bonjour à tous, j'ai souvent recours à ce forum pour suivre les conseils des uns et des autres, c'est comme cela que petit à petit je connais un peu mieux mon système d'exploitation. je tiens à remercier tous les acteurs de cette fabuleuse source d'information et d'échange.
je me suis inscrit ce jour pour tenter de me faire aider. en effet j'ai appremment de gros problémes sur mon ordi.
aprés une sérieuse infection par un bagle, j'ai utiliser divers logiciel : jv16, gen proc, hijackthis,toolbar sd, spyboot, combo fix, elibagla, avira antivir,................... bref la TOTALE....
j'ai aussi du reparer avec le cd d'origine....
enfin j'ai installer unlocker n'arrivant plus à effacer les fichiers...
la mouise.... sniff.... j'ai toujours de gros soucis.. c'est pourquoi je fais appel aux competences des plus experts pour m'aider.
je poste ce rapport hijack pour commencer




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:19, on 2008-09-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\LEXPPS.EXE
D:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\WINDOWS\system32\drivers\CDAC11BA.EXE
D:\Program Files\FolderSize\FolderSizeSvc.exe
D:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
D:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
D:\WINDOWS\System32\tcpsvcs.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\Mixer.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Program Files\Unlocker\UnlockerAssistant.exe
D:\WINDOWS\system32\LXSUPMON.EXE
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\MSN Messenger\usnsvc.exe
D:\Documents and Settings\moi\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
D:\Documents and Settings\moi\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
D:\Documents and Settings\moi\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
D:\hija\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [LXSUPMON] D:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/bina [...] b56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn. [...] nPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/window [...] 1288122979
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/bina [...] b56986.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - D:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Folder Size (FolderSize) - Brio - D:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - D:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - D:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - D:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - D:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6474 bytes



merci beaucoup, chris

Bonjour,

Quel est ton problème ?

bonjour Angeldark,

je n'arrive plus à installer adware par exemple, mon ordi rame à la fermeture ( une fenetre s'affiche succinctement par l'execution automatique d'unlocker : deskop ), pas moyen d'effacer des fichiers malgrés l'execution systematique de ccleaner, pas moyen d'executer comfix jusqu'au bout,

15 jours de galeres.... et de recherches.
j'ai refait un log aprés manips, cftmon se semblant pas etre correct...

le voici:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:44, on 2008-09-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\LEXPPS.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\WINDOWS\system32\drivers\CDAC11BA.EXE
D:\Program Files\FolderSize\FolderSizeSvc.exe
D:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
D:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\System32\tcpsvcs.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Mixer.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Documents and Settings\moi\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
D:\Documents and Settings\moi\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
D:\Documents and Settings\moi\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
D:\hija\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/bina [...] b56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn. [...] nPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/window [...] 1288122979
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} -
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - D:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Folder Size (FolderSize) - Brio - D:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - D:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - D:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - D:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - D:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5204 bytes




merci beaucoup de ton aide Angeldark;

chris

Re,

Télécharge Gmer.
Dézippe le dans un dossier ou sur ton bureau.

Déconnecte toi d'Internet puis et ferme tous les programmes.
Double-clique sur Gmer.exe.

IMPORTANT: Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.

Clique sur l'onglet rootkit.
A droite, coche Files et Services.
Clique maintenant sur Scan.

Lorsque le scan est terminé, clique sur Copy.

Ouvre le Bloc-notes puis clique sur le Menu Edition / Coller.
Le rapport doit alors apparaître.
Enregistre le fichier sur ton bureau et copie/colle le contenu ici.

merci Angeldark

voici mon scan GMER:


GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2008-09-09 20:18:46
Windows 5.1.2600 Service Pack 2


---- User IAT/EAT - GMER 1.0.14 ----

IAT D:\WINDOWS\Explorer.EXE[416] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00AE2F30] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\WINDOWS\Explorer.EXE[416] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00AE2CA0] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\WINDOWS\Explorer.EXE[416] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00AE2D00] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\WINDOWS\Explorer.EXE[416] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00AE2CD0] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe[844] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [009C2F30] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe[844] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [009C2CA0] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe[844] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [009C2D00] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe[844] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [009C2CD0] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\WINDOWS\system32\wscntfy.exe[1808] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [008C2F30] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\WINDOWS\system32\wscntfy.exe[1808] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [008C2CA0] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\WINDOWS\system32\wscntfy.exe[1808] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [008C2D00] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\WINDOWS\system32\wscntfy.exe[1808] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [008C2CD0] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\WINDOWS\Mixer.exe[1964] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [01532F30] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\WINDOWS\Mixer.exe[1964] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [01532CA0] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\WINDOWS\Mixer.exe[1964] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [01532D00] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\WINDOWS\Mixer.exe[1964] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [01532CD0] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\Documents and Settings\moi\Bureau\gmer.exe[3152] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00802F30] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\Documents and Settings\moi\Bureau\gmer.exe[3152] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00802CA0] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\Documents and Settings\moi\Bureau\gmer.exe[3152] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00802D00] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT D:\Documents and Settings\moi\Bureau\gmer.exe[3152] @ D:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00802CD0] D:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)

---- Devices - GMER 1.0.14 ----

AttachedDevice \FileSystem\Ntfs \Ntfs VET-FILT.SYS
AttachedDevice \FileSystem\Fastfat \Fat VET-FILT.SYS
AttachedDevice \FileSystem\Fastfat \Fat VET-REC.SYS

---- Registry - GMER 1.0.14 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000

---- EOF - GMER 1.0.14 ----

T'as essayé de passer Combofix en sans échec ?

bonjour Angeldark,

j'avais tenté l'exécution de Combofix en mode sans echec, mais l'ordi redémarrait sans poursuivre les étapes, j'ai effacé tous les fichiers combo, retélécharger l'application sur mon bureau en le renommant essaie.exe .
rebotté en mode sans echec et là surprise ça fonctionne.

voici le rapport:


ComboFix 08-09-05.14 - moi 2008-09-10 12:27:39.7 - NTFSx86 MINIMAL
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.370 [GMT 2:00]
Endroit: D:\Documents and Settings\moi\Bureau\essaie.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\InfoSat.txt
D:\Documents and Settings\moi\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
D:\Program Files\internet explorer\iekey.dll
D:\WINDOWS\system32\drivers\downld
D:\WINDOWS\system32\drivers\downld\275250.exe
D:\WINDOWS\system32\drivers\downld\278359.exe
D:\WINDOWS\system32\drivers\downld\294656.exe
D:\WINDOWS\system32\drivers\downld\306875.exe
D:\WINDOWS\system32\drivers\downld\359171.exe
D:\WINDOWS\system32\drivers\downld\391562.exe
D:\WINDOWS\system32\drivers\downld\404515.exe
D:\WINDOWS\system32\drivers\downld\791609.exe
D:\WINDOWS\system32\drivers\downld\795109.exe
D:\WINDOWS\system32\drivers\downld\821015.exe
D:\WINDOWS\system32\drivers\downld\831359.exe
D:\WINDOWS\system32\drivers\downld\883968.exe
D:\WINDOWS\system32\drivers\downld\917968.exe
D:\WINDOWS\system32\drivers\downld\930015.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SROSA
-------\Legacy_6TO4
-------\Legacy_IPRIP
-------\Service_6to4
-------\Service_Iprip


((((((((((((((((((((((((((((( Fichiers créés 2008-08-10 to 2008-09-10 ))))))))))))))))))))))))))))))))))))
.

2008-09-09 19:48 . 2008-09-09 19:48 250 --a------ D:\WINDOWS\gmer.ini
2008-09-09 19:12 . 2008-09-09 19:12 232,075 --a------ D:\WINDOWS\Burn4Free_Toolbar_Uninstaller_2578.exe
2008-09-09 19:11 . 2008-09-09 19:12 <REP> d-------- D:\Program Files\Burn4Free Toolbar
2008-09-09 19:11 . 2008-09-09 21:55 <REP> d-------- D:\Program Files\Burn4Free
2008-09-09 18:54 . 2008-09-09 19:04 <REP> d-------- D:\Program Files\Free Easy Burner
2008-09-09 18:54 . 2005-03-11 18:37 1,986,560 --a------ D:\WINDOWS\system32\AudFile.dll
2008-09-09 18:54 . 2005-02-24 13:11 1,212,416 --a------ D:\WINDOWS\system32\AudioInfos.dll
2008-09-09 18:54 . 2005-02-24 12:51 348,160 --a------ D:\WINDOWS\system32\WMAFile.dll
2008-09-09 18:54 . 1998-07-12 22:00 141,312 --a------ D:\WINDOWS\system32\MSCMCFR.DLL
2008-09-09 18:54 . 2005-01-10 13:54 116,296 --a------ D:\WINDOWS\system32\NCTWMAProfiles.prx
2008-09-09 18:54 . 1999-03-25 18:00 101,888 --a------ D:\WINDOWS\system32\VB6STKIT.DLL
2008-09-09 18:54 . 2003-04-18 15:29 44,544 --a------ D:\WINDOWS\system32\msxml4a.dll
2008-09-09 18:54 . 2003-01-26 12:41 40,960 --a------ D:\WINDOWS\system32\SSubTmr6.dll
2008-09-09 12:53 . 2008-09-09 12:53 <REP> d-------- D:\Program Files\SpywareBlaster
2008-09-07 18:36 . 2008-09-07 18:36 10 --a------ D:\WINDOWS\popcinfo.dat
2008-09-07 17:26 . 2008-09-07 18:36 14 --a------ D:\WINDOWS\popcinfot.dat
2008-09-07 17:26 . 2008-09-07 17:26 0 --a------ D:\WINDOWS\popcreg.dat
2008-09-07 11:24 . 2008-09-07 11:24 126 --a------ D:\WINDOWS\_delis43.ini
2008-09-06 11:09 . 2008-09-09 21:26 <REP> d-------- D:\Program Files\Unlocker
2008-09-06 11:09 . 2008-09-06 11:09 <REP> d-------- D:\Documents and Settings\moi\Application Data\Desktopicon
2008-09-06 10:43 . 2008-09-06 10:43 <REP> d-------- D:\Program Files\SafeSoft
2008-09-06 09:44 . 2001-08-28 14:00 18,944 --a------ D:\WINDOWS\system32\simptcp.dll
2008-09-06 08:52 . 2008-09-06 09:00 <REP> d-------- D:\ToolBar SD
2008-09-05 23:41 . 2008-09-05 23:41 1,004,162 --a------ D:\WINDOWS\system32\PerfStringBackup.TMP_002
2008-09-05 23:41 . 2008-09-05 23:41 1,002,460 --a------ D:\WINDOWS\system32\PerfStringBackup.TMP_001
2008-09-05 23:38 . 2008-09-05 23:38 <REP> d-------- D:\Program Files\CCleaner
2008-09-05 23:06 . 2008-09-05 23:06 <REP> d-------- D:\Program Files\Avira
2008-09-05 23:06 . 2008-09-05 23:06 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Avira
2008-09-05 22:56 . 2008-09-05 22:56 2,955 --a------ D:\WINDOWS\system32\spupdsvc.inf
2008-09-05 22:50 . 2004-08-19 16:10 380,928 --------- D:\WINDOWS\system32\irprops.cpl
2008-09-05 22:50 . 2004-08-19 16:10 163,840 --------- D:\WINDOWS\system32\wuaucpl.cpl
2008-09-05 22:49 . 2004-08-19 16:09 7,680 --a--c--- D:\WINDOWS\system32\dllcache\migregdb.exe
2008-09-05 22:47 . 2008-09-05 22:47 <REP> d-------- D:\WINDOWS\ServicePackFiles
2008-09-05 22:47 . 2004-08-19 16:09 36,864 --a------ D:\WINDOWS\system32\iprip.dll
2008-09-05 22:39 . 2004-07-17 11:40 19,528 --a------ D:\WINDOWS\002485_.tmp
2008-09-05 20:41 . 2008-09-05 21:41 <REP> d-------- D:\ellibagle
2008-09-05 20:19 . 2001-08-28 14:00 113,222 --a--c--- D:\WINDOWS\system32\dllcache\zoneclim.dll
2008-09-05 20:19 . 2001-08-28 14:00 41,029 --a--c--- D:\WINDOWS\system32\dllcache\zcorem.dll
2008-09-05 20:19 . 2001-08-28 14:00 36,937 --a--c--- D:\WINDOWS\system32\dllcache\zclientm.exe
2008-09-05 20:19 . 2001-08-28 14:00 29,760 --a--c--- D:\WINDOWS\system32\dllcache\znetm.dll
2008-09-05 20:19 . 2001-08-28 14:00 13,894 --a--c--- D:\WINDOWS\system32\dllcache\zonelibm.dll
2008-09-05 20:19 . 2001-08-28 14:00 4,677 --a--c--- D:\WINDOWS\system32\dllcache\zeeverm.dll
2008-09-05 20:17 . 2004-08-03 22:31 482,304 --a--c--- D:\WINDOWS\system32\dllcache\pintlgnt.ime
2008-09-05 20:16 . 2001-08-28 14:00 10,096,640 --a--c--- D:\WINDOWS\system32\dllcache\hwxcht.dll
2008-09-05 20:15 . 2001-08-23 17:47 2,134,528 --a--c--- D:\WINDOWS\system32\dllcache\EXCH_smtpsnap.dll
2008-09-05 20:15 . 2001-08-28 14:00 1,817,687 --a--c--- D:\WINDOWS\system32\dllcache\bckgres.dll
2008-09-05 20:15 . 2001-08-23 17:46 315,904 --a--c--- D:\WINDOWS\system32\dllcache\EXCH_aqueue.dll
2008-09-05 20:15 . 2001-08-23 17:47 175,104 --a--c--- D:\WINDOWS\system32\dllcache\EXCH_smtpadm.dll
2008-09-05 20:15 . 2001-08-28 14:00 82,501 --a--c--- D:\WINDOWS\system32\dllcache\bckg.dll
2008-09-05 20:15 . 2001-08-23 17:46 45,056 --a--c--- D:\WINDOWS\system32\dllcache\EXCH_aqadmin.dll
2008-09-05 20:15 . 2001-08-28 14:00 19,456 --a--c--- D:\WINDOWS\system32\dllcache\agt040d.dll
2008-09-05 20:15 . 2001-08-28 14:00 19,456 --a--c--- D:\WINDOWS\system32\dllcache\agt0401.dll
2008-09-05 20:15 . 2001-08-23 17:46 5,632 --a--c--- D:\WINDOWS\system32\dllcache\EXCH_adsiisex.dll
2008-09-05 20:10 . 2008-09-05 20:10 488 -rah----- D:\WINDOWS\system32\logonui.exe.manifest
2008-09-05 20:09 . 2008-09-05 20:09 <REP> d-------- D:\Program Files\Services en ligne
2008-09-05 20:08 . 2004-08-19 16:09 282,624 --a------ D:\WINDOWS\system32\inetcfg.dll
2008-09-05 20:08 . 2004-08-19 16:09 281,600 --a------ D:\WINDOWS\system32\mstask.dll
2008-09-05 20:08 . 2004-08-19 16:09 193,024 --a------ D:\WINDOWS\system32\schedsvc.dll
2008-09-05 20:08 . 2004-08-19 16:09 86,016 --a------ D:\WINDOWS\system32\isign32.dll
2008-09-05 20:08 . 2004-08-19 16:09 73,728 --a------ D:\WINDOWS\system32\icwdial.dll
2008-09-05 20:08 . 2001-08-28 14:00 73,728 --a--c--- D:\WINDOWS\system32\dllcache\icwtutor.exe
2008-09-05 20:08 . 2004-08-19 16:09 65,536 --a------ D:\WINDOWS\system32\icwphbk.dll
2008-09-05 20:08 . 2001-08-28 14:00 65,536 --a--c--- D:\WINDOWS\system32\dllcache\icwres.dll
2008-09-05 20:08 . 2004-08-19 16:08 50,688 --a------ D:\WINDOWS\system32\inetres.dll
2008-09-05 20:08 . 2001-08-28 14:00 40,960 --a--c--- D:\WINDOWS\system32\dllcache\trialoc.dll
2008-09-05 20:08 . 2004-08-19 16:10 12,288 --a------ D:\WINDOWS\system32\mstinit.exe
2008-09-05 20:06 . 2004-08-03 23:01 196,864 --a------ D:\WINDOWS\system32\drivers\rdpdr.sys
2008-09-05 20:06 . 2004-08-19 16:09 191,488 --a------ D:\WINDOWS\system32\cmprops.dll
2008-09-05 20:06 . 2004-08-19 16:09 58,880 --a------ D:\WINDOWS\system32\licwmi.dll
2008-09-05 20:06 . 2004-08-03 23:07 52,864 --a------ D:\WINDOWS\system32\drivers\dmusic.sys
2008-09-05 20:06 . 2004-08-03 23:10 19,328 --a------ D:\WINDOWS\system32\drivers\wstcodec.sys
2008-09-05 20:06 . 2004-08-19 16:09 17,920 --a------ D:\WINDOWS\system32\mmfutil.dll
2008-09-05 20:06 . 2004-08-03 23:10 17,024 --a------ D:\WINDOWS\system32\drivers\ccdecode.sys
2008-09-05 20:06 . 2004-08-03 22:58 5,504 --a------ D:\WINDOWS\system32\drivers\mstee.sys
2008-09-05 20:05 . 2004-08-03 23:10 85,376 --a------ D:\WINDOWS\system32\drivers\nabtsfec.sys
2008-09-05 20:01 . 2004-08-03 23:07 59,264 --a------ D:\WINDOWS\system32\drivers\usbaudio.sys
2008-09-05 20:00 . 2004-08-19 16:10 91,648 --a------ D:\WINDOWS\system32\kswdmcap.ax
2008-09-05 20:00 . 2004-08-19 16:10 61,952 --a------ D:\WINDOWS\system32\kstvtune.ax
2008-09-05 20:00 . 2004-08-19 15:54 58,496 --a------ D:\WINDOWS\system32\drivers\redbook.sys
2008-09-05 20:00 . 2004-08-19 16:09 54,784 --a------ D:\WINDOWS\system32\vfwwdm32.dll
2008-09-05 20:00 . 2004-08-19 16:10 43,008 --a------ D:\WINDOWS\system32\ksxbar.ax
2008-09-05 19:57 . 2004-08-03 23:15 145,792 --a------ D:\WINDOWS\system32\drivers\portcls.sys
2008-09-05 19:57 . 2004-08-03 23:15 140,928 --a------ D:\WINDOWS\system32\drivers\ks.sys
2008-09-05 19:57 . 2004-08-19 16:10 130,048 --a------ D:\WINDOWS\system32\ksproxy.ax
2008-09-05 19:57 . 2004-08-03 23:08 60,288 --a------ D:\WINDOWS\system32\drivers\drmk.sys
2008-09-05 19:57 . 2004-08-03 23:08 48,640 --a------ D:\WINDOWS\system32\drivers\stream.sys
2008-09-05 19:57 . 2004-08-19 16:10 23,552 --a------ D:\WINDOWS\system32\wdmaud.drv
2008-09-05 19:57 . 2004-08-03 22:31 20,992 --a------ D:\WINDOWS\system32\drivers\rtl8139.sys
2008-09-05 19:57 . 2004-08-19 16:09 4,096 --a------ D:\WINDOWS\system32\ksuser.dll
2008-09-05 19:56 . 2004-08-19 16:10 40,840 --a------ D:\WINDOWS\system32\drivers\termdd.sys
2008-09-05 19:55 . 2004-08-19 16:10 146,944 --a------ D:\WINDOWS\system\winspool.drv
2008-09-05 19:55 . 2004-08-19 16:09 76,800 --a------ D:\WINDOWS\system32\storprop.dll
2008-09-05 19:55 . 2001-08-28 14:00 70,352 --a--c--- D:\WINDOWS\system32\dllcache\avicap.dll
2008-09-05 19:55 . 2001-08-28 14:00 70,352 --a------ D:\WINDOWS\system\AVICAP.DLL
2008-09-05 19:55 . 2001-08-28 14:00 24,661 --a------ D:\WINDOWS\system32\spxcoins.dll
2008-09-05 19:55 . 2001-08-28 14:00 24,661 --a--c--- D:\WINDOWS\system32\dllcache\spxcoins.dll
2008-09-05 19:55 . 2001-08-28 14:00 13,312 --a------ D:\WINDOWS\system32\irclass.dll
2008-09-05 19:55 . 2001-08-28 14:00 13,312 --a--c--- D:\WINDOWS\system32\dllcache\irclass.dll
2008-09-05 19:55 . 2004-08-03 23:00 11,264 --a------ D:\WINDOWS\system32\drivers\irenum.sys
2008-09-05 19:54 . 2008-09-09 19:36 <REP> d-------- D:\WINDOWS\system32\CatRoot2
2008-09-05 19:54 . 2001-08-28 14:00 1,085,938 -ra------ D:\WINDOWS\SETF8.tmp
2008-09-05 19:54 . 2001-08-28 14:00 13,923 -ra------ D:\WINDOWS\SET104.tmp
2008-09-05 19:52 . 2008-09-05 19:52 <REP> d-------- D:\WINDOWS\msapps
2008-09-05 17:32 . 2008-09-05 17:32 <REP> d-------- D:\WINDOWS\system32\NtmsData
2008-09-05 16:25 . 2008-09-05 16:25 <REP> d-------- D:\Program Files\Fichiers communs\Wise Installation Wizard
2008-09-01 16:04 . 2008-09-03 18:04 1,492 --a------ D:\WINDOWS\system32\tmp.reg
2008-09-01 16:04 . 2008-09-03 18:04 0 --a------ D:\WINDOWS\system32\tmp.MSNFix
2008-08-30 12:15 . 2008-09-09 17:38 <REP> d-------- D:\hija
2008-08-30 11:44 . 2008-08-30 11:44 <REP> d-------- D:\Program Files\Neuf
2008-08-30 11:20 . 2008-08-30 11:21 <REP> d-------- D:\Program Files\jv16 PowerTools
2008-08-29 16:01 . 2008-09-01 18:23 <REP> d-------- D:\Documents and Settings\Administrateur\Application Data\Talkback
2008-08-28 23:45 . 2008-08-28 23:45 <REP> d-------- D:\Program Files\Trend Micro
2008-08-27 16:30 . 2008-08-27 16:30 <REP> d-------- D:\WUTemp
2008-08-19 14:55 . 2008-08-21 20:21 <REP> d-------- D:\Documents and Settings\moi\Application Data\PlayFirst
2008-08-19 14:55 . 2008-08-21 20:21 <REP> d-------- D:\Documents and Settings\All Users\Application Data\PlayFirst
2008-08-17 15:52 . 2008-09-07 17:17 <REP> d-------- D:\Program Files\Zylom Games
2008-08-17 15:52 . 2008-08-23 03:38 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Zylom

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-09 19:32 --------- d-----w D:\Documents and Settings\moi\Application Data\Ahead
2008-09-09 19:28 --------- d-----w D:\Program Files\Ahead
2008-09-09 19:27 --------- d-----w D:\Documents and Settings\All Users\Application Data\Ahead
2008-09-09 16:21 --------- d-----w D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-09 10:07 --------- d-----w D:\Program Files\Spybot - Search & Destroy
2008-09-07 15:12 --------- d-----w D:\Program Files\Classic PuffBOMB
2008-09-06 09:46 --------- d-----w D:\Program Files\eMule
2008-09-06 08:21 --------- d-----w D:\Program Files\MSN Messenger
2008-09-05 20:05 --------- d-----w D:\Program Files\Messenger Plus! Live
2008-09-01 16:23 --------- d-----w D:\Documents and Settings\moi\Application Data\Talkback
2008-08-31 03:42 --------- d-----w D:\Program Files\Full Tilt Poker
2008-08-31 03:06 --------- d-----w D:\Program Files\PokerStars
2008-08-28 20:59 --------- d-----w D:\Program Files\The Weather Channel FW
2008-08-25 09:55 --------- d-----w D:\Documents and Settings\moi\Application Data\Microgaming
2008-08-18 18:47 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-08-18 18:45 --------- d-----w D:\Program Files\Myst III Exile
2008-08-18 18:38 --------- d-----w D:\Program Files\Yahoo!
2008-07-18 20:10 45,768 ----a-w D:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w D:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w D:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w D:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w D:\WINDOWS\system32\wuweb.dll
2008-07-18 20:07 270,880 ----a-w D:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w D:\WINDOWS\system32\muweb.dll
2008-05-31 16:57 558 ----a-w D:\Program Files\mpc1.reg
2008-05-31 16:57 32,668 ----a-w D:\Program Files\ffdsvsetts.reg
2008-05-31 16:57 3,476 ----a-w D:\Program Files\mpc7.reg
2008-05-31 16:57 3,026 ----a-w D:\Program Files\mpc3.reg
2008-05-31 16:57 236 ----a-w D:\Program Files\mpc4.reg
2008-05-31 16:57 18,156 ----a-w D:\Program Files\mpc6.reg
2008-05-31 16:57 16,008 ----a-w D:\Program Files\ffdsasetts.reg
2008-05-31 16:57 15,832 ----a-w D:\Program Files\mpc5.reg
2008-05-31 16:56 2,200 ----a-w D:\Program Files\ffdssetts.reg
2006-11-15 05:53 299 ----a-w D:\Documents and Settings\moi\Application Data\internaldb1942.dat
2002-10-29 13:31 11,917 ----a-w D:\Program Files\GMUSES.INF
2002-10-24 09:25 1,482 ------w D:\Program Files\setup.txt
2002-07-16 08:58 379,726 ------w D:\Program Files\CMAUDIO.SYS
2002-07-12 14:33 1,581,056 ------w D:\Program Files\MIXER.EXE
2002-07-11 10:13 135,168 ------w D:\Program Files\CMUNINST.DAT
2002-07-11 09:24 139,264 ------w D:\Program Files\CMUNINST.EXE
2002-03-29 12:52 32,768 ------w D:\Program Files\CMNPROP.DLL
2001-11-23 10:08 712,704 ------w D:\Program Files\AUDIO3D.DLL
2000-10-20 16:28 765,952 ------w D:\Program Files\CRLDS3D.DLL
.

------- Sigcheck -------

2001-08-28 14:00 12800 333a4db8410d8e24db06d6aebecdc7c2 D:\WINDOWS\$NtServicePackUninstall$\svchost.exe
2004-08-19 16:10 14336 2979b03d5382a602623c0535b16ab9c0 D:\WINDOWS\ServicePackFiles\i386\svchost.exe
2004-08-19 16:10 14336 2979b03d5382a602623c0535b16ab9c0 D:\WINDOWS\system32\svchost.exe

2005-03-02 20:20 578048 c34920eb988ce98910bd6b0417f334eb D:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
2007-03-08 17:50 579072 4d88aaf39adabfe45958ea1384e2c4ff D:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
2001-08-28 14:00 562176 0116f8b66043084912d4ceb1c3abf1e2 D:\WINDOWS\$NtServicePackUninstall$\user32.dll
2004-08-19 16:09 578048 61c8c283ad063bb697ae61a155c64a5a D:\WINDOWS\ServicePackFiles\i386\user32.dll
2004-08-19 16:09 578048 61c8c283ad063bb697ae61a155c64a5a D:\WINDOWS\system32\user32.dll

2001-08-28 14:00 75264 20c6d9f9522dda0f9a8e4b8641ca9245 D:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll
2004-08-19 16:09 82944 eed74b969b2ca1acc558ff60fb420e28 D:\WINDOWS\ServicePackFiles\i386\ws2_32.dll
2004-08-19 16:09 82944 eed74b969b2ca1acc558ff60fb420e28 D:\WINDOWS\system32\ws2_32.dll

2006-06-23 13:25 668672 582953780721ac5d38f98cab229ec7b9 D:\WINDOWS\$hf_mig$\KB918899\SP2QFE\wininet.dll
2006-09-14 10:38 668672 b8b6f05885a6f42724e8d6bfede6bd3f D:\WINDOWS\$hf_mig$\KB922760\SP2QFE\wininet.dll
2006-10-23 17:34 668672 efa0c2870cba1747809a13e09f35bf82 D:\WINDOWS\$hf_mig$\KB925454\SP2QFE\wininet.dll
2007-03-23 11:29 823296 375b58a68a016546535a84060092325c D:\WINDOWS\$hf_mig$\KB931768-IE7\SP2QFE\wininet.dll
2007-04-25 10:26 823808 47ddad237f60729dea2b9e0e2382b58f D:\WINDOWS\$hf_mig$\KB933566-IE7\SP2QFE\wininet.dll
2007-06-27 16:14 824320 7201d19b81883b57d5ffe8ebb5a83e8b D:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll
2007-08-20 11:49 825344 2dd1b0f579c80562edcb8848ff7ea9f6 D:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
2007-10-11 01:22 825344 871ae10d6ae8877e9636ae5017953d52 D:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
2007-12-07 03:42 825344 f4fd487241d3ac291046a22cebd2cf71 D:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
2008-03-01 14:34 827392 5a0093f59b505c008ed0cee615563c72 D:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
2008-04-23 09:19 827392 78d3d2b0be6ad3e6d82ccb115cf74310 D:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
2008-06-23 17:40 827904 52589bae67dd9859724287372668690b D:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
2001-08-28 14:00 598016 ea72e6aab27289c10edce06f4af91557 D:\WINDOWS\$NtServicePackUninstall$\wininet.dll
2006-10-23 17:34 668672 efa0c2870cba1747809a13e09f35bf82 D:\WINDOWS\ie7\wininet.dll
2007-02-27 15:26 822784 75de73e328e300caed5965faea2f5d3f D:\WINDOWS\ie7updates\KB933566-IE7\wininet.dll
2007-10-11 01:49 824832 bc5119c53bdd48dabc628d448a3bdccb D:\WINDOWS\ie7updates\KB944533-IE7\wininet.dll
2008-03-01 14:58 826368 8e027981ddffa690d456fe18b37415a0 D:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll
2004-08-19 16:09 660480 4e958b97efc3d801f49283d1820f48b7 D:\WINDOWS\ServicePackFiles\i386\wininet.dll
2006-10-23 17:34 668672 efa0c2870cba1747809a13e09f35bf82 D:\WINDOWS\system32\wininet.dll
2006-10-23 17:34 668672 efa0c2870cba1747809a13e09f35bf82 D:\WINDOWS\system32\dllcache\wininet.dll

2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 D:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 18:53 360832 64798ecfa43d78c7178375fcdd16d8c8 D:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2008-06-20 12:44 360960 744e57c99232201ae98c49168b918f48 D:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
2008-06-20 13:51 361600 9aefa14bd6b182d61e3119fa5f436d3d D:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
2008-06-20 13:59 361600 ad978a1b783b5719720cff204b666c8e D:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2001-08-28 14:00 327168 e7774698bb0d14b0710a9a31e209f9b6 D:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c D:\WINDOWS\ServicePackFiles\i386\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c D:\WINDOWS\system32\drivers\tcpip.sys

2001-08-28 14:00 434176 7486a7d62930d64e83cd847c3c69e7cc D:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
2004-08-19 16:10 506368 123eea158f74d0f67a51dcdf065d1091 D:\WINDOWS\ServicePackFiles\i386\winlogon.exe
2004-08-19 16:10 506368 123eea158f74d0f67a51dcdf065d1091 D:\WINDOWS\system32\winlogon.exe

2001-08-28 14:00 161536 3efd4f59ba0a340de0a3ab984001dbf7 D:\WINDOWS\$NtServicePackUninstall$\ndis.sys
2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e D:\WINDOWS\ServicePackFiles\i386\ndis.sys
2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e D:\WINDOWS\system32\drivers\ndis.sys

2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 D:\WINDOWS\ServicePackFiles\i386\ip6fw.sys
2004-08-04 08:00 29056 4448006b6bc60e6c027932cfc38d6855 D:\WINDOWS\system32\drivers\ip6fw.sys

2005-03-02 20:13 2059008 5311776074b6c13f983dc75baeac9c0c D:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2006-12-19 20:45 2061440 8b039efbe4c9aa23f152ffa0e238b8fa D:\WINDOWS\$hf_mig$\KB929338\SP2QFE\ntkrnlpa.exe
2007-02-28 18:08 2061440 7a56a64eb50399613587e90292dd2aab D:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2001-08-28 14:00 1900416 7a09a7b275351329b4eec542bcf70d3a D:\WINDOWS\$NtServicePackUninstall$\ntkrnlpa.exe
2004-08-19 16:04 2058880 f252fae094c54572ece38a039f2103c4 D:\WINDOWS\ServicePackFiles\i386\ntkrnlpa.exe
2004-08-19 16:04 2058880 f252fae094c54572ece38a039f2103c4 D:\WINDOWS\system32\ntkrnlpa.exe

2005-03-02 20:13 2181632 3e2a0a4a0c0b19fc113618a9562a3b2a D:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2006-12-19 20:45 2184064 1f3fa2065e6e043a1d82a487b5da309c D:\WINDOWS\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe
2007-02-28 18:08 2184192 8e244108562e0e452eb68dff64cb08a9 D:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
2001-08-28 14:00 1985920 fcda48a4ab042ba954dbaa4bac40c9b5 D:\WINDOWS\$NtServicePackUninstall$\ntoskrnl.exe
2004-08-19 16:04 2183040 7d38ce4398e6aa6339b4644feadcc0d8 D:\WINDOWS\ServicePackFiles\i386\ntoskrnl.exe
2004-08-19 16:04 2183040 7d38ce4398e6aa6339b4644feadcc0d8 D:\WINDOWS\system32\ntoskrnl.exe

2004-08-19 16:09 1036288 2a7bd330924252a2fd80344fc949bb72 D:\WINDOWS\explorer.exe
2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 D:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2001-08-28 14:00 1005056 9e20a8ef0ca524446afee29f4423cc8f D:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2004-08-19 16:09 1036288 2a7bd330924252a2fd80344fc949bb72 D:\WINDOWS\ServicePackFiles\i386\explorer.exe

2001-08-28 14:00 101888 fc0691097471ee374907e1024edcbd43 D:\WINDOWS\$NtServicePackUninstall$\services.exe
2004-08-19 16:10 108544 63dcde1a0d86eeb8924d6738ff616ead D:\WINDOWS\ServicePackFiles\i386\services.exe
2004-08-19 16:10 108544 63dcde1a0d86eeb8924d6738ff616ead D:\WINDOWS\system32\services.exe

2001-08-28 14:00 11776 2c2431b30a629123c1757582c9d93f38 D:\WINDOWS\$NtServicePackUninstall$\lsass.exe
2004-08-19 16:09 13312 259af82a0932eea4f316f92db94707b6 D:\WINDOWS\ServicePackFiles\i386\lsass.exe
2004-08-19 16:09 13312 259af82a0932eea4f316f92db94707b6 D:\WINDOWS\system32\lsass.exe

2001-08-28 14:00 13312 f95275cf5e7c30cea58b0b1b7b40210f D:\WINDOWS\$NtServicePackUninstall$\ctfmon.exe
2004-08-19 16:09 15360 64e41e8fee655b03e3f19ded21ba5118 D:\WINDOWS\ServicePackFiles\i386\ctfmon.exe
2004-08-19 16:09 15360 64e41e8fee655b03e3f19ded21ba5118 D:\WINDOWS\system32\ctfmon.exe

2005-06-11 02:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 D:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2001-08-28 14:00 51200 b1ce5287f096895d9be26eb86f4d5faf D:\WINDOWS\$NtSer