Infection PC (virus) - Besoin d'un coup de main en analyse de log

benjaminbl · le 21 février 2009

Bonjour, depuis quelques temps ma machine sous vista présente des symptomes d'infection : les antivirus et vista ne parviennet pas à se mettre à jour et dans les navigateur il y a des redirect intempestif à l'ouverture d'onglet sur des site de pub type downlod rapide ou emule..

voici mon log.

Merci d'avance pour l'aide que vous pourrez m'apporter.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:15:48, on 21/02/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Windows\Explorer.EXE

C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

C:\Windows\system32\svchost.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Sony\ISB Utility\ISBMgr.exe

C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe

C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

C:\Program Files\USB_HD\GPIOManager\GPIOManager.exe

C:\Windows\WindowsMobile\wmdc.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Hewlett-Packard\HP Media Vault\Utilities\HPMVTray.exe

C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe

C:\Windows\system32\WUDFHost.exe

C:\Users\benjamin\AppData\Local\Google\Update\GoogleUpdate.exe

C:\Program Files\Eraser\eraser.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

C:\Windows\System32\mobsync.exe

C:\Program Files\Apoint\ApMsgFwd.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\OpenOffice.org 2.3\program\soffice.exe

C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Windows\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-vaio.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\PROGRA~1\GOOGLE~1\BAE.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [DRCU] "C:\Program Files\Sony\DRCU\DRCU.exe"

O4 - HKLM\..\Run: [iSBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [GPIO] C:\Program Files\USB_HD\GPIOManager\GPIOManager.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdc.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [HPMVTray] "C:\Program Files\Hewlett-Packard\HP Media Vault\Utilities\HPMVTray.exe"

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [Google Update] "C:\Users\benjamin\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe

O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Bluetooth Manager.lnk = ?

O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ?

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: Ajouter un site de support RSS à VAIO Information FLOW - C:\Program Files\Sony\VAIO Information FLOW\aiesc.html

O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: avgrsstx.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AvLib\MSCSPTISRV.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AvLib\PACSPTISVR.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AvLib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AvLib\SSScsiSV.exe

O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe

O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe

O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe

O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe

O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe

O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe

O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe

O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe

O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 15453 bytes

benjaminbl · le 21 février 2009

Bonjour,

c'est de pire en pire ici ;( maintenant presque chaque clic dans un résultat de recherche google me renvoie sur une page de pub pour emule ou autre... je commence à me demander si un réinstall complet de la machine sera nécessaire...

Falkra · le 21 février 2009

Bonsoir,

ne reformate pas, il faut tenter autre chose d'abord.

Le logiciel qui suit n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.

Ne pas utiliser en dehors de ce cas de figure ou seul : dangereux.

Télécharge combofix.exe de sUBs et sauvegarde le sur ton bureau (et pas ailleurs).

Assure toi que tous les programmes sont fermés avant de commencer.
Désactive l'antivirus, sinon combofix va te mettre un message (sinon, dis ok au message).
Double-clique combofix.exe afin de l'exécuter.
Clique sur "Oui" au message de Limitation de Garantie qui s'affiche.
Si on te propose de redémarrer parc qu'un rootkit a été trouvé, fais-le.
On va te proposer de télécharger et installer la console de récupération, clique sur "Oui" au message, autorise le téléchargement dans ton firewall si demandé, puis accepte le message de contrat utilisateur final.
Le bureau disparaît, c'est normal, et il va revenir.
Ne ferme pas la fenêtre qui s'ouvre, tu te retrouverais avec un bureau vide.
Lorsque l'analyse sera terminée, un rapport apparaîtra.
Copie-colle ce rapport dans ta prochaine réponse.
Le rapport se trouve dans : C:\Combofix.txt (si jamais).

benjaminbl · le 21 février 2009

Rebonjour,

il me semble que cela a amélioré les choses : apres avoir suivi vos indications j'ai rebooté la machine. A redémarrage de vista windows update s'est automatiquement connecté et est en train d'installer une centaine de méga de mises à jour. AVG a aussi réussi à se mettre a jour ( ca faisait un mois que cela ne passait pas , je pensais que cela venait des serveur d'avg...)

voici mon log, faut il encore faire quelque chose ? et surtout : Encore MERCI pour le coup de main :

ComboFix 09-02-19.01 - benjamin 2009-02-21 18:18:49.1 - NTFSx86

Microsoft® Windows Vista™ Professionnel 6.0.6001.1.1252.1.1036.18.2045.1311 [GMT 1:00]

Lancé depuis: c:\users\benjamin\Documents\Downloads\plop.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)

* Un nouveau point de restauration a été créé

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\drivers\gaopdxxebvbixp.sys

c:\windows\system32\gaopdxtvxppviw.dll

c:\windows\system32\x64

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_gaopdxserv.sys

((((((((((((((((((((((((((((( Fichiers créés du 2009-01-21 au 2009-02-21 ))))))))))))))))))))))))))))))))))))

.

2009-02-21 01:15 . 2009-02-21 01:15 <REP> d-------- c:\program files\Trend Micro

2009-02-21 01:06 . 2009-02-21 01:06 <REP> d-------- c:\users\benjamin\AppData\Roaming\PC Tools

2009-02-21 01:06 . 2009-02-21 01:22 <REP> d-a------ c:\programdata\TEMP

2009-02-21 01:06 . 2009-02-21 01:07 <REP> d-------- c:\program files\Spyware Doctor

2009-02-21 01:06 . 2008-08-25 12:36 81,288 --a------ c:\windows\System32\drivers\iksyssec.sys

2009-02-21 01:06 . 2008-08-25 12:36 66,952 --a------ c:\windows\System32\drivers\iksysflt.sys

2009-02-21 01:06 . 2008-08-25 12:36 40,840 --a------ c:\windows\System32\drivers\ikfilesec.sys

2009-02-21 01:06 . 2008-06-02 16:19 29,576 --a------ c:\windows\System32\drivers\kcom.sys

2009-02-18 21:31 . 2009-02-18 21:31 <REP> d-------- c:\users\benjamin\AppData\Roaming\Malwarebytes

2009-02-18 21:31 . 2009-02-11 10:19 15,504 --a------ c:\windows\System32\drivers\mbam.sys

2009-02-18 21:30 . 2009-02-18 21:30 <REP> d-------- c:\programdata\Malwarebytes

2009-02-18 21:30 . 2009-02-18 21:31 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-02-18 21:30 . 2009-02-11 10:19 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys

2009-02-14 03:02 . 2009-02-14 18:43 <REP> d-------- c:\programdata\Spybot - Search & Destroy

2009-02-14 03:02 . 2009-02-14 18:43 <REP> d-------- c:\program files\Spybot - Search & Destroy

2009-02-14 00:43 . 2009-02-14 00:43 <REP> d-------- c:\users\benjamin\AppData\Roaming\NeoDownloader

2009-02-14 00:43 . 2009-02-14 00:43 <REP> d-------- c:\program files\NeoDownloader

2009-02-12 18:23 . 2009-02-12 18:23 <REP> d-------- c:\program files\IKEA HomePlanner

2009-02-12 18:22 . 2009-02-12 18:22 <REP> d-------- c:\program files\Common Files\Wise Installation Wizard

2009-02-09 19:44 . 2009-02-09 19:44 107,272 --a------ c:\windows\System32\drivers\avgtdix.sys

2009-02-08 22:36 . 2009-02-08 22:37 <REP> d-------- c:\users\benjamin\Logitech

2009-02-08 22:35 . 2009-02-08 22:36 <REP> d-------- c:\program files\Common Files\Remote Control Software Common

2009-02-08 22:34 . 2009-02-08 22:34 <REP> d-------- c:\program files\Common Files\Remote Control USB Driver

2009-02-05 19:23 . 2009-02-05 19:23 410,984 --a------ c:\windows\System32\deploytk.dll

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-21 16:35 --------- d-----w c:\users\benjamin\AppData\Roaming\OpenOffice.org2

2009-02-20 21:12 --------- d-----w c:\users\benjamin\AppData\Roaming\Azureus

2009-02-20 14:03 --------- d-----w c:\users\catherine\AppData\Roaming\OpenOffice.org2

2009-02-15 12:45 --------- d-----w c:\program files\Glary Utilities

2009-02-09 18:44 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys

2009-02-09 18:44 10,520 ----a-w c:\windows\System32\avgrsstx.dll

2009-02-09 18:43 --------- d-----w c:\programdata\avg8

2009-02-08 21:35 --------- d--h--w c:\program files\InstallShield Installation Information

2009-02-08 21:35 --------- d-----w c:\program files\Logitech

2009-02-05 18:23 --------- d-----w c:\program files\Java

2009-01-31 18:20 --------- d-----w c:\program files\Azureus

2009-01-27 17:45 --------- d-----w c:\program files\adslTV

2009-01-27 17:43 --------- d-----w c:\users\benjamin\AppData\Roaming\vlc

2009-01-20 08:54 --------- d-----w c:\program files\Sony

2009-01-19 22:54 --------- d-----w c:\program files\SigmaTel

2009-01-16 18:28 --------- d-----w c:\program files\Aimersoft

2009-01-16 18:25 272,896 ----a-w c:\windows\System32\advddr32.exe

2009-01-16 18:25 18,816 ----a-w c:\windows\system32\drivers\dvd43llh.sys

2009-01-15 00:30 --------- d-----w c:\program files\Windows Mail

2009-01-14 19:20 --------- d-----w c:\users\catherine\AppData\Roaming\Apple Computer

2009-01-14 18:25 --------- d-----w c:\users\catherine\AppData\Roaming\MiniLyrics

2009-01-11 18:22 --------- d-----w c:\program files\Real

2009-01-11 18:22 --------- d-----w c:\program files\Common Files\xing shared

2009-01-11 18:22 --------- d-----w c:\program files\Common Files\Real

2009-01-05 22:33 3,751,995 ----a-w c:\windows\System32\GPhotos.scr

2009-01-04 22:42 --------- d-----w c:\program files\Mozilla Thunderbird

2009-01-02 22:43 --------- d-----w c:\program files\iGnuteel

2009-01-02 22:17 --------- d-----w c:\users\benjamin\AppData\Roaming\MiniLyrics

2009-01-02 09:48 --------- d-----w c:\program files\iTunes

2008-12-29 22:15 --------- d-----w c:\program files\Hp

2008-12-29 22:15 --------- d-----w c:\program files\Hewlett-Packard

2008-12-29 22:03 --------- d-----w c:\program files\NewTech Infosystems

2008-12-29 22:02 --------- d-----w c:\program files\Common Files\NewTech Infosystems

2008-09-12 22:12 174 --sha-w c:\program files\desktop.ini

2007-04-23 21:48 0 ----a-w c:\users\benjamin\AppData\Roaming\wklnhst.dat

2007-08-09 12:08 8,784 ----a-w c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll

2007-08-09 12:10 245,408 ----a-w c:\program files\mozilla firefox\plugins\unicows.dll

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="c:\users\benjamin\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-09-02 133104]

"Eraser"="c:\program files\Eraser\eraser.exe" [2006-08-07 634880]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\Apoint\Apoint.exe" [2006-09-11 118784]

"DRCU"="c:\program files\Sony\DRCU\DRCU.exe" [2006-12-03 61440]

"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2006-11-11 43128]

"Acrobat Assistant 7.0"="c:\program files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-27 98304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-27 106496]

"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-27 81920]

"GPIO"="c:\program files\USB_HD\GPIOManager\GPIOManager.exe" [2005-09-02 709120]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdc.exe" [2007-01-24 563080]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-19 7766016]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-19 81920]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-09 1601304]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]

"HPMVTray"="c:\program files\Hewlett-Packard\HP Media Vault\Utilities\HPMVTray.exe" [2007-02-15 947864]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-05 136600]

c:\users\catherine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]

c:\users\benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2006-11-25 2134016]

Lancement rapide d'Adobe Acrobat.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-100000000002}\SC_Acrobat.exe [2007-04-24 25214]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

2006-11-24 10:36 73728 c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.dvsd"= c:\program files\Common Files\Sony Shared\VideoLib\sonydv.dll

"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

"vidc.wmv3"= c:\progra~1\COMBIN~1\Filters\wmv9vcm.dll

"VIDC.X264"= x264vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe"

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

"WinampAgent"=c:\program files\Winamp\winampa.exe

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe"

"Adobe Photo Downloader"="c:\program files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe"

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]

"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"= c:\program files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{2C0A9C71-9321-4D8E-A3BB-4087B313B9AB}"= UDP:c:\program files\Google\Google Talk\googletalk.exe:Google Talk

"{BCF8344E-827D-4310-B4FF-55FF759332D8}"= TCP:c:\program files\Google\Google Talk\googletalk.exe:Google Talk

"{FBE11515-41F7-40FF-8302-E3E9DC7E6216}"= UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media

"{49476F2D-C657-4359-B0AA-581A53B6680D}"= TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media

"{968D7BC0-EB09-46C0-BEEB-F0DE5D32FD77}"= UDP:c:\program files\Google\Google Talk\googletalk.exe:Google Talk

"{02ADD6CF-1584-42ED-8E55-C421839788ED}"= TCP:c:\program files\Google\Google Talk\googletalk.exe:Google Talk

"{CCA65F84-A72B-4DD3-8758-D320E400F499}"= UDP:c:\programdata\Sony\MyClubVAIO\MyClubVAIO.exe:My Club VAIO

"{4D035730-1198-4C65-B53D-E842DCC4678E}"= TCP:c:\programdata\Sony\MyClubVAIO\MyClubVAIO.exe:My Club VAIO

"{DFD8E81E-38AB-4EF2-A5DE-18F27BD88E87}"= UDP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne

"{B744F54E-753C-4427-8C9E-C61456382062}"= TCP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne

"{CBE222F5-C8F7-473E-8471-20EA58EF9071}"= UDP:c:\program files\Windows Sidebar\sidebar.exe:sidebar

"{3AB4226B-1421-4085-8E52-BDF15EF4CC70}"= TCP:c:\program files\Windows Sidebar\sidebar.exe:sidebar

"TCP Query User{3A8DD5AA-6213-4458-9360-C5DA92344A4A}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus

"UDP Query User{F980E630-685C-441F-B4F9-569B0AD52459}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus

"{AC5FAE25-FC9D-45DD-82F2-DE8579188245}"= UDP:c:\program files\Grisoft\AVG7\avgcc.exe:AVG Control Center

"{92E1C2B9-43CE-4560-8053-8F8678EE9266}"= TCP:c:\program files\Grisoft\AVG7\avgcc.exe:AVG Control Center

"{FB0AA95B-BB00-4D5E-B066-5C9EEF865DBA}"= UDP:c:\program files\Grisoft\AVG7\avgw.exe:AVG Test Center

"{B01D3132-B491-47EC-B227-0D68B8810A64}"= TCP:c:\program files\Grisoft\AVG7\avgw.exe:AVG Test Center

"TCP Query User{45B56D90-4C1F-47F2-BB8C-B72B73D77BB4}c:\\program files\\freebrowser\\vlc\\vlc.exe"= UDP:c:\program files\freebrowser\vlc\vlc.exe:VLC media player

"UDP Query User{CF12F4EA-AB29-46DB-B007-DB19599B30EE}c:\\program files\\freebrowser\\vlc\\vlc.exe"= TCP:c:\program files\freebrowser\vlc\vlc.exe:VLC media player

"TCP Query User{989FC5AA-2960-445F-B83E-54E6F930CA95}c:\\program files\\adsltv\\adsltv.exe"= UDP:c:\program files\adsltv\adsltv.exe:adsltv

"UDP Query User{C45ADD85-C687-467F-BA65-BF12F45CE935}c:\\program files\\adsltv\\adsltv.exe"= TCP:c:\program files\adsltv\adsltv.exe:adsltv

"TCP Query User{B0687FE2-BD2B-4186-B3F6-B3E773DE0B17}c:\\program files\\adsltv\\vlc.exe"= UDP:c:\program files\adsltv\vlc.exe:VLC media player

"UDP Query User{6E653034-8819-42F0-9B03-CFBFFAB6640B}c:\\program files\\adsltv\\vlc.exe"= TCP:c:\program files\adsltv\vlc.exe:VLC media player

"TCP Query User{4DDD7B7C-4835-48F2-B593-74E5D4EC0A28}c:\\program files\\freebrowser\\vlc\\vlc.exe"= UDP:c:\program files\freebrowser\vlc\vlc.exe:VLC media player

"UDP Query User{434BC976-D598-42A5-B029-3643B47564D7}c:\\program files\\freebrowser\\vlc\\vlc.exe"= TCP:c:\program files\freebrowser\vlc\vlc.exe:VLC media player

"TCP Query User{F988DA0F-CB73-4941-8309-74ED022F1AB0}c:\\program files\\freebrowser\\freebrowser\\freebrowser.exe"= UDP:c:\program files\freebrowser\freebrowser\freebrowser.exe:FreeBrowser

"UDP Query User{78CD0E2F-EEC6-4EBB-AB78-97830DAE768F}c:\\program files\\freebrowser\\freebrowser\\freebrowser.exe"= TCP:c:\program files\freebrowser\freebrowser\freebrowser.exe:FreeBrowser

"{E641AEE8-F840-49C7-838D-725B4C0AB00C}"= UDP:990:LocalSubnet:LocalSubnet|IF={7D8A79C1-83D7-4895-A556-91EF895D42EA}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001

"{B2A89B54-D3D0-40CB-93D3-0BB59F1CE7EA}"= UDP:5721:LocalSubnet:LocalSubnet|IF={7D8A79C1-83D7-4895-A556-91EF895D42EA}:@%systemroot%\WindowsMobile\wmdc.exe,-4002

"{DD7DF75D-5F63-4E28-826B-816137BD0F50}"= UDP:1034:LocalSubnet:LocalSubnet|IF={7D8A79C1-83D7-4895-A556-91EF895D42EA}:@%systemroot%\WindowsMobile\wmdc.exe,-4003

"{96715ECC-498B-4B80-A197-111EAF9F8D7A}"= UDP:5678:LocalSubnet:LocalSubnet|IF={7D8A79C1-83D7-4895-A556-91EF895D42EA}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4004

"{07853795-E385-4606-898C-0EBFCDF75A64}"= UDP:999:LocalSubnet:LocalSubnet|IF={7D8A79C1-83D7-4895-A556-91EF895D42EA}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4005

"{2866A95A-66CC-49DA-95F6-C520EBDDDE87}"= UDP:26675:LocalSubnet:LocalSubnet|IF={7D8A79C1-83D7-4895-A556-91EF895D42EA}:@%systemroot%\WindowsMobile\wmdc.exe,-4006

"{32728863-8C7A-4B5A-BFE6-6FDE1896FA8B}"= UDP:990:LocalSubnet:LocalSubnet|IF={7D8A79C1-83D7-4895-A556-91EF895D42EA}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdc.exe,-4001

"TCP Query User{90C5DB46-C19E-4B0C-A5A9-6F059A8E6012}c:\\users\\benjamin\\desktop\\pdafreetv\\vlc\\vlc.exe"= UDP:c:\users\benjamin\desktop\pdafreetv\vlc\vlc.exe:VLC media player

"UDP Query User{6920ED8F-45C8-44D1-BE43-95CBBD183826}c:\\users\\benjamin\\desktop\\pdafreetv\\vlc\\vlc.exe"= TCP:c:\users\benjamin\desktop\pdafreetv\vlc\vlc.exe:VLC media player

"{8C39470E-BC67-491F-9732-AD5B68A19197}"= UDP:5721:LocalSubnet:LocalSubnet|IF={2E3B51AC-B0A0-4D0C-A520-FA7EF38A39FF}:@%systemroot%\WindowsMobile\wmdc.exe,-4002

"{75A60B78-F00E-4F91-A7C3-8F3CEFE3F8A5}"= UDP:1034:LocalSubnet:LocalSubnet|IF={2E3B51AC-B0A0-4D0C-A520-FA7EF38A39FF}:@%systemroot%\WindowsMobile\wmdc.exe,-4003

"{A2A1E430-69A2-4C01-99EC-BC898B24B57C}"= UDP:5678:LocalSubnet:LocalSubnet|IF={2E3B51AC-B0A0-4D0C-A520-FA7EF38A39FF}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4004

"{E4DA144A-A24E-41B3-8649-5DC5A29F5BB8}"= UDP:999:LocalSubnet:LocalSubnet|IF={2E3B51AC-B0A0-4D0C-A520-FA7EF38A39FF}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4005

"{39B1DEAB-8D82-4A0C-8885-F50EA65239C9}"= UDP:26675:LocalSubnet:LocalSubnet|IF={2E3B51AC-B0A0-4D0C-A520-FA7EF38A39FF}:@%systemroot%\WindowsMobile\wmdc.exe,-4006

"{EEB6642D-9B4B-456E-B734-D479F66F2B0C}"= UDP:990:LocalSubnet:LocalSubnet|IF={2E3B51AC-B0A0-4D0C-A520-FA7EF38A39FF}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdc.exe,-4001

"TCP Query User{45E51A40-7D0A-45E8-A359-3CE4743D61DB}c:\\program files\\filezilla\\filezilla.exe"= UDP:c:\program files\filezilla\filezilla.exe:FileZilla

"UDP Query User{153667D1-8E52-4E19-BB3C-5255FB34D4C7}c:\\program files\\filezilla\\filezilla.exe"= TCP:c:\program files\filezilla\filezilla.exe:FileZilla

"TCP Query User{0C886484-CB11-4CAB-AB8D-3B3AAA15CDA6}c:\\program files\\quicktime\\quicktimeplayer.exe"= UDP:c:\program files\quicktime\quicktimeplayer.exe:QuickTime Player

"UDP Query User{BA2425C3-7A46-4FE3-AC22-963AB368ABEB}c:\\program files\\quicktime\\quicktimeplayer.exe"= TCP:c:\program files\quicktime\quicktimeplayer.exe:QuickTime Player

"{1EC45C04-8E93-465F-96BA-91072B0E5520}"= UDP:5721:LocalSubnet:LocalSubnet|IF={7D8A79C1-83D7-4895-A556-91EF895D42EA}:@%systemroot%\WindowsMobile\wmdc.exe,-4002

"{112DA225-67F0-4B09-A04E-FDF7D8C78689}"= UDP:1034:LocalSubnet:LocalSubnet|IF={7D8A79C1-83D7-4895-A556-91EF895D42EA}:@%systemroot%\WindowsMobile\wmdc.exe,-4003

"{F9465BA4-A967-4EF7-83B9-1FB169F4CDAC}"= UDP:5678:LocalSubnet:LocalSubnet|IF={7D8A79C1-83D7-4895-A556-91EF895D42EA}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4004

"{EB75BA9C-78EB-44A6-B454-86B17226A470}"= UDP:999:LocalSubnet:LocalSubnet|IF={7D8A79C1-83D7-4895-A556-91EF895D42EA}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4005

"{73014951-1683-4866-A674-A10DC2D9F8A6}"= UDP:26675:LocalSubnet:LocalSubnet|IF={7D8A79C1-83D7-4895-A556-91EF895D42EA}:@%systemroot%\WindowsMobile\wmdc.exe,-4006

"{E40D14C9-94BC-487F-85F1-8156B9B72B4A}"= UDP:990:LocalSubnet:LocalSubnet|IF={7D8A79C1-83D7-4895-A556-91EF895D42EA}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdc.exe,-4001

"{63F06540-17A8-4FA3-BB5F-AE1423D06606}"= UDP:5721:LocalSubnet:LocalSubnet|IF={2E3B51AC-B0A0-4D0C-A520-FA7EF38A39FF}:@%systemroot%\WindowsMobile\wmdc.exe,-4002

"{034DEFE3-C696-49F7-AE37-8E14ACF30188}"= UDP:1034:LocalSubnet:LocalSubnet|IF={2E3B51AC-B0A0-4D0C-A520-FA7EF38A39FF}:@%systemroot%\WindowsMobile\wmdc.exe,-4003

"{0E75F6E3-173A-4D67-BDA3-95259CC733B3}"= UDP:5678:LocalSubnet:LocalSubnet|IF={2E3B51AC-B0A0-4D0C-A520-FA7EF38A39FF}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4004

"{B414A03A-2084-4361-87C2-96D1B45A69E7}"= UDP:999:LocalSubnet:LocalSubnet|IF={2E3B51AC-B0A0-4D0C-A520-FA7EF38A39FF}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4005

"{9D79386E-20C1-49A4-BF1E-589D95FCC0F3}"= UDP:26675:LocalSubnet:LocalSubnet|IF={2E3B51AC-B0A0-4D0C-A520-FA7EF38A39FF}:@%systemroot%\WindowsMobile\wmdc.exe,-4006

"{4628460B-9180-4392-AD97-FABC4D7C85D3}"= UDP:990:LocalSubnet:LocalSubnet|IF={2E3B51AC-B0A0-4D0C-A520-FA7EF38A39FF}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdc.exe,-4001

"{40134676-1C7A-4A36-9ADB-FB385A67971D}"= UDP:5721:LocalSubnet:LocalSubnet|IF={D86CAC19-5D52-4FB0-87A8-9D8BB01A4CE4}:@%systemroot%\WindowsMobile\wmdc.exe,-4002

"{92F66B55-6383-4437-A639-B642064373CF}"= UDP:1034:LocalSubnet:LocalSubnet|IF={D86CAC19-5D52-4FB0-87A8-9D8BB01A4CE4}:@%systemroot%\WindowsMobile\wmdc.exe,-4003

"{327E9AE0-5D45-45B6-992F-7C5BAAEA4331}"= UDP:5678:LocalSubnet:LocalSubnet|IF={D86CAC19-5D52-4FB0-87A8-9D8BB01A4CE4}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4004

"{82C235A8-7251-4BDC-8D37-C032839AD8CA}"= UDP:999:LocalSubnet:LocalSubnet|IF={D86CAC19-5D52-4FB0-87A8-9D8BB01A4CE4}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4005

"{9CBD8DCC-744F-4D0B-B417-7F73863846BF}"= UDP:26675:LocalSubnet:LocalSubnet|IF={D86CAC19-5D52-4FB0-87A8-9D8BB01A4CE4}:@%systemroot%\WindowsMobile\wmdc.exe,-4006

"{8B95B96C-5DDE-4B5F-9F08-B6F38F9BBB1C}"= UDP:990:LocalSubnet:LocalSubnet|IF={D86CAC19-5D52-4FB0-87A8-9D8BB01A4CE4}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdc.exe,-4001

"{5BB62F02-B2B7-4D1E-8D2A-F82EC73323D8}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe

"{CC7607BF-19AA-468D-8ADE-21C6A51CCF70}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe

"{C3B02C3A-D1F9-430A-817C-EBFD9B7E0CCE}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{CA386490-F550-48E6-9A3A-4BF722418555}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"TCP Query User{18C4E4A7-7E7D-4DE9-8CC1-17A1F1708798}c:\\program files\\hewlett-packard\\hp media vault\\utilities\\hpmvtray.exe"= UDP:c:\program files\hewlett-packard\hp media vault\utilities\hpmvtray.exe:HP Media Vault Monitor Application

"UDP Query User{331F0A21-888A-43A7-8E6F-97089A15F1AF}c:\\program files\\hewlett-packard\\hp media vault\\utilities\\hpmvtray.exe"= TCP:c:\program files\hewlett-packard\hp media vault\utilities\hpmvtray.exe:HP Media Vault Monitor Application

"TCP Query User{06BC61C2-57C9-45C2-8C0F-56398F06A77B}c:\\users\\benjamin\\appdata\\local\\temp\\_iscb0f.exe"= UDP:c:\users\benjamin\appdata\local\temp\_iscb0f.exe:_iscb0f.exe

"UDP Query User{C508958D-8EB2-4A28-844F-F6C265C91AF0}c:\\users\\benjamin\\appdata\\local\\temp\\_iscb0f.exe"= TCP:c:\users\benjamin\appdata\local\temp\_iscb0f.exe:_iscb0f.exe

"TCP Query User{31A43115-98DD-4A66-BA46-D580264C22EF}c:\\program files\\hewlett-packard\\hp media vault\\utilities\\nasdrivemapper.exe"= UDP:c:\program files\hewlett-packard\hp media vault\utilities\nasdrivemapper.exe:NASDriveMapper Application

"UDP Query User{3FDF671C-6776-4348-B301-D31426859462}c:\\program files\\hewlett-packard\\hp media vault\\utilities\\nasdrivemapper.exe"= TCP:c:\program files\hewlett-packard\hp media vault\utilities\nasdrivemapper.exe:NASDriveMapper Application

"TCP Query User{CDC57107-A2F1-4731-8157-10F3FB34028D}c:\\program files\\hewlett-packard\\hp media vault\\utilities\\nasselector.exe"= UDP:c:\program files\hewlett-packard\hp media vault\utilities\nasselector.exe:Media Vault Selection Application

"UDP Query User{15D4346C-97FD-4E77-B073-61D55F9C7CEB}c:\\program files\\hewlett-packard\\hp media vault\\utilities\\nasselector.exe"= TCP:c:\program files\hewlett-packard\hp media vault\utilities\nasselector.exe:Media Vault Selection Application

"TCP Query User{9CBA8F5C-A038-4889-B0C3-7A821C86B601}c:\\program files\\emule\\emule.exe"= Disabled:UDP:c:\program files\emule\emule.exe:eMule

"UDP Query User{F2F89590-87DE-4041-8D38-27F1B284862A}c:\\program files\\emule\\emule.exe"= Disabled:TCP:c:\program files\emule\emule.exe:eMule

"TCP Query User{D02FE2E6-B1BA-4A7C-A6B1-F25E9CD863E7}c:\\program files\\hewlett-packard\\hp media vault\\utilities\\hpmvtray.exe"= UDP:c:\program files\hewlett-packard\hp media vault\utilities\hpmvtray.exe:HP Media Vault Monitor Application

"UDP Query User{28AF2177-E316-4456-97BD-611873B4B362}c:\\program files\\hewlett-packard\\hp media vault\\utilities\\hpmvtray.exe"= TCP:c:\program files\hewlett-packard\hp media vault\utilities\hpmvtray.exe:HP Media Vault Monitor Application

"TCP Query User{BEB9D963-89E5-47B2-9F28-3B0ECF23DB86}c:\\program files\\hewlett-packard\\hp media vault\\utilities\\hpezbkup.exe"= UDP:c:\program files\hewlett-packard\hp media vault\utilities\hpezbkup.exe:HP Easy Backup

"UDP Query User{AA7FFC59-DD54-4530-BE47-5F51B5EA4D6C}c:\\program files\\hewlett-packard\\hp media vault\\utilities\\hpezbkup.exe"= TCP:c:\program files\hewlett-packard\hp media vault\utilities\hpezbkup.exe:HP Easy Backup

"TCP Query User{BE9ACDE8-606D-42DE-A034-52558F810DDC}c:\\program files\\hewlett-packard\\hp media vault\\utilities\\hpmvcheck.exe"= UDP:c:\program files\hewlett-packard\hp media vault\utilities\hpmvcheck.exe:HP Media Vault Automatic Firmware Check

"UDP Query User{C115F82A-B793-4B6C-9021-C1EB7BBD48C6}c:\\program files\\hewlett-packard\\hp media vault\\utilities\\hpmvcheck.exe"= TCP:c:\program files\hewlett-packard\hp media vault\utilities\hpmvcheck.exe:HP Media Vault Automatic Firmware Check

"TCP Query User{F6A6E3BE-0461-4D46-A21A-3753EB67EC27}c:\\program files\\real\\realplayer\\realplay.exe"= UDP:c:\program files\real\realplayer\realplay.exe:RealPlayer

"UDP Query User{6D3D161A-812A-43D9-887E-020BD0B854C8}c:\\program files\\real\\realplayer\\realplay.exe"= TCP:c:\program files\real\realplayer\realplay.exe:RealPlayer

"{D4936F86-7A8F-4554-89DF-7D31638284DD}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes

"{E424E84F-BB59-4629-91C3-5D3CD6577E96}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

"TCP Query User{E8654C1B-89C8-432A-9185-F80820886E57}c:\\program files\\itunes\\itunes.exe"= UDP:c:\program files\itunes\itunes.exe:iTunes

"UDP Query User{C4377B5A-B88A-4E3D-BF75-F3C0EC804623}c:\\program files\\itunes\\itunes.exe"= TCP:c:\program files\itunes\itunes.exe:iTunes

"{9ACBE392-74E6-4F63-A642-FAEA080C6B06}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe

"{7E506900-4D62-4E7D-BA92-2DBCF5DF3E7F}"= Disabled:UDP:c:\program files\Sony\VAIO Camera Capture Utility\VAIOCameraCaptureUtility.exe:VAIO Camera Capture Utility

"{73FB2A06-3E03-4AA0-AE9F-37CE3C6213E9}"= Disabled:TCP:c:\program files\Sony\VAIO Camera Capture Utility\VAIOCameraCaptureUtility.exe:VAIO Camera Capture Utility

"{99EF7C58-F857-4FFB-B2D3-6958B2BFA8BB}"= Disabled:UDP:c:\program files\Santa Cruz Networks\Festoon\Festoon.exe:Festoon

"{2FB782E8-9EE3-4C40-86F1-2DD793C54C34}"= Disabled:TCP:c:\program files\Santa Cruz Networks\Festoon\Festoon.exe:Festoon

"TCP Query User{E1DEBB10-746F-4063-B280-39563CCF194B}c:\\program files\\freebrowser\\freebrowser\\freebrowser.exe"= Disabled:UDP:c:\program files\freebrowser\freebrowser\freebrowser.exe:FreeBrowser

"UDP Query User{57106ABA-427E-4F3D-BAEF-EA0922EF5667}c:\\program files\\freebrowser\\freebrowser\\freebrowser.exe"= Disabled:TCP:c:\program files\freebrowser\freebrowser\freebrowser.exe:FreeBrowser

"TCP Query User{19F1E9FE-4194-4F3C-934E-4EC367290BCD}c:\\program files\\caplio software\\rgatelxp.exe"= Disabled:UDP:c:\program files\caplio software\rgatelxp.exe:RICOH Gate La for DSC

"UDP Query User{BE357633-A6BF-4F8D-9BB0-E9C3049D6E15}c:\\program files\\caplio software\\rgatelxp.exe"= Disabled:TCP:c:\program files\caplio software\rgatelxp.exe:RICOH Gate La for DSC

"TCP Query User{3E8F9BFB-828E-435A-AABD-45CED0BF4CDD}c:\\program files\\joost\\xulrunner\\tvprunner.exe"= Disabled:UDP:c:\program files\joost\xulrunner\tvprunner.exe:tvprunner

"UDP Query User{B507008A-99F8-4090-B0C9-9EF2FE3CD9CF}c:\\program files\\joost\\xulrunner\\tvprunner.exe"= Disabled:TCP:c:\program files\joost\xulrunner\tvprunner.exe:tvprunner

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]

"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"= c:\program files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7

R0 shpf;Sony HDD Protection Filter Driver;c:\windows\System32\drivers\shpf.sys [2006-12-20 12416]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2008-11-11 325128]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2009-02-09 107272]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-11 903960]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-11 298264]

R2 MSSQL$VAIO_VEDB;SQL Server (VAIO_VEDB);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2006-11-15 28933976]

R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\System32\drivers\R5U870FLx86.sys [2006-12-20 73472]

R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\System32\drivers\R5U870FUx86.sys [2006-12-20 43904]

R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\System32\drivers\SonyImgF.sys [2006-12-20 30976]

R3 SPI;Sony Programmable I/O Control Device;c:\windows\System32\drivers\SonyPI.sys [2006-12-20 33792]

R3 ti21sony;ti21sony;c:\windows\System32\drivers\ti21sony.sys [2006-12-20 227328]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-02-21 356920]

S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-04-23 745472]

S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-01-18 397312]

S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-01-18 1089536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]

\shell\AutoRun\command - G:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4d0a773f-f73a-11db-8e7c-0013a98ea019}]

\shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5192675d-f7f2-11db-be9c-0013a98ea019}]

\shell\AutoRun\command - wd_windows_tools\setup.exe

.

Contenu du dossier 'Tâches planifiées'

2009-02-21 c:\windows\Tasks\GlaryInitialize.job

- c:\program files\Glary Utilities\initialize.exe [2009-01-10 17:02]

2009-02-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-445907227-769801408-7353829-1003.job

- c:\users\benjamin\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-02 20:59]

2009-02-20 c:\windows\Tasks\User_Feed_Synchronization-{BB6E1DFE-5C8B-4CFF-A380-1C04D549CFBB}.job

- c:\windows\system32\msfeedssync.exe [2008-01-19 08:33]

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.club-vaio.com

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Ajouter un site de support RSS à VAIO Information FLOW - c:\program files\Sony\VAIO Information FLOW\aiesc.html

IE: Convertir en Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir en un fichier PDF existant - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\users\benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\b4j1mg8l.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.netvibes.com/

1 fichier(s) déplacé(s).

FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll

FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll

FF - component: c:\users\benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\b4j1mg8l.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayAccessService.dll

FF - component: c:\users\benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\b4j1mg8l.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayFormSubmitObserver.dll

FF - component: c:\users\benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\b4j1mg8l.default\extensions\piclens@cooliris.com\components\coolirisstub.dll

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npRACtrl.dll

FF - plugin: c:\users\benjamin\AppData\Local\Google\Update\1.2.141.5\npGoogleOneClick7.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-21 18:24:54

Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés:

**************************************************************************

.

Heure de fin: 2009-02-21 18:26:44

ComboFix-quarantined-files.txt 2009-02-21 17:26:42

Avant-CF: 30,895,235,072 octets libres

Après-CF: 31,010,869,248 octets libres

329 --- E O F --- 2009-01-15 19:59:07

Falkra · le 21 février 2009

On continue.

:!: Ce qui suit n'est que pour ta machine, et ta machine seulement.

Ne surtout pas utiliser sur une autre machine : dangereux.

Ouvre le Bloc-notes. Vérifie que dans le menu "Format", le "retour automatique à la ligne" est désactivé. Copie colle ceci dedans :

Killall::

File::

c:\windows\System32\advddr32.exe

registry::

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=-

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=-

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=-

Sauvegarde cela comme fichier texte nommé CFScript, sur le bureau.
Fais un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe comme sur la capture

Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Ensuite ajoute un nouveau rapport HijackThis stp après ce rapport là.

benjaminbl · le 21 février 2009

aussitôt dit aussitôt fait ... voilà ce que ça donne :

tu crois que je tiens le bon bout ? une idée de la source de l'infection ?

ComboFix 09-02-19.01 - benjamin 2009-02-22 0:24:32.2 - NTFSx86

Microsoft® Windows Vista™ Professionnel 6.0.6001.1.1252.1.1036.18.2045.988 [GMT 1:00]

Lancé depuis: c:\users\benjamin\Documents\Downloads\plop.exe

Commutateurs utilisés :: c:\users\benjamin\Desktop\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)

FILE ::

c:\windows\System32\advddr32.exe

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\System32\advddr32.exe

.

((((((((((((((((((((((((((((( Fichiers créés du 2009-01-21 au 2009-02-21 ))))))))))))))))))))))))))))))))))))

.

2009-02-22 00:20 . 2009-02-22 00:21 <REP> d-------- C:\32788R22FWJFW

2009-02-21 19:10 . 2009-02-21 19:10 137 --a------ c:\windows\System32\MRT.INI

2009-02-21 18:54 . 2008-06-20 02:14 781,344 --a------ c:\windows\System32\PresentationNative_v0300.dll

2009-02-21 18:54 . 2008-06-20 02:14 622,080 --a------ c:\windows\System32\icardagt.exe

2009-02-21 18:54 . 2008-06-20 02:14 326,160 --a------ c:\windows\System32\PresentationHost.exe

2009-02-21 18:54 . 2008-06-20 02:14 105,016 --a------ c:\windows\System32\PresentationCFFRasterizerNative_v0300.dll

2009-02-21 18:54 . 2008-06-20 02:14 97,800 --a------ c:\windows\System32\infocardapi.dll

2009-02-21 18:54 . 2008-06-20 02:14 43,544 --a------ c:\windows\System32\PresentationHostProxy.dll

2009-02-21 18:54 . 2008-06-20 02:14 37,384 --a------ c:\windows\System32\infocardcpl.cpl

2009-02-21 18:54 . 2008-06-20 02:14 11,264 --a------ c:\windows\System32\icardres.dll

2009-02-21 18:47 . 2008-07-27 19:03 282,112 --a------ c:\windows\System32\mscoree.dll

2009-02-21 18:47 . 2008-07-27 19:03 158,720 --a------ c:\windows\System32\mscorier.dll

2009-02-21 18:47 . 2008-07-27 19:03 96,760 --a------ c:\windows\System32\dfshim.dll

2009-02-21 18:47 . 2008-07-27 19:03 83,968 --a------ c:\windows\System32\mscories.dll

2009-02-21 18:47 . 2008-07-27 19:03 41,984 --a------ c:\windows\System32\netfxperf.dll

2009-02-21 18:46 . 2009-01-15 04:36 1,383,424 --a------ c:\windows\System32\mshtml.tlb

2009-02-21 18:46 . 2009-01-15 07:11 827,392 --a------ c:\windows\System32\wininet.dll