[LOGICIEL] decoder mon rapport hijacthis

rudye · le 23 février 2009

plaise besoin d'aide dites mois ce qui ne vas pas la dedans Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:18:40, on 23/02/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe

C:\Program Files\ATK Hotkey\ASLDRSrv.exe

C:\Program Files\ATK Hotkey\Hcontrol.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\crypserv.exe

C:\Windows\system32\spool\DRIVERS\W32X86\3\lxdiserv.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\Windows\system32\lxdicoms.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\ATK Hotkey\ATKOSD.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\StkSrv.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe

C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Program Files\Internet Explorer\ieuser.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll

O4 - HKLM\..\Run: [sMSERIAL] "C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe"

O4 - HKLM\..\Run: [synTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [lxdimon.exe] "C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe"

O4 - HKLM\..\Run: [lxdiamon] "C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe"

O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\\Lexmark Fax Solutions\fm3032.exe" /s

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"

O4 - HKLM\..\Run: [bitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"

O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun

O4 - HKCU\..\Run: [smpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O13 - Gopher Prefix:

O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/dow...llerControl.cab

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co...ex/qtplugin.cab

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab

O16 - DPF: {5852F5ED-8BF4-11D4-A245-0080C6F74284} (isInstalled Class) - http://javadl-esd.sun.com/update/1.5.0/jin...indows-i586.cab

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe

O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\Windows\SYSTEM32\crypserv.exe

O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Service Google Update (gupdate1c994591a826add) (gupdate1c994591a826add) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

O23 - Service: lxdiCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdiserv.exe

O23 - Service: lxdi_device - - C:\Windows\system32\lxdicoms.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkSrv.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

--

End of file - 10453 bytes

snooky · le 23 février 2009

1/ Désinstalle Spyware Doctor .

2/ Désactive et quitte BitDefender .

3/ Lance ComboFix et poste le rapport créé :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

rudye · le 23 février 2009

1/ Désinstalle Spyware Doctor .
2/ Désactive et quitte BitDefender .

3/ Lance ComboFix et poste le rapport créé :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

merci de ton aide je le fait de suite

snooky · le 23 février 2009

Lance ensuite MSNFix et poste le rapport créé : http://www.malekal.com/tutorial_MSNFix.php

rudye · le 23 février 2009

1/ Désinstalle Spyware Doctor .
2/ Désactive et quitte BitDefender .

3/ Lance ComboFix et poste le rapport créé :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

desoComboFix 09-02-21.01 - rudy 2009-02-23 14:50:19.1 - NTFSx86

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2047.1363 [GMT 1:00]

Lancé depuis: c:\users\rudy\Documents\ComboFix.exe

AV: BitDefender Antivirus *On-access scanning disabled* (Updated)

AV: Norton Internet Security *On-access scanning enabled* (Updated)

FW: Norton Internet Security *enabled*

* Un nouveau point de restauration a été créé

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\QUAD Utilities

c:\program files\XLGuarder

c:\program files\XLGuarder\esearch.dll

c:\windows\system32\tmp.reg

.

((((((((((((((((((((((((((((( Fichiers créés du 2009-01-23 au 2009-02-23 ))))))))))))))))))))))))))))))))))))

.

2009-02-22 19:01 . 2009-02-22 19:07 <REP> d-------- c:\program files\Registry Easy

2009-02-22 01:34 . 2009-02-22 21:05 <REP> d-------- c:\windows\System32\SmitfraudFix

2009-02-22 00:52 . 2009-02-22 01:17 <REP> d-------- c:\program files\Spybot - Search & Destroy

2009-02-21 23:04 . 2009-02-21 23:06 <REP> d-------- c:\programdata\Lavasoft

2009-02-21 22:27 . 2009-02-21 22:32 <REP> d-------- c:\program files\RogueRemover FREE

2009-02-21 20:17 . 2009-02-23 10:52 <REP> d-------- c:\program files\Picasa2

2009-02-21 12:49 . 2009-02-23 14:32 81,984 --a------ c:\windows\System32\bdod.bin

2009-02-21 12:41 . 2009-02-21 12:41 850 --a------ c:\windows\System32\ProductTweaks.xml

2009-02-21 12:41 . 2009-02-21 12:41 385 --a------ c:\windows\System32\user_gensett.xml

2009-02-21 12:38 . 2009-02-21 12:38 <REP> d-------- c:\program files\BitDefender

2009-02-21 12:36 . 2009-02-23 14:33 <REP> d-------- c:\program files\Common Files\BitDefender

2009-02-20 20:09 . 2009-02-20 21:18 <REP> d-------- c:\program files\Fighters

2009-02-20 00:41 . 2009-02-20 00:41 0 --ah----- c:\users\Default.LOG2

2009-02-20 00:41 . 2009-02-20 00:41 0 --ah----- c:\users\Default.LOG1

2009-02-20 00:41 . 2009-02-20 00:41 0 --ah----- C:\ProgramData.LOG2

2009-02-20 00:41 . 2009-02-20 00:41 0 --ah----- C:\ProgramData.LOG1

2009-02-20 00:01 . 2009-02-20 00:01 164 --a------ C:\install.dat

2009-02-19 23:14 . 2009-02-21 20:11 <REP> d-------- c:\program files\Panda Security

2009-02-19 22:08 . 2009-02-19 22:08 <REP> d-------- c:\windows\BDOSCAN8

2009-02-18 20:06 . 2009-02-18 20:08 <REP> d-------- c:\program files\K-Lite Codec Pack

2009-02-18 20:06 . 2008-09-16 20:23 168,448 --a------ c:\windows\System32\unrar.dll

2009-02-18 19:24 . 2009-02-18 19:25 26 --a------ c:\windows\System32\satsukidecodersettings.ini

2009-02-17 21:28 . 2009-02-17 21:28 <REP> d-------- c:\program files\LimeWire

2009-02-17 21:14 . 2009-02-17 21:14 <REP> d-------- c:\windows\Downloaded Installations

2009-02-17 16:23 . 2008-06-20 02:14 781,344 --a------ c:\windows\System32\PresentationNative_v0300.dll

2009-02-17 16:23 . 2008-06-20 02:14 622,080 --a------ c:\windows\System32\icardagt.exe

2009-02-17 16:23 . 2008-06-20 02:14 326,160 --a------ c:\windows\System32\PresentationHost.exe

2009-02-17 16:23 . 2008-06-20 02:14 105,016 --a------ c:\windows\System32\PresentationCFFRasterizerNative_v0300.dll

2009-02-17 16:23 . 2008-06-20 02:14 97,800 --a------ c:\windows\System32\infocardapi.dll

2009-02-17 16:23 . 2008-06-20 02:14 43,544 --a------ c:\windows\System32\PresentationHostProxy.dll

2009-02-17 16:23 . 2008-06-20 02:14 37,384 --a------ c:\windows\System32\infocardcpl.cpl

2009-02-17 16:23 . 2008-06-20 02:14 11,264 --a------ c:\windows\System32\icardres.dll

2009-02-17 16:17 . 2008-07-27 19:03 282,112 --a------ c:\windows\System32\mscoree.dll

2009-02-17 16:17 . 2008-07-27 19:03 158,720 --a------ c:\windows\System32\mscorier.dll

2009-02-17 16:17 . 2008-07-27 19:03 96,760 --a------ c:\windows\System32\dfshim.dll

2009-02-17 16:17 . 2008-07-27 19:03 83,968 --a------ c:\windows\System32\mscories.dll

2009-02-17 16:17 . 2008-07-27 19:03 41,984 --a------ c:\windows\System32\netfxperf.dll

2009-02-17 16:14 . 2008-08-28 04:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll

2009-02-17 16:14 . 2008-12-05 05:32 428,544 --a------ c:\windows\System32\EncDec.dll

2009-02-17 16:14 . 2008-08-28 04:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll

2009-02-17 16:14 . 2008-08-28 04:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll

2009-02-17 16:14 . 2008-12-05 05:32 293,376 --a------ c:\windows\System32\psisdecd.dll

2009-02-17 16:14 . 2008-10-22 04:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll

2009-02-17 16:14 . 2008-12-05 05:31 217,088 --a------ c:\windows\System32\psisrndr.ax

2009-02-17 16:14 . 2008-12-05 05:31 177,664 --a------ c:\windows\System32\mpg2splt.ax

2009-02-17 16:14 . 2008-09-18 05:56 147,456 --a------ c:\windows\System32\Faultrep.dll

2009-02-17 16:14 . 2008-09-18 05:56 125,952 --a------ c:\windows\System32\wersvc.dll

2009-02-17 16:14 . 2008-12-05 05:31 80,896 --a------ c:\windows\System32\MSNP.ax

2009-02-17 16:14 . 2008-04-23 05:41 57,856 --a------ c:\windows\System32\MSDvbNP.ax

2009-02-17 16:11 . 2008-10-21 06:25 1,645,568 --a------ c:\windows\System32\connect.dll

2009-02-16 12:47 . 2009-02-16 12:47 <REP> d-------- c:\programdata\Messenger Plus!

2009-02-16 12:35 . 2009-02-16 12:35 <REP> d-------- c:\program files\Messenger Plus! Live

2009-02-16 12:30 . 2009-02-16 12:31 <REP> d-------- c:\program files\Windows Live Safety Center

2009-02-16 11:43 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\System32\d3dx9_32.dll

2009-02-16 11:40 . 2009-02-16 11:40 <REP> d-------- c:\program files\Windows Live Favorites

2009-02-15 23:09 . 2009-02-15 23:09 <REP> d-------- c:\program files\Trend Micro

2009-02-15 22:52 . 1996-08-20 20:37 15,840 --a------ c:\windows\System32\Machnm1.exe

2009-02-15 22:52 . 2005-09-25 16:37 5,632 --a------ c:\windows\System32\Machnm64.sys

2009-02-15 22:52 . 2009-02-15 22:52 3,120 --a------ c:\windows\System32\118290.54

2009-02-15 22:52 . 2009-02-15 22:52 3,120 --a------ c:\windows\118294.78

2009-02-15 22:52 . 2003-08-13 00:27 2,304 --a------ c:\windows\System32\Machnm32.sys

2009-02-15 22:39 . 2009-02-15 22:39 <REP> d-------- C:\Upload_Me

2009-02-15 22:38 . 2009-02-16 08:10 <REP> d-------- c:\program files\MSNFix

2009-02-15 20:19 . 2009-01-15 04:36 1,383,424 --a------ c:\windows\System32\mshtml.tlb

2009-02-15 20:19 . 2009-01-15 07:11 827,392 --a------ c:\windows\System32\wininet.dll

2009-02-15 19:32 . 2009-02-15 19:32 <REP> d-------- c:\program files\Microsoft Sync Framework

2009-02-15 19:30 . 2009-02-15 19:30 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition

2009-02-15 18:33 . 2009-02-15 19:42 <REP> d-------- c:\users\kentin\Tracing

2009-02-12 19:49 . 2009-02-12 19:49 <REP> d-------- c:\program files\Microsoft Silverlight

2009-02-12 19:32 . 2009-02-12 19:32 <REP> d-------- c:\program files\Common Files\Windows Live

2009-02-08 22:25 . 2009-02-08 22:50 <REP> d-------- c:\program files\SoftLogica

2009-02-08 21:51 . 2009-02-08 21:54 <REP> d-------- c:\program files\FreeUndelete

2009-02-08 21:32 . 2009-02-08 21:32 <REP> d-------- c:\program files\Ontrack

2009-02-08 21:09 . 2009-02-08 21:09 <REP> d-------- c:\programdata\CrypKey

2009-02-08 21:09 . 2009-02-08 21:25 <REP> d-------- c:\program files\Stellar Phoenix Windows Data Recovery

2009-01-30 19:16 . 2009-02-16 12:22 <REP> d----c--- c:\windows\System32\DRVSTORE

2009-01-30 19:16 . 2009-01-30 19:16 <REP> d-------- c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2009-01-30 19:16 . 2009-01-30 19:16 <REP> d-------- c:\program files\iTunes

2009-01-30 19:16 . 2009-01-30 19:16 <REP> d-------- c:\program files\iPod

2009-01-30 19:16 . 2008-04-17 13:12 107,368 --a------ c:\windows\System32\GEARAspi.dll

2009-01-30 19:16 . 2008-04-17 13:12 15,464 --a------ c:\windows\System32\drivers\GEARAspiWDM.sys

2009-01-30 19:11 . 2009-01-30 19:11 <REP> d-------- c:\program files\Bonjour

2009-01-30 18:46 . 2008-12-16 03:42 288,768 --a------ c:\windows\System32\drivers\srv.sys

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-23 13:35 --------- d-----w c:\program files\Common Files\Symantec Shared

2009-02-23 12:53 --------- d---a-w c:\programdata\TEMP

2009-02-23 09:52 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller

2009-02-23 09:52 --------- d-----w c:\users\kentin\AppData\Roaming\FaxCtr

2009-02-23 09:52 --------- d-----w c:\programdata\Lx_cats

2009-02-23 09:52 --------- d-----w c:\program files\Azureus

2009-02-22 21:18 --------- d-----w c:\programdata\Google Updater

2009-02-21 19:19 --------- d-----w c:\program files\Google

2009-02-19 18:02 --------- d-----w c:\users\kentin\AppData\Roaming\LimeWire

2009-02-18 17:30 42,216 ----a-w c:\users\kentin\AppData\Roaming\nvModes.dat

2009-02-17 16:24 --------- d-----w c:\users\guillaume\AppData\Roaming\LimeWire

2009-02-17 16:19 13,213 ----a-w c:\users\guillaume\AppData\Roaming\nvModes.dat

2009-02-17 15:40 --------- d-----w c:\program files\Windows Mail

2009-02-17 13:24 410,984 ----a-w c:\windows\System32\deploytk.dll

2009-02-16 11:22 --------- d-----w c:\program files\Windows Live

2009-02-16 10:40 --------- d-----w c:\program files\Windows Live Toolbar

2009-02-16 10:36 --------- d-----w c:\programdata\WLInstaller

2009-02-15 22:47 --------- d-----w c:\program files\Common Files\Adobe

2009-02-15 21:56 --------- d--h--w c:\program files\InstallShield Installation Information

2009-01-31 11:58 --------- d-----w c:\program files\BitComet

2009-01-31 10:08 --------- d-----w c:\program files\Java

2009-01-30 18:16 --------- d-----w c:\program files\Common Files\Apple

2009-01-30 18:11 --------- d-----w c:\program files\QuickTime

2008-12-31 17:04 --------- d-----w c:\programdata\Recisio

2008-12-31 17:04 --------- d-----w c:\program files\KaraFun

2008-12-12 10:18 87,336 ----a-w c:\windows\System32\dns-sd.exe

2008-12-12 10:11 61,440 ----a-w c:\windows\System32\dnssd.dll

2008-06-26 20:48 174 --sha-w c:\program files\desktop.ini

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]

"SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2006-10-23 1092152]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-09 68856]

"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-10-09 729088]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-22 815104]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-27 29744]

"lxdimon.exe"="c:\program files\Lexmark 3500-4500 Series\lxdimon.exe" [2007-07-16 434864]

"lxdiamon"="c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe" [2007-07-16 25264]

"FaxCenterServer"="c:\program files\\Lexmark Fax Solutions\fm3032.exe" [2007-07-16 311984]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-17 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.i420"= i420vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe"

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UacDisableNotify"=dword:00000001

"InternetSettingsDisableNotify"=dword:00000001

"AutoUpdateDisableNotify"=dword:00000001

"AntiVirusDisableNotify"="0x00000000"

"UpdatesDisableNotify"="0x00000000"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{42B86C26-26B5-4442-B2D5-3CB214A5A9D2}"= UDP:c:\program files\Skype\Phone\Skype.exe:Skype

"{E3F0D72A-3309-4744-BA9B-A66D7F2D28A6}"= TCP:c:\program files\Skype\Phone\Skype.exe:Skype

"TCP Query User{95B2478C-F1F1-442A-88EF-7FB64FA4C65F}c:\\program files\\java\\jre1.5.0_10\\bin\\javaw.exe"= UDP:c:\program files\java\jre1.5.0_10\bin\javaw.exe:Java 2 Platform Standard Edition binary

"UDP Query User{07AFF22C-B462-411C-B417-EB0FB23E946F}c:\\program files\\java\\jre1.5.0_10\\bin\\javaw.exe"= TCP:c:\program files\java\jre1.5.0_10\bin\javaw.exe:Java 2 Platform Standard Edition binary

"TCP Query User{094FD306-0050-4FDD-A224-EF6CAF554CE1}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule Plus

"UDP Query User{37D17E61-D4F1-4DEE-9D65-11E5432A4B03}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule Plus

"TCP Query User{1D861F2F-8E03-4546-8368-92C5C8B994AB}c:\\users\\rudy\\appdata\\local\\temp\\temp1_emule_pro_ultra3_0.48a_mod.zip\\emule.exe"= UDP:c:\users\rudy\appdata\local\temp\temp1_emule_pro_ultra3_0.48a_mod.zip\emule.exe:emule.exe

"UDP Query User{57BBE87A-5432-4096-BC91-7A6E40601A51}c:\\users\\rudy\\appdata\\local\\temp\\temp1_emule_pro_ultra3_0.48a_mod.zip\\emule.exe"= TCP:c:\users\rudy\appdata\local\temp\temp1_emule_pro_ultra3_0.48a_mod.zip\emule.exe:emule.exe

"TCP Query User{C9F09D3A-CCDD-4755-895C-3436A69BED52}c:\\users\\rudy\\appdata\\local\\temp\\temp2_emule_pro_ultra3_0.48a_mod.zip\\emule.exe"= UDP:c:\users\rudy\appdata\local\temp\temp2_emule_pro_ultra3_0.48a_mod.zip\emule.exe:emule.exe

"UDP Query User{B4CB35DD-41C7-42BD-97D9-65F792A0DFF0}c:\\users\\rudy\\appdata\\local\\temp\\temp2_emule_pro_ultra3_0.48a_mod.zip\\emule.exe"= TCP:c:\users\rudy\appdata\local\temp\temp2_emule_pro_ultra3_0.48a_mod.zip\emule.exe:emule.exe

"TCP Query User{36750C0E-7D01-4504-8F06-6C7083F059B5}c:\\users\\rudy\\appdata\\local\\temp\\temp3_emule_pro_ultra3_0.48a_mod.zip\\emule.exe"= UDP:c:\users\rudy\appdata\local\temp\temp3_emule_pro_ultra3_0.48a_mod.zip\emule.exe:emule.exe

"UDP Query User{91A9D78D-CB6A-49D8-A137-DBFCF24621B1}c:\\users\\rudy\\appdata\\local\\temp\\temp3_emule_pro_ultra3_0.48a_mod.zip\\emule.exe"= TCP:c:\users\rudy\appdata\local\temp\temp3_emule_pro_ultra3_0.48a_mod.zip\emule.exe:emule.exe

"TCP Query User{79991394-9725-46E5-AA38-968AEE95D819}c:\\users\\rudy\\appdata\\local\\temp\\temp4_emule_pro_ultra3_0.48a_mod.zip\\emule.exe"= UDP:c:\users\rudy\appdata\local\temp\temp4_emule_pro_ultra3_0.48a_mod.zip\emule.exe:emule.exe

"UDP Query User{35D3C69D-6C85-4B75-A5C6-A097ADDEAF42}c:\\users\\rudy\\appdata\\local\\temp\\temp4_emule_pro_ultra3_0.48a_mod.zip\\emule.exe"= TCP:c:\users\rudy\appdata\local\temp\temp4_emule_pro_ultra3_0.48a_mod.zip\emule.exe:emule.exe

"TCP Query User{5EF633CC-DD26-41AD-BABC-9B59E3A94D5E}c:\\users\\rudy\\appdata\\local\\temp\\temp5_emule_pro_ultra3_0.48a_mod.zip\\emule.exe"= UDP:c:\users\rudy\appdata\local\temp\temp5_emule_pro_ultra3_0.48a_mod.zip\emule.exe:emule.exe

"UDP Query User{9EF8519B-A309-4DA8-AEE3-0ECCA2F69358}c:\\users\\rudy\\appdata\\local\\temp\\temp5_emule_pro_ultra3_0.48a_mod.zip\\emule.exe"= TCP:c:\users\rudy\appdata\local\temp\temp5_emule_pro_ultra3_0.48a_mod.zip\emule.exe:emule.exe

"TCP Query User{AFE508F8-7090-4904-957F-19F5A1A6CD35}c:\\users\\rudy\\appdata\\local\\virtualstore\\program files\\emule\\incoming\\emule_pro_ultra3_0.48a_mod\\emule.exe"= UDP:c:\users\rudy\appdata\local\virtualstore\program files\emule\incoming\emule_pro_ultra3_0.48a_mod\emule.exe:emule.exe

"UDP Query User{605F581F-CCC7-4C50-B4F1-5F05215BD742}c:\\users\\rudy\\appdata\\local\\virtualstore\\program files\\emule\\incoming\\emule_pro_ultra3_0.48a_mod\\emule.exe"= TCP:c:\users\rudy\appdata\local\virtualstore\program files\emule\incoming\emule_pro_ultra3_0.48a_mod\emule.exe:emule.exe

"TCP Query User{B66F8E79-00C9-4F96-AA63-381D9E2EE3F9}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus

"UDP Query User{26904FCF-B20F-4CF8-9102-E57E18E76A19}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus

"TCP Query User{01B40518-5927-4A53-835B-32A920E41FB7}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire

"UDP Query User{678F6395-7CE1-494C-9D7C-B120C9494BD7}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire

"{24CA16CF-FE3C-4A2E-8CF7-A0DC24BCBF5F}"= UDP:c:\windows\System32\lxdicoms.exe:Lexmark Communications System

"{3428B799-92D5-4D53-AAE0-3080BC289BDF}"= TCP:c:\windows\System32\lxdicoms.exe:Lexmark Communications System

"{A832C53C-DFBA-4F7B-B33A-2A61E05719EB}"= UDP:c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe:Lexmark Device Monitor

"{7262FB70-7916-4334-BC20-FD4731B0F4A8}"= TCP:c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe:Lexmark Device Monitor

"{EB68EBF6-E167-4A3F-9852-B157645EF90B}"= UDP:c:\program files\Lexmark 3500-4500 Series\App4R.exe:Lexmark Imaging Studio

"{97D57893-4710-4888-9DBC-F1F239009E2A}"= TCP:c:\program files\Lexmark 3500-4500 Series\App4R.exe:Lexmark Imaging Studio

"{15A30BB8-0F60-48DB-BD5D-25BF4276C8F3}"= UDP:c:\program files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader

"{98DC5ACF-0CC8-4A0F-B734-2E8133026B0E}"= TCP:c:\program files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader

"{9E3A0ABC-5C88-497B-8DDE-CC2DB9E8517E}"= UDP:c:\program files\Lexmark Fax Solutions\FaxCtr.exe:Fax software

"{711D7EB3-8DFA-4F47-B501-97A1EAFFAB46}"= TCP:c:\program files\Lexmark Fax Solutions\FaxCtr.exe:Fax software

"{45E6DB40-D65B-45C2-BE91-947A379711A0}"= UDP:c:\program files\Lexmark 3500-4500 Series\lxdimon.exe:Device Monitor

"{440696EA-76DA-4CDB-BC58-EF11632B8EB7}"= TCP:c:\program files\Lexmark 3500-4500 Series\lxdimon.exe:Device Monitor

"{6788D58A-9270-4020-ACBE-ECBC8D8D97A3}"= UDP:c:\users\rudy\AppData\Local\Temp\lxdi\wireless\FRENCH\lxdiwpss.exe:

"{253B3D98-0F3A-4E56-BE79-7ECAC03816B4}"= TCP:c:\users\rudy\AppData\Local\Temp\lxdi\wireless\FRENCH\lxdiwpss.exe:

"{3F0CC7CF-506E-4074-BF84-996E14FB099C}"= UDP:c:\windows\System32\lxdicfg.exe:Printer Communication System

"{4EBADA2A-887B-43F2-B73F-FF87097BA6F4}"= TCP:c:\windows\System32\lxdicfg.exe:Printer Communication System

"{9DD604D9-76E3-4E47-9BE3-B71851858B22}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxdipswx.exe:Printer Status Window Interface

"{45F7A494-E383-4B91-9CCE-111B83808BEA}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxdipswx.exe:Printer Status Window Interface

"{E9E5450F-83F7-46B4-9ECC-9B4BD6A227BE}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxditime.exe:Lexmark Connect Time Executable

"{A2128822-7118-4926-825E-50656EDF1284}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxditime.exe:Lexmark Connect Time Executable

"{EA7465D0-6E16-4A78-9FAB-9E6B62792475}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxdijswx.exe:Job Status Window Interface

"{9C41408C-428F-489A-8241-9862C753F2D8}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxdijswx.exe:Job Status Window Interface

"{08585AF2-E1C4-4A85-8540-17F78160B22B}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

"{19E13251-A666-4809-9FAA-48A3A2D62546}"= UDP:57852:Pando P2P TCP Listening Port

"{54C6EF82-9D7C-4C12-A369-C36F3C2E30EB}"= TCP:57852:Pando P2P UDP Listening Port

"{766FC062-3753-4314-8B19-6FBCB488B5D5}"= UDP:c:\program files\Lexmark 3500-4500 Series\Wireless\lxdiwpss.exe:

"{8F5C35EF-D65B-46F1-94FB-A98DBD25CBF8}"= TCP:c:\program files\Lexmark 3500-4500 Series\Wireless\lxdiwpss.exe:

"{10932FC8-28F4-4678-80FC-1654416777BC}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{464A6E59-2D98-4882-9E75-DA63CF037B39}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{6DF31066-74D3-4890-8991-97025D013D14}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes

"{E25E42AC-2BB3-40F5-AC41-6FEEB5E85625}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

"TCP Query User{4ED4D992-E935-422B-9ED7-95525B44E86E}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent

"UDP Query User{7F0CC55E-AF08-4100-BE1D-8E568A931303}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent

"{1ED51FB4-B063-45F7-98E2-A50A914276CC}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

"{FBC8B3FB-278B-40E1-9399-DDC82A548732}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

"TCP Query User{D017E4AF-09D1-4843-ADAA-8B8526765AE3}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client

"UDP Query User{6B8476C2-0A07-4EC9-9E64-B10CB2041CB4}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client

"TCP Query User{2A45560F-B477-41A3-B8F5-D5541EF926C9}c:\\program files\\pando networks\\pando\\pando.exe"= UDP:c:\program files\pando networks\pando\pando.exe:pando

"UDP Query User{DA4B3710-A75E-4505-9543-AA250D4B2DF3}c:\\program files\\pando networks\\pando\\pando.exe"= TCP:c:\program files\pando networks\pando\pando.exe:pando

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)

R2 lxdi_device;lxdi_device;c:\windows\system32\lxdicoms.exe -service --> c:\windows\system32\lxdicoms.exe -service [?]

R2 lxdiCATSCustConnectService;lxdiCATSCustConnectService;c:\windows\System32\spool\drivers\w32x86\3\lxdiserv.exe [2007-06-11 99248]

R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkSrv.exe [2007-03-27 24576]

R3 StkCMini;Syntek AVStream USB2.0 VGA WebCam;c:\windows\System32\drivers\StkCMini.sys [2007-03-27 669568]

S2 gupdate1c994591a826add;Service Google Update (gupdate1c994591a826add);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-21 133104]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-03-26 29744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs REG_MULTI_SZ BthServ

.

Contenu du dossier 'Tâches planifiées'

2009-02-23 c:\windows\Tasks\ErrorFix Scan.job

- c:\program files\ErrorFix\ErrorFix.exe []

2009-02-23 c:\windows\Tasks\ErrorFix Scan.job

- c:\program files\ErrorFix []

2009-02-23 c:\windows\Tasks\ErrorFix Startup.job

- c:\program files\ErrorFix\ErrorFix.exe []

2009-02-23 c:\windows\Tasks\Extension de garantie.job

- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2006-11-21 17:38]

2009-02-23 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-21 20:16]

2009-02-23 c:\windows\Tasks\GoogleUpdateTaskMachine.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-21 20:17]

2009-02-22 c:\windows\Tasks\Schedule Task Weekly.job

- c:\program files\Registry Easy\RE.exe []

2009-02-15 c:\windows\Tasks\User_Feed_Synchronization-{760C02A0-AF19-4D52-AB2E-17DFB3AA8D12}.job

- c:\windows\system32\msfeedssync.exe [2008-01-19 08:33]

2009-02-16 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job

- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

.

------- Examen supplémentaire -------

.

uInternet Settings,ProxyOverride = *.local

IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

LSP: c:\windows\system32\wpclsp.dll

DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-23 14:53:30

Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés: 0

**************************************************************************

.

Heure de fin: 2009-02-23 14:55:25

ComboFix-quarantined-files.txt 2009-02-23 13:55:22

Avant-CF: 95.007.916.032 octets libres

Après-CF: 95,055,650,816 octets libres

290 --- E O F --- 2009-02-20 09:11:00

ler si c'est long mais mon pc bloc sans arret voici le rapport combo

rudye · le 23 février 2009

desole d'avoir ete long mais mon pc bloc sans arret voici mon rapport combo ComboFix 09-02-21.01 - rudy 2009-02-23 15:19:50.2 - NTFSx86

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2047.1408 [GMT 1:00]