Heuristic virus Solved

Question

Hello,

What is a Heuristic virus? Antivir found this today. I copied the following description:
HEUR/Exploit.HTML

I already received this message a few days ago. As a precaution, I ran a search with Malwarebytes in safe mode. It didn't find anything. I also did a scan with Antivir, which found nothing either.

I feel like this is more of a way to convince me to buy the paid version of Antivir.

In any case, everything is working on my computer.

Thank you for explaining what this message means.

Best regards

Configuration: Windows XP Firefox 3.5.7

Firefox3 · Accepted Answer

A heuristic virus means that the antivirus does not recognize it in its database but finds it suspicious due to its behavior on the system -- tic tac toe ie7 vs firefox which wins firefox of course

fraggle559 · Answer

I therefore have no particular concerns, especially since Malwarebytes found nothing. Thank you.

fraggle559 · Answer

Should I run Malwarebytes in safe mode? Is it possible that it won't find anything?

fraggle559 · Answer

Here it is, I updated and ran the scan

the report is as follows:

Malwarebytes' Anti-Malware 1.44
Database version: 3662
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

30/01/2010 16:35:08
mbam-log-2010-01-30 (16-35-08).txt

Scan type: Complete scan (C:\|G:\|)
Items examined: 218819
Elapsed time: 50 minute(s), 20 second(s)

Infected memory process(es): 0
Infected memory module(s): 0
Infected Registry key(s): 0
Infected Registry value(s): 0
Infected Registry data item(s): 0
Infected folder(s): 0
Infected file(s): 2

Infected memory process(es):
(No malicious items detected)

Infected memory module(s):
(No malicious items detected)

Infected Registry key(s):
(No malicious items detected)

Infected Registry value(s):
(No malicious items detected)

Infected Registry data item(s):
(No malicious items detected)

Infected folder(s):
(No malicious items detected)

Infected file(s):
C:\jacobin\Combo-Fix.sys (Malware.Trace) -> Quarantined and deleted successfully.
C:\jacobin\pv.cfexe (Trojan.Agent) -> Quarantined and deleted successfully.

The computer restarted showing that the disk had suffered damage and it ran a disk check before it could restart. I hope I haven't lost anything.

Anonymous user · Answer

The first one found is ComboFix, a powerful disinfection utility to be used with caution.

fraggle559 · Answer

how to check if I have all my documents because I have a lot of things

fraggle559 · Answer

I just emptied the malware quarantine. I was trying to look at my documents but if I have to do them one by one it will take a long time!!

What do you mean by regularly backing up documents? How do we do that?

I run scans with Malwarebytes from time to time and Antivir.

There was a cleanup via this forum in May I believe and that’s it. By the way, ComboFix is one of the cleaning tools and it shouldn’t be on the computer anymore.

fraggle559 · Answer

so no, I don't have a backup.

fraggle559 · Answer

Yes, I understand. However, do you advise me to back up only my personal documents or also all the programs on the computer? Because for the documents, what would bother me the most is losing the photos, and I burn them from time to time.

fraggle559 · Answer

I understand. Unfortunately, I don't have any installation software because I bought the computer second-hand and received it without the CDs.

fraggle559 · Answer

Here it is. I couldn't install the program on the desktop. I can't find it. I re-registered it and started it from the "finished files" box that the computer displays at the end of each download. Tell me how to find it to install it on the desktop.

Here are the links to the 2 reports that I saved on my desktop for easy access.

http://www.cijoint.fr/cjlink.php?file=cj201001/cijhcPU6x6.txt

http://www.cijoint.fr/cjlink.php?file=cj201001/cijEODitmi.txt

fraggle559 · Answer

############################## | UsbFix V6.083 |

User : 13 (Administrators) # LAURA
Update on 30/01/2010 by El Desaparecido , C_XX & Chimay8
Start at: 22:25:26 | 30/01/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

AMD Sempron(tm) 2800+
Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

C:\ -> Local disk # 37.26 Go (7.64 Go free) [ACER] # FAT32
D:\ -> CD-ROM drive
E:\ -> CD-ROM drive
F:\ -> Removable drive
G:\ -> Removable drive # 7.45 Go (2.75 Go free) [8 GB USB] # FAT32
I:\ -> Removable drive
J:\ -> Removable drive
K:\ -> Removable drive

############################## | Active Processes |

C:\WINDOWS\System32\smss.exe 436
C:\WINDOWS\system32\csrss.exe 524
C:\WINDOWS\system32\winlogon.exe 548
C:\WINDOWS\system32\services.exe 592
C:\WINDOWS\system32\lsass.exe 604
C:\WINDOWS\system32\svchost.exe 764
C:\WINDOWS\system32\svchost.exe 824
C:\WINDOWS\System32\svchost.exe 932
C:\Program Files\Ahead\InCD\InCDsrv.exe 956
C:\WINDOWS\system32\svchost.exe 1124
C:\WINDOWS\system32\svchost.exe 1208
C:\WINDOWS\system32\spoolsv.exe 1316
C:\Program Files\Avira\AntiVir Desktop\sched.exe 1364
C:\WINDOWS\Explorer.EXE 1544
C:\WINDOWS\system32\svchost.exe 1748
C:\Program Files\Avira\AntiVir Desktop\avguard.exe 204
C:\WINDOWS\system32\svchost.exe 200
C:\Program Files\Microsoft LifeCam\MSCamS32.exe 264
C:\WINDOWS\system32\svchost.exe 408
C:\Program Files\Ahead\InCD\InCD.exe 968
C:\WINDOWS\system32\rundll32.exe 972
C:\WINDOWS\vVX1000.exe 1160
C:\Program Files\BboxUpdate\BTLiveUpdate.exe 1204
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 1376
C:\WINDOWS\SOUNDMAN.EXE 1456
C:\Program Files\PROMT5\INTEGRAL\pinmenu.exe 1476
C:\Program Files\Messenger\msmsgs.exe 1504
C:\WINDOWS\system32\ctfmon.exe 1512
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 1612
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe 1636
C:\Program Files\Logitech\SetPoint\SetPoint.exe 1728
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE 112
C:\Program Files\Logitech\SetPoint\LU\LULnchr.exe 1948
C:\Program Files\Logitech\SetPoint\LU\LogitechUpdate.exe 1956
C:\WINDOWS\System32\alg.exe 2408
C:\Program Files\Windows Live\Messenger\msnmsgr.exe 2960
C:\WINDOWS\system32\wbem\wmiprvse.exe 3132

################## | Infectious Elements |

################## | Registry |

[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"

################## | Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{442fa552-f13b-11de-b723-000fead631fe}
Shell\AutoRun\command =H:\InstallTomTomHOME.exe

HKCU\..\..\Explorer\MountPoints2\{5c4563d0-e49e-11dd-b57f-000fead631fe}
Shell\Auto\command =cmd /C launch.bat
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

HKCU\..\..\Explorer\MountPoints2\{e6168d5c-db36-11dd-b56c-000fead631fe}
Shell\AutoRun\command =H:\LaunchU3.exe -a

################## | ! End of report # UsbFix V6.083 ! |

fraggle559 · Answer

Why can't I choose where to install programs? I can't put them on the desktop like you tell me. As a result, I can't find them.

fraggle559 · Answer

By opening the Downloads folder, I find the programs. Can I drag them to the desktop to install them there?

fraggle559 · Answer

in usbfix  option 2? what does it delete? should I run it like that? is there no risk?

fraggle559 · Answer

Ok, I dragged it to the desktop and it worked. I also put Rsit on the desktop. I will launch Usbfix.

fraggle559 · Answer

Should I post the deletion report?

fraggle559 · Answer

I can't seem to add the report; I've tried three times, but it doesn't save.

fraggle559 · Answer

I will try again tomorrow. Good evening and thank you for your valuable help.

fraggle559 · Answer

Here is the report: what has been removed?   ############################## | UsbFix V6.083 |  User: 13 (Administrators) # LAURA Update on 30/01/2010 by El Desaparecido, C_XX & Chimay8 Start at: 23:11:44 | 30/01/2010 Website: http://pagesperso-orange.fr/NosTools/index.html Contact: FindyKill.Contact@gmail.com  AMD Sempron(tm) 2800+ Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3 Internet Explorer 8.0.6001.18702 Windows Firewall Status: Enabled AV: AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]  C:\ -> Local hard drive # 37.26 Go (7.6 Go free) [ACER] # FAT32 D:\ -> CD-ROM drive E:\ -> CD-ROM drive F:\ -> Removable drive G:\ -> Removable drive # 7.45 Go (2.75 Go free) [CLÉ 8 G] # FAT32 I:\ -> Removable drive J:\ -> Removable drive K:\ -> Removable drive  ############################## | Active processes |  C:\WINDOWS\System32\smss.exe 432 C:\WINDOWS\system32\csrss.exe 504 C:\WINDOWS\system32\winlogon.exe 528 C:\WINDOWS\system32\services.exe 572 C:\WINDOWS\system32\lsass.exe 584 C:\WINDOWS\system32\svchost.exe 744 C:\WINDOWS\system32\svchost.exe 792 C:\WINDOWS\System32\svchost.exe 860 C:\Program Files\Ahead\InCD\InCDsrv.exe 880 C:\WINDOWS\system32\logonui.exe 908 C:\WINDOWS\system32\svchost.exe 1132 C:\WINDOWS\system32\userinit.exe 1180 C:\WINDOWS\system32\svchost.exe 1268 C:\WINDOWS\Explorer.EXE 1308 C:\WINDOWS\system32\spoolsv.exe 1396 C:\Program Files\Avira\AntiVir Desktop\sched.exe 1432 C:\WINDOWS\system32\svchost.exe 1476 C:\Program Files\Avira\AntiVir Desktop\avguard.exe 1536 C:\WINDOWS\system32\svchost.exe 1548 C:\Program Files\Microsoft LifeCam\MSCamS32.exe 1588 C:\WINDOWS\system32\svchost.exe 1692 C:\WINDOWS\system32\wuauclt.exe 1988 C:\WINDOWS\system32\wbem\wmiprvse.exe 496  ################## | Infectious elements |   ################## | Registry |  Deleted! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives" Deleted! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"  ################## | Mountpoints2 |  Deleted! HKCU\...\Explorer\MountPoints2\{442fa552-f13b-11de-b723-000fead631fe}\Shell\AutoRun\Command Deleted! HKCU\...\Explorer\MountPoints2\{5c4563d0-e49e-11dd-b57f-000fead631fe}\Shell\Auto\Command Deleted! HKCU\...\Explorer\MountPoints2\{e6168d5c-db36-11dd-b56c-000fead631fe}\Shell\AutoRun\Command  ################## | Listing of present files |  [20/04/2004 11:31|--a------|5] C:\xpsp2.id [20/04/2004 11:31|--a------|5] C:\flag.id [20/04/2004 11:31|--a------|5] C:\fr.id [?|?|?] C:\pagefile.sys [15/03/1998 10:30|--a------|81920] C:\bivbx11.dll [27/09/1993 10:17|-r-------|50784] C:\mhcl200.vbx [21/09/1993 17:30|-r-------|58192] C:\mhrun300.dll [16/06/2009 18:10|--ah-----|8628] C:\chiffres.GID [18/04/2005 15:38|---hs----|78] C:\BOOTLOG.TXT [27/08/1995 13:19|--a------|11912] C:\chiffres.hlp [29/07/1998 19:39|--a------|47384] C:\katalog.hlp [16/06/2009 18:09|--ah-----|8628] C:\katalog.GID [18/04/2005 15:38|---hs----|512] C:\BOOTSECT.DOS [?|?|?] C:\hiberfil.sys [12/07/2007 12:41|--a------|90] C:\Setup.log [25/12/2007 19:40|--a------|186] C:\picsetup.log [05/08/2004 05:00|-rahs----|4952] C:\Bootfont.bin [09/04/2009 09:38|-rahs----|252240] C:\ntldr [05/08/2004 05:00|-rahs----|47564] C:\NTDETECT.COM [29/07/2009 09:19|--a------|0] C:\conmgr.log [05/01/2010 20:26|--a------|230424] C:\img2-001.raw [20/05/2009 14:14|-rahs----|286] C:\boot.ini [09/04/2004 16:42|--a------|0] C:\AUTOEXEC.BAT [09/04/2004 16:22|--a------|0] C:\CONFIG.SYS [23/04/1999 22:22|-r-hs----|0] C:\IO.SYS [18/04/2005 15:29|-r-hs----|0] C:\MSDOS.SYS [09/08/2007 16:02|--a------|44545] C:\playground.log [02/03/2009 13:18|--a------|0] C:\LOGCE.tmp [05/01/2009 16:21|--a------|0] C:\LOG3.tmp [21/02/2009 14:14|--a------|0] C:\LOG136.tmp [21/02/2009 14:18|--a------|0] C:\LOG137.tmp [02/03/2009 17:14|--a------|0] C:\LOG1B.tmp [05/01/2009 16:06|--a------|0] C:\LOG2.tmp [22/02/2009 01:06|--a------|0] C:\LOG2C8.tmp [22/02/2009 11:19|--a------|0] C:\LOG2D.tmp [22/02/2009 01:25|--a------|0] C:\LOG2DE.tmp [30/01/2010 23:13|--a------|4131] C:\UsbFix.txt [15/05/2009 09:24|--a------|0] C:\LOG4D.tmp [02/03/2009 16:53|--a------|0] C:\LOG5.tmp [27/01/2009 16:16|--a------|84244846] C:\Sauv.reg [21/05/2009 17:26|--a------|1446] C:\TCleaner.txt [08/02/2009 11:01|--a------|0] C:\LOG76E.tmp [08/02/2009 11:07|--a------|0] C:\LOG770.tmp [08/02/2009 11:10|--a------|0] C:\LOG774.tmp [08/02/2009 11:38|--a------|0] C:\LOG775.tmp [16/05/2009 12:56|--a------|0] C:\LOGB6F.tmp [08/02/2009 17:12|--a------|0] C:\LOG86E.tmp [03/08/2004 23:00|--a------|263488] C:\cmldr [16/05/2009 13:14|--a------|8375] C:\UsbFixsup3.txt [04/07/2005 17:54|--a------|216] C:\Boot.bak [28/01/2010 10:48|--a------|2298401] G:\générique - L'agence tout risque francais.mp3 [27/01/2010 22:34|--a------|346107137] G:\Lea.Passion.17.Jeux.nds.rar [05/05/2009 19:56|--a------|736720498] G:\Cash avec Jean Reno, Jean Dujardin.avi [28/01/2010 20:45|--a------|37972309] G:\nds horse life 2 [28/01/2010 21:06|--a------|33554432] G:\Nintendo Horse Life 2 - Aventures Autour Du Monde.nds [30/01/2010 21:30|--a------|370038800] G:\Le Retour De K2000 1x05 La chasse aux mercenaires.avi [20/02/2009 02:16|--a------|738957312] G:\Mesrine.L.instinct.de.Mort.FRENCH.R5.XViD-K-SUAL.By.Agecanonix.[emulepassion.com].avi [16/10/2009 18:13|--a------|103282331] G:\(Album) Pink Floyd - Dark Side of the Moon (Full Album).mp3 [25/01/2010 21:37|--a------|737063384] G:\G.I. Joe, Le réveil du Cobra.FRENCH.REPACK.1CD.DVDRip.XviD-GKS.FUCK.[emule-island.com].avi [11/01/2010 19:07|--a------|738899968] G:\Neuilly.sa.mère.2009.FRENCH.DVDRIP.XVID-BN.DIV.[emule-island.com].avi  ################## | Vaccination |  # C:\autorun.inf -> Folder created by UsbFix. # G:\autorun.inf -> Folder created by UsbFix.  ################## | ! End of report # UsbFix V6.083 ! |

fraggle559 · Answer

Hello, So these are not elements that I might miss?

fraggle559 · Answer

Here is the file log.txt. I do not have the info.txt file this time. Is that normal? Logfile of random's system information tool 1.06 (written by random/random) Run by 13 at 2010-01-31 16:19:40 Microsoft Windows XP Home Edition Service Pack 3 System drive C: has 8 GB (22%) free of 38 GB Total RAM: 735 MB (63% free)  Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:19:47, on 31/01/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal  Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\Microsoft LifeCam\MSCamS32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Documents and Settings\13\Desktop\RSIT(2).exe C:\Program Files	rend micro\13.exe  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/en-us R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Windows Live Sign-in Assistant Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [PROMT Integrator] "C:\Program Files\PROMT5\INTEGRAL\PinStart.exe" /autorun O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe" O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe O4 - HKLM\..\Run: [BboxUpdate] C:\Program Files\BboxUpdate\BTLiveUpdate.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe" O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -"http://www.funlabo.com/delirants-insolites/jeu-transport-de-whisky.htm" O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites O8 - Extra context menu item: E&xporter to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add to Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint Quick Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Open in a Background Tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?2a22063e1a6841fa860803837843fbd1 O8 - Extra context menu item: Open in a Foreground Tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?2a22063e1a6841fa860803837843fbd1 O9 - Extra button: Direct Add - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Direct Add in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Translation - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm O9 - Extra 'Tools' menuitem: Translate - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm O9 - Extra 'Tools' menuitem: Customize Translation Options - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm O9 - Extra button: Note Organizer - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://GLOBAL.ACER.COM/ O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader5.cab O16 - DPF: {741747F6-83B4-4FB9-A268-8CA4010762C8} (Snapfish Activia2) - http://www3.snapfish.fr/SnapfishActivia2.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe  -- End of file - 8245 bytes  ======Scheduled tasks folder======  C:\WINDOWS	asks\User_Feed_Synchronization-{FF5DF99F-C204-45E8-9DC9-B60BD76EAA1D}.job C:\WINDOWS	asks\AppleSoftwareUpdate.job  ======Registry dump======  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Sign-in Assistant Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-12-21 251504]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2009-11-30 764912]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}] Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll [2008-12-21 522224]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2004-08-26 405504] {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-12-21 251504]  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "InCD"=C:\Program Files\Ahead\InCD\InCD.exe [2004-10-18 1315840] "PROMT Integrator"=C:\Program Files\PROMT5\INTEGRAL\PinStart.exe [2001-09-03 49152] "BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent [] "Logitech Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2008-02-29 76304] "Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2008-02-29 76304] "LifeCam"=C:\Program Files\Microsoft LifeCam\LifeExp.exe [2007-05-17 279912] "VX1000"=C:\WINDOWS\vVX1000.exe [2007-04-10 709992] "BboxUpdate"=C:\Program Files\BboxUpdate\BTLiveUpdate.exe [2008-08-06 103936] "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-01-05 413696] "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153] "Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd [] "SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-05-14 67072]  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] "msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-09-16 5724184] "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-10-09 68856] "TomTomHOME.exe"=C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [2009-11-13 247144]  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"=C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150600.exe [2009-06-05 468408]  C:\Documents and Settings\All Users\Start Menu\Programs\Startup Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn] c:\program files\common files\logitech\bluetooth\LBTWlgn.dll [2008-05-02 72208]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\procexp90.Sys]  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WdfLoadGroup]  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=128 "NoDriveAutoRun"=128 "HonorAutoRunSetting"=0  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "HonorAutoRunSetting"= "NoLogOff"= "NoDriveAutoRun"= "NoDriveTypeAutoRun"=  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Messenger\MSMSGS.EXE"="C:\Program Files\Messenger\MSMSGS.EXE:*:Enabled:Windows Messenger" "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Disabled:Logitech Desktop Messenger" "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule" "C:\WINDOWS\System32tcshare.exe"="C:\WINDOWS\System32tcshare.exe:*:Disabled:RTC Application Sharing" "C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting®" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Microsoft LifeCam\LifeCam.exe"="C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe" "C:\Program Files\Microsoft LifeCam\LifeExp.exe"="C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe" "C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Disabled:Firefox" "C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE"="C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "C:\Program Files\Bbox\eSKernel.exe"="C:\Program Files\Bbox\eSKernel.exe:*:Enabled:Bbox installation assistant" "C:\Program Files\BboxUpdate\BTLiveUpdate.exe"="C:\Program Files\BboxUpdate\BTLiveUpdate.exe:*:Enabled:Bbox - Bouygues Telecom - Update Utility" "C:\WINDOWS\System32\RUNDLL32.EXE"="C:\WINDOWS\System32\RUNDLL32.EXE:*:Enabled:Run a DLL as an application" "C:\WINDOWS\System32\dpvsetup.exe"="C:\WINDOWS\System32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE"="C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"  ======List of files/folders created in the last 2 months======  2010-01-31 11:31:09 ----D---- C:\Documents and Settings\13\Application Data\LEGO Company 2010-01-31 11:31:01 ----D---- C:\Program Files\LEGO Company 2010-01-30 23:13:52 ----RASHD---- C:\autorun.inf 2010-01-30 23:11:39 ----A---- C:\UsbFix.txt 2010-01-30 22:23:17 ----D---- C:\UsbFix 2010-01-30 18:28:05 ----D---- C:sit 2010-01-15 23:10:50 ----HD---- C:\WINDOWS\$NtUninstallKB972270$ 2010-01-13 13:28:28 ----D---- C:\Documents and Settings\13\Application Data\Apple Computer 2009-12-25 11:52:26 ----D---- C:\Documents and Settings\All Users\Application Data\TomTom 2009-12-25 11:51:19 ----D---- C:\Documents and Settings\13\Application Data\TomTom 2009-12-25 11:51:11 ----D---- C:\Program Files\TomTom International B.V 2009-12-25 11:50:59 ----D---- C:\Program Files\TomTom HOME 2 2009-12-21 11:11:12 ----HD---- C:\WINDOWS\$NtUninstallKB955759$ 2009-12-20 13:33:03 ----A---- C:\WINDOWS
tbtlog.txt 2009-12-12 23:49:20 ----HD---- C:\WINDOWS\$NtUninstallKB970430$ 2009-12-12 23:49:15 ----HD---- C:\WINDOWS\$NtUninstallKB974318$ 2009-12-12 23:48:36 ----HD---- C:\WINDOWS\$NtUninstallKB973904$ 2009-12-12 23:48:30 ----HD---- C:\WINDOWS\$NtUninstallKB974392$ 2009-12-12 23:48:23 ----HD---- C:\WINDOWS\$NtUninstallKB971737$  ======List of files/folders modified in the last 2 months======  2010-01-31 12:57:52 ----A---- C:\WINDOWS\NeroDigital.ini 2010-01-30 23:10:38 ----A---- C:\WINDOWS\SchedLgU.Txt 2010-01-15 23:10:56 ----A---- C:\WINDOWS\imsins.BAK 2010-01-05 01:17:46 ----A---- C:\WINDOWS\system32\MRT.exe 2009-12-21 20:07:02 ----A---- C:\WINDOWS\system32\wininet.dll 2009-12-21 20:07:02 ----A---- C:\WINDOWS\system32\urlmon.dll 2009-12-21 20:07:00 ----A---- C:\WINDOWS\system32\occache.dll 2009-12-21 20:07:00 ----A---- C:\WINDOWS\system32\mshtml.dll 2009-12-21 20:06:58 ----A---- C:\WINDOWS\system32\msfeedsbs.dll 2009-12-21 20:06:58 ----A---- C:\WINDOWS\system32\msfeeds.dll 2009-12-21 20:06:58 ----A---- C:\WINDOWS\system32\jsproxy.dll 2009-12-21 20:06:58 ----A---- C:\WINDOWS\system32\iertutil.dll 2009-12-21 20:06:56 ----A---- C:\WINDOWS\system32\iepeers.dll 2009-12-21 20:06:56 ----A---- C:\WINDOWS\system32\ieframe.dll 2009-12-21 20:06:52 ----A---- C:\WINDOWS\system32\iedkcs32.dll 2009-12-21 14:20:16 ----A---- C:\WINDOWS\system32\ie4uinit.exe 2009-12-12 23:52:36 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI  ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======  R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2005-07-04 43488] R1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41856] R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [] R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104] R1 InCDPass;InCDPass; C:\WINDOWS\System32\DRIVERS\InCDPass.sys [2004-10-18 28928] R1 incdrm;InCD Reader; C:\WINDOWS\system32\drivers\incdrm.sys [2004-10-18 27648] R1 SiSkp;SiSkp; C:\WINDOWS\system32\DRIVERS\srvkp.sys [2004-07-08 12416] R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-07-18 28520] R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2009-07-29 5632] R1 WS2IFSL;Windows Sockets 2.0 Non-IFS Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-05 12032] R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-10 56816] R3 ALCXSENS;WDM 3D Audio Driver Service; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2004-02-24 400384] R3 ALCXWDM;Realtek AC97 Audio (WDM) Service; C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-05-14 622172] R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2008-02-29 20240] R3 L8042mou;SetPoint PS/2 Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\L8042mou.Sys [2008-02-29 63120] R3 LMouKE;SetPoint Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouKE.Sys [2008-02-29 79120] R3 NTIDrvr;Upper Class Filter Driver; C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys [2005-04-18 6912] R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2004-07-08 217600] R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2004-02-28 32256] R3 usbaudio;USB audio (WDM) Driver; C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032] R3 usbccgp;Microsoft Generic USB Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;USB2 Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbohci;Microsoft Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152] R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] R3 VX1000;VX-1000; C:\WINDOWS\system32\DRIVERS\VX1000.sys [2007-04-10 1966312] R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDfs.sys [2004-10-18 98048] S1 kbdhid;HID Keyboard Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720] S3 BthEnum;Bluetooth Enumerator Service; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-13 17024] S3 BTHMODEM;Bluetooth Serial Communication Driver; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-13 37888] S3 BthPan;Bluetooth Personal Area Network Device; C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-13 101120] S3 BTHPORT;Bluetooth Port Driver; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 272768] S3 BTHUSB;Bluetooth Radio USB Driver;

fraggle559 · Answer

it didn't happen like you told me. I couldn't mark option1 search. He didn't open a catme folder on the desktop.  I just have a report that is as follows, but I'm not sure I did it correctly.  http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem_Install.exe   that's all that's in the report. Is this what you were expecting?

fraggle559 · Answer

Yes, I have a problem with its installation. I'll start again.

fraggle559 · Answer

well I understand. The zip only sends to the link that allowed me to load the program. Here is the report:   List'em by g3n-h@ckm@n 1.2.1.2 User: 13 (Administrators) Update on 29/01/2010 by g3n-h@ckm@n ::::: 11:50 Start at: 17:01:48 | 31/01/2010 Contact: g3n-h@ckm@n on CCM  AMD Sempron(tm) 2800+ Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3 Internet Explorer 8.0.6001.18702 Windows Firewall Status: Disabled AV: AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]  C:\ -> Local hard drive | 37.26 Go (8.06 Go free) [ACER] | FAT32 D:\ -> CD-ROM E:\ -> CD-ROM F:\ -> Removable drive G:\ -> Removable drive | 7.45 Go (3.09 Go free) [USB 8 G] | FAT32 I:\ -> Removable drive J:\ -> Removable drive K:\ -> Removable drive  ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running  C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft LifeCam\MSCamS32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\system32undll32.exe C:\WINDOWS\vVX1000.exe C:\Program Files\BboxUpdate\BTLiveUpdate.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\PROMT5\INTEGRAL\pinmenu.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\svchost.exe c:\program files\avira\antivir desktop\avcenter.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\List_Kill'em\List_Kill'em.scr C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Documents and Settings\13\Local Settings	emp\27.tmp\pv.exe  ====================== Keys "Run" ====================== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] MSMSGS REG_SZ "C:\Program Files\Messenger\msmsgs.exe" /background ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" TomTomHOME.exe REG_SZ "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] InCD REG_SZ C:\Program Files\Ahead\InCD\InCD.exe PROMT Integrator REG_SZ "C:\Program Files\PROMT5\INTEGRAL\PinStart.exe" /autorun BluetoothAuthenticationAgent REG_SZ rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent Logitech Hardware Abstraction Layer REG_SZ KHALMNPR.EXE Kernel and Hardware Abstraction Layer REG_SZ KHALMNPR.EXE LifeCam REG_SZ "C:\Program Files\Microsoft LifeCam\LifeExp.exe" VX1000 REG_SZ C:\WINDOWS\vVX1000.exe BboxUpdate REG_SZ C:\Program Files\BboxUpdate\BTLiveUpdate.exe QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min Cmaudio REG_SZ RunDll32 cmicnfg.cpl,CMICtrlWnd SoundMan REG_SZ SOUNDMAN.EXE  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]  ===================== Other Keys ===================== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] dontdisplaylastusername REG_DWORD 0 (0x0) legalnoticecaption REG_SZ legalnoticetext REG_SZ shutdownwithoutlogon REG_DWORD 1 (0x1) undockwithoutlogon REG_DWORD 1 (0x1)  =============== [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] NoDriveTypeAutoRun REG_DWORD 128 (0x80) NoDriveAutoRun REG_DWORD 128 (0x80) HonorAutoRunSetting REG_DWORD 0 (0x0)  =============== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] HonorAutoRunSetting REG_DWORD 0 (0x0) NoLogOff REG_DWORD 0 (0x0) NoDriveAutoRun REG_DWORD 128 (0x80) NoDriveTypeAutoRun REG_DWORD 128 (0x80)  =============== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]  =============== [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\crypt32chain] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cryptnet] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cscdll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\dimsntfy] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LBTWlgn] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ScCertProp] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\Schedule] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\sclgntfy] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\SensLogn] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify	ermsrv] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\wlballoon]  =============== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ  =============== [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 C:\Program Files\Messenger\MSMSGS.EXE REG_SZ C:\Program Files\Messenger\MSMSGS.EXE:*:Enabled:Windows Messenger C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Disabled:Logitech Desktop Messenger C:\Program Files\eMule\emule.exe REG_SZ C:\Program Files\eMule\emule.exe:*:Enabled:eMule C:\WINDOWS\System32tcshare.exe REG_SZ C:\WINDOWS\System32tcshare.exe:*:Disabled:RTC application sharing C:\Program Files\NetMeeting\conf.exe REG_SZ C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting® %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 C:\Program Files\Microsoft LifeCam\LifeCam.exe REG_SZ C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe C:\Program Files\Microsoft LifeCam\LifeExp.exe REG_SZ C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe C:\Program Files\Mozilla Firefox\firefox.exe REG_SZ C:\Program Files\Mozilla Firefox\firefox.exe:*:Disabled:Firefox C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE REG_SZ C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE:*:Enabled:Windows Live Messenger C:\Program Files\Windows Live\Messenger\livecall.exe REG_SZ C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) C:\Program Files\Bbox\eSKernel.exe REG_SZ C:\Program Files\Bbox\eSKernel.exe:*:Enabled:Bbox installation assistant C:\Program Files\BboxUpdate\BTLiveUpdate.exe REG_SZ C:\Program Files\BboxUpdate\BTLiveUpdate.exe:*:Enabled:Bbox - Bouygues Telecom - update utility C:\WINDOWS\System32\RUNDLL32.EXE REG_SZ C:\WINDOWS\System32\RUNDLL32.EXE:*:Enabled:Run a DLL as an application C:\WINDOWS\System32\dpvsetup.exe REG_SZ C:\WINDOWS\System32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE REG_SZ C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE:*:Enabled:Windows Live Messenger C:\Program Files\Windows Live\Messenger\livecall.exe REG_SZ C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)  =============== ActivX controls =============== HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{166B1BCA-3F9C-11CF-8075-444553540000} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D637FAD-E202-48D1-8F18-5B9C459BD1E3} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{741747F6-83B4-4FB9-A268-8CA4010762C8} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}  =============== HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{DFB17AA8-042A-429D-987C-26CE244A4189} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\WriteRegStr HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{166B1BCA-3F9C-11CF-8075-444553540000} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}  ============== BHO: ====== [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]  ================ Internet Explorer: ================ [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] Start Page REG_SZ https://www.msn.com/fr-fr  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome  ======== Services ======== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]  Ndisuio: 0x3 EapHost: 0x3 SharedAccess: 0x2 wuauserv: 0x2  ========= Atapi.sys =========  %%%% HASHDEEP-1.0 %%%% size,md5,sha256,filename ## Invoked from: C:\Documents and Settings\13\Local Settings	emp\27.tmp ## C:\> hashdeep C:\WINDOWS\System32\Drivers\atapi.sys ## 96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\System32\Drivers\atapi.sys   Sources =======  C:\WINDOWS\system32\drivers\atapi.sys C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\atapi.sys C:\WINDOWS\$NtServicePackUninstall$\atapi.sys C:\WINDOWS\ServicePackFiles\i386\atapi.sys  Reference: ==========  Win XP_SP2_32b: CDFE4411A69C224BD1D11B2DA92DAC51 Win XP_SP3_32b: 9F3A2F5AA6875C72BF062C712CFA2674 Vista_SP1_32b: 2d9c903dc76a66813d350a562de40ed9 Vista_SP2_32b: 1F05B78AB91C9075565A9D8A4B880BC4 Vista_SP2_64b: 1898FAE8E07D97F2F6C2D5326C633FAC Windows 7_32b: 80C40F7FDFC376E4C5FEEC28B41C119E Windows 7_64b: 02062C0B390B7729EDC9E69C680A6F3C  ======= Drive: =======  Windows Disk Defragmenter Copyright (c) 2001 Microsoft Corp. and Executive Software International Inc.  Analysis report  37.26 Go total, 8.06 Go free (21%), 21% fragmented (file fragmentation 38%)  You should defragment this volume.  ¤¤¤¤¤¤¤¤¤¤ Files/folders:  Present !!: C:\Program Files\Adverts Present !!: C:\WINDOWS\002960_.tmp Present !!: C:\WINDOWS\005876_.tmp Present !!: C:\WINDOWS\005897_.tmp Present !!: C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe Present !!: C:\WINDOWS\Fonts\GRGAREF.TTF Present !!: C:\WINDOWS\iun6002.exe Present !!: C:\WINDOWS\system32\xinput9_1_0.dll Present !!: C:\WINDOWS\system32\x3daudio1_0.dll Present !!: C:\WINDOWS\system32\x3daudio1_1.dll Present !!: C:\WINDOWS\System32\drivers\etc\hosts.msn Present !!: C:\WINDOWS\System32\SET144.tmp Present !!: C:\WINDOWS\System32\SET150.tmp Present !!: C:\WINDOWS\System32\SETFB.tmp Present !!: C:\WINDOWS\System32\SETFC.tmp Present !!: C:\WINDOWS\System32\SETFD.tmp Present !!: C:\WINDOWS\System32\SETFE.tmp Present !!: C:\WINDOWS\System32\SETFF.tmp Present !!: C:\WINDOWS\System32\SET100.tmp Present !!: C:\WINDOWS\System32\SET101.tmp Present !!: C:\WINDOWS\System32\SET102.tmp Present !!: C:\WINDOWS\System32\SET103.tmp Present !!: C:\WINDOWS\System32\SET106.tmp Present !!: C:\WINDOWS\System32\SET107.tmp Present !!: C:\WINDOWS\System32\SET108.tmp Present !!: C:\WINDOWS\System32\SET109.tmp Present !!: C:\WINDOWS\System32\SET10A.tmp Present !!: C:\WINDOWS\System32\SET10B.tmp Present !!: C:\WINDOWS\System32\SET10D.tmp Present !!: C:\WINDOWS\System32\SET10E.tmp Present !!: C:\WINDOWS\System32\SET10F.tmp Present !!: C:\WINDOWS\System32\SET110.tmp Present !!: C:\WINDOWS\System32\SET111.tmp Present !!: C:\WINDOWS\System32\SET112.tmp Present !!: C:\WINDOWS\System32\SET113.tmp Present !!: C:\WINDOWS\System32\SET114.tmp Present !!: C:\WINDOWS\System32\SET115.tmp Present !!: C:\WINDOWS\System32\SET116.tmp Present !!: C:\WINDOWS\System32\SET117.tmp Present !!: C:\WINDOWS\System32\SET118.tmp Present !!: C:\WINDOWS\System32\SET119.tmp Present !!: C:\WINDOWS\System32\SET11A.tmp Present !!: C:\WINDOWS\System32\SET11B.tmp Present !!: C:\WINDOWS\System32\SET11C.tmp Present !!: C:\WINDOWS\System32\SET11D.tmp Present !!: C:\WINDOWS\System32\SET11E.tmp Present !!: C:\WINDOWS\System32\SET120.tmp Present !!: C:\WINDOWS\System32\SET121.tmp Present !!: C:\WINDOWS\System32\SET122.tmp Present !!: C:\WINDOWS\System32\SET124.tmp Present !!: C:\WINDOWS\System32\SET125.tmp Present !!: C:\WINDOWS\System32\SET126.tmp Present !!: C:\WINDOWS\System32\SET128.tmp Present !!: C:\WINDOWS\System32\SET129.tmp Present !!: C:\WINDOWS\System32\SET12A.tmp Present !!: C:\WINDOWS\System32\SET12B.tmp Present !!: C:\WINDOWS\System32\SET12C.tmp Present !!: C:\WINDOWS\System32\SET12D.tmp Present !!: C:\WINDOWS\System32\SET12E.tmp Present !!: C:\WINDOWS\System32\SET12F.tmp Present !!: C:\WINDOWS\System32\SET130.tmp Present !!: C:\Documents and Settings\13\Application Data\GDIPFONTCACHEV1.DAT Present !!: C:\Documents and Settings\13\Application Data\GDIPFONTCACHEV1.DAT Present !!: C:\Documents and Settings\13\LOCAL Settings\Temp\qta5.exe Present !!: C:\Documents and Settings\13\LOCAL Settings\Temp\wlsetup-cvr.exe Present !!: C:\Documents and Settings\13\RefEdit.exd  ¤¤¤¤¤¤¤¤¤¤ Keys:  Present !!: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} Present !!: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff Present !!: "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe" Present !!: "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe" Present !!: HKCR\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632 Present !!: HKCR\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0 Present !!: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0 Present !!: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632  ============  catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-01-31 17:12:53 Windows 5.1.2600 Service Pack 3 FAT NTAPI  scanning hidden processes ...  scanning hidden services ...  scanning hidden autostart entries ...  scanning hidden files ...  scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0   Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net  device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK copy of MBR has been found in sector 1!  ========== Programs ==========  Common Files SiSLan Windows NT MSN MSN Gaming Zone Messenger Windows Media Player Online Services ComPlus Applications Internet Explorer Outlook Express NetMeeting Movie Maker Online Services WindowsUpdate microsoft frontpage xerox Uninstall Information InstallShield Installation Information AvRack Realtek Sound Manager NewTech Infosystems CyberLink Adobe QuickTime GameSpy Arcade Publisher Ahead Microsoft Office Microsoft Encarta WinRAR Counter-Strike 1.6 Pod-Bot PROMT5 ACE Mega CoDecS Pack Mozilla SuperCopier Easy CD-DA Extractor 5.0 ArcSoft Woody Woodpecker Demo Maxis Logitech MUSICMATCH Securitoo Wanadoo Google Picasa2 Alwil Software Windows

fraggle559 · Answer

Do we need to close the antivirus again?

fraggle559 · Answer

Here is the report  Kill'em by g3n-h@ckm@n 1.2.1.2  User : 13 (Administrators) Update on 29/01/2010 by g3n-h@ckm@n ::::: 11:50 Start at: 17:52:34 | 31/01/2010 Contact : g3n-h@ckm@n on CCM  AMD Sempron(tm) 2800+ Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3 Internet Explorer 8.0.6001.18702 Windows Firewall Status : Disabled AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]  C:\ -> Local hard disk | 37.26 Go (8.06 Go free) [ACER] | FAT32 D:\ -> CD-ROM drive E:\ -> CD-ROM drive F:\ -> Removable disk G:\ -> Removable disk | 7.45 Go (3.09 Go free) [8 GB USB] | FAT32 I:\ -> Removable disk J:\ -> Removable disk K:\ -> Removable disk   ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running  C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft LifeCam\MSCamS32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\system32undll32.exe C:\WINDOWS\vVX1000.exe C:\Program Files\BboxUpdate\BTLiveUpdate.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\PROMT5\INTEGRAL\pinmenu.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\List_Kill'em\List_Kill'em.scr C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Documents and Settings\13\Local Settings	emp\48.tmp\ERUNT.EXE C:\Documents and Settings\13\Local Settings	emp\48.tmp\pv.exe  Detections : ==========   ¤¤¤¤¤¤¤¤¤¤ Files/folders :  Quarantined & Deleted !! : C:\Program Files\Adverts Quarantined & Deleted !! : C:\WINDOWS\002960_.tmp Quarantined & Deleted !! : C:\WINDOWS\005876_.tmp Quarantined & Deleted !! : C:\WINDOWS\005897_.tmp Quarantined & Deleted !! : C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe Quarantined & Deleted !! : C:\WINDOWS\Fonts\GRGAREF.TTF Quarantined & Deleted !! : C:\WINDOWS\iun6002.exe  Quarantined & Deleted !! : C:\WINDOWS\system32\xinput9_1_0.dll Quarantined & Deleted !! : C:\WINDOWS\system32\x3daudio1_0.dll Quarantined & Deleted !! : C:\WINDOWS\system32\x3daudio1_1.dll Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn Quarantined & Deleted !! : C:\WINDOWS\System32\SET144.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET150.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SETFB.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SETFC.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SETFD.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SETFE.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SETFF.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET100.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET101.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET102.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET103.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET106.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET107.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET108.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET109.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET10A.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET10B.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET10D.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET10E.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET10F.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET110.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET111.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET112.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET113.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET114.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET115.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET116.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET117.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET118.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET119.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET11A.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET11B.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET11C.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET11D.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET11E.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET120.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET121.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET122.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET124.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET125.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET126.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET128.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET129.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET12A.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET12B.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET12C.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET12D.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET12E.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET12F.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SET130.tmp Quarantined & Deleted !! : C:\Documents and Settings\13\Application Data\GDIPFONTCACHEV1.DAT Quarantined & Deleted !! : C:\Documents and Settings\13\LOCAL Settings\Temp\qta5.exe Quarantined & Deleted !! : C:\Documents and Settings\13\LOCAL Settings\Temp\wlsetup-cvr.exe Quarantined & Deleted !! : C:\Documents and Settings\13\RefEdit.exd  ============== host file OK ! ==============  ======== Registry ======== Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff  ============ Disk Cleaned ============  ================ Prefetch cleaned ================    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

fraggle559 · Answer

I thought it was already done!! What is left?  Here is the RSIT report   Logfile of random's system information tool 1.06 (written by random/random) Run by 13 at 2010-01-31 18:13:42 Microsoft Windows XP Home Edition Service Pack 3 System drive C: has 8 GB (22%) free of 38 GB Total RAM: 735 MB (63% free)  Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:13:48, on 31/01/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal  Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\Microsoft LifeCam\MSCamS32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\system32undll32.exe C:\WINDOWS\vVX1000.exe C:\Program Files\BboxUpdate\BTLiveUpdate.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\PROMT5\INTEGRAL\pinmenu.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Documents and Settings\13\Desktop\RSIT(2).exe C:\Program Files	rend micro\13.exe  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Windows Live Sign-in Assistant Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [PROMT Integrator] "C:\Program Files\PROMT5\INTEGRAL\PinStart.exe" /autorun O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe" O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe O4 - HKLM\..\Run: [BboxUpdate] C:\Program Files\BboxUpdate\BTLiveUpdate.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe" O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -"Mozilla/5.0_(Windows;_U;_Windows_NT_5.1;_fr;_rv:1.9.0.15)_Gecko/2009101601_Firefox/3.0.15_(.NET_CLR_3.5.30729)" -"http://www.funlabo.com/delirants-insolites/jeu-transport-de-whisky.htm" O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xporter to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add to Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint Quick Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Open in a new background tab - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2a22063e1a6841fa860803837843fbd1 O8 - Extra context menu item: Open in a new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2a22063e1a6841fa860803837843fbd1 O9 - Extra button: Direct Add - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menu item: &Direct Add in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Translation - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm O9 - Extra 'Tools' menu item: Translate - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm O9 - Extra 'Tools' menu item: Customize translation options - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm O9 - Extra button: Organize notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menu item: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menu item: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://GLOBAL.ACER.COM/ O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader5.cab O16 - DPF: {741747F6-83B4-4FB9-A268-8CA4010762C8} (Snapfish Activia2) - http://www3.snapfish.fr/SnapfishActivia2.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe  -- End of file - 8712 bytes  ======Scheduled tasks folder======  C:\WINDOWS	asks\User_Feed_Synchronization-{FF5DF99F-C204-45E8-9DC9-B60BD76EAA1D}.job C:\WINDOWS	asks\AppleSoftwareUpdate.job  ======Registry dump======  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Sign-in Assistant Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-12-21 251504]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2009-11-30 764912]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}] Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll [2008-12-21 522224]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2004-08-26 405504] {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-12-21 251504]  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "InCD"=C:\Program Files\Ahead\InCD\InCD.exe [2004-10-18 1315840] "PROMT Integrator"=C:\Program Files\PROMT5\INTEGRAL\PinStart.exe [2001-09-03 49152] "BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent [] "Logitech Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2008-02-29 76304] "Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2008-02-29 76304] "LifeCam"=C:\Program Files\Microsoft LifeCam\LifeExp.exe [2007-05-17 279912] "VX1000"=C:\WINDOWS\vVX1000.exe [2007-04-10 709992] "BboxUpdate"=C:\Program Files\BboxUpdate\BTLiveUpdate.exe [2008-08-06 103936] "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-01-05 413696] "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153] "Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd [] "SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-05-14 67072]  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] "msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-09-16 5724184] "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-10-09 68856] "TomTomHOME.exe"=C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [2009-11-13 247144]  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"=C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150600.exe [2009-06-05 468408]  C:\Documents and Settings\All Users\Start Menu\Programs\Startup Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn] c:\program files\common files\logitech\bluetooth\LBTWlgn.dll [2008-05-02 72208]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\procexp90.Sys]  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WdfLoadGroup]  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=128 "NoDriveAutoRun"=128 "HonorAutoRunSetting"=0  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "HonorAutoRunSetting"= "NoDriveAutoRun"= "NoDriveTypeAutoRun"=  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Messenger\MSMSGS.EXE"="C:\Program Files\Messenger\MSMSGS.EXE:*:Enabled:Windows Messenger" "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Disabled:Logitech Desktop Messenger" "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule" "C:\WINDOWS\System32tcshare.exe"="C:\WINDOWS\System32tcshare.exe:*:Disabled:RTC Application Sharing" "C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting®" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Microsoft LifeCam\LifeCam.exe"="C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe" "C:\Program Files\Microsoft LifeCam\LifeExp.exe"="C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe" "C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Disabled:Firefox" "C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE"="C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "C:\Program Files\Bbox\eSKernel.exe"="C:\Program Files\Bbox\eSKernel.exe:*:Enabled:Bbox installation assistant" "C:\Program Files\BboxUpdate\BTLiveUpdate.exe"="C:\Program Files\BboxUpdate\BTLiveUpdate.exe:*:Enabled:Bbox - Bouygues Telecom - Update utility" "C:\WINDOWS\System32\RUNDLL32.EXE"="C:\WINDOWS\System32\RUNDLL32.EXE:*:Enabled:Run a DLL as an application" "C:\WINDOWS\System32\dpvsetup.exe"="C:\WINDOWS\System32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE"="C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"  ======List of files/folders created in the last 2 months======  2010-01-31 17:52:32 ----A---- C:\Kill'em.txt 2010-01-31 17:52:25 ----D---- C:\Kill'em 2010-01-31 17:01:46 ----A---- C:\List'em.txt 2010-01-31 17:01:25 ----D---- C:\Program Files\List_Kill'em 2010-01-31 11:31:09 ----D---- C:\Documents and Settings\13\Application Data\LEGO Company 2010-01-31 11:31:01 ----D---- C:\Program Files\LEGO Company 2010-01-30 23:13:52 ----RASHD---- C:\autorun.inf 2010-01-30 23:11:39 ----A---- C:\UsbFix.txt 2010-01-30 22:23:17 ----D---- C:\UsbFix 2010-01-30 18:28:05 ----D---- C:sit 2010-01-15 23:10:50 ----HD---- C:\WINDOWS\$NtUninstallKB972270$ 2010-01-13 13:28:28 ----D---- C:\Documents and Settings\13\Application Data\Apple Computer 2009-12-25 11:52:26 ----D---- C:\Documents and Settings\All Users\Application Data\TomTom 2009-12-25 11:51:19 ----D---- C:\Documents and Settings\13\Application Data\TomTom 2009-12-25 11:51:11 ----D---- C:\Program Files\TomTom International B.V 2009-12-25 11:50:59 ----D---- C:\Program Files\TomTom HOME 2 2009-12-21 11:11:12 ----HD---- C:\WINDOWS\$NtUninstallKB955759$ 2009-12-20 13:33:03 ----A---- C:\WINDOWS
tbtlog.txt 2009-12-12 23:49:20 ----HD---- C:\WINDOWS\$NtUninstallKB970430$ 2009-12-12 23:49:15 ----HD---- C:\WINDOWS\$NtUninstallKB974318$ 2009-12-12 23:48:36 ----HD---- C:\WINDOWS\$NtUninstallKB973904$ 2009-12-12 23:48:30 ----HD---- C:\WINDOWS\$NtUninstallKB974392$ 2009-12-12 23:48:23 ----HD---- C:\WINDOWS\$NtUninstallKB971737$  ======List of files/folders modified in the last 2 months======  2010-01-31 18:04:22 ----A---- C:\AUTOEXEC.BAT 2010-01-31 16:32:28 ----A---- C:\WINDOWS\SchedLgU.Txt 2010-01-31 12:57:52 ----A---- C:\WINDOWS\NeroDigital.ini 2010-01-15 23:10:56 ----A---- C:\WINDOWS\imsins.BAK 2010-01-05 01:17:46 ----A---- C:\WINDOWS\system32\MRT.exe 2009-12-21 20:07:02 ----A---- C:\WINDOWS\system32\wininet.dll 2009-12-21 20:07:02 ----A---- C:\WINDOWS\system32\urlmon.dll 2009-12-21 20:07:00 ----A---- C:\WINDOWS\system32\occache.dll 2009-12-21 20:07:00 ----A---- C:\WINDOWS\system32\mshtml.dll 2009-12-21 20:06:58 ----A---- C:\WINDOWS\system32\msfeedsbs.dll 2009-12-21 20:06:58 ----A---- C:\WINDOWS\system32\msfeeds.dll 2009-12-21 20:06:58 ----A---- C:\WINDOWS\system32\jsproxy.dll 2009-12-21 20:06:58 ----A---- C:\WINDOWS\system32\iertutil.dll 2009-12-21 20:06:56 ----A---- C:\WINDOWS\system32\iepeers.dll 2009-12-21 20:06:56 ----A---- C:\WINDOWS\system32\ieframe.dll 2009-12-21 20:06:52 ----A---- C:\WINDOWS\system32\iedkcs32.dll 2009-12-21 14:20:16 ----A---- C:\WINDOWS\system32\ie4uinit.exe 2009-12-12 23:52:36 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI  ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======  R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2005-07-04 43488] R1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41856] R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [] R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104] R1 InCDPass;InCDPass; C:\WINDOWS\System32\DRIVERS\InCDPass.sys [2004-10-18 28928] R1 incdrm;InCD Reader; C:\WINDOWS\system32\drivers\incdrm.sys [2004-10-18 27648] R1 SiSkp;SiSkp; C:\WINDOWS\system32\DRIVERS\srvkp.sys [2004-07-08 12416] R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-07-18 28520] R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2009-07-29 5632] R1 WS2IFSL;Windows Sockets 2.0 Non-IFS Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-05 12032] R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-10 56816] R3 ALCXSENS;WDM 3D Audio Driver Service; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2004-02-24 400384] R3 ALCXWDM;Realtek AC97 Audio (WDM) Service; C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-05-14 622172] R3 catchme;catchme; \??\C:\DOCUME~1\13\LOCALS~1\Temp\catchme.sys [] R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2008-02-29 20240] R3 L8042mou;SetPoint PS/2 Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\L8042mou.Sys [2008-02-29 63120] R3 LMouKE;SetPoint Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouKE.Sys [2008-02-29 79120] R3 NTIDrvr;Upper Class Filter Driver; C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys [2005-04-18 6912] R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2004-07-08 217600] R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2004-02-28 32256] R3 usbaudio;USB audio driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032] R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;USB2 Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152] R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] R3 VX1000;VX-1000; C:\WINDOWS\system32\DRIVERS\VX1000.sys [2007-04-10 1966312] R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDfs.sys [2004-10-18 98048]

fraggle559 · Answer

Here is the ToolCleaner report, but I still have icons on the desktop for Rsit and list kill'em.

[ ToolCleaner Report version 2.3.11 (by A.Rothstein & dj QUIOU) ]

--> Search:

C:\UsbFix.txt: found!
C:\UsbFix: found!
C:\Rsit: found!
C:\Documents and Settings\13\Local Settings\temp\27.tmp\catchme.exe: found!
C:\Documents and Settings\13\Local Settings\temp\27.tmp\mbr.log: found!
C:\Documents and Settings\13\Local Settings\temp\27.tmp\mbr.exe: found!
C:\Documents and Settings\13\Local Settings\temp\48.tmp\catchme.exe: found!
C:\Documents and Settings\13\Local Settings\temp\48.tmp\mbr.exe: found!
C:\Documents and Settings\13\Desktop\UsbFix.exe: found!
C:\Documents and Settings\13\Desktop\UsbFix.txt: found!
C:\Documents and Settings\13\Desktop\Rsit.exe: found!
C:\Documents and Settings\13\Desktop\catchme.log: found!
C:\Program Files\Trend Micro\HijackThis.exe: found!
C:\Program Files\Trend Micro\hijackthis.log: found!
C:\Backups\catchme.log: found!

---------------------------------
--> Deletion:

C:\Documents and Settings\13\Local Settings\temp\27.tmp\catchme.exe: deleted!
C:\Documents and Settings\13\Local Settings\temp\48.tmp\catchme.exe: deleted!
C:\Program Files\Trend Micro\HijackThis.exe: deleted!
C:\UsbFix.txt: deleted!
C:\Documents and Settings\13\Local Settings\temp\27.tmp\mbr.log: deleted!
C:\Documents and Settings\13\Local Settings\temp\27.tmp\mbr.exe: deleted!
C:\Documents and Settings\13\Local Settings\temp\48.tmp\mbr.exe: deleted!
C:\Documents and Settings\13\Desktop\UsbFix.exe: deleted!
C:\Documents and Settings\13\Desktop\UsbFix.txt: deleted!
C:\Documents and Settings\13\Desktop\Rsit.exe: deleted!
C:\Documents and Settings\13\Desktop\catchme.log: deleted!
C:\Program Files\Trend Micro\hijackthis.log: deleted!
C:\Backups\catchme.log: deleted!
C:\UsbFix: deleted!
C:\Rsit: deleted!

Recycle Bin emptied!

fraggle559 · Answer

I have to leave the computer now. I will resume the cleaning with CCleaner later. I also still need to recreate a restore point. Thank you.

fraggle559 · Answer

Hello,

I have finished the cleaning.

I loaded FileHippo. I had it on my computer for a while but I noticed that it always downloaded original versions where I couldn't choose French, which is why I removed it. I then had programs all in English that I had to uninstall to reinstall in French. Not great.
Is there a French version available?

Thank you for your valuable help.

fraggle559 · Answer

Should I use the defragmenter now? I've never done it because I'm a bit hesitant to touch it.

fraggle559 · Answer

I actually thought it was the opposite and that it scattered the documents. I will do it later because I suppose nothing can be done while it's defragmenting.

fraggle559 · Answer

Ok. I suppose the cleaning is finished then. Can I mark it as resolved?

fraggle559 · Answer

To defragment, do I first need to run a scan or should I check defragment immediately?

fraggle559 · Answer

ok thanks

fraggle559 · Answer

Hello, Indeed, I gained about 4 GB by defragmenting.

fraggle559 · Answer

Yes, that's huge; it's true that I had never done it before. I will follow your advice, by the way, can I set an option for it to be done automatically by the computer?

fraggle559 · Answer

Hello, I searched but it seems complicated to me. So I will leave it like this and get into the habit of doing it regularly. Thank you.

fraggle559 · Answer

Hello,  Sorry, I haven’t turned on the computer for a few days. I would like to know if the next time I have a problem with the computer, I can use Hitjakthis alone, and possibly run it from time to time to make sure everything is okay. Is there a risk of making a mistake? Have a good day.

fraggle559 · Answer

Thank you for your response. Actually, I just ran Malwarebytes which found nothing, but I have a strange feeling. Today, I saw my mouse moving without me touching it and I just had a lot of trouble connecting to the forum; I couldn't access this post directly. So I would like to learn how to handle it on my own when this happens. There may be nothing, but since my son downloaded a program with a toolbar that I uninstalled, I'm afraid it didn't come alone.

fraggle559 · Answer

Good evening, Yes, I am quite annoyed by this useless download.  Here is the link to the report http://www.cijoint.fr/cjlink.php?file=cj201002/cijUyQdERd.txt  I just noticed strange links to "avenue des jeux" when I opened Mozilla. I don’t always monitor it, but it seems suspicious to me.  I am furious because the cleaning was excellent.

fraggle559 · Answer

That's good news. However, Malwarebytes was unable to update. It displayed an error message. So I went ahead and started the scan anyway.

fraggle559 · Answer

Here is the Malwarebytes report.  Malwarebytes' Anti-Malware 1.44 Database version: 3720 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702  11/02/2010 20:06:42 mbam-log-2010-02-11 (20-06-42).txt  Scan type: Full scan (C:\|G:\|) Items scanned: 201426 Elapsed time: 49 minute(s), 33 second(s)  Infected memory processes: 0 Infected memory modules: 0 Infected Registry keys: 0 Infected Registry values: 0 Infected Registry data items: 0 Infected folders: 0 Infected files: 0  Infected memory processes: (No harmful items detected)  Infected memory modules: (No harmful items detected)  Infected Registry keys: (No harmful items detected)  Infected Registry values: (No harmful items detected)  Infected Registry data items: (No harmful items detected)  Infected folders: (No harmful items detected)  Infected files: (No harmful items detected)

fraggle559 · Answer

Hello,  So that's a relief. I prefer that. Can I uninstall ZHPfix manually?

fraggle559 · Answer

Yes, I now use Malwarebytes whenever I have a doubt, but it’s true that before, I tended to forget its updates.  The PC seems to be working fine at the moment. I may have had a temporary issue with the connection that made me think it was the PC. I don’t really know what else it could be since there are no viruses.  Thank you for your help. Have a good day and a great weekend.

Heuristic virus

46 answers

No sound

Suspected virus

Allow website on kaspersky

Add google calendar appointment by voice

Reversing at the toll booth: 4 points lost and €135 fine

Saracroche: the effective french app against phone spam

Sound is blocked! how to fix it?

Asterisk key?

Ellsworth kelly

Victim of a bank hacking