> %SystemRoot%\$NtUninstallKB922819$ -> [Folder | Modified Date = 23.05.2007 22:23:04 | Attr = H ]

$NtUninstallKB923191$ -> %SystemRoot%\$NtUninstallKB923191$ -> [Folder | Modified Date = 23.05.2007 22:22:56 | Attr = H ]

$NtUninstallKB923414$ -> %SystemRoot%\$NtUninstallKB923414$ -> [Folder | Modified Date = 23.05.2007 22:22:50 | Attr = H ]

$NtUninstallKB923689$ -> %SystemRoot%\$NtUninstallKB923689$ -> [Folder | Modified Date = 23.05.2007 22:23:32 | Attr = H ]

$NtUninstallKB923694$ -> %SystemRoot%\$NtUninstallKB923694$ -> [Folder | Modified Date = 23.05.2007 22:23:20 | Attr = H ]

$NtUninstallKB923980$ -> %SystemRoot%\$NtUninstallKB923980$ -> [Folder | Modified Date = 23.05.2007 22:23:14 | Attr = H ]

$NtUninstallKB924191$ -> %SystemRoot%\$NtUninstallKB924191$ -> [Folder | Modified Date = 23.05.2007 22:23:00 | Attr = H ]

$NtUninstallKB924270$ -> %SystemRoot%\$NtUninstallKB924270$ -> [Folder | Modified Date = 23.05.2007 22:23:06 | Attr = H ]

$NtUninstallKB924496$ -> %SystemRoot%\$NtUninstallKB924496$ -> [Folder | Modified Date = 23.05.2007 22:22:54 | Attr = H ]

$NtUninstallKB924667$ -> %SystemRoot%\$NtUninstallKB924667$ -> [Folder | Modified Date = 23.05.2007 22:23:48 | Attr = H ]

$NtUninstallKB925398_WMP64$ -> %SystemRoot%\$NtUninstallKB925398_WMP64$ -> [Folder | Modified Date = 23.05.2007 22:23:26 | Attr = H ]

$NtUninstallKB925720$ -> %SystemRoot%\$NtUninstallKB925720$ -> [Folder | Modified Date = 23.05.2007 23:32:10 | Attr = H ]

$NtUninstallKB925902$ -> %SystemRoot%\$NtUninstallKB925902$ -> [Folder | Modified Date = 23.05.2007 23:32:16 | Attr = H ]

$NtUninstallKB926239$ -> %SystemRoot%\$NtUninstallKB926239$ -> [Folder | Modified Date = 23.05.2007 22:49:52 | Attr = H ]

$NtUninstallKB926255$ -> %SystemRoot%\$NtUninstallKB926255$ -> [Folder | Modified Date = 23.05.2007 22:23:18 | Attr = H ]

$NtUninstallKB926436$ -> %SystemRoot%\$NtUninstallKB926436$ -> [Folder | Modified Date = 23.05.2007 22:23:58 | Attr = H ]

$NtUninstallKB927779$ -> %SystemRoot%\$NtUninstallKB927779$ -> [Folder | Modified Date = 23.05.2007 22:23:50 | Attr = H ]

$NtUninstallKB927802$ -> %SystemRoot%\$NtUninstallKB927802$ -> [Folder | Modified Date = 23.05.2007 22:23:46 | Attr = H ]

$NtUninstallKB927891$ -> %SystemRoot%\$NtUninstallKB927891$ -> [Folder | Modified Date = 23.05.2007 23:36:08 | Attr = H ]

$NtUninstallKB928255$ -> %SystemRoot%\$NtUninstallKB928255$ -> [Folder | Modified Date = 23.05.2007 22:23:38 | Attr = H ]

$NtUninstallKB928843$ -> %SystemRoot%\$NtUninstallKB928843$ -> [Folder | Modified Date = 23.05.2007 22:23:42 | Attr = H ]

$NtUninstallKB929399$ -> %SystemRoot%\$NtUninstallKB929399$ -> [Folder | Modified Date = 23.05.2007 23:32:32 | Attr = H ]

$NtUninstallKB929969$ -> %SystemRoot%\$NtUninstallKB929969$ -> [Folder | Modified Date = 23.05.2007 22:23:34 | Attr = H ]

$NtUninstallKB930178$ -> %SystemRoot%\$NtUninstallKB930178$ -> [Folder | Modified Date = 23.05.2007 23:32:42 | Attr = H ]

$NtUninstallKB930916$ -> %SystemRoot%\$NtUninstallKB930916$ -> [Folder | Modified Date = 23.05.2007 23:35:28 | Attr = H ]

$NtUninstallKB931261$ -> %SystemRoot%\$NtUninstallKB931261$ -> [Folder | Modified Date = 23.05.2007 23:32:46 | Attr = H ]

$NtUninstallKB931768$ -> %SystemRoot%\$NtUninstallKB931768$ -> [Folder | Modified Date = 23.05.2007 23:35:32 | Attr = H ]

$NtUninstallKB931784$ -> %SystemRoot%\$NtUninstallKB931784$ -> [Folder | Modified Date = 23.05.2007 23:32:38 | Attr = H ]

$NtUninstallKB931836$ -> %SystemRoot%\$NtUninstallKB931836$ -> [Folder | Modified Date = 23.05.2007 22:24:00 | Attr = H ]

$NtUninstallKB932168$ -> %SystemRoot%\$NtUninstallKB932168$ -> [Folder | Modified Date = 23.05.2007 23:35:14 | Attr = H ]

$NtUninstallKB935448$ -> %SystemRoot%\$NtUninstallKB935448$ -> [Folder | Modified Date = 23.05.2007 23:35:16 | Attr = H ]

$NtUninstallMSCompPackV1$ -> %SystemRoot%\$NtUninstallMSCompPackV1$ -> [Folder | Modified Date = 23.05.2007 22:49:46 | Attr = H ]

$NtUninstallWdf01005$ -> %SystemRoot%\$NtUninstallWdf01005$ -> [Folder | Modified Date = 23.05.2007 23:09:50 | Attr = H ]

$NtUninstallWIC$ -> %SystemRoot%\$NtUninstallWIC$ -> [Folder | Modified Date = 23.05.2007 22:51:54 | Attr = H ]

$NtUninstallWMFDist11$ -> %SystemRoot%\$NtUninstallWMFDist11$ -> [Folder | Modified Date = 23.05.2007 22:49:10 | Attr = H ]

$NtUninstallwmp11$ -> %SystemRoot%\$NtUninstallwmp11$ -> [Folder | Modified Date = 23.05.2007 22:49:34 | Attr = H ]

$NtUninstallWudf01000$ -> %SystemRoot%\$NtUninstallWudf01000$ -> [Folder | Modified Date = 23.05.2007 22:48:54 | Attr = H ]

addins -> %SystemRoot%\addins -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

AppPatch -> %SystemRoot%\AppPatch -> [Folder | Modified Date = 23.05.2007 23:20:42 | Attr = ]

assembly -> %SystemRoot%\assembly -> [Folder | Modified Date = 02.06.2007 17:04:26 | Attr = R S]

BlendSettings.ini -> %SystemRoot%\BlendSettings.ini -> [Ver = | Size = 23 bytes | Modified Date = 09.06.2007 00:51:56 | Attr = ]

bootstat.dat -> %SystemRoot%\bootstat.dat -> [Ver = | Size = 2048 bytes | Modified Date = 11.06.2007 18:39:42 | Attr = S]

BricoPack Wallpaper.bmp -> %SystemRoot%\BricoPack Wallpaper.bmp -> [Ver = | Size = 5292054 bytes | Modified Date = 05.06.2007 19:25:56 | Attr = ]

BricoPackFoldersDelete.cmd -> %SystemRoot%\BricoPackFoldersDelete.cmd -> [Ver = | Size = 6120 bytes | Modified Date = 05.06.2007 19:26:12 | Attr = ]

BricoPacks -> %SystemRoot%\BricoPacks -> [Folder | Modified Date = 05.06.2007 19:23:28 | Attr = ]

BricoPackUninst.cmd -> %SystemRoot%\BricoPackUninst.cmd -> [Ver = | Size = 64801 bytes | Modified Date = 05.06.2007 19:26:12 | Attr = ]

Cache -> %SystemRoot%\Cache -> [Folder | Modified Date = 23.05.2007 21:15:54 | Attr = ]

Config -> %SystemRoot%\Config -> [Folder | Modified Date = 25.05.2007 17:48:58 | Attr = ]

config.ini -> %SystemRoot%\config.ini -> [Ver = | Size = 41 bytes | Modified Date = 23.05.2007 23:49:30 | Attr = ]

Connection Wizard -> %SystemRoot%\Connection Wizard -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

control.ini -> %SystemRoot%\control.ini -> [Ver = | Size = 0 bytes | Modified Date = 23.05.2007 20:55:36 | Attr = ]

Cursors -> %SystemRoot%\Cursors -> [Folder | Modified Date = 05.06.2007 19:24:52 | Attr = ]

Debug -> %SystemRoot%\Debug -> [Folder | Modified Date = 23.05.2007 23:33:22 | Attr = ]

DIIUnin.dat -> %SystemRoot%\DIIUnin.dat -> [Ver = | Size = 35662 bytes | Modified Date = 29.05.2007 23:15:24 | Attr = ]

DIIUnin.exe -> %SystemRoot%\DIIUnin.exe -> Blizzard Entertainment [Ver = 1, 0, 0, 5 | Size = 102400 bytes | Modified Date = 29.05.2007 19:44:46 | Attr = ]

DIIUnin.pif -> %SystemRoot%\DIIUnin.pif -> [Ver = | Size = 2829 bytes | Modified Date = 29.05.2007 19:44:46 | Attr = ]

Downloaded Installations -> %SystemRoot%\Downloaded Installations -> [Folder | Modified Date = 29.05.2007 22:27:54 | Attr = ]

Downloaded Program Files -> %SystemRoot%\Downloaded Program Files -> [Folder | Modified Date = 05.06.2007 18:55:56 | Attr = S]

Driver Cache -> %SystemRoot%\Driver Cache -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

Fonts -> %SystemRoot%\Fonts -> [Folder | Modified Date = 05.06.2007 19:27:48 | Attr = R S]

GPInstall.exe -> %SystemRoot%\GPInstall.exe -> Qsc [Ver = 5.0.3.32 | Size = 796672 bytes | Modified Date = 28.05.2007 18:18:20 | Attr = ]

Help -> %SystemRoot%\Help -> [Folder | Modified Date = 04.06.2007 23:46:54 | Attr = ]

ie7 -> %SystemRoot%\ie7 -> [Folder | Modified Date = 23.05.2007 23:34:48 | Attr = H ]

ie7updates -> %SystemRoot%\ie7updates -> [Folder | Modified Date = 24.05.2007 21:14:24 | Attr = ]

ime -> %SystemRoot%\ime -> [Folder | Modified Date = 23.05.2007 20:55:48 | Attr = ]

imsins.BAK -> %SystemRoot%\imsins.BAK -> [Ver = | Size = 1374 bytes | Modified Date = 26.05.2007 03:27:44 | Attr = ]

inf -> %SystemRoot%\inf -> [Folder | Modified Date = 05.06.2007 20:51:50 | Attr = H ]

Installer -> %SystemRoot%\Installer -> [Folder | Modified Date = 09.06.2007 17:08:30 | Attr = HS]

Internet Logs -> %SystemRoot%\Internet Logs -> [Folder | Modified Date = 11.06.2007 18:39:56 | Attr = ]

java -> %SystemRoot%\java -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

Lic.xxx -> %SystemRoot%\Lic.xxx -> [Ver = | Size = 26 bytes | Modified Date = 09.06.2007 01:06:00 | Attr = ]

logo1_.exe -> %SystemRoot%\logo1_.exe -> [Folder | Modified Date = 09.06.2007 01:06:50 | Attr = ]

Media -> %SystemRoot%\Media -> [Folder | Modified Date = 05.06.2007 19:24:42 | Attr = ]

Microsoft.NET -> %SystemRoot%\Microsoft.NET -> [Folder | Modified Date = 29.05.2007 21:52:58 | Attr = ]

mozver.dat -> %SystemRoot%\mozver.dat -> [Ver = | Size = 1550 bytes | Modified Date = 02.06.2007 14:13:38 | Attr = ]

msagent -> %SystemRoot%\msagent -> [Folder | Modified Date = 23.05.2007 23:42:36 | Attr = ]

msapps -> %SystemRoot%\msapps -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

mui -> %SystemRoot%\mui -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

NeroDigital.ini -> %SystemRoot%\NeroDigital.ini -> [Ver = | Size = 69 bytes | Modified Date = 03.06.2007 12:26:22 | Attr = ]

network diagnostic -> %SystemRoot%\network diagnostic -> [Folder | Modified Date = 23.05.2007 23:33:16 | Attr = ]

nsreg.dat -> %SystemRoot%\nsreg.dat -> [Ver = | Size = 0 bytes | Modified Date = 23.05.2007 21:30:08 | Attr = ]

NV33681796.TMP -> %SystemRoot%\NV33681796.TMP -> [Folder | Modified Date = 30.05.2007 00:52:34 | Attr = ]

nview -> %SystemRoot%\nview -> [Folder | Modified Date = 30.05.2007 00:52:32 | Attr = ]

ODBCINST.INI -> %SystemRoot%\ODBCINST.INI -> [Ver = | Size = 4205 bytes | Modified Date = 23.05.2007 20:55:28 | Attr = ]

Offline Web Pages -> %SystemRoot%\Offline Web Pages -> [Folder | Modified Date = 23.05.2007 20:54:58 | Attr = R ]

pchealth -> %SystemRoot%\pchealth -> [Folder | Modified Date = 23.05.2007 22:50:14 | Attr = ]

PeerNet -> %SystemRoot%\PeerNet -> [Folder | Modified Date = 24.05.2007 04:30:36 | Attr = ]

Prefetch -> %SystemRoot%\Prefetch -> [Folder | Modified Date = 11.06.2007 18:43:30 | Attr = ]

Provisioning -> %SystemRoot%\Provisioning -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

pss -> %SystemRoot%\pss -> [Folder | Modified Date = 03.06.2007 19:09:04 | Attr = ]

QTFont.for -> %SystemRoot%\QTFont.for -> [Ver = | Size = 1409 bytes | Modified Date = 02.06.2007 11:13:12 | Attr = ]

QTFont.qfn -> %SystemRoot%\QTFont.qfn -> [Ver = | Size = 54156 bytes | Modified Date = 09.06.2007 13:20:02 | Attr = H ]

Registration -> %SystemRoot%\Registration -> [Folder | Modified Date = 23.05.2007 20:55:26 | Attr = ]

REGLOCS.OLD -> %SystemRoot%\REGLOCS.OLD -> [Ver = | Size = 8192 bytes | Modified Date = 23.05.2007 20:58:14 | Attr = ]

repair -> %SystemRoot%\repair -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

Resources -> %SystemRoot%\Resources -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

rundl132.dll -> %SystemRoot%\rundl132.dll -> [Folder | Modified Date = 09.06.2007 01:06:50 | Attr = ]

rundll16.exe -> %SystemRoot%\rundll16.exe -> [Folder | Modified Date = 09.06.2007 01:06:50 | Attr = ]

security -> %SystemRoot%\security -> [Folder | Modified Date = 23.05.2007 21:04:44 | Attr = ]

SHELLNEW -> %SystemRoot%\SHELLNEW -> [Folder | Modified Date = 07.06.2007 23:03:28 | Attr = ]

SoftwareDistribution -> %SystemRoot%\SoftwareDistribution -> [Folder | Modified Date = 25.05.2007 18:05:16 | Attr = ]

srchasst -> %SystemRoot%\srchasst -> [Folder | Modified Date = 23.05.2007 20:54:46 | Attr = ]

SxsCaPendDel -> %SystemRoot%\SxsCaPendDel -> [Folder | Modified Date = 02.06.2007 14:07:44 | Attr = ]

system -> %SystemRoot%\system -> [Folder | Modified Date = 23.05.2007 22:48:32 | Attr = ]

system.ini -> %SystemRoot%\system.ini -> [Ver = | Size = 227 bytes | Modified Date = 03.06.2007 19:09:06 | Attr = ]

system32 -> %System32% -> [Folder | Modified Date = 09.06.2007 02:45:58 | Attr = ]

Tasks -> %SystemRoot%\Tasks -> [Folder | Modified Date = 23.05.2007 21:01:54 | Attr = S]

Temp -> %SystemRoot%\Temp -> [Folder | Modified Date = 11.06.2007 18:41:36 | Attr = ]

Thumbs.db -> %SystemRoot%\Thumbs.db -> [Ver = | Size = 9216 bytes | Modified Date = 09.06.2007 13:22:58 | Attr = HS]

@Alternate Data Stream - 0 bytes -> %SystemRoot%\Thumbs.db:encryptable ->

twain_32 -> %SystemRoot%\twain_32 -> [Folder | Modified Date = 26.05.2007 19:08:56 | Attr = ]

vb.ini -> %SystemRoot%\vb.ini -> [Ver = | Size = 36 bytes | Modified Date = 23.05.2007 20:53:36 | Attr = ]

vbaddin.ini -> %SystemRoot%\vbaddin.ini -> [Ver = | Size = 37 bytes | Modified Date = 23.05.2007 20:53:36 | Attr = ]

WBEM -> %SystemRoot%\WBEM -> [Folder | Modified Date = 23.05.2007 23:35:00 | Attr = ]

Web -> %SystemRoot%\Web -> [Folder | Modified Date = 07.06.2007 23:03:30 | Attr = R ]

win.ini -> %SystemRoot%\win.ini -> [Ver = | Size = 582 bytes | Modified Date = 03.06.2007 19:09:06 | Attr = ]

WindowsShell.Manifest -> %SystemRoot%\WindowsShell.Manifest -> [Ver = | Size = 749 bytes | Modified Date = 23.05.2007 20:54:56 | Attr = RH ]

WinSxS -> %SystemRoot%\WinSxS -> [Folder | Modified Date = 02.06.2007 12:56:34 | Attr = ]

WMSysPr9.prx -> %SystemRoot%\WMSysPr9.prx -> [Ver = | Size = 316640 bytes | Modified Date = 23.05.2007 20:55:34 | Attr = ]

zts2.exe -> %SystemRoot%\zts2.exe -> [Folder | Modified Date = 09.06.2007 01:06:50 | Attr = ]

SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [Ver = | Size = 6 bytes | Modified Date = 11.06.2007 18:39:46 | Attr = H ]

$winnt$.inf -> %System32%\$winnt$.inf -> [Ver = | Size = 261 bytes | Modified Date = 23.05.2007 20:57:12 | Attr = ]

1025 -> %System32%\1025 -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

1028 -> %System32%\1028 -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

1031 -> %System32%\1031 -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

1033 -> %System32%\1033 -> [Folder | Modified Date = 24.05.2007 04:27:40 | Attr = ]

1036 -> %System32%\1036 -> [Folder | Modified Date = 24.05.2007 04:28:38 | Attr = ]

1037 -> %System32%\1037 -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

1041 -> %System32%\1041 -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

1042 -> %System32%\1042 -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

1054 -> %System32%\1054 -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

2052 -> %System32%\2052 -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

3076 -> %System32%\3076 -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

3com_dmi -> %System32%\3com_dmi -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

amcompat.tlb -> %System32%\amcompat.tlb -> [Ver = | Size = 16832 bytes | Modified Date = 23.05.2007 23:52:02 | Attr = ]

aswBoot.exe -> %System32%\aswBoot.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 745600 bytes | Modified Date = 30.04.2007 17:46:10 | Attr = ]

AvastSS.scr -> %System32%\AvastSS.scr -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 95872 bytes | Modified Date = 30.04.2007 17:35:28 | Attr = ]

BuzzingBee.wav -> %System32%\BuzzingBee.wav -> [Ver = | Size = 146650 bytes | Modified Date = 23.05.2007 21:05:58 | Attr = ]

CatRoot -> %System32%\CatRoot -> [Folder | Modified Date = 26.05.2007 19:10:06 | Attr = ]

CatRoot2 -> %System32%\CatRoot2 -> [Folder | Modified Date = 05.06.2007 23:03:10 | Attr = ]

cdplayer.exe.manifest -> %System32%\cdplayer.exe.manifest -> [Ver = | Size = 749 bytes | Modified Date = 23.05.2007 20:54:56 | Attr = RH ]

Com -> %System32%\Com -> [Folder | Modified Date = 23.05.2007 22:21:06 | Attr = ]

config -> %System32%\config -> [Folder | Modified Date = 25.05.2007 18:00:32 | Attr = ]

CONFIG.NT -> %System32%\CONFIG.NT -> [Ver = | Size = 3121 bytes | Modified Date = 23.05.2007 21:35:04 | Attr = ]

dhcp -> %System32%\dhcp -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

DirectX -> %System32%\DirectX -> [Folder | Modified Date = 02.06.2007 17:04:28 | Attr = ]

dllcache -> %System32%\dllcache -> [Folder | Modified Date = 05.06.2007 19:27:48 | Attr = RHS]

drivers -> %System32%\drivers -> [Folder | Modified Date = 09.06.2007 12:14:08 | Attr = ]

DRVSTORE -> %System32%\DRVSTORE -> [Folder | Modified Date = 02.06.2007 12:51:36 | Attr = ]

emptyregdb.dat -> %System32%\emptyregdb.dat -> [Ver = | Size = 21892 bytes | Modified Date = 23.05.2007 20:53:44 | Attr = ]

en-us -> %System32%\en-us -> [Folder | Modified Date = 23.05.2007 22:53:00 | Attr = ]

exec1.exe -> %System32%\exec1.exe -> Lavalys, Inc. [Ver = 4.00.976 | Size = 2141544 bytes | Modified Date = 25.05.2007 07:25:32 | Attr = ]

exec1.ini -> %System32%\exec1.ini -> [Ver = | Size = 68552 bytes | Modified Date = 25.05.2007 07:29:02 | Attr = ]

export -> %System32%\export -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

ff_vfw.dll -> %System32%\ff_vfw.dll -> [Ver = | Size = 10752 bytes | Modified Date = 08.05.2007 20:23:10 | Attr = ]

FNTCACHE.DAT -> %System32%\FNTCACHE.DAT -> [Ver = | Size = 189000 bytes | Modified Date = 05.06.2007 23:00:34 | Attr = ]

fr-fr -> %System32%\fr-fr -> [Folder | Modified Date = 26.05.2007 10:10:30 | Attr = ]

ias -> %System32%\ias -> [Folder | Modified Date = 24.05.2007 04:27:44 | Attr = ]

icsxml -> %System32%\icsxml -> [Folder | Modified Date = 24.05.2007 04:28:00 | Attr = ]

iifgfgf.dll -> %System32%\iifgfgf.dll -> [Folder | Modified Date = 09.06.2007 01:06:50 | Attr = ]

IME -> %System32%\IME -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

inetsrv -> %System32%\inetsrv -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

Lang -> %System32%\Lang -> [Folder | Modified Date = 23.05.2007 21:05:52 | Attr = ]

LogFiles -> %System32%\LogFiles -> [Folder | Modified Date = 23.05.2007 22:48:56 | Attr = ]

logonui.exe.manifest -> %System32%\logonui.exe.manifest -> [Ver = | Size = 488 bytes | Modified Date = 23.05.2007 20:54:58 | Attr = RH ]

LoopyMusic.wav -> %System32%\LoopyMusic.wav -> [Ver = | Size = 940794 bytes | Modified Date = 23.05.2007 21:05:58 | Attr = ]

lsdelete.exe -> %System32%\lsdelete.exe -> [Ver = | Size = 7680 bytes | Modified Date = 13.04.2007 15:19:52 | Attr = ]

Macromed -> %System32%\Macromed -> [Folder | Modified Date = 23.05.2007 22:54:32 | Attr = ]

Microsoft -> %System32%\Microsoft -> [Folder | Modified Date = 23.05.2007 21:01:52 | Attr = S]

MsDtc -> %System32%\MsDtc -> [Folder | Modified Date = 23.05.2007 20:53:32 | Attr = ]

mui -> %System32%\mui -> [Folder | Modified Date = 23.05.2007 22:51:40 | Attr = ]

ncpa.cpl.manifest -> %System32%\ncpa.cpl.manifest -> [Ver = | Size = 749 bytes | Modified Date = 23.05.2007 20:54:56 | Attr = RH ]

npp -> %System32%\npp -> [Folder | Modified Date = 24.05.2007 04:30:30 | Attr = ]

nscompat.tlb -> %System32%\nscompat.tlb -> [Ver = | Size = 23392 bytes | Modified Date = 23.05.2007 23:52:02 | Attr = ]

nvapps.xml -> %System32%\nvapps.xml -> [Ver = | Size = 88556 bytes | Modified Date = 11.06.2007 18:39:58 | Attr = ]

nwc.cpl.manifest -> %System32%\nwc.cpl.manifest -> [Ver = | Size = 749 bytes | Modified Date = 23.05.2007 20:54:56 | Attr = RH ]

oobe -> %System32%\oobe -> [Folder | Modified Date = 23.05.2007 20:54:32 | Attr = ]

perfc009.dat -> %System32%\perfc009.dat -> [Ver = | Size = 67356 bytes | Modified Date = 26.05.2007 10:10:26 | Attr = ]

perfc00C.dat -> %System32%\perfc00C.dat -> [Ver = | Size = 80110 bytes | Modified Date = 26.05.2007 10:10:26 | Attr = ]

perfh009.dat -> %System32%\perfh009.dat -> [Ver = | Size = 430632 bytes | Modified Date = 26.05.2007 10:10:26 | Attr = ]

perfh00C.dat -> %System32%\perfh00C.dat -> [Ver = | Size = 497736 bytes | Modified Date = 26.05.2007 10:10:26 | Attr = ]

PerfStringBackup.INI -> %System32%\PerfStringBackup.INI -> [Ver = | Size = 1114066 bytes | Modified Date = 26.05.2007 03:27:44 | Attr = ]

PreInstall -> %System32%\PreInstall -> [Folder | Modified Date = 23.05.2007 21:33:26 | Attr = ]

QuickTime.qts -> %System32%\QuickTime.qts -> Apple Inc. [Ver = 7.1.6 | Size = 49152 bytes | Modified Date = 27.04.2007 09:42:00 | Attr = ]

QuickTimeVR.qtx -> %System32%\QuickTimeVR.qtx -> Apple Inc. [Ver = 7.1.6 | Size = 65536 bytes | Modified Date = 27.04.2007 09:42:00 | Attr = ]

ras -> %System32%\ras -> [Folder | Modified Date = 24.05.2007 04:28:16 | Attr = ]

ReinstallBackups -> %System32%\ReinstallBackups -> [Folder | Modified Date = 30.05.2007 00:50:46 | Attr = ]

Restore -> %System32%\Restore -> [Folder | Modified Date = 09.06.2007 00:50:46 | Attr = ]

RTCOM -> %System32%\RTCOM -> [Folder | Modified Date = 23.05.2007 21:04:34 | Attr = ]

sapi.cpl.manifest -> %System32%\sapi.cpl.manifest -> [Ver = | Size = 749 bytes | Modified Date = 23.05.2007 20:54:56 | Attr = RH ]

Setup -> %System32%\Setup -> [Folder | Modified Date = 24.05.2007 04:30:54 | Attr = ]

ShellExt -> %System32%\ShellExt -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

SIntf16.dll -> %System32%\SIntf16.dll -> [Ver = | Size = 12067 bytes | Modified Date = 29.05.2007 20:58:04 | Attr = ]

SIntf32.dll -> %System32%\SIntf32.dll -> [Ver = | Size = 17212 bytes | Modified Date = 29.05.2007 20:58:04 | Attr = ]

SIntfNT.dll -> %System32%\SIntfNT.dll -> [Ver = | Size = 21840 bytes | Modified Date = 29.05.2007 20:58:04 | Attr = ]

SoftwareDistribution -> %System32%\SoftwareDistribution -> [Folder | Modified Date = 23.05.2007 21:31:14 | Attr = ]

spool -> %System32%\spool -> [Folder | Modified Date = 23.05.2007 22:52:00 | Attr = ]

Thumbs.db -> %System32%\Thumbs.db -> [Ver = | Size = 5120 bytes | Modified Date = 09.06.2007 13:23:40 | Attr = HS]

@Alternate Data Stream - 0 bytes -> %System32%\Thumbs.db:encryptable ->

usmt -> %System32%\usmt -> [Folder | Modified Date = 05.06.2007 19:27:46 | Attr = ]

vcmgcd32.dll -> %System32%\vcmgcd32.dll -> [Folder | Modified Date = 09.06.2007 01:06:50 | Attr = ]

vsconfig.xml -> %System32%\vsconfig.xml -> [Ver = | Size = 52662 bytes | Modified Date = 11.06.2007 18:39:46 | Attr = ]

wbem -> %System32%\wbem -> [Folder | Modified Date = 25.05.2007 18:01:40 | Attr = ]

WindowsLogon.manifest -> %System32%\WindowsLogon.manifest -> [Ver = | Size = 488 bytes | Modified Date = 23.05.2007 20:54:58 | Attr = RH ]

wins -> %System32%\wins -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

wpa.bak -> %System32%\wpa.bak -> [Ver = | Size = 13646 bytes | Modified Date = 23.05.2007 21:04:50 | Attr = ]

wpa.dbl -> %System32%\wpa.dbl -> [Ver = | Size = 13646 bytes | Modified Date = 11.06.2007 18:41:50 | Attr = ]

wuaucpl.cpl.manifest -> %System32%\wuaucpl.cpl.manifest -> [Ver = | Size = 749 bytes | Modified Date = 23.05.2007 20:54:56 | Attr = RH ]

xircom -> %System32%\xircom -> [Folder | Modified Date = 23.05.2007 20:55:48 | Attr = ]

XPSViewer -> %System32%\XPSViewer -> [Folder | Modified Date = 23.05.2007 22:53:02 | Attr = ]

zllictbl.dat -> %System32%\zllictbl.dat -> [Ver = | Size = 4212 bytes | Modified Date = 10.06.2007 02:05:58 | Attr = H ]

ZoneLabs -> %System32%\ZoneLabs -> [Folder | Modified Date = 03.06.2007 13:51:08 | Attr = ]

aavmker4.sys -> %System32%\drivers\aavmker4.sys -> ALWIL Software [Ver = 4.7.997.0 | Size = 26888 bytes | Modified Date = 30.04.2007 17:37:24 | Attr = ]

aswmon.sys -> %System32%\drivers\aswmon.sys -> ALWIL Software [Ver = 4.7.997.0 | Size = 85952 bytes | Modified Date = 30.04.2007 17:41:56 | Attr = ]

aswmon2.sys -> %System32%\drivers\aswmon2.sys -> ALWIL Software [Ver = 4.7.997.0 | Size = 94552 bytes | Modified Date = 30.04.2007 17:41:42 | Attr = ]

aswRdr.sys -> %System32%\drivers\aswRdr.sys -> ALWIL Software [Ver = 4.7.997.0 | Size = 23416 bytes | Modified Date = 30.04.2007 17:39:42 | Attr = ]

aswTdi.sys -> %System32%\drivers\aswTdi.sys -> ALWIL Software [Ver = 4.7.997.0 | Size = 43176 bytes | Modified Date = 30.04.2007 17:38:52 | Attr = ]

AWRTPD.sys -> %System32%\drivers\AWRTPD.sys -> Lavasoft AB [Ver = 1.0.0.134 | Size = 6272 bytes | Modified Date = 04.06.2007 15:14:56 | Attr = ]

AWRTRD.sys -> %System32%\drivers\AWRTRD.sys -> Lavasoft AB [Ver = 7.0.1.2 | Size = 8320 bytes | Modified Date = 04.06.2007 15:17:02 | Attr = ]

disdn -> %System32%\drivers\disdn -> [Folder | Modified Date = 24.05.2007 04:27:02 | Attr = ]

etc -> %System32%\drivers\etc -> [Folder | Modified Date = 09.06.2007 12:43:24 | Attr = ]

lvuvc.hs -> %System32%\drivers\lvuvc.hs -> [Ver = | Size = 0 bytes | Modified Date = 11.06.2007 18:39:36 | Attr = ]

MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf -> %System32%\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf -> [Ver = | Size = 0 bytes | Modified Date = 23.05.2007 23:09:56 | Attr = H ]

Msft_Kernel_LMouFilt_01005.Wdf -> %System32%\drivers\Msft_Kernel_LMouFilt_01005.Wdf -> [Ver = | Size = 0 bytes | Modified Date = 23.05.2007 23:09:58 | Attr = H ]

NSDriver.sys -> %System32%\drivers\NSDriver.sys -> Lavasoft AB [Ver = 1.0.0.0 | Size = 9344 bytes | Modified Date = 04.06.2007 15:18:48 | Attr = ]

services.xml -> %System32%\drivers\services.xml -> [Ver = | Size = 7220 bytes | Modified Date = 11.06.2007 18:40:56 | Attr = ]

UMDF -> %System32%\drivers\UMDF -> [Folder | Modified Date = 23.05.2007 22:49:16 | Attr = ]

win32.dll -> %System32%\drivers\etc\win32.dll -> [Ver = | Size = 314 bytes | Modified Date = 29.05.2007 21:00:36 | Attr = ]

win32.dll~ -> %System32%\drivers\etc\win32.dll~ -> [Ver = | Size = 284 bytes | Modified Date = 29.05.2007 21:00:36 | Attr = ]

winnt32.dll -> %System32%\drivers\etc\winnt32.dll -> [Ver = | Size = 372 bytes | Modified Date = 29.05.2007 21:01:36 | Attr = ]

winnt32.dll~ -> %System32%\drivers\etc\winnt32.dll~ -> [Ver = | Size = 372 bytes | Modified Date = 29.05.2007 21:00:36 | Attr = ]

MsftWdf_user_01_00_00.Wdf -> %System32%\drivers\UMDF\MsftWdf_user_01_00_00.Wdf -> [Ver = | Size = 0 bytes | Modified Date = 23.05.2007 22:48:56 | Attr = H ]

[File String Scan - Non-Microsoft Only]

@Alternate Data Stream - 0 bytes -> %SystemRoot%\Thumbs.db:encryptable ->

UPX! , UPX0 , -> %System32%\aswBoot.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 745600 bytes | Modified Date = 30.04.2007 17:46:10 | Attr = ]

PEC2 , -> %System32%\dfrg.msc -> [Ver = | Size = 41131 bytes | Modified Date = 05.08.2004 14:00:00 | Attr = ]

UPX! , UPX0 , -> %System32%\exec1.exe -> Lavalys, Inc. [Ver = 4.00.976 | Size = 2141544 bytes | Modified Date = 25.05.2007 07:25:32 | Attr = ]

@Alternate Data Stream - 0 bytes -> %System32%\Thumbs.db:encryptable ->

winsync , -> %System32%\wbdbase.deu -> [Ver = | Size = 1309184 bytes | Modified Date = 05.08.2004 14:00:00 | Attr = ]

WSUD , UPX0 , -> %System32%\dllcache\hwxjpn.dll -> [Ver = | Size = 13463552 bytes | Modified Date = 05.08.2004 14:00:00 | Attr = ]

UPX0 , -> %System32%\dllcache\NT5IIS.CAT -> [Ver = | Size = 809394 bytes | Modified Date = 05.08.2004 14:00:00 | Attr = ]

PEC2 , -> %System32%\drivers\etc\cygwin1.dll -> Red Hat [Ver = 1.5.22-cr-0x5f1 | Size = 1872347 bytes | Modified Date = 13.11.2006 17:48:12 | Attr = ]

< End of report >

Connexion

Pas encore inscrit ?

Pitits problèmes

Messages recommandés

Syberio

Lien vers le commentaire

Partager sur d’autres sites

Thanos

Lien vers le commentaire

Partager sur d’autres sites

Syberio

Lien vers le commentaire

Partager sur d’autres sites

Syberio

Lien vers le commentaire

Partager sur d’autres sites

Thanos

Lien vers le commentaire

Partager sur d’autres sites

Thanos

Lien vers le commentaire

Partager sur d’autres sites

Syberio

Lien vers le commentaire

Partager sur d’autres sites

Syberio

Lien vers le commentaire

Partager sur d’autres sites

Thanos

Lien vers le commentaire

Partager sur d’autres sites

Syberio

Lien vers le commentaire

Partager sur d’autres sites

Rejoindre la conversation

En ligne récemment 0 membre est en ligne

Zebulon

Outils en ligne

Naviguer