Virus bagle comment s'en débarrasser???

bonjour ,merci pour ton aide,
je viens de le faire,je joint le rapport .
############################## [ FindyKill V4.718 ]

# User : Benoit (Administrateurs) # TEST-Q91SJ19OTC
# Update on 01/03/09
# Start at: 17:27:28 | 02/03/2009

# AMD Sempron(tm) Processor LE-1150
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Disabled

# C:\ # Disque fixe local # 37,27 Go (14,71 Go free) # NTFS
# D:\ # Disque CD-ROM

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\common\win32\PythonService.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\CONTRO~1\bin\optgui.exe
C:\Program Files\Hotbar\bin\10.2.236.0\OEAddOn.exe
C:\Program Files\Hotbar\bin\10.2.236.0\HotbarSA.exe
C:\Program Files\EoRezo\EoEngine.exe
C:\Documents and Settings\Francis\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
C:\Program Files\Hotbar\bin\10.2.236.0\Weather.exe
C:\documents and settings\francis\local settings\application data\mqgesuu.exe
C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\WINDOWS\system32\wintems.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Francis\Application Data\m\flec006.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Hotbar\bin\10.2.236.0\Srv.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

################## [ Processus infectieux stoppés ]

"C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe" (2164)
"C:\WINDOWS\system32\wintems.exe" (2356)
"C:\Documents and Settings\Francis\Application Data\m\flec006.exe" (1388)

################## [ Fichiers / Dossiers infectieux C:\ ]

Found ! - C:\InfoSat.txt

################## [ C:\WINDOWS ]


################## [ C:\WINDOWS\system32 ]

Found ! - C:\WINDOWS\system32\mdelk.exe
Found ! - C:\WINDOWS\system32\wintems.exe
Found ! - C:\WINDOWS\system32\ban_list.txt

################## [ C:\WINDOWS\system32\drivers ]


################## [ C:\.. Application Data ... ]

Found ! - "C:\Documents and Settings\Francis\Application Data\m\flec006.exe"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\list.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\data.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\srvlist.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\shared"
Found ! - "C:\Documents and Settings\Francis\Application Data\m"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\srosa2.sys"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\wfsintwq.sys"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\downld"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\flec006.exe"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\list.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\data.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\srvlist.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\shared"
Found ! - "C:\Documents and Settings\Francis\Application Data\m"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\srosa2.sys"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\wfsintwq.sys"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\downld"

################## [ Registre / Clés infectieuses ]

Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

# Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
# Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

################## [ Recherche dans supports amovibles]

# Presence des fichiers :


################## [ Registre / Mountpoint2 ]

# -> Not found !

################## [ ! Fin du rapport # FindyKill V4.718 ! ]

bonjour ,
j'ai fait ce que tu m'as dis ,je joint le rapport , je l'ai deja envoyé j'ai un doute ,je crois qu'il n'ai pas arrivé a destination.merci
############################## [ FindyKill V4.718 ]

# User : Benoit (Administrateurs) # TEST-Q91SJ19OTC
# Update on 01/03/09
# Start at: 17:27:28 | 02/03/2009

# AMD Sempron(tm) Processor LE-1150
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Disabled

# C:\ # Disque fixe local # 37,27 Go (14,71 Go free) # NTFS
# D:\ # Disque CD-ROM

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\common\win32\PythonService.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\CONTRO~1\bin\optgui.exe
C:\Program Files\Hotbar\bin\10.2.236.0\OEAddOn.exe
C:\Program Files\Hotbar\bin\10.2.236.0\HotbarSA.exe
C:\Program Files\EoRezo\EoEngine.exe
C:\Documents and Settings\Francis\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
C:\Program Files\Hotbar\bin\10.2.236.0\Weather.exe
C:\documents and settings\francis\local settings\application data\mqgesuu.exe
C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\WINDOWS\system32\wintems.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OrangeH
############################## [ FindyKill V4.718 ]

# User : Benoit (Administrateurs) # TEST-Q91SJ19OTC
# Update on 01/03/09
# Start at: 17:27:28 | 02/03/2009

# AMD Sempron(tm) Processor LE-1150
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Disabled

# C:\ # Disque fixe local # 37,27 Go (14,71 Go free) # NTFS
# D:\ # Disque CD-ROM

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\common\win32\PythonService.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\CONTRO~1\bin\optgui.exe
C:\Program Files\Hotbar\bin\10.2.236.0\OEAddOn.exe
C:\Program Files\Hotbar\bin\10.2.236.0\HotbarSA.exe
C:\Program Files\EoRezo\EoEngine.exe
C:\Documents and Settings\Francis\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
C:\Program Files\Hotbar\bin\10.2.236.0\Weather.exe
C:\documents and settings\francis\local settings\application data\mqgesuu.exe
C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\WINDOWS\system32\wintems.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Francis\Application Data\m\flec006.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Hotbar\bin\10.2.236.0\Srv.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

################## [ Processus infectieux stoppés ]

"C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe" (2164)
"C:\WINDOWS\system32\wintems.exe" (2356)
"C:\Documents and Settings\Francis\Application Data\m\flec006.exe" (1388)

################## [ Fichiers / Dossiers infectieux C:\ ]

Found ! - C:\InfoSat.txt

################## [ C:\WINDOWS ]


################## [ C:\WINDOWS\system32 ]

Found ! - C:\WINDOWS\system32\mdelk.exe
Found ! - C:\WINDOWS\system32\wintems.exe
Found ! - C:\WINDOWS\system32\ban_list.txt

################## [ C:\WINDOWS\system32\drivers ]


################## [ C:\.. Application Data ... ]

Found ! - "C:\Documents and Settings\Francis\Application Data\m\flec006.exe"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\list.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\data.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\srvlist.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\shared"
Found ! - "C:\Documents and Settings\Francis\Application Data\m"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\srosa2.sys"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\wfsintwq.sys"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\downld"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\flec006.exe"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\list.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\data.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\srvlist.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\shared"
Found ! - "C:\Documents and Settings\Francis\Application Data\m"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\srosa2.sys"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\wfsintwq.sys"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\downld"

################## [ Registre / Clés infectieuses ]

Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

# Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
# Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

################## [ Recherche dans supports amovibles]

# Presence des fichiers :


################## [ Registre / Mountpoint2 ]

# -> Not found !

################## [ ! Fin du rapport # FindyKill V4.718 ! ]

SS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Francis\Application Data\m\flec006.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Hotbar\bin\10.2.236.0\Srv.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

################## [ Processus infectieux stoppés ]

"C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe" (2164)
"C:\WINDOWS\system32\wintems.exe" (2356)
"C:\Documents and Settings\Francis\Application Data\m\flec006.exe" (1388)

################## [ Fichiers / Dossiers infectieux C:\ ]

Found ! - C:\InfoSat.txt

################## [ C:\WINDOWS ]


################## [ C:\WINDOWS\system32 ]

Found ! - C:\WINDOWS\system32\mdelk.exe
Found ! - C:\WINDOWS\system32\wintems.exe
Found ! - C:\WINDOWS\system32\ban_list.txt

################## [ C:\WINDOWS\system32\drivers ]


################## [ C:\.. Application Data ... ]

Found ! - "C:\Documents and Settings\Francis\Application Data\m\flec006.exe"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\list.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\data.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\srvlist.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\shared"
Found ! - "C:\Documents and Settings\Francis\Application Data\m"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\srosa2.sys"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\wfsintwq.sys"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\downld"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\flec006.exe"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\list.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\data.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\srvlist.oct"
Found ! - "C:\Documents and Settings\Francis\Application Data\m\shared"
Found ! - "C:\Documents and Settings\Francis\Application Data\m"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\srosa2.sys"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\wfsintwq.sys"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe"
Found ! - "C:\Documents and Settings\Francis\Application Data\drivers\downld"

################## [ Registre / Clés infectieuses ]

Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"
Found ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

# Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
# Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

################## [ Recherche dans supports amovibles]

# Presence des fichiers :


################## [ Registre / Mountpoint2 ]

# -> Not found !

################## [ ! Fin du rapport # FindyKill V4.718 ! ]

bonjour,
j'ai eu un gros probleme avec l'ordi cela fait depuis 13h que j'essaie d'aller sur le forum mais l'ordi ne voulait pas ouvrir la page .JE n'ai pas de sources de données externe, donc j'ai fait comme vous m'avez indiqué ,je vous joint le rapport: et encore merci pour votre aide .
############################## [ FindyKill V4.718 ]

# User : Benoit (Administrateurs) # TEST-Q91SJ19OTC
# Update on 01/03/09
# Start at: 12:47:30 | 03/03/2009

# AMD Sempron(tm) Processor LE-1150
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Disabled

# C:\ # Disque fixe local # 37,27 Go (15,01 Go free) # NTFS
# D:\ # Disque CD-ROM

############################## [ Active Processes ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\common\win32\PythonService.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\CONTRO~1\bin\optgui.exe
C:\Program Files\Hotbar\bin\10.2.236.0\OEAddOn.exe
C:\Program Files\Hotbar\bin\10.2.236.0\HotbarSA.exe
C:\Program Files\EoRezo\EoEngine.exe
C:\Documents and Settings\Francis\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
C:\Program Files\Hotbar\bin\10.2.236.0\Weather.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\documents and settings\francis\local settings\application data\mqgesuu.exe
C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe
C:\WINDOWS\system32\wintems.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Documents and Settings\Francis\Application Data\drivers\downld\204171.exe
C:\Documents and Settings\Francis\Application Data\m\flec006.exe

################## [ Infected processes stopped ]

"C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe" (1536)
"C:\WINDOWS\system32\wintems.exe" (2100)

################## [ Infected Files / Folders C:\

bonsoir,
il n'y avait que ça comme rapport, je vais refaire l'opération de suite ,et vous envoyer le rapport.merci

bonsoir, voila enfin ce rapport ,j'espére qu'il est complet maintenant.merci
############################## [ FindyKill V4.718 ]

# User : Benoit (Administrateurs) # TEST-Q91SJ19OTC
# Update on 01/03/09
# Start at: 18:25:57 | 03/03/2009

# AMD Sempron(tm) Processor LE-1150
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Disabled

# C:\ # Disque fixe local # 37,27 Go (14,97 Go free) # NTFS
# D:\ # Disque CD-ROM

############################## [ Active Processes ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\common\win32\PythonService.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\CONTRO~1\bin\optgui.exe
C:\Program Files\Hotbar\bin\10.2.236.0\OEAddOn.exe
C:\Program Files\Hotbar\bin\10.2.236.0\HotbarSA.exe
C:\Program Files\EoRezo\EoEngine.exe
C:\Documents and Settings\Francis\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
C:\Program Files\Hotbar\bin\10.2.236.0\Weather.exe
C:\documents and settings\francis\local settings\application data\mqgesuu.exe
C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe
C:\Documents and Settings\Francis\Application Data\hidires\flec003.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Documents and Settings\Francis\Application Data\m\flec006.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Francis\Application Data\drivers\downld\342375.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wintems.exe

################## [ Infected processes stopped ]

"C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe" (1208)
"C:\Documents and Settings\Francis\Application Data\hidires\flec003.exe" (1996)
"C:\Documents and Settings\Francis\Application Data\m\flec006.exe" (200)
"C:\Documents and Settings\Francis\Application Data\drivers\downld\342375.exe" (1204)
"C:\WINDOWS\system32\wintems.exe" (2468)

################## [ Infected Files / Folders C:\ ]


################## [ C:\WINDOWS ]


################## [ C:\WINDOWS\system32 ]

Deleted ! - C:\WINDOWS\system32\mdelk.exe
Deleted ! - C:\WINDOWS\system32\wintems.exe
Deleted ! - C:\WINDOWS\system32\ban_list.txt

################## [ C:\WINDOWS\system32\drivers ]


################## [ C:\.. Application Data ... ]

Deleted ! - "C:\Documents and Settings\Francis\Application Data\m\flec006.exe"
Deleted ! - "C:\Documents and Settings\Francis\Application Data\m\list.oct"
Deleted ! - "C:\Documents and Settings\Francis\Application Data\m\data.oct"
Deleted ! - "C:\Documents and Settings\Francis\Application Data\m\srvlist.oct"
Deleted ! - "C:\Documents and Settings\Francis\Application Data\m\shared"
Deleted ! - "C:\Documents and Settings\Francis\Application Data\m"
Deleted ! - "C:\Documents and Settings\Francis\Application Data\hidires\flec003.exe"
Deleted ! - "C:\Documents and Settings\Francis\Application Data\hidires"
Deleted ! - "C:\Documents and Settings\Francis\Application Data\drivers\srosa2.sys"
Deleted ! - "C:\Documents and Settings\Francis\Application Data\drivers\wfsintwq.sys"
Deleted ! - "C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe"
Deleted ! - "C:\Documents and Settings\Francis\Application Data\drivers\downld"
Deleted ! - "C:\Documents and Settings\Francis\Application Data\drivers"

################## [ Registry / Infected keys ]

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_CURRENT_USER\Software\bisoft
Deleted ! - HKEY_CURRENT_USER\Software\DateTime4
Deleted ! - HKEY_CURRENT_USER\Software\FirtR
Deleted ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Deleted ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\FFC
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Deleted ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Deleted ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"
Deleted ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"flec003.exe"
Deleted ! - HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"flec003.exe"

################## [ Cleaning Removable drives ]

# Deleting files :


################## [ Registry / Mountpoint2 ]

# -> Not found !

################## [ Searching Other Infections ]

# Références de comparaison Bagle MD5 :

bb6c9c21 C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe
6578d3c880f067cfba0e33344ba9b271 C:\Documents and Settings\Francis\Application Data\drivers\winupgro.exe

Suspect ! "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
# Taille : 860160 # MD5 : 6578D3C880F067CFBA0E33344BA9B271


################## [ PEH Corrupted ]

C:\16aa81e409b7dfc220d9b3c0df6495\update\update.exe
C:\VIRUSfighter\Bin\Zanda.exe
C:\VIRUSfighter\Bin\Zlh.exe
C:\WINDOWS\$hf_mig$\KB898461\update\update.exe
C:\WINDOWS\$hf_mig$\KB938127-v2-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB946648\update\update.exe
C:\WINDOWS\$hf_mig$\KB950762\update\update.exe
C:\WINDOWS\$hf_mig$\KB950974\update\update.exe
C:\WINDOWS\$hf_mig$\KB951066\update\update.exe
C:\WINDOWS\$hf_mig$\KB951072-v2\update\update.exe
C:\WINDOWS\$hf_mig$\KB951376-v2\update\update.exe
C:\WINDOWS\$hf_mig$\KB951698\update\update.exe
C:\WINDOWS\$hf_mig$\KB951748\update\update.exe
C:\WINDOWS\$hf_mig$\KB951978\update\update.exe
C:\WINDOWS\$hf_mig$\KB952287\update\update.exe
C:\WINDOWS\$hf_mig$\KB952954\update\update.exe
C:\WINDOWS\$hf_mig$\KB953838-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB954211\update\update.exe
C:\WINDOWS\$hf_mig$\KB954459\update\update.exe
C:\WINDOWS\$hf_mig$\KB954600\update\update.exe
C:\WINDOWS\$hf_mig$\KB955069\update\update.exe
C:\WINDOWS\$hf_mig$\KB955839\update\update.exe
C:\WINDOWS\$hf_mig$\KB956390\update\update.exe
C:\WINDOWS\$hf_mig$\KB956390-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB956391\update\update.exe
C:\WINDOWS\$hf_mig$\KB956802\update\update.exe
C:\WINDOWS\$hf_mig$\KB956803\update\update.exe
C:\WINDOWS\$hf_mig$\KB956841\update\update.exe
C:\WINDOWS\$hf_mig$\KB957095\update\update.exe
C:\WINDOWS\$hf_mig$\KB957097\update\update.exe
C:\WINDOWS\$hf_mig$\KB958215-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB958644\update\update.exe
C:\WINDOWS\$hf_mig$\KB958687\update\update.exe
C:\WINDOWS\$hf_mig$\KB960714-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB960715\update\update.exe
C:\WINDOWS\$hf_mig$\KB961260-IE7\update\update.exe
C:\WINDOWS\$NtServicePackUninstall$\sysinfo.exe
C:\WINDOWS\ServicePackFiles\i386\sysinfo.exe
C:\WINDOWS\SoftwareDistribution\Download\848074f054596c97d2468deeb41d6ba1\update\update.exe
C:\WINDOWS\SoftwareDistribution\Download\a37a907ce729d9b027006f974e62dcad\update\update.exe
C:\WINDOWS\system32\dllcache\register.exe

################## [ ! End of Report # FindyKill V4.718 ! ]

bonsoir,
voici le nouveau résultat.merci pour votre patience .poSuomi | ihMdI | | עברית | | Slovenščina | Dansk | Русский | Română | Türkçe | Nederlands | Ελληνικά | Svenska | Português | Italiano | | | Magyar | Deutsch | Česky | Polski | Español | English
Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...
Fichier NBJ.exe reçu le 2009.03.03 08:06:07 (CET)
Situation actuelle: terminé

Résultat: 26/36 (72.22%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
AntiVir - - TR/Dldr.Bagle.ant
Authentium - - W32/Heuristic-210!Eldorado
Avast - - Win32:Trojan-gen {Other}
AVG - - Win32/Themida
BitDefender - - DeepScan:Generic.Bagle.8F7DE051
CAT-QuickHeal - - (Suspicious) - DNAScan
ClamAV - - -
Comodo - - -
DrWeb - - Trojan.Packed.650
eSafe - - -
eTrust-Vet - - -
F-Prot - - W32/Heuristic-210!Eldorado
F-Secure - - Trojan-Downloader.Win32.Bagle.ant
Fortinet - - -
GData - - DeepScan:Generic.Bagle.8F7DE051
Ikarus - - Gen.Packer
K7AntiVirus - - -
Kaspersky - - Trojan-Downloader.Win32.Bagle.ant
McAfee - - New Malware.jn
McAfee+Artemis - - New Malware.jn
Microsoft - - -
NOD32 - - Win32/Bagle.QT
Norman - - W32/Mitglied.BKE
Panda - - W32/Bagle.KV.worm
PCTools - - -
Prevx1 - - High Risk Worm
Rising - - Trojan.Win32.Nodef.dsg
SecureWeb-Gateway - - Trojan.Dldr.Bagle.ant
Sophos - - Mal/Generic-A
Sunbelt - - -
Symantec - - Trojan Horse
TheHacker - - W32/Behav-Heuristic-064
TrendMicro - - -
VBA32 - - Trojan-Downloader.Win32.Bagle.ant
ViRobot - - Spyware.Bagle.Do.860160.D
VirusBuster - - Trojan.DL.Bagle.AAOC
Information additionnelle
MD5: 6578d3c880f067cfba0e33344ba9b271
SHA1: 9e705392daee103ed10e4602cfe4e01f38ff6d6d
SHA256: 5588b907c83420a81c1a11b8bf0cfeddc27986e927926036e20151ce222abd41
SHA512: ef6373e8a073ba5fcc9a1c7e17854a113173f40bdb6c0d70cd330bdce41675d094ad6ece43424bdc64800552d2b898fd96bf8e49075f8c2cc0c5f89d58e80d0b


ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy ur votre patience ,et vos conseils.

Bonjour ,
voici le premier rapport de random's system.Logfile of random's system information tool 1.05 (written by random/random)
Run by Benoit at 2009-03-04 16:47:22
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 16 GB (41%) free of 38 GB
Total RAM: 959 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:47:43, on 04/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\common\win32\PythonService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\CONTRO~1\bin\optgui.exe
C:\Program Files\Hotbar\bin\10.2.236.0\OEAddOn.exe
C:\Program Files\Hotbar\bin\10.2.236.0\HotbarSA.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\Program Files\EoRezo\EoEngine.exe
C:\Documents and Settings\Francis\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
C:\Program Files\Hotbar\bin\10.2.236.0\Weather.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\documents and settings\francis\local settings\application data\mqgesuu.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Hotbar\bin\10.2.236.0\Srv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Francis\Bureau\RSIT.exe
C:\Program Files\trend micro\Benoit.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail?kw=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\AGI\common\agcutils.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\AGI\common\agcutils.dll
O2 - BHO: Smart-Shopper - {4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E} - C:\Program Files\Smart-Shopper\Bin\2.5.1\Smrt-Shpr.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeIEToolbar.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Hotbar - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Hotbar\bin\10.2.236.0\HostIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: livetvbar Toolbar - {ad55c869-668e-457c-b270-0cfb2f61116f} - C:\Program Files\livetvbar\tbliv1.dll
O2 - BHO: EoBHO - {C7B76B90-3455-4AE6-A752-EAC4D19689E5} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeIEToolbar.dll
O3 - Toolbar: Hotbar - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Hotbar\bin\10.2.236.0\HostIE.dll
O3 - Toolbar: livetvbar Toolbar - {ad55c869-668e-457c-b270-0cfb2f61116f} - C:\Program Files\livetvbar\tbliv1.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [OPTENET_GUI] C:\PROGRA~1\CONTRO~1\bin\optgui.exe
O4 - HKLM\..\Run: [KiweeHook] "C:\Program Files\Kiwee Toolbar\2.9.168\kwtbaim.exe"
O4 - HKLM\..\Run: [HotbarOE] C:\Program Files\Hotbar\bin\10.2.236.0\OEAddOn.exe
O4 - HKLM\..\Run: [HotbarSA] "C:\Program Files\Hotbar\bin\10.2.236.0\HotbarSA.exe"
O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"
O4 - HKLM\..\Run: [SoftwareHelper] C:\Documents and Settings\Francis\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [msnlivesearch] C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe /Run
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WeatherDPA] "C:\Program Files\Hotbar\bin\10.2.236.0\Weather.exe" -auto
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKCU\..\Run: [mqgesuu] "c:\documents and settings\francis\local settings\application data\mqgesuu.exe" mqgesuu
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103470 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SIMBAR={F7FFBCF7-8DAD-47EF-9D9C-343C607C5A94}; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; Embedded Web Browser from: http://bsalsa.com/; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; Hotbar 10.2.236.0)" -"http://www.funlabo.com/voiture/jeu-de-voiture.htm"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\Smart-Shopper\Bin\2.5.1\Smrt-Shpr.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\Smart-Shopper\Bin\2.5.1\Smrt-Shpr.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C68F9105-04FD-4B48-B6CC-2A076F711C35} (HpodPCFileCtrl2 Class) - file://D:\MEMDISC\ALBUM_A\VIEW\PLUGIN\HPODPCFC.CAB
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Orange Contrôle Parental (OPTENET_FILTER) - Orange - C:\Program Files\Controle Parental\bin\optproxy.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

ci joint le deuxieme. merci


info.txt logfile of random's system information tool 1.05 2009-03-04 16:47:45

======Uninstall list======

-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNNMP.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.0 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81000000003}
Adobe Shockwave Player-->C:\WINDOWS\system32\Adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
AnumanLive-->"C:\Documents and Settings\Francis\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe" /UNINSTALL
Architecture d'intérieur 3D-->"C:\Program Files\Anuman Interactive\Architecture d'interieur 3D\unins000.exe"
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Contrôle Parental-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{93094D10-9388-11D4-9886-0000B43F396D}\Setup.exe" -l0x40c
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
CyberSky-->C:\PROGRA~1\CyberSky\UNWISE.EXE C:\PROGRA~1\CyberSky\INSTALL.LOG
Dairy Dash Deluxe-->"C:\Program Files\Zylom Games\Dairy Dash Deluxe\GameInstlr.exe" --uninstall UnInstall.log
Dis-moi Adi CM2-->C:\WINDOWS\unvise32.exe C:\Program Files\Coktel\Dis-moi Adi\CM2\uninstal.log
DJ FACILE 1.2.0.4-->"C:\adj\unins000.exe"
DWGdirectX 2.5-->MsiExec.exe /I{98929AD0-0DE4-4BC9-B28F-C7B352450955}
eMule-->"C:\Program Files\eMule\Uninstall.exe"
eoEngine 9.1-->"C:\Program Files\EoRezo\unins000.exe"
Extension de Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{0CA6047C-D28B-4295-834A-07C52BA20C2D}
Favorit-->"c:\documents and settings\francis\local settings\application data\mqgesuu.exe" -uninstall
FindyKill-->C:\Program Files\FindyKill\Uninstal.exe
FlightGear v1.0.0-->"C:\Program Files\FlightGear\unins000.exe"
Galerie de photos Windows Live-->MsiExec.exe /X{44E54A81-9D91-4AA1-9417-80AFF134F5FF}
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotbar-->"C:\Program Files\Hotbar\bin\10.2.236.0\HotbarUninstaller.exe" Web
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
HP Image Zone 3.5-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP PSC & OfficeJet 3.5-->"C:\Program Files\HP\Digital Imaging\{0FABD3D7-3036-4e78-B29D-58957ADB0A12}\setup\hpzscr01.exe" -datfile hposcr03.dat
HP Software Update-->MsiExec.exe /X{34957B51-9676-41CE-9E52-44AE91B73F1C}
IncrediMail-->C:\Program Files\IncrediMail\bin\ImSetup.exe /remove /addon:IncrediMail /log:IncMail.log
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
InternetGameBox -->C:\Program Files\InternetGameBox\uninst.exe
Junk Mail filter update-->MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}
Kaspersky Online Scanner-->C:\WINDOWS\system32\KASPER~1\KASPER~1\kavuninstall.exe
Kaspersky On-line Scanner-->C:\WINDOWS\system32\KASPER~1\KASPER~1\kavuninstall.exe
Kiwee Toolbar-->"C:\Program Files\AGI\common\bootstrapper.exe" -uninstall"\"C:/Program Files/AGI/Python25\pythonw.exe\" \"C:\Program Files\AGI\common\pyagcore\installer.pyc\" -u KiweeToolbar"
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LIVETV4PC-->"C:\WINDOWS\unins000.exe"
livetvbar Toolbar-->C:\PROGRA~1\LIVETV~1\UNWISE.EXE C:\PROGRA~1\LIVETV~1\INSTALL.LOG
Macromedia Flash Player 8-->MsiExec.exe /X{6815FCDD-401D-481E-BA88-31B4754C2B46}
Memories Disc Creator 2.0-->MsiExec.exe /X{2E132061-C78A-48D4-A899-1D13B9D189FA}
Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
Micro Application - Etiquettes CD-DVD Edition Classic-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D712874A-B387-4B99-9172-F42E157A82E5}\SETUP.EXE" -l0x40c
Micro Application - Scrapbook Edition Classic-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{22AAD611-8859-4E20-9010-283B32106EC3}\Setup.exe" -l0x40c
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Live Add-in 1.3-->MsiExec.exe /I{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}
Microsoft Office Outlook Connector-->MsiExec.exe /I{95120000-0120-040C-0000-0000000FF1CE}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Search Enhancement Pack-->MsiExec.exe /I{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Monopoly Deluxe-->"C:\Program Files\Zylom Games\Monopoly Deluxe\GameInstlr.exe" --uninstall UnInstall.log
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Nero Suite-->C:\Program Files\Fichiers communs\Ahead\Uninstall\setup.exe /uninstall
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
Orange - Logiciels Internet-->C:\Program Files\OrangeHSS\installation\core\Installgui.exe -u
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
QuickTime-->C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m -nrg2709
Riding Star-->MsiExec.exe /I{F79D122F-A2EF-4D9D-93FB-CA8ECF931AB8}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Simulateur de conduite 3D Demo-->"C:\program files\Simulateur de conduite 3D Demo\uninstall.exe"
SmartShopper-->C:\Program Files\Smart-Shopper\Uninst.exe
SoftwareUpdate 1.0-->"C:\Documents and Settings\Francis\Application Data\eoRezo\SoftwareUpdate\unins000.exe"
Spyware-Secure -->C:\Documents and Settings\Francis\Mes documents\Spyware-Secure\uninst.exe
Surligneur (Windows Live Toolbar)-->MsiExec.exe /X{81B5F83F-2291-48B0-8375-36B63A9BF5B0}
SweetIM for Messenger 2.6-->MsiExec.exe /X{A1E4213E-06AD-4C58-8315-92F11531D960}
SweetIM Toolbar for Internet Explorer 3.3-->MsiExec.exe /X{266C7330-C0F4-49E5-8F20-A56F9F822875}
Uninstall Léa passion vétérinaire-->"C:\Program Files\Braingame\Léa passion vétérinaire\unins000.exe"
VIRUSfighter-->C:\VIRUSfighter\NVC\BIN\DelNVC5.exe
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Contrôle parental-->MsiExec.exe /X{D6A2DDE3-9D7C-412C-932A-756580D29919}
Windows Live Favorites pour Windows Live Toolbar-->MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
Windows Live Mail-->MsiExec.exe /I{63DC2DA0-2A6C-4C38-9249-B75395458657}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT
Windows Live Sync-->MsiExec.exe /X{9C5EB781-0D37-44B8-9A58-77B3E4BF5F5E}
Windows Live Toolbar-->MsiExec.exe /X{F7D27C70-90F5-49B9-B188-0A133C0CE353}
Windows Live Writer-->MsiExec.exe /X{2231CE39-B963-4B9D-823A-F412ECA637B1}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

System event log

Computer Name: TEST-Q91SJ19OTC
Event Code: 7036
Message: Le service avast! Mail Scanner est entré dans l'état : en cours d'exécution.

Record Number: 22689
Source Name: Service Control Manager
Time Written: 20090222084744.000000+060
Event Type: Informations
User:

Computer Name: TEST-Q91SJ19OTC
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service avast! Mail Scanner.

Record Number: 22688
Source Name: Service Control Manager
Time Written: 20090222084743.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: TEST-Q91SJ19OTC
Event Code: 7000
Message: Le service Orange Contrôle Parental n'a pas pu démarrer en raison de l'erreur :
Le service n'a pas répondu assez vite à la demande de lancement ou de contrôle.


Record Number: 22687
Source Name: Service Control Manager
Time Written: 20090222084739.000000+060
Event Type: erreur
User:

Computer Name: TEST-Q91SJ19OTC
Event Code: 7009
Message: Délai (30000 millisecondes) d'attente pour une connexion du service Orange Contrôle Parental.

Record Number: 22686
Source Name: Service Control Manager
Time Written: 20090222084739.000000+060
Event Type: erreur
User:

Computer Name: TEST-Q91SJ19OTC
Event Code: 4201
Message: Le système a détecté que la carte réseau \DEVICE\TCPIP_{F7319CAC-3961-4F14-8362-B14D4057B0AF} était connectée au réseau,
et a lancé une opération normale sur la carte réseau.

Record Number: 22685
Source Name: Tcpip
Time Written: 20090222084717.000000+060
Event Type: Informations
User:

Application event log

Computer Name: TEST-Q91SJ19OTC
Event Code: 1000
Message: Application défaillante deskboard.exe, version 1.0.170.739, module défaillant msvcrt.dll, version 7.0.2600.5512, adresse de défaillance 0x00037fd4.

Record Number: 2807
Source Name: Application Error
Time Written: 20081209204140.000000+060
Event Type: erreur
User:

Computer Name: TEST-Q91SJ19OTC
Event Code: 302
Message: msnmsgr (3208) \\.\C:\Documents and Settings\Francis\Local Settings\Application Data\Microsoft\Messenger\gobenj59@msn.com\SharingMetadata\Working\database_E48_4F9E_484F_8385\dfsr.db: Le moteur de base de données a exécuté la procédure de récupération avec succès.

Record Number: 2806
Source Name: ESENT
Time Written: 20081209204131.000000+060
Event Type: Informations
User:

Computer Name: TEST-Q91SJ19OTC
Event Code: 301
Message: msnmsgr (3208) \\.\C:\Documents and Settings\Francis\Local Settings\Application Data\Microsoft\Messenger\gobenj59@msn.com\SharingMetadata\Working\database_E48_4F9E_484F_8385\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\C:\Documents and Settings\Francis\Local Settings\Application Data\Microsoft\Messenger\gobenj59@msn.com\SharingMetadata\Working\database_E48_4F9E_484F_8385\fsr.log.

Record Number: 2805
Source Name: ESENT
Time Written: 20081209204125.000000+060
Event Type: Informations
User:

Computer Name: TEST-Q91SJ19OTC
Event Code: 301
Message: msnmsgr (3208) \\.\C:\Documents and Settings\Francis\Local Settings\Application Data\Microsoft\Messenger\gobenj59@msn.com\SharingMetadata\Working\database_E48_4F9E_484F_8385\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\C:\Documents and Settings\Francis\Local Settings\Application Data\Microsoft\Messenger\gobenj59@msn.com\SharingMetadata\Working\database_E48_4F9E_484F_8385\fsr00063.log.

Record Number: 2804
Source Name: ESENT
Time Written: 20081209204121.000000+060
Event Type: Informations
User:

Computer Name: TEST-Q91SJ19OTC
Event Code: 300
Message: msnmsgr (3208) \\.\C:\Documents and Settings\Francis\Local Settings\Application Data\Microsoft\Messenger\gobenj59@msn.com\SharingMetadata\Working\database_E48_4F9E_484F_8385\dfsr.db: Le moteur de base de données initialise la procédure de récupération.

Record Number: 2803
Source Name: ESENT
Time Written: 20081209204120.000000+060
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 127 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=7f01
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO

-----------------EOF-----------------

bonjour,
je ne suis pas connecté en wi-fi.j'ai essayé de relancer random's system l'apres midi j'ai réussi : les rapports sont mis en 14 et 15 je ne sais pas comment ils sont arrivés avant la question du probleme de connection mais ils sont bien là je ne sais pas si tu les a vu.merci.

je viens d'effectuer ce que tu m'as demandé ,voici le rapport .

merci.


-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Sempron(tm) Processor LE-1150 )
BIOS : Default System BIOS
USER : Benoit ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:37 Go (Free:15 Go)
D:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 05/03/2009|16:46 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\DOCUME~1\Francis\APPLIC~1\Hotbar
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\IESkins
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostOI
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostOL
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostOI\dynamic
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostOI\static
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostOL\dynamic
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostOL\static
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\030104_emte10_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\030104_emte11_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\030104_emte12_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\030104_emte13_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\030104_emte14_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\030104_emte19_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\030104_emte20_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\030104_emte21_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\030104_emte9_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\030203lib_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102angel_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102bigluf_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102bigsmile_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102birthday_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102cheers_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102flo_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102good_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102jump_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102king_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102lough_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102luf_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102smiled_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102smile_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102sor_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102thanx_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\033102uhu_1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\040103ahh_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\040103wow_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\040104_emi2_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\042102_1134_112_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\050103big_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\050103gig_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\050103hm_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\050103nomail_emoti_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\050103norm_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\060104_ema15_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\060104_ema16_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\060104_ema17_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\060104_ema18_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\060104_ema19_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\060104_ema20_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\060104_ema21_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\060104_ema24_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\060104_ema25_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\060104_ema26_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\060104_ema30_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\060104_ema33_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\060104_ema34_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\062802hippi_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\062802jumpie_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\080402argh_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\080402oops_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\080402ouch_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\082502no_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\082502yes_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_boring1_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_confused_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_crying_ugly_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_fantastic_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_feel_better_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_gimme_break_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_heehee_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_hlopaet_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_ign_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_lol_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_no_comment_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_peace_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_smashing_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\110103_talk2thehand_prv.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\blocked.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\blocked2.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\block_sm.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\block_sm2.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\block_smli.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\block_smli2.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\btn_add-but.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\btn_back-but.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\btn_left_cut_enabled_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\btn_left_enabled_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\btn_left_pressed_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\btn_middle_enabled_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\btn_middle_pressed_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\btn_right_cut_enabled_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\btn_right_enabled_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\btn_right_pressed_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\business_promo.htm
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\buttondir.txt
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\components.cdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\css2_main.css
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\css2_pagingmodule.css
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\css2_topbuttons.css
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\css_cattree.css
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\css_flashpreview.css
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\delete.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\edit_clear_sound.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\edit_fs.htm
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\edit_select.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-511745-514279.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-backgrounds.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-bcards.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-ecards.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-edit.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-emoticons.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-estationery.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-funny.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-help.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-images.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-info.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-more.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-my.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-people.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-photo.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-tell.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-temp.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-temp_OI.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-text.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def-email-voice.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-def.cdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-premium-email-premium.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-premium-email-premium_OI.mnu
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-t1-bg.res
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\email-temp-bg.res
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\estatationery.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\flashpatch.js
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\flashpreview.htm
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\fs3.htm
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\hotbar_promo.htm
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_checked_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_close_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_close_pressed_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_edit_preview.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_edit_send.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_flash_preview.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_recently_used.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_remove_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_remove_pressed_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_sand-clock2.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_tell_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_tell_pressed_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_tree_null.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_unchecked_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\icon_unchecked_pressed_1.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\img_barlayout.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\img_barlayout2.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\img_barlayout4.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\img_corner_left.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\img_local_logo.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\js2_basetemplate.js
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\js2_hbgroups.js
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\js2_hbobject3.js
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\js2_hbobjectset3.js
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\js2_hotbarwrapper.js
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\js2_iteratorsandreaders3nf.js
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\js2_pagingmoduleobj3.js
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\js2_texts3.js
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\js2_xmltree3nf.js
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\layout.cdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\linkpathlegal.txt
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\more.res
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\n.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\nav_bb_2.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\nav_b_2.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\nav_ff_2.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\nav_f_2.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\progress.res
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\searchbtn.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\submit.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\tab_bg.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\tab_bga.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\tab_bgia.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\tab_l.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\tab_la.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\tab_lia.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\tab_r.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\tab_ra.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\tab_ria.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\treedata_animations.xml
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\treedata_backgrounds.xml
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\treedata_ecards.xml
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\treedata_emoticons.xml
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\treedata_notifiers.xml
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\treedata_text.xml
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\tree_dots.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\tree_minus.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\1\tree_plus.gif
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\business_promo.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\buttondir.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\code.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\email-def.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\email-t1-bg.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\email-temp-bg.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\hotbar_promo.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\images.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\layout.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\linkpathlegal.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\localcontent.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\more.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\progress.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\HostWD\static\DownLoad\treexml.xip
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\static
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\101819.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1041655.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1042745.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1043399.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1049051.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1055669.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1055749.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1057776.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1067154.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1070524.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\121700.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1383356.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1383771.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1384138.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1384147.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1384736.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1384900.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1386046.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1386414.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1386779.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1387273.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1388730.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1388868.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1389152.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1389614.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1390054.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1390720.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1390732.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1390909.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1390994.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1391092.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1391571.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1394204.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1395464.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1396684.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1396708.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1400295.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1401230.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1401232.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1402137.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1404802.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1405446.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1405886.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1416760.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1416762.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1416861.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1420901.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\143907.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1566244.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1581365.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1595348.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1642471.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1652200.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\170017.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\171042.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1765196.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1774768.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1834710.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1859639.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1905489.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1907075.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1911512.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\1991809.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2014471.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2066842.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2073431.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2180985.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\218441.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\219597.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2208948.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2265882.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2283189.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2363962.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2395854.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2407244.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\243689.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2445365.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2615954.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2738217.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2780046.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2790311.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2867485.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2867663.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2871864.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2885069.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\2903988.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\292413.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\29242.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\297049.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3248879.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3251993.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\32639.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3328600.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\332957.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3340762.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\340026.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3469510.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\351457.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3736917.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3740520.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3740580.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3741025.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3742564.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3743727.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3744239.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3748478.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3750949.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3751912.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3752961.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3754162.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3755917.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3756263.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3756596.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3779870.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3781281.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3781333.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3786166.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3786169.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3786177.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3786291.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3812110.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3852296.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3855249.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3855935.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3893200.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3893245.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3893292.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3893642.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3893670.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3893730.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3895082.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3895318.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3895378.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3895485.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3895518.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\3895552.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\430653.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\438658.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\442905.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\462781.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\471737.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\485184.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\499863.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\549620.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\566360.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\57048.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\575811.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\577518.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\593384.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\600583.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\608910.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\60899.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\621595.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\625696.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\627350.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\645857.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\66828.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\698446.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\707554.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\737654.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\737686.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\751088.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\758683.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\803618.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\805469.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\805478.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\833723.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\856835.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\878855.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\878951.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\898494.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\935346.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\948597.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\949763.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\971442.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\991767.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\995715.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\997827.sdf
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\domains.txt
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\ustat
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000013401
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000021497
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000021726
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000023612
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000023658
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000023690
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000023840
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000023894
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000023901
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024063
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024104
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024121
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024148
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024202
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024268
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024395
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024490
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024721
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024736
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024749
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024752
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024806
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024821
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000024980
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025015
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025211
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025243
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025284
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025311
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025375
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025397
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025635
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025650
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025771
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025775
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025780
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025790
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025974
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000025975
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026008
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026048
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026057
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026073
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026088
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026179
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026227
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026235
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026262
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026267
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026286
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026287
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026432
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026495
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026566
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026567
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026693
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000026997
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027025
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027034
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027037
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027050
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027228
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027269
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027734
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027767
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027826
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027874
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027908
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027929
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027936
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027956
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000027957
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000028804
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000028825
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000028900
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000028911
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000029212
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000029227
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000029230
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000029251
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000029312
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000029639
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000030258
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000030529
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000030596
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000031075
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000031802
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000032385
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000032521
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000032671
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000032945
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000033014
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000033024
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000033025
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000033064
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000033070
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000033079
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000037257
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000041119
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000044868
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000047858
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000048656
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000051643
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000051976
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000051993
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000051994
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052008
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052045
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052118
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052121
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052153
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052181
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052241
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052291
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052354
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052374
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052417
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052481
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052484
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052511
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052546
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052628
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052637
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052645
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052665
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052712
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052809
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052839
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052875
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000052938
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000053072
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000053498
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000053560
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000053803
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000053856
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000054461
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000054900
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000055202
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000055462
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000055848
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000056485
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000056843
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000056860
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000056908
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000056948
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000057533
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000058075
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000058289
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000058646
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000058647
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000059264
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000059410
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000059581
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000059657
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000059702
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000060511
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000060582
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000060627
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000060711
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000060968
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000061140
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000061367
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000061533
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000062177
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000062903
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000062991
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000063348
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000063466
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000063476
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000063558
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000063581
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000063588
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000063595
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000063615
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000063625
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000063660
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000063820
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000063923
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000065128
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000066676
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000067242
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000067464
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000067585
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000067680
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000068253
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000068667
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000068689
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000068837
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000069497
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000069582
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000069613
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000069647
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000069695
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000069767
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000079147
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000079361
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000079884
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000079933
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000080242
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000080836
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000081289
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000081733
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000081759
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000081898
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000081972
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000082011
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000082117
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000082412
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000082754
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000082797
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000082926
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000083059
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000083134
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000083145
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000090886
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000090952
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000091007
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000091175
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000091308
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000091365
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000091467
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000091759
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000091818
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000093923
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1000093924
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1085
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\11213
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\11297
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\118874
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\12457
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\128338
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\130787
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\133685
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\13546
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\13562
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\13608
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\13632
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1370
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\14272
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\14716
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1491
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\15032
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\15596
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\16065
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\16173
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\16204
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\16211
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\16214
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\164461
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\167151
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\17025
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\17040
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\1810
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\182550
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\18296
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\186757
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\187650
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\19052
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\194105
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\19475
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\199881
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\2020
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\202978
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\20516
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\205355
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\20549
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\20570
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\20613
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\20923
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\212944
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\213887
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\218712
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\218859
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\21889
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\224717
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\226006
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\227849
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\22913
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\23111
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\235169
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\243256
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\24625
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\246314
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\247895
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\249916
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\254367
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\25803
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\25810
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\258484
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\26030
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\260609
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\261393
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\26335
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\264564
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\266255
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\266291
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\27505
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\278243
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\28383
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\288799
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\29115
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\29135
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\3001
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\301249
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\303639
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\304169
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\31301
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\32171
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\32418
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\324832
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\33069
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\33168
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\3338
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\33695
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\337118
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\33912
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\33916
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\3405
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\34374
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\344900
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\34911
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\352526
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\355914
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\363374
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\372224
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\372500
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\374830
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\389560
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\39228
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\39232
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\394023
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\396771
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\39897
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\4020
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\40999
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\4142
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\41694
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\42034
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\4226
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\422734
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\427075
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\427148
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\42871
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\436199
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\43979
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\Hotbar\dynamic\TooltipXML\44293
C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0\H

je viens de le faire voici le nouveau rapport .Il est complet.
comment faire pour supprimer les barres d'outils nefaste sur l'ordi ??? MERCI.


-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Sempron(tm) Processor LE-1150 )
BIOS : Default System BIOS
USER : Benoit ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:37 Go (Free:15 Go)
D:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 05/03/2009|18:44 )

-----------\\ SUPPRESSION

Supprime! - C:\DOCUME~1\Francis\APPLIC~1\Hotbar\IESkins
Supprime! - C:\DOCUME~1\Francis\APPLIC~1\Hotbar\v3.0
Echec ! - C:\Program Files\Hotbar\bin
Echec ! - C:\Program Files\Hotbar\bin\10.2.236.0
Echec ! - C:\Program Files\Hotbar\bin\10.2.236.0\HostOE.dll
Supprime! - C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Hotbar
Supprime! - C:\DOCUME~1\Francis\Cookies\benoit@contentcatalog.hotbar[2].txt
Supprime! - C:\DOCUME~1\Francis\Cookies\benoit@hotbar[2].txt
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\HotbarSA\HotbarSA.dat
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\HotbarSA\HotbarSAAbout.mht
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\HotbarSA\HotbarSAau.dat
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\HotbarSA\HotbarSAEULA.mht
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\HotbarSA\HotbarSA_kyf.dat
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\config
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images
Supprime! - C:\Program Files\Kiwee Toolbar\2.8.167
Supprime! - C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Kiwee Toolbar
Supprime! - C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\SmartShopper
Supprime! - C:\DOCUME~1\Francis\Cookies\benoit@cs.lp.smartshopper[2].txt
Supprime! - C:\DOCUME~1\Francis\APPLIC~1\Smart-Shopper\Application Data
Supprime! - C:\DOCUME~1\Francis\APPLIC~1\Smart-Shopper\cs
Supprime! - C:\DOCUME~1\Francis\APPLIC~1\Smart-Shopper\Documents and Settings
Supprime! - C:\DOCUME~1\Francis\APPLIC~1\Smart-Shopper\Francis
Supprime! - C:\DOCUME~1\Francis\APPLIC~1\Smart-Shopper\report
Supprime! - C:\DOCUME~1\Francis\APPLIC~1\Smart-Shopper\Smart-Shopper
Supprime! - C:\Program Files\Smart-Shopper\Bin
Supprime! - C:\Program Files\Smart-Shopper\cs
Supprime! - C:\Program Files\Smart-Shopper\Uninst.exe
Supprime! - C:\DOCUME~1\Francis\APPLIC~1\WeatherDPA\Weather
Supprime! - C:\DOCUME~1\Francis\APPLIC~1\Hotbar
Echec ! - C:\Program Files\Hotbar
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\HotbarSA
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar
Supprime! - C:\Program Files\Kiwee Toolbar
Supprime! - C:\DOCUME~1\Francis\APPLIC~1\Smart-Shopper
Supprime! - C:\Program Files\Smart-Shopper
Supprime! - C:\DOCUME~1\Francis\APPLIC~1\WeatherDPA
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\2ACA5CC3-0F83-453D-A079-1076FE1A8B65

-----------\\ DEUXIEME PASSAGE

Echec ! - C:\Program Files\Hotbar\bin
Echec ! - C:\Program Files\Hotbar\bin\10.2.236.0
Echec ! - C:\Program Files\Hotbar\bin\10.2.236.0\HostOE.dll
Echec ! - C:\Program Files\Hotbar

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\Hotbar
C:\Program Files\Hotbar\bin
C:\Program Files\Hotbar\bin\10.2.236.0
C:\Program Files\Hotbar\bin\10.2.236.0\HostOE.dll

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Search Page"="https://www.google.com/?gws_rd=ssl"
"Search Bar"="https://www.orange.fr/portail?kw="
"SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/"


--------------------\\ Recherche d'autres infections

C:\Program Files\InternetGameBox
C:\Program Files\InternetGameBox\InternetGameBox.exe
C:\Program Files\InternetGameBox\language
C:\Program Files\InternetGameBox\ressources
C:\Program Files\InternetGameBox\skins
C:\Program Files\InternetGameBox\uninst.exe
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\InternetGameBox
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\InternetGameBox\Conditions g‚n‚rales.url
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\InternetGameBox\Confidentialit‚.url
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\InternetGameBox\D‚sinstaller.lnk
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\InternetGameBox\InternetGameBox.lnk
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\InternetGameBox\Website.url

C:\DOCUME~1\Francis\LOCALS~1\APPLIC~1\mqgesuu.dat
C:\DOCUME~1\Francis\LOCALS~1\APPLIC~1\mqgesuu.exe
C:\DOCUME~1\Francis\LOCALS~1\APPLIC~1\mqgesuu_nav.dat
C:\DOCUME~1\Francis\LOCALS~1\APPLIC~1\mqgesuu_navps.dat
[b]==> EGDACCESS <==/b

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Francis\Cookies\benoit@crack[1].txt
C:\DOCUME~1\Francis\Local Settings\Temporary Internet Files\Content.IE5\8UUTSQBY\crackshot-3140[1].gif
C:\DOCUME~1\Francis\Local Settings\Temporary Internet Files\Content.IE5\BY0D7WUZ\firststeps_crackpusher[1].jpg
C:\DOCUME~1\Francis\Local Settings\Temporary Internet Files\Content.IE5\NV0LIFKD\0-O1TSadUD-crack-s-[1].png



1 - "C:\ToolBar SD\TB_1.txt" - 05/03/2009|16:48 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 05/03/2009|18:47 - Option : [2]

-----------\\ Fin du rapport a 18:47:31,48

bonjour,
voici le nouveau rapport.
merci
-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Sempron(tm) Processor LE-1150 )
BIOS : Default System BIOS
USER : Benoit ( Administrator )
BOOT : Fail-safe boot
C:\ (Local Disk) - NTFS - Total:37 Go (Free:15 Go)
D:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 06/03/2009| 8:53 )

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\Hotbar\bin
Supprime! - C:\Program Files\Hotbar

-----------\\ Recherche de Fichiers / Dossiers ...

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\config
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\config\content_a.xml
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\config\content_ie.xml
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\config\content_m.xml
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\config\content_y.xml
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\config\logger.xml
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\config\toolbarIE.xml
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\config\toolbarIM_a.xml
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\config\toolbarIM_m.xml
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\config\toolbarIM_y.xml
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\allow.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\block.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\dontsend.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\im_toolbardropdownmenu.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\im_toolbarsHelprolloverbase.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\im_toolbarsm1rolloverbase.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\im_toolbarsm1rolloverbase_bg.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\im_toolbarsm1rolloverbase_dp.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\im_toolbarsm2rolloverbase.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\im_toolbarstextrollover.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\kiwee_iconX16.ico
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\kiwee_iconX48.ico
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\send.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\toolbar_eg.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\toolbar_emoticons.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\toolbar_eyeglass.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\toolbar_gear.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\toolbar_images.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\toolbar_kiwee.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\toolbar_msnlogo.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\toolbar_news.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\toolbar_text.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\toolbar_videos.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\toolbar_webshots.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\toolbar_winks.bmp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar\images\X.bmp

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Search Page"="https://www.google.com/?gws_rd=ssl"
"Search Bar"="https://www.orange.fr/portail?kw="
"SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/"


--------------------\\ Recherche d'autres infections

C:\Program Files\InternetGameBox
C:\Program Files\InternetGameBox\InternetGameBox.exe
C:\Program Files\InternetGameBox\language
C:\Program Files\InternetGameBox\ressources
C:\Program Files\InternetGameBox\skins
C:\Program Files\InternetGameBox\uninst.exe
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\InternetGameBox
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\InternetGameBox\Conditions g‚n‚rales.url
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\InternetGameBox\Confidentialit‚.url
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\InternetGameBox\D‚sinstaller.lnk
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\InternetGameBox\InternetGameBox.lnk
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\InternetGameBox\Website.url

C:\DOCUME~1\Francis\LOCALS~1\APPLIC~1\mqgesuu.dat
C:\DOCUME~1\Francis\LOCALS~1\APPLIC~1\mqgesuu.exe
C:\DOCUME~1\Francis\LOCALS~1\APPLIC~1\mqgesuu_nav.dat
C:\DOCUME~1\Francis\LOCALS~1\APPLIC~1\mqgesuu_navps.dat
[b]==> EGDACCESS <==/b

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Francis\Cookies\benoit@crack[1].txt



1 - "C:\ToolBar SD\TB_1.txt" - 05/03/2009|16:48 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 05/03/2009|18:47 - Option : [2]
3 - "C:\ToolBar SD\TB_3.txt" - 06/03/2009| 8:55 - Option : [2]

-----------\\ Fin du rapport a 8:55:50,06

bonjour ,
voici un nouveau rapport.
merci pour votre aide .


Search Navipromo version 3.7.5 commencé le 06/03/2009 à 16:32:28,65

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 26.02.2009 à 18h00 par IL-MAFIOSO

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Sempron(tm) Processor LE-1150 )
BIOS : Default System BIOS
USER : Benoit ( Administrator )
BOOT : Normal boot




C:\ (Local Disk) - NTFS - Total:37 Go (Free:15 Go)
D:\ (CD or DVD)


Recherche executé en mode normal

*** Recherche Programmes installés ***

Favorit
InternetGameBox

*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***

...\InternetGameBox trouvé !

*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***

...\InternetGameBox trouvé !

*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Francis\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Francis\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Francis\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Francis\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Francis\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Francis\menudm~1\progra~1" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Francis\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\Francis\locals~1\applic~1" *



*** Recherche fichiers ***


c:\docume~1\alluse~1\bureau\InternetGameBox.lnk trouvé !

*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!

HKEY_CURRENT_USER\Software\Lanconfig

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mqgesuu"="\"c:\\documents and settings\\francis\\local settings\\application data\\mqgesuu.exe\" mqgesuu"


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Francis\locals~1\applic~1" :

mqgesuu.exe trouvé !
mqgesuu.dat trouvé !
mqgesuu_nav.dat trouvé !
mqgesuu_navps.dat trouvé !

* Dans "C:\DOCUME~1\Francis\locals~1\applic~1" :

mqgesuu.exe trouvé !
mqgesuu.dat trouvé !
mqgesuu_nav.dat trouvé !
mqgesuu_navps.dat trouvé !

3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :



*** Analyse terminée le 06/03/2009 à 16:42:24,96 ***

bonjour,

Clean Navipromo version 3.7.5 commencé le 07/03/2009 à 14:12:56,59

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 26.02.2009 à 18h00 par IL-MAFIOSO

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Sempron(tm) Processor LE-1150 )
BIOS : Default System BIOS
USER : Benoit ( Administrator )
BOOT : Normal boot




C:\ (Local Disk) - NTFS - Total:37 Go (Free:15 Go)
D:\ (CD or DVD)


Mode suppression automatique
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur


*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\Francis\locals~1\applic~1" *


* Suppression dans "C:\DOCUME~1\Francis\locals~1\applic~1" *


*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***

...\InternetGamebox ...suppression...
...\InternetGamebox supprimé !


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***

...\InternetGamebox ...suppression...
...\InternetGamebox supprimé !


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Francis\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\Francis\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Francis\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\Francis\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Francis\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\Francis\menudm~1\progra~1" ***



*** Suppression fichiers ***

c:\docume~1\alluse~1\bureau\InternetGameBox.lnk supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Francis\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


C:\WINDOWS\prefetch\mqgesuu*.pf trouvé !
Copie C:\WINDOWS\prefetch\mqgesuu*.pf réalisée avec succès !
C:\WINDOWS\prefetch\mqgesuu*.pf supprimé !


* Dans "C:\Documents and Settings\Francis\locals~1\applic~1" *


mqgesuu.exe trouvé !
Copie mqgesuu.exe réalisée avec succès !
mqgesuu.exe supprimé !

mqgesuu.dat trouvé !
Copie mqgesuu.dat réalisée avec succès !
mqgesuu.dat supprimé !

mqgesuu_nav.dat trouvé !
Copie mqgesuu_nav.dat réalisée avec succès !
mqgesuu_nav.dat supprimé !

mqgesuu_navps.dat trouvé !
Copie mqgesuu_navps.dat réalisée avec succès !
mqgesuu_navps.dat supprimé !


* Dans "C:\DOCUME~1\Francis\locals~1\applic~1" *



*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Recherche autres dossiers et fichiers connus ***



*** Nettoyage terminé le 07/03/2009 à 14:16:44,68 ***

bonsoir,
voici la rapport de Ad-remover.merci


------- LOGFILE OF AD-REMOVER 1.1.1.6 | ONLY XP/VISTA -------

Updated by C_XX on 07/03/2009 at 21:40

Start at: 22:06:32 | Sam 07/03/2009 | Boot mode: Normal Boot
Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
Computer Name: TEST-Q91SJ19OTC
Current User: Benoit - Administrator
Drive(s):
- C:\ (File System: NTFS)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 51

+-----------------| Boonty/Boonty Games Elements Found:

.
.
C:\Documents and Settings\Francis\Cookies\benoit@boonty.tf1[1].txt

+-----------------| Eorezo Elements Found:

HKCR\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}
HKCR\AppID\EoRezoBHO.DLL
HKCR\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\Typelib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}
HKCU\Software\EoRezo
HKLM\Software\EoRezo
HKLM\Software\Classes\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}
HKLM\Software\Classes\AppID\EoRezoBHO.DLL
HKLM\Software\Classes\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
HKLM\Software\Classes\EoRezoBHO.EoBho
HKLM\Software\Classes\EoRezoBHO.EoBho.1
HKLM\Software\Classes\TypeLib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\eoEngine_is1
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdate_is1
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Eoengine
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Softwarehelper
.
C:\Program Files\EoRezo
C:\Documents and Settings\Francis\Application Data\EoRezo
C:\Documents and Settings\Francis\Application Data\Eorezo
C:\WINDOWS\Prefetch\SOFTWAREUPDATEHP.EXE-201CD97E.pf
C:\Documents and Settings\Francis\Cookies\benoit@ads.eorezo[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@dl.eorezo[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@eorezo[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@mir1.eorezo[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@soft.eorezo[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@ads.eorezo[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@dl.eorezo[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@eorezo[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@mir1.eorezo[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@soft.eorezo[1].txt

+-----------------| Infected Poker Softwares Elements Found:

.
C:\Documents and Settings\Francis\Bureau\Dairy Dash Deluxe.lnk
C:\Documents and Settings\Francis\Bureau\Monopoly Deluxe.lnk

+-----------------| FunWebProducts/MyWay/MyWebSearch Elements Found:

.
.

+-----------------| It's TV Elements Found:

.

+-----------------| Sweetim Elements Found:

HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKCR\MediaPlayer.GraphicsUtils
HKCR\MediaPlayer.GraphicsUtils.1
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\MediaPlayer.GraphicsUtils
HKLM\Software\Classes\MediaPlayer.GraphicsUtils.1
HKLM\Software\Classes\MgMediaPlayer.GifAnimator
HKLM\Software\Classes\MgMediaPlayer.GifAnimator.1
HKLM\Software\Classes\SWEETIE.IEToolbar
HKLM\Software\Classes\SWEETIE.IEToolbar.1
HKLM\Software\Classes\SWEETIE.SWEETIE
HKLM\Software\Classes\SWEETIE.SWEETIE.3
HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKLM\Software\Classes\Toolbar3.SWEETIE
HKLM\Software\Classes\Toolbar3.SWEETIE.1
HKLM\Software\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKLM\Software\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKLM\Software\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKLM\Software\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A1E4213E-06AD-4C58-8315-92F11531D960}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\SweetIM
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\Installer\Products\E3124E1ADA6085C43851291F51139D06
HKLM\Software\Classes\Installer\Products\E3124E1ADA6085C43851291F51139D06
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\E3124E1ADA6085C43851291F51139D06
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
.
C:\WINDOWS\Installer\909fc1.msi
C:\WINDOWS\Installer\909fc6.msi
C:\Program Files\SweetIM
C:\Documents and Settings\All Users\Application Data\SweetIM
C:\WINDOWS\Prefetch\SWEETIM.EXE-114201E6.pf
C:\Documents and Settings\Francis\Cookies\benoit@search.sweetim[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@sweetim[2].txt
C:\Documents and Settings\Francis\Cookies\benoit@www.sweetim[2].txt
C:\Documents and Settings\Francis\Cookies\benoit@www.sweetim[3].txt

+-----------------| Other Adwares Found:

.
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
.
C:\Program Files\Conduit
C:\Documents and Settings\Francis\Cookies\benoit@atdmt[2].txt
C:\Documents and Settings\Francis\Cookies\benoit@bs.serving-sys[1].txt

+-----------------| Added Scan:

---- Internet Explorer Version 7.0.5730.13 ----

+-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Search bar: hxxp://search.ke.voila.fr/S/voila?kw=
Search Page: hxxp://www.google.com
Start page: hxxp://www.google.fr/

+-[HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\..\Internet Explorer\Main]

Search bar: hxxp://search.ke.voila.fr/S/voila?kw=
Search Page: hxxp://www.google.com
Start page: hxxp://www.google.fr/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start page: hxxp://www.msn.com/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

+---------------------------------------------------------------------------+

[~13937 Bytes] - C:\Ad-Report-Scan-07.03.2009.log

- C:\Program Files\Ad-remover\TOOLS\BACKUP
- C:\Program Files\Ad-remover\TOOLS\QUARANTINE

End at: 22:08:15 | 07/03/2009
.
+-----------------| E.O.F - 207 Lines
.

bonjour,
sur quel site gratuit mon fils peut -il télecharger des jeux sans attraper de virus, peux- tu m'en indiquer??
------- LOGFILE OF AD-REMOVER 1.1.1.6 | ONLY XP/VISTA -------

Updated by C_XX on 07/03/2009 at 21:40

*** LIMITED TO ***

Eorezo
Infected Poker Softwares
FunWebProduct/MyWay/MyWebSearch
Sweetim
Other Adwares

******************

Start at: 10:40:42 | Dim 08/03/2009 | Boot mode: Normal Boot
Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
Computer Name: TEST-Q91SJ19OTC
Current User: Benoit - Administrator
Drive(s):
- C:\ (File System: NTFS)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 61

(!) ---- IE start pages/Tabs reset

+-----------------| Eorezo Elements Deleted :

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Eoengine
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Softwarehelper
HKCR\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}
HKCR\AppID\EoRezoBHO.DLL
HKCR\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\Typelib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}
HKCU\Software\EoRezo
HKLM\Software\EoRezo
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\eoEngine_is1
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdate_is1
.
C:\Program Files\EoRezo
C:\Documents and Settings\Francis\Application Data\EoRezo
C:\WINDOWS\Prefetch\SOFTWAREUPDATEHP.EXE-201CD97E.pf
C:\Documents and Settings\Francis\Cookies\benoit@ads.eorezo[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@dl.eorezo[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@eorezo[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@mir1.eorezo[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@soft.eorezo[1].txt

+-----------------| Infected Poker Softwares Elements Deleted :

.
C:\Documents and Settings\Francis\Bureau\Dairy Dash Deluxe.lnk
C:\Documents and Settings\Francis\Bureau\Monopoly Deluxe.lnk

+-----------------| FunWebProducts/MyWay/MyWebSearch Elements Deleted :

.
.

+-----------------| Sweetim Elements Deleted :

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKCR\MediaPlayer.GraphicsUtils
HKCR\MediaPlayer.GraphicsUtils.1
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A1E4213E-06AD-4C58-8315-92F11531D960}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\SweetIM
HKCR\Installer\Products\E3124E1ADA6085C43851291F51139D06
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\E3124E1ADA6085C43851291F51139D06
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
.
C:\WINDOWS\Installer\909fc1.msi
C:\WINDOWS\Installer\909fc6.msi
/!\ NOT DELETED - C:\Program Files\SweetIM
/!\ NOT DELETED - C:\Program Files\SweetIM\Messenger
/!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll
/!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\msvcr71.dll
C:\Documents and Settings\All Users\Application Data\SweetIM
C:\WINDOWS\Prefetch\SWEETIM.EXE-114201E6.pf
C:\Documents and Settings\Francis\Cookies\benoit@search.sweetim[1].txt
C:\Documents and Settings\Francis\Cookies\benoit@sweetim[2].txt
C:\Documents and Settings\Francis\Cookies\benoit@www.sweetim[2].txt
C:\Documents and Settings\Francis\Cookies\benoit@www.sweetim[3].txt

+-----------------| Other Adwares Deleted:

.
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
.
C:\Program Files\Conduit
C:\Documents and Settings\Francis\Cookies\benoit@atdmt[2].txt
C:\Documents and Settings\Francis\Cookies\benoit@bs.serving-sys[1].txt

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.


************* /!\ FILE(S)/FOLDER(S) NOT DELETED /!\ *************

"C:\Program Files\SweetIM\Messenger"
"C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll"
"C:\Program Files\SweetIM\Messenger\msvcr71.dll"

Second run ...

/!\ RESIST ! - "C:\Program Files\SweetIM\Messenger"
/!\ RESIST ! - "C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll"
DELETED ! - "C:\Program Files\SweetIM\Messenger\msvcr71.dll"


+-----------------| Added Scan :

---- Internet Explorer Version 7.0.5730.13 ----

+-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.google.com
Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+-[HKEY_USERS\S-1-5-21-507921405-706699826-1417001333-1003\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.google.com
Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://fr.msn.com/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

+---------------------------------------------------------------------------+

[~13047 Bytes] - C:\Ad-Report-Clean-08.03.2009.log
[~14160 Bytes] - C:\Ad-Report-Scan-07.03.2009.log

- C:\Program Files\Ad-remover\TOOLS\BACKUP
- C:\Program Files\Ad-remover\TOOLS\QUARANTINE

End at: 10:45:23 | 08/03/2009
.
+-----------------| E.O.F - 191 Lines
.

bonjour,

je viens d'effectuer ce que tu m'as demandé.
quand je supprime le dossier sweet Im il y a un message d'erreur qui me dit :
impossible de supprimer sweet Im: accés refusé vérifier que le disque n'est pas plein ou protégé en écriture et que le fichier n'est pas utilisé actuellement.

Quand j'ouvre le dossier il me dit: Vous essayez d'ouvrir un fichier type "extension d'application (.dll) ces fichiers sont utilisés par le systeme d'exploitation et d'autres programmes. leur modification risque d'endommager votre systeme.

donc que dois -je faire?? Est-il vraiment nécessaire de la supprimer? j'ai vu que le fichier correspond à MSN et mon fils utilise souvent MSN ,et il envoie souvent des petits personnages humoristique a ses copains, est ce que ce dossier contient cela ou non .si je lui supprime MSN ou ses petits personnages il va être faché .donc je préfère avoir ton avis avec ce que ce dossier peut contenir d'important.En ce qui concerne le virus BAGLE est -il déjà supprimé de mon ordi. merci.

bonjour,
je viens de faire ce que tu m'as demandé,par contre je n'ai pas trouvé la selection disque dur dans les parametres ,j'ai donc lancé le scan voici le résultat j'espère que ça va aller comme ceci .merci.
avast n'avez pas fonctionné depuis que j'avais le virus il fonctionne depuis quelques jours.j'ai fait un scan hier il a trouvé un ver dans navilog , un cheval de troi ils sont supprimés (normalent du moins je l'espère par avast)par contre il m'a trouvé baegle dans win 32 impossible de le mettre en quarantaine il me demande de supprimer win 32 (je n'ai pas osé supprimer win 32 car je crois que c'est indispensable pour l'ordi ;je voudrai avoir ton avis avant de faire quoi que ce soit ) merci

Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1831
Windows 5.1.2600 Service Pack 3

10/03/2009 08:48:44
mbam-log-2009-03-10 (08-48-44).txt

Type de recherche: Examen rapide
Eléments examinés: 67519
Temps écoulé: 4 minute(s), 2 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 6
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\IGB (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1831
Windows 5.1.2600 Service Pack 3

10/03/2009 08:48:44
mbam-log-2009-03-10 (08-48-44).txt

Type de recherche: Examen rapide
Eléments examinés: 67519
Temps écoulé: 4 minute(s), 2 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 6
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\IGB (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

bonjour,
voici le nouveau rapport, quel antivirus gratuit et efficace me conseilles tu , j'en souhaite un gratuit car je trouve que nous sommes suffisamment taxé de partout .merci pour tes conseils .



dLogfile of random's system information tool 1.05 (written by random/random)
Run by Benoit at 2009-03-10 17:10:59
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 16 GB (43%) free of 38 GB
Total RAM: 959 MB (51% free)
Logfile of random's system information tool 1.05 (written by random/random)
Run by Benoit at 2009-03-10 17:10:59
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 16 GB (43%) free of 38 GB
Total RAM: 959 MB (51% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:11:00, on 10/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AGI\common\win32\PythonService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\CONTRO~1\bin\optgui.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Francis\Bureau\RSIT.exe
C:\Program Files\trend micro\Benoit.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\AGI\common\agcutils.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\AGI\common\agcutils.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: livetvbar Toolbar - {ad55c869-668e-457c-b270-0cfb2f61116f} - C:\Program Files\livetvbar\tbliv1.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: (no name) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)
O3 - Toolbar: livetvbar Toolbar - {ad55c869-668e-457c-b270-0cfb2f61116f} - C:\Program Files\livetvbar\tbliv1.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [OPTENET_GUI] C:\PROGRA~1\CONTRO~1\bin\optgui.exe
O4 - HKLM\..\Run: [HotbarOE] C:\Program Files\Hotbar\bin\10.2.236.0\OEAddOn.exe
O4 - HKLM\..\Run: [HotbarSA] "C:\Program Files\Hotbar\bin\10.2.236.0\HotbarSA.exe"
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [PAC207_Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [msnlivesearch] C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe /Run
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WeatherDPA] "C:\Program Files\Hotbar\bin\10.2.236.0\Weather.exe" -auto
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103470 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SIMBAR={F7FFBCF7-8DAD-47EF-9D9C-343C607C5A94}; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; Embedded Web Browser from: http://bsalsa.com/; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; Hotbar 10.2.236.0)" -"http://www.funlabo.com/voiture/jeu-de-voiture.htm"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\Francis\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C68F9105-04FD-4B48-B6CC-2A076F711C35} (HpodPCFileCtrl2 Class) - file://D:\MEMDISC\ALBUM_A\VIEW\PLUGIN\HPODPCFC.CAB
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Orange Contrôle Parental (OPTENET_FILTER) - Orange - C:\Program Files\Controle Parental\bin\optproxy.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

bonjour,
je viens de lire ton message, j'ai un doute avant d'effectuer ce que tu m'as demandé:est ce que je dois supprimer navilog, ad-remover, findykill,malwarebytes ou non juste arrêter avast et le pare feu .
je préfère avoir ton avis avant d'éffectuer l'opération. merci.