Sujet Précédent Sujet Suivant

Virus msnmsgrz.exe

Bam -  
pimprenelle27 Messages postés 22182 Statut Contributeur sécurité -
Bonjour,
j ai essayé de suivre le protocole mais enfaite j ai windows xp alors j ai pas pu trouver le désavtiver les comptes d utilisateurs! je sais pas si c est grave... et merci de m aider!
mais voila les données:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:13:56, on 23.02.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TeamViewer3\TeamViewer_Host.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\TeamViewer3\TeamViewer.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\FlashGet\FlashGet.exe
C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Vista Start Menu\VistaStartMenu.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
D:\jeux\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ITE\ITE IT8212 ATA RAID Controller\RaidMgr.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.postarticles.net
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: IeMonitorBho Class - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - E:\MegaIEMn.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [PMCS] C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe -host -clearDebug
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\FlashGet.exe /min
O4 - HKLM\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Windows UDP Control Center] msnmsgrz.exe
O4 - HKLM\..\Run: [Window UDP Control Servic] winlogon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [VistaStartMenu] "C:\Program Files\Vista Start Menu\VistaStartMenu.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [sqyos] c:\documents and settings\tahir\local settings\application data\sqyos.exe sqyos
O4 - HKCU\..\Run: [camsemq] "c:\documents and settings\tahir\local settings\application data\camsemq.exe" camsemq
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\jeux\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [wogskyi] "c:\documents and settings\tahir\local settings\application data\wogskyi.exe" wogskyi
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] E:\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: LimeWire On Startup.lnk = D:\LimeWire\LimeWire.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: RAID Manager.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Tout télécharger avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download Link Using Mega Manager... - E:\mm_file.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=19588
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TeamViewer 3 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer3\TeamViewer_Host.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
A voir également:

7 réponses

Réponse 1 / 7
pimprenelle27 Messages postés 22182 Statut Contributeur sécurité 2 502
 
Bonsoir,

Fait ceci et poste moi le rapport à la suite de la question êtes vous aider par quelqu'un. Merci.

Télécharge GenProc sur ton bureau (Attention le fichier est un fichier zip)
Dézippe le dossier, double-clique sur GenProc.bat
En final, poste le contenu du rapport qui s'affiche.
Comment utiliser GenProc

Pour ceux qui ont vista, ne pas oublier de désactiver Le contrôle des comptes utilisateurs
0
Réponse 2 / 7
Bam
 
bonsoir,
voila j ai utilisé toolbar et navilog1( navilog1 n a pas du tous duré 10 min, pour moi moins de 2 min, est ce normal?) merci de m aider
voila les resultats:

toolbar:

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.40GHz )
BIOS : BIOS Date: 09/27/04 21:48:26 Ver: 08.00.10
USER : Tahir ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1296 [VPS 090224-0] 4.8.1296 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:58 Go (Free:8 Go)
D:\ (Local Disk) - NTFS - Total:79 Go (Free:19 Go)
E:\ (Local Disk) - NTFS - Total:47 Go (Free:34 Go)
F:\ (CD or DVD)
G:\ (CD or DVD)
H:\ (CD or DVD)
I:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 24.02.2009|19:37 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\DOCUME~1\Musta\APPLIC~1\Dealio
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\resFF
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\temp
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\alerts.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\alerts_over.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\alerts_rec.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\alerts_rec_over.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\chevron-small.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\DealioSearch.html
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\deals-leftcap.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\deal_report.jpg
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\ebay_login.jpg
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\err_mainwindow.html
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\err_toolbar.html
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\global_scripts.js
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\headerbgthin.jpg
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\highlight-bg.png
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\logo.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\logo_over.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\man_toolbar.css
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\man_toolbar.html
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\man_toolbar.js
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\man_toolbarl.js
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\post-this-deal.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\post-this-deal_over.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\scripts.js
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\scroller.js
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\search-chevron.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\search-chevron_over.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\search_bg_blink.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\separator.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\settings.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\settings_over.gif
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\res\yahoo-search.png
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\resFF\deal_report.jpg
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\resFF\ebay_login.jpg
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\index.76.35
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.10.76
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.109.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.110.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.12.52
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.13.58
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.130.58
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.135.50
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.153.44
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.155.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.156.49
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.16.60
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.161.52
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.178.66
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.184.55
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.188.52
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.189.45
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.196.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.198.56
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.199.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.200.53
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.201.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.202.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.203.71
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.205.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.213.71
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.214.49
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.215.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.216.67
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.217.67
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.218.52
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.219.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.220.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.221.57
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.222.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.223.68
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.226.68
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.227.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.228.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.229.76
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.23.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.239.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.24.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.240.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.241.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.242.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.243.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.244.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.245.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.247.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.248.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.249.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.250.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.251.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.252.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.253.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.254.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.255.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.256.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.257.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.279.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.28.58
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.282.75
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.283.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.284.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.289.67
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.290.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.291.61
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.296.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.297.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.304.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.307.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.308.75
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.31.47
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.310.46
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.311.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.315.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.316.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.317.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.318.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.319.49
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.32.48
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.334.44
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.335.60
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.336.44
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.337.44
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.338.75
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.339.47
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.34.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.340.47
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.341.47
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.349.50
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.35.48
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.350.50
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.351.51
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.352.54
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.353.51
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.354.51
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.357.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.358.52
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.359.52
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.360.53
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.361.54
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.362.68
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.363.58
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.364.54
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.365.53
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.367.56
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.368.58
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.369.55
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.370.56
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.371.56
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.372.57
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.373.55
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.375.56
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.376.57
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.377.55
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.378.65
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.384.58
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.386.71
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.387.59
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.388.59
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.389.59
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.390.60
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.391.60
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.392.60
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.393.60
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.394.60
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.396.61
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.397.61
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.398.60
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.399.60
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.403.61
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.404.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.405.61
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.406.61
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.407.76
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.408.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.409.61
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.412.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.413.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.414.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.415.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.416.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.417.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.418.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.419.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.420.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.421.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.423.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.424.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.425.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.426.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.427.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.428.65
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.429.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.430.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.432.65
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.433.64
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.434.65
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.435.64
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.436.76
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.437.64
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.438.71
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.439.71
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.440.75
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.442.73
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.443.73
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.444.73
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.445.68
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.446.69
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.450.67
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.451.67
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.452.68
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.453.68
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.454.69
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.456.69
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.457.75
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.458.70
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.459.70
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.460.69
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.462.74
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.463.69
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.464.70
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.465.68
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.468.70
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.469.70
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.470.70
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.471.73
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.472.70
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.478.74
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.479.73
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.480.68
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.481.71
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.482.74
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.49.67
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.50.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.500.71
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.501.74
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.502.71
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.51.69
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.52.72
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.520.76
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.521.76
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.522.76
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.53.51
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.531.76
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.532.75
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.534.75
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.54.47
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.55.45
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.56.69
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.57.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.58.47
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.593.76
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.595.76
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.63.57
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.66.47
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.70.75
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rules\rules.1.71.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\index.3.67.22
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.109.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.178.66
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.198.56
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.245.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.247.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.279.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.283.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.284.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.289.67
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.290.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.297.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.315.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.319.49
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.335.60
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.337.44
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.340.47
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.360.53
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.386.59
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.388.59
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.391.60
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.398.60
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.399.60
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.403.61
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.404.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.405.61
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.406.61
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.407.61
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.408.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.409.61
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.412.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.413.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.414.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.415.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.416.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.417.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.418.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.419.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.420.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.421.62
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.424.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.427.63
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.432.65
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.49.67
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.51.46
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.52.57
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.53.51
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.54.47
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.57.43
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\rulesFF\rules.3.58.47
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\temp\dod_cache.xml
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_3596_2524_1.html
C:\DOCUME~1\Musta\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_3596_2524_3.html
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\CONTENT\searchsettingsplugin.js
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\CONTENT\searchsettingsplugin.xul
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\LOCALE\EN-US\searchsettingsplugin.dtd
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\LOCALE\EN-US\searchsettingsplugin.properties
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\COMPONENTS\SearchSettingsFF.dll
C:\DOCUME~1\Musta\APPLIC~1\Search Settings
C:\DOCUME~1\Musta\APPLIC~1\Search Settings\kb127
C:\DOCUME~1\Musta\APPLIC~1\Search Settings\kb127\res
C:\DOCUME~1\Musta\APPLIC~1\Search Settings\kb127\temp
C:\DOCUME~1\Musta\APPLIC~1\Search Settings\kb127\temp\ws-14287.log
C:\DOCUME~1\Tahir\APPLIC~1\Search Settings
C:\DOCUME~1\Tahir\APPLIC~1\Search Settings\kb127
C:\DOCUME~1\Tahir\APPLIC~1\Search Settings\kb127\res
C:\DOCUME~1\Tahir\APPLIC~1\Search Settings\kb127\temp
C:\DOCUME~1\Tahir\APPLIC~1\Search Settings\kb127\temp\ws-14296.log
C:\DOCUME~1\Tahir\APPLIC~1\Search Settings\kb127\temp\ws-14297.log
C:\DOCUME~1\Tahir\APPLIC~1\Search Settings\kb127\temp\ws-14298.log
C:\DOCUME~1\Tahir\APPLIC~1\Search Settings\kb127\temp\ws-14299.log
C:\Program Files\Search Settings
C:\Program Files\Search Settings\kb127
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Search Settings\kb127\res
C:\Program Files\Search Settings\kb127\SearchSettings.dll
C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
C:\Program Files\Search Settings\kb127\temp
C:\WINDOWS\iun6002.exe

-----------\\ Extensions

(Musta) - {1650a312-02bc-40ee-977e-83f158701739} => safe
(Musta) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

(Tahir) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(Tahir) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
(Tahir) - {991A772A-BA13-4c1d-A9EF-F897F31DEC7D} => megaupload

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.ch/?gws_rd=ssl"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Local Page"="https://www.msn.com/fr-fr/"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"

--------------------\\ Recherche d'autres infections

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sqyos"="c:\\documents and settings\\tahir\\local settings\\application data\\sqyos.exe sqyos"

C:\DOCUME~1\Tahir\LOCALS~1\APPLIC~1\cuyye_navfx.dat
C:\DOCUME~1\Tahir\LOCALS~1\APPLIC~1\vlulbj_navfx.dat
[b]==> EGDACCESS <==/b

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Tahir\Desktop\jeuxx\Crack
C:\DOCUME~1\Tahir\Desktop\jeuxx\Crack\AssassinsCreed_Dx10.exe
C:\DOCUME~1\Tahir\Desktop\jeuxx\Crack\AssassinsCreed_Dx9.exe
C:\DOCUME~1\Tahir\Favorites\tahir\Game KeyGenerators.url

1 - "C:\ToolBar SD\TB_1.txt" - 24.02.2009|19:38 - Option : [1]

-----------\\ Fin du rapport a 19:38:04.67

et voila navilog1

Search Navipromo version 3.7.4 commencé le 24.02.2009 à 19:40:39.85

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 16.02.2009 à 18h00 par IL-MAFIOSO

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.40GHz )
BIOS : BIOS Date: 09/27/04 21:48:26 Ver: 08.00.10
USER : Tahir ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1296 [VPS 090224-0] 4.8.1296 (Activated)

A:\ (USB)
C:\ (Local Disk) - NTFS - Total:58 Go (Free:8 Go)
D:\ (Local Disk) - NTFS - Total:79 Go (Free:19 Go)
E:\ (Local Disk) - NTFS - Total:47 Go (Free:34 Go)
F:\ (CD or DVD)
G:\ (CD or DVD)
H:\ (CD or DVD)
I:\ (CD or DVD)

Recherche executé en mode normal

*** Recherche Programmes installés ***

Favorit
Favorit

*** Recherche dossiers dans "C:\WINDOWS" ***

*** Recherche dossiers dans "C:\Program Files" ***

*** Recherche dossiers dans "C:\Documents and Settings\All Users\startm~1\programs" ***

*** Recherche dossiers dans "C:\Documents and Settings\All Users\startm~1" ***

*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Tahir\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\admin\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\Musta\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\Secir\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Tahir\locals~1\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\admin\locals~1\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\Musta\locals~1\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\Secir\locals~1\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Tahir\startm~1\programs" ***

*** Recherche dossiers dans "C:\DOCUME~1\admin\startm~1\programs" ***

*** Recherche dossiers dans "C:\DOCUME~1\Musta\startm~1\programs" ***

*** Recherche dossiers dans "C:\DOCUME~1\Secir\startm~1\programs" ***

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Tahir\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\admin\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\Musta\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\Secir\locals~1\applic~1" *

*** Recherche fichiers ***

*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!

HKEY_CURRENT_USER\Software\Lanconfig

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sqyos"="c:\\documents and settings\\tahir\\local settings\\application data\\sqyos.exe sqyos"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"camsemq"="\"c:\\documents and settings\\tahir\\local settings\\application data\\camsemq.exe\" camsemq"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wogskyi"="\"c:\\documents and settings\\tahir\\local settings\\application data\\wogskyi.exe\" wogskyi"

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :

2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :

* Dans "C:\Documents and Settings\Tahir\locals~1\applic~1" :

cuyye_navfx.dat trouvé !
vlulbj_navfx.dat trouvé !

* Dans "C:\DOCUME~1\admin\locals~1\applic~1" :

* Dans "C:\DOCUME~1\Musta\locals~1\applic~1" :

* Dans "C:\DOCUME~1\Secir\locals~1\applic~1" :

3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :

*** Analyse terminée le 24.02.2009 à 19:41:20.00 ***
0
Réponse 3 / 7
pimprenelle27 Messages postés 22182 Statut Contributeur sécurité 2 502
 
Je pourrais avoir quand même le rapport genproc merci.
0
Réponse 4 / 7
Bam
 
voila le rapport genproc:

Rapport GenProc 2.385 [2] - 24.02.2009 à 18:48:07.20 - Windows XP

# Etape 1/ Télécharge :

- Navilog1 http://il.mafioso.pagesperso-orange.fr/Navifix/Navilog1.exe (IL-MAFIOSO) sur ton Bureau.
Double clique sur navilog1.exe pour lancer l'installation. Une fois l'installation terminée, le fix s'exécutera automatiquement
(si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau). Laisse-toi guider. Au menu principal, choisis 1 et valide.
Patiente jusqu'au message " Analyse Termine le .....". Appuie sur une touche comme demandé, le blocnote va s'ouvrir, poste-le maintenant et passe à la suite.

- Toolbar-S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 (Team IDN) sur ton Bureau.

- MSNFix http://sosvirus.changelog.fr/MSNFix.zip (!aur3n7) et décompresse-le sur le Bureau.

Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/ ; pour retrouver le rapport, clique sur le raccourci "GenProc" sur ton bureau. Choisis ta session courante *** Tahir ***

# Etape 2/

Double clique sur le raccourci Navilog1, choisis l'option 2 et valide, patiente jusqu'au message : *** Nettoyage Termine le ..... ***
le blocnote va s'ouvrir ; sauvegarde le rapport de manière à le retrouver, referme le blocnote. Ton bureau va réapparaitre

# Etape 3/

Lance Toolbar-S&D situé sur le Bureau.
Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenêtre lors de la suppression.

# Etape 4/

Lance le fichier MSNFix.bat qui se trouve dans le dossier MSNfix, sur le bureau.
- Exécute l'option R.
- Si l'infection est détectée, exécute l'option N.
- Sauvegarde ce rapport sur ton bureau.

# Etape 5/

Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 6/

Redémarre normalement et poste, dans la même réponse :

- Le contenu du fichier cleannavi.txt qui se trouve dans Poste de travail > Disque C:\
- Le contenu du rapport MSNfix situé sur le Bureau ;
- Le contenu du rapport C:\TB.txt ;
- Un nouveau rapport HijackThis http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ;

Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

____________________________________________________________________________________________________________

Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 7
pimprenelle27 Messages postés 22182 Statut Contributeur sécurité 2 502
 
Donc tu peux suivre ce rapport en me postan les rapports à chaque logiciels fait. Merci.
0
Réponse 6 / 7
BAm
 
enfaite si j ai bien compri je suis les étapes de genproc?
0
Réponse 7 / 7
pimprenelle27 Messages postés 22182 Statut Contributeur sécurité 2 502
 
oui ensuite il y aura d'autre choses à faire.
0

Discussions similaires

Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses
virus Artemis!
mabiche37 -
Malekal_morte- -

14 réponses
Message Apple virus !!
Souclik67 -
MPMP10 -

3 réponses