infection win32 sality q Fermé

Question

salut à tous !
je suis aussi infecté par win32 sality q.
Après quelques tours sur les forums je crois avoir compris qu'il fallait fair un scan avec hijackThis.
Donc voici le mien, en espérant que quelqu'un puisse m'aider !!
(j'ai avast comme antivirus sur win xp sp 2)

en vous remerciant, flo



Logfile of HijackThis v1.99.1
Scan saved at 17:30:02, on 18/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\APPS\SMP\SmpSys.exe
C:\WINDOWS\system32\ctfmon.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Flo\Bureau\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=6&key=SEARCH
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [TkBellExe] "realsched.exe"  -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {275D2217-FFE8-46B5-8FD2-B18CA0B7EE36} (Seagate SeaTools Online French) - file:///C:/DRIVERS/snapsys/HDDDiag/bin/npseatools.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4902/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

salwa5 · Answer

bonsoir fait un scan en ligne ici

https://www.pandasecurity.com/?ref=www.pandasoftware.com/activescan/fr/activescan_principal.htm 

Il faudra peut etre désactiver ton AV. 
Ensuite colle le rapport du scan.

a++++

rOgé · Answer

ok voici le scan panda :

Virus:Trj/RcomSteal.B                                                           Désinfecté                    C:\WINDOWS\system32\ope6.exe                                                                                                                                                                                                                                    
Virus:Trj/RcomSteal.B                                                           Désinfecté                    C:\WINDOWS\system32\opeA3.exe                                                                                                                                                                                                                                   
Spyware:Cookie/Xiti                                                             No Désinfecté                 D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt[.xiti.com/]                                                                                                                                                
Spyware:Cookie/Doubleclick                                                      No Désinfecté                 D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt[.doubleclick.net/]                                                                                                                                         
Spyware:Cookie/RealMedia                                                        No Désinfecté                 D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt[.247realmedia.com/]                                                                                                                                        
Spyware:Cookie/Zedo                                                             No Désinfecté                 D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt[.zedo.com/]                                                                                                                                                
Spyware:Cookie/Adtech                                                           No Désinfecté                 D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt[.adtech.de/]                                                                                                                                               
Spyware:Cookie/Bluestreak                                                       No Désinfecté                 D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt[.bluestreak.com/]                                                                                                                                          
Spyware:Cookie/Tradedoubler                                                     No Désinfecté                 D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt[.tradedoubler.com/]                                                                                                                                        
Spyware:Cookie/Mediaplex                                                        No Désinfecté                 D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt[.mediaplex.com/]                                                                                                                                           
Spyware:Cookie/Weborama                                                         No Désinfecté                 D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt[.weborama.fr/]                                                                                                                                             
Spyware:Cookie/Atlas DMT                                                        No Désinfecté                 D:\Documents and Settings\Flo\Cookies\flo@atdmt[2].txt                                                                                                                                                                                                          
Spyware:Cookie/Bluestreak                                                       No Désinfecté                 D:\Documents and Settings\Flo\Cookies\flo@bluestreak[1].txt                                                                                                                                                                                                     
Spyware:Cookie/Doubleclick                                                      No Désinfecté                 D:\Documents and Settings\Flo\Cookies\flo@doubleclick[1].txt                                                                                                                                                                                                    
Spyware:Cookie/Xiti  


merci déja et j'attends tes conseils pour la suite

(j'ai changé de pseudo)

salwa5 · Answer

bonsoir ; malheureusement t'es infecté par un virus tres destructeur  donc il faut agir vite  avant qu'il ne sois trop tard car ce virus peu  infecté des fichier system :/ , j'aurai esperé que panda le trouve et le supprime mais malhereusement il ne l'a meme pas detecté :/

donc en urgence telecharge

AVG anti spyware 
 https://www.01net.com/telecharger/

(n'oublie pas de le mettre a jour avant de lancer le scan)


Relance AVG AS puis choisis l'onglet "Analyse" 
Puis l'onglet "Paramètres" 
Sous la question "Comment réagir ?", clique sur "Actions recommandées" et choisis "Quarantaine" 
Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système" 
 
/!\ Si un fichier est infecté en fin d'analyse /!\  
Clique sur "Appliquer toutes les actions "  
 
Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous" 
Enregistre ce fichier texte sur ton bureau ensuite colle le raport ici 

je ne pourai pas attendre la fin du scan car il se fait tard , si avg antispyware ne le supprime pas  alors fait comme ceci


- Télécharge eScan Antivirus Toolkit https://www.malekal.com/tutorial-escan-antivirus-toolkit/

Redémarre en mode sans échec, pour cela : 
redémarre l'ordinateur, avant le logo windows, tapote sur la touche F8, un menu va apparaître, choisis: 
mode sans échec avec prise en charge du réseau. 

- Installe le dans le dossier C:\Kaspersky 
- Rends toi dans le dossier C:\Kaspersky et double-clic sur kavupd.exe pour le mettre à jour 
- Ouvre le dossier C:\Kaspersky 
- double-clique sur le fichier mwavscan.com 
- Coche les options comme indiquées sur cette page https://www.malekal.com/fichiers/eScan/eScan3.png
- puis en bas à droite, clic sur Scan Clean pour démarrer le scan 
- A la fin du scan clic sur le bouton view log, enregistre le fichier à l'endroit que tu le souhaites 

- Redémarre l'ordinateur 
- Copie/colle le contenu le rapport de scan que tu as sauvegardé 

voila on esperant qu'il n'est pas trop et que des fichier system n'ont pas été touché


a+++

bon courage

rOgé · Answer

Oula !!

Et bien merci bien de ton aide précieuse. J'ai fait le scan AVG :

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	09:28:40 19/12/2006

 + Résultat de l'analyse:	



C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP137\A0026939.exe -> Dropper.Agent.aaq : Aucune action entreprise.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP137\A0026940.exe -> Dropper.Agent.aaq : Aucune action entreprise.
G:\@Installation\@internet\Internet Download Manager 3.17\Internet_Download_Manager_3.17_crack\idm.3.full.patch-tsrh.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Aucune action entreprise.
G:\@Installation\@systeme\Panda Titanium 2004\Panda.AntiVirus.Titanium.2004.v3.0_crack.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Aucune action entreprise.
:mozilla.30:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.31:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.32:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.33:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.34:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.35:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.36:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.38:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.39:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.40:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.41:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.42:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.8:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Adtech : Aucune action entreprise.
:mozilla.9:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Adtech : Aucune action entreprise.
D:\Documents and Settings\Flo\Cookies\flo@atdmt[2].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
:mozilla.43:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
D:\Documents and Settings\Flo\Cookies\flo@bluestreak[1].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
:mozilla.13:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
D:\Documents and Settings\Flo\Cookies\flo@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
D:\Documents and Settings\Flo\Cookies\flo@doubleclick[2].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
:mozilla.25:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
:mozilla.24:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.26:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.27:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.28:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.29:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.10:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.11:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.12:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
D:\Documents and Settings\Flo\Cookies\flo@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.47:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
:mozilla.21:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.22:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.23:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.46:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Zedo : Aucune action entreprise.


Fin du rapport

--------------------------------------------------------------------------------

Je continue avec ce que tu m'as dis dans le post d'avant .

Encore merci, 
à++

rOgé · Answer

Voici le scan escan mais j'arrive pas a coller la totalité donc je n'ai mis que la fin, je ne sais pas si ça va te servir .
En attendant tes conseils avisés, encore merci pour ta patience.


Tue Dec 19 10:56:01 2006 => ***** Checking for specific ITW Viruses *****
Tue Dec 19 10:56:01 2006 => Checking for Welchia Virus...
Tue Dec 19 10:56:01 2006 => Checking for LovGate Virus...
Tue Dec 19 10:56:01 2006 => Checking for CodeRed Virus...
Tue Dec 19 10:56:01 2006 => Checking for OpaServ Virus...
Tue Dec 19 10:56:01 2006 => Checking for Sobig.e Virus...
Tue Dec 19 10:56:01 2006 => Checking for Winupie Virus...
Tue Dec 19 10:56:01 2006 => Checking for Swen Virus...
Tue Dec 19 10:56:01 2006 => Checking for JS.Fortnight Virus...
Tue Dec 19 10:56:01 2006 => Checking for Novarg Virus...
Tue Dec 19 10:56:01 2006 => Checking for Pagabot Virus...
Tue Dec 19 10:56:01 2006 => Checking for Parite.b Virus...
Tue Dec 19 10:56:01 2006 => Checking for Parite.a Virus...
 
Tue Dec 19 10:56:01 2006 => ***** Scanning complete. *****
 
Tue Dec 19 10:56:02 2006 => Total Number of Files Scanned: 98991
Tue Dec 19 10:56:02 2006 => Total Number of Virus(es) Found: 3
Tue Dec 19 10:56:02 2006 => Total Number of Disinfected Files: 0
Tue Dec 19 10:56:02 2006 => Total Number of Files Renamed: 1
Tue Dec 19 10:56:02 2006 => Total Number of Deleted Files: 0
Tue Dec 19 10:56:02 2006 => Total Number of Errors: 231
Tue Dec 19 10:56:02 2006 => Time Elapsed: 01:05:23
Tue Dec 19 10:56:02 2006 => Virus Database Date: 2006/12/02
Tue Dec 19 10:56:02 2006 => Virus Database Count: 247278
 
Tue Dec 19 10:56:02 2006 => Scan Completed.

salwa5 · Answer

bonjour concernant avg il fallais cliqué sur "entreprendre toute les action" pour supprimer ce qu'il  a trouvé 

pour le 2eme scan etant donnée que le scan n'est pas complet donc on peu pas savoir ce qu'il a trouvé :/ c domage 

donc ce qu'il reste a faire c'est de lancé avast et ensuite noté dans le bloc note l'emplacement exact du virus win32 sality q

apres on le suprimera manuelement en mode sans echec


a++++

rOgé · Answer

Ok !!

encore merci, mais pour avg il m'avait sembler avoir fait ce que tu m'avais dit .... j'ai du louper une étape, "flute" !!

Je scan avec avast et je te montre le rapport

A +++

salwa5 · Answer

ok ca marche :p

atoute

GotiC-AngeL · Answer

c:\APPS\HIDSERVICE\HIDSERVICE.exe - Inconnu
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe - Inconnu
C:\apps\ABoard\AOSD.exe - Inconnu
C:\APPS\SMP\SmpSys.exe - Inconnu
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" - Inconnu
O4 - HKLM\..\Run: [TkBellExe] "realsched.exe" -osboot - Inconnu
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe - Inconnu
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html - Eventuellement méchant
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html - Eventuellement méchant
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) - Eventuellement méchant
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) - Eventuellement méchant
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm - Eventuellement méchant
O16 - DPF: {275D2217-FFE8-46B5-8FD2-B18CA0B7EE36} (Seagate SeaTools Online French) - file:///C:/DRIVERS/snapsys/HDDDiag/bin/npseatools.cab - Eventuellement méchant
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/ - Méchant
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe - Inconnu


ses aplication son louche A MON AVIE tu deverais les suprimer mai attent confirmation de quelqun plus caller que moi

rOgé · Answer

ok mais oui j'attend la réponse de salwa5 qui m'aiguille depuis le début ... merci quand même

mon scan d'avast mais un temps fou à se terminer  !!!!!

rOgé · Answer

je n'ai pas planifié de rapport de scan ....

je recommence donc

rOgé · Answer

*
* Rapport avast!
* Ce fichier est généré automatiquement
*
* Tâche utilisée 'Interface utilisateur simplifiée'
* Débuté le mardi 19 décembre 2006 18:21:10
* VPS : 0660-0, 19/12/2006
*

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP137\A0027112.dll [L] Win32:CTX (0)
Fichier déplacé avec succès vers la zone de quarantaine...
Fichiers infectés : 1
Total des fichiers : 171731
Total des dossiers : 7474
Taille totale : 172,2 GB

*
* Tâche arrêtée : mardi 19 décembre 2006 18:48:53
* Programme en exécution était 27 minute(s), 43 seconde(s)
*

rOgé · Answer

j'a refait un scan avec avg en faisant effectuer toutes les actions : 

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	19:39:08 19/12/2006

 + Résultat de l'analyse:	



:mozilla.10:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.11:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.12:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.13:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.14:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.15:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.16:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.17:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.18:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.8:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.23:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.25:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.44:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.45:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.46:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.47:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.41:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
D:\Documents and Settings\Flo\Cookies\flo@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.6:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
D:\Documents and Settings\Flo\Cookies\flo@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.29:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.30:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.31:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.28:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
D:\Documents and Settings\Flo\Cookies\flo@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.32:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.33:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.34:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.35:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.36:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.20:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.21:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.22:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
D:\Documents and Settings\Flo\Cookies\flo@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.49:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.50:D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.


Fin du rapport

salwa5 · Answer

c'est bon avast ne detect plus le virus ce qui est une bonne nouvelle :) . 
esque tu recois toujour des alertes sur  le virus win32 sality q??

refait un log hijack pour un dernier netoayage

a++++

rOgé · Answer

hijack : 


Logfile of HijackThis v1.99.1
Scan saved at 21:12:00, on 19/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\apps\ABoard\AOSD.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\APPS\SMP\SmpSys.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\ctfmon.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\svchost.exe
D:\Documents and Settings\Flo\Bureau\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=6&key=SEARCH
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {275D2217-FFE8-46B5-8FD2-B18CA0B7EE36} (Seagate SeaTools Online French) - file:///C:/DRIVERS/snapsys/HDDDiag/bin/npseatools.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4902/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe



je refai un scan avec avast au cas ou !!

salwa5 · Answer

ree

ouvre hijack / coche ces ligne puis clic sur fix checked :

O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file) 


ensuite supprime les fichiers inutiles (fichiers temporaire , cookies .. ect avec ceci

Ccleaner
https://www.malekal.com/tutoriel-ccleaner/


si tu veut refaire un scan antivirus je te conseil d'effectué un scan en ligne chez kaspersky c'est l'antivirus en ligne qui detecte le mieu le virus win32 sality q  

scan kaspersky https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

 Clic sur l'image Kaspersky Online Scanner
      Clic sur J'accepte
      Installes le ActiveX
      Tu attends que la mise à jour se termine, une fois terminé, 
clic sur Suivant
      Clic sur Paramètres d'analyse
      Coche la case Étendue >> Ok
      Clic sur Poste de travail pour faire un scan complet
      Une fois le scan fini à 100%, clic sur Enregistrer rapport 
sous...
       Enregistrer le rapport au format .txt (en nom tu mets rapport ) ensuite copie et colle  le rapport ici 


a+++

rOgé · Answer

voila : 

-------------------------------------------------------------------------------
 KASPERSKY ON-LINE SCANNER REPORT
 Wednesday, December 20, 2006 1:09:24 AM
 Système d'exploitation : Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
 Kaspersky On-line Scanner version : 5.0.83.0
 Dernière mise à jour de la base antivirus Kaspersky : 19/12/2006
 Enregistrements dans la base antivirus Kaspersky : 252157
-------------------------------------------------------------------------------

Paramètres d'analyse:
	Analyser avec la base antivirus suivante: étendue
	Analyser les archives: vrai
	Analyser les bases de messagerie: vrai

Cible de l'analyse - Poste de travail:
	C:\
	D:\
	E:\
	F:\
	G:\
	I:\

Statistiques de l'analyse:
	Total d'objets analysés: 98644
	Nombre de virus trouvés: 3
	Nombre d'objets infectés: 12 / 0
	Nombre d'objets suspects: 0
	Durée de l'analyse: 02:10:34

Nom de l'objet infecté / Nom du virus / Dernière action
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat	L'objet est verrouillé	ignoré
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db	L'objet est verrouillé	ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws	L'objet est verrouillé	ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log	L'objet est verrouillé	ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log
shield.log	L'objet est verrouillé	ignoré
C:\Program Files\Alwil Software\Avast4\DATAeport\Protection résidente.txt	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_AGENT_LOG1.txt	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_AUDIO\CLML.db	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_AUDIO\CLML.db-journal	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_BINARY\CLML.db	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_BLOB\CLML.db	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_BLOB\CLML.db-journal	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_GLOBAL\CLML.db	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_GLOBAL\CLML.db-journal	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_IMAGE\CLML.db	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_IMAGE\CLML.db-journal	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_MAIN\CLML.db	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_MAIN\CLML.db-journal	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_TV\CLML.db	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_TV\CLML.db-journal	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_VIDEO\CLML.db	L'objet est verrouillé	ignoré
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_VIDEO\CLML.db-journal	L'objet est verrouillé	ignoré
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP137\change.log	L'objet est verrouillé	ignoré
C:\WINDOWS\Debug\PASSWD.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\SchedLgU.Txt	L'objet est verrouillé	ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log	L'objet est verrouillé	ignoré
C:\WINDOWS\Sti_Trace.log	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\CatRoot2\edb.log	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\CatRoot2	mp.edb	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\Antivirus.Evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\AppEvent.Evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\DEFAULT	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\default.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\Internet.evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SAM	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SAM.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SecEvent.Evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SECURITY	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SECURITY.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SOFTWARE	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\software.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SysEvent.Evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SYSTEM	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\system.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\h323log.txt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP	L'objet est verrouillé	ignoré
C:\WINDOWS\Temp\Perflib_Perfdata_150.dat	L'objet est verrouillé	ignoré
C:\WINDOWS\Temp\_avast4_\Webshlock.txt	L'objet est verrouillé	ignoré
C:\WINDOWS\wiadebug.log	L'objet est verrouillé	ignoré
C:\WINDOWS\wiaservc.log	L'objet est verrouillé	ignoré
C:\WINDOWS\WindowsUpdate.log	L'objet est verrouillé	ignoré
D:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-11272006-134744.log	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Cookies\index.dat	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\Logs\Dfsr.log	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\pending.dat	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\Working\database_B6F4_9FAE_F49F_6F7D\dfsr.db	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\Working\database_B6F4_9FAE_F49F_6F7D\fsr.log	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\Working\database_B6F4_9FAE_F49F_6F7D\fsrtmp.log	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\Working\database_B6F4_9FAE_F49F_6F7D	mp.edb	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Windows Live Contacts\cordiercamila@hotmail.comeal\members.stg	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Windows Live Contacts\cordiercamila@hotmail.com\shadow\members.stg	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Historique\History.IE5\index.dat	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Historique\History.IE5\MSHist012006121920061220\index.dat	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Temp\Perflib_Perfdata_574.dat	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Temp\~DF6C3B.tmp	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Temp\~DF747D.tmp	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Temp\~DFF302.tmp	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Temp\~DFF496.tmp	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\Local Settings\Temporary Internet Files\Content.IE5\index.dat	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo\NTUSER.DAT	L'objet est verrouillé	ignoré
D:\Documents and Settings\Flo
tuser.dat.LOG	L'objet est verrouillé	ignoré
D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	L'objet est verrouillé	ignoré
D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	L'objet est verrouillé	ignoré
D:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat	L'objet est verrouillé	ignoré
D:\Documents and Settings\LocalService\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\index.dat	L'objet est verrouillé	ignoré
D:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat	L'objet est verrouillé	ignoré
D:\Documents and Settings\LocalService\NTUSER.DAT	L'objet est verrouillé	ignoré
D:\Documents and Settings\LocalService
tuser.dat.LOG	L'objet est verrouillé	ignoré
D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	L'objet est verrouillé	ignoré
D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	L'objet est verrouillé	ignoré
D:\Documents and Settings\NetworkService\NTUSER.DAT	L'objet est verrouillé	ignoré
D:\Documents and Settings\NetworkService
tuser.dat.LOG	L'objet est verrouillé	ignoré
D:\System Volume Information\MountPointManagerRemoteDatabase	L'objet est verrouillé	ignoré
D:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP137\change.log	L'objet est verrouillé	ignoré
F:\System Volume Information\MountPointManagerRemoteDatabase	L'objet est verrouillé	ignoré
F:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP137\change.log	L'objet est verrouillé	ignoré
G:\@Installation\@internet\RAdminadmin.exe/AdmDll.dll	Infecté : not-a-virus:RemoteAdmin.Win32.RAdmin.20	ignoré
G:\@Installation\@internet\RAdminadmin.exe/raddrv.dll	Infecté : not-a-virus:RemoteAdmin.Win32.RAdmin.20	ignoré
G:\@Installation\@internet\RAdminadmin.exe/radmin.exe	Infecté : not-a-virus:RemoteAdmin.Win32.RAdmin.21	ignoré
G:\@Installation\@internet\RAdminadmin.exe/r_server.exe	Infecté : not-a-virus:RemoteAdmin.Win32.RAdmin.21	ignoré
G:\@Installation\@internet\RAdminadmin.exe	Gentee: infecté - 4	ignoré
G:\System Volume Information\MountPointManagerRemoteDatabase	L'objet est verrouillé	ignoré
G:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP134\A0026608.exe/data0003/NHInstall.exe	Infecté : not-a-virus:AdWare.Win32.NavExcel	ignoré
G:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP134\A0026608.exe/data0003/v2.0.2.cab/NHUninstaller.exe	Infecté : not-a-virus:AdWare.Win32.NavExcel	ignoré
G:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP134\A0026608.exe/data0003/v2.0.2.cab/NHUpdater.exe	Infecté : not-a-virus:AdWare.Win32.NavExcel	ignoré
G:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP134\A0026608.exe/data0003/v2.0.2.cab/NHelper.dll	Infecté : not-a-virus:AdWare.Win32.NavExcel	ignoré
G:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP134\A0026608.exe/data0003/v2.0.2.cab	Infecté : not-a-virus:AdWare.Win32.NavExcel	ignoré
G:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP134\A0026608.exe/data0003	Infecté : not-a-virus:AdWare.Win32.NavExcel	ignoré
G:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP134\A0026608.exe	Inno: infecté - 6	ignoré
G:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP137\change.log	L'objet est verrouillé	ignoré
I:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP137\change.log	L'objet est verrouillé	ignoré

Analyse terminée.

salwa5 · Answer

bonjour aparement ton ordi n'est plus infecté par le virus sality :)


sinon apart ca le scan a detecté un virus que tu doit supprimé manuelement  :

suprime le fichier en gras :

G:\@Installation\@internet\RAdmin\radmin.exe

a+++++

rOgé · Answer

ok c'est fait!!!  merci beaucoup pour tout salwa

je peux encore faire quelquechose afin d'être sûr de la désinfection?

salwa5 · Answer

de rien :) pour finir 

quelque quelque conseilles de base

- installe un parefeu ca va renforcé la securité de l'ordi je te conseille un firewall gratuit ( si tu peu te procurer la version payant c'est encore mieu :)

Kerio (parefeu)

https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html

tuto

http://www.malekal.com/kerio_firewall.php

- passe reglierement les antispyware (adaware , spybot , avg .. ect) pense a les mettre ajour avant de les lancé c'est tres important

-supprime regulierement les fichiers inutiles (fichiers temporaire , cookies .. ect) a l'aide de CCleaner https://www.malekal.com/tutoriel-ccleaner/

-maintenant que ton ordinateur est propre je te conseille de creer un point de restauration comme ca en cas de probleme (virus , plantage ..ect) tu poura tjr revenir en arriere 
http://www.aidoforum.com/tutoriaux-371-creer-un-point-de-restauration-sous-windows.html


a++++

rOgé · Answer

désolé mais avec ad aware sality est détecté (alerte avast)

voici le scan : 

Ad-Aware SE Build 1.06r1
Logfile Created on:mercredi 20 décembre 2006 14:04:18
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R140 18.12.2006
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):11 total references
Tracking Cookie(TAC index:3):3 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


20-12-2006 14:04:18 - Scan started. (Full System Scan)

 MRU List Object Recognized!
    Location:          : D:\Documents and Settings\Floecent
    Description        : list of recently opened documents


 MRU List Object Recognized!
    Location:          : software\microsoft\direct3d\mostrecentapplication
    Description        : most recent application to use microsoft direct3d


 MRU List Object Recognized!
    Location:          : software\microsoft\direct3d\mostrecentapplication
    Description        : most recent application to use microsoft direct X


 MRU List Object Recognized!
    Location:          : software\microsoft\directdraw\mostrecentapplication
    Description        : most recent application to use microsoft directdraw


 MRU List Object Recognized!
    Location:          : S-1-5-21-3927155136-4172668120-3112746847-1006\software\microsoft\directinput\mostrecentapplication
    Description        : most recent application to use microsoft directinput


 MRU List Object Recognized!
    Location:          : S-1-5-21-3927155136-4172668120-3112746847-1006\software\microsoft\directinput\mostrecentapplication
    Description        : most recent application to use microsoft directinput


 MRU List Object Recognized!
    Location:          : S-1-5-21-3927155136-4172668120-3112746847-1006\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
    Description        : list of recent programs opened


 MRU List Object Recognized!
    Location:          : S-1-5-21-3927155136-4172668120-3112746847-1006\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
    Description        : list of recently saved files, stored according to file extension


 MRU List Object Recognized!
    Location:          : S-1-5-21-3927155136-4172668120-3112746847-1006\software\microsoft\windows\currentversion\explorerecentdocs
    Description        : list of recent documents opened


 MRU List Object Recognized!
    Location:          : S-1-5-21-3927155136-4172668120-3112746847-1006\software
ico mak computing\winzip\filemenu
    Description        : winzip recently used archives


 MRU List Object Recognized!
    Location:          : S-1-5-21-3927155136-4172668120-3112746847-1006\software\microsoft\windows media\wmsdk\general
    Description        : windows media sdk 


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
    FilePath           : \SystemRoot\System32\
    ProcessID          : 448
    ThreadCreationTime : 20-12-2006 13:02:39
    BasePriority       : Normal


#:2 [csrss.exe]
    FilePath           : \??\C:\WINDOWS\system32\
    ProcessID          : 672
    ThreadCreationTime : 20-12-2006 13:02:42
    BasePriority       : Normal


#:3 [winlogon.exe]
    FilePath           : \??\C:\WINDOWS\system32\
    ProcessID          : 700
    ThreadCreationTime : 20-12-2006 13:02:45
    BasePriority       : High


#:4 [services.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 744
    ThreadCreationTime : 20-12-2006 13:02:47
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Système d'exploitation Microsoft® Windows®
    CompanyName        : Microsoft Corporation
    FileDescription    : Applications Services et Contrôleur
    InternalName       : services.exe
    LegalCopyright     : © Microsoft Corporation. Tous droits réservés.
    OriginalFilename   : services.exe

#:5 [lsass.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 756
    ThreadCreationTime : 20-12-2006 13:02:47
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : LSA Shell (Export Version)
    InternalName       : lsass.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : lsass.exe

#:6 [ati2evxx.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 900
    ThreadCreationTime : 20-12-2006 13:02:49
    BasePriority       : Normal
    FileVersion        : 6.14.10.4117
    ProductVersion     : 6.14.10.4117
    ProductName        : ATI External Event Utility for WindowsNT and Windows9X
    CompanyName        : ATI Technologies Inc.
    FileDescription    : ATI External Event Utility EXE Module
    InternalName       : ATI2EVXX.EXE
    LegalCopyright     : Copyright © 1999-2004 ATI Technologies Inc.
    OriginalFilename   : ATI2EVXX.EXE

#:7 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 920
    ThreadCreationTime : 20-12-2006 13:02:49
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:8 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 992
    ThreadCreationTime : 20-12-2006 13:02:50
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:9 [msmpeng.exe]
    FilePath           : C:\Program Files\Windows Defender\
    ProcessID          : 1032
    ThreadCreationTime : 20-12-2006 13:02:50
    BasePriority       : Normal
    FileVersion        : 1.1.1593.0
    ProductVersion     : 1.1.1593.0
    ProductName        : Windows Defender
    CompanyName        : Microsoft Corporation
    FileDescription    : Service Executable
    InternalName       : MsMpEng.exe
    LegalCopyright     : © Microsoft Corporation.  All rights reserved.
    OriginalFilename   : MsMpEng.exe

#:10 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1112
    ThreadCreationTime : 20-12-2006 13:02:51
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:11 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1168
    ThreadCreationTime : 20-12-2006 13:02:51
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:12 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1280
    ThreadCreationTime : 20-12-2006 13:02:52
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:13 [ati2evxx.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1596
    ThreadCreationTime : 20-12-2006 13:02:58
    BasePriority       : Normal
    FileVersion        : 6.14.10.4117
    ProductVersion     : 6.14.10.4117
    ProductName        : ATI External Event Utility for WindowsNT and Windows9X
    CompanyName        : ATI Technologies Inc.
    FileDescription    : ATI External Event Utility EXE Module
    InternalName       : ATI2EVXX.EXE
    LegalCopyright     : Copyright © 1999-2004 ATI Technologies Inc.
    OriginalFilename   : ATI2EVXX.EXE

#:14 [explorer.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 1684
    ThreadCreationTime : 20-12-2006 13:02:59
    BasePriority       : Normal
    FileVersion        : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 6.00.2900.2180
    ProductName        : Système d'exploitation Microsoft® Windows®
    CompanyName        : Microsoft Corporation
    FileDescription    : Explorateur Windows
    InternalName       : explorer
    LegalCopyright     : © Microsoft Corporation. Tous droits réservés.
    OriginalFilename   : EXPLORER.EXE

#:15 [spoolsv.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1728
    ThreadCreationTime : 20-12-2006 13:02:59
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)
    ProductVersion     : 5.1.2600.2696
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Spooler SubSystem App
    InternalName       : spoolsv.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : spoolsv.exe

#:16 [aswupdsv.exe]
    FilePath           : C:\Program Files\Alwil Software\Avast4\
    ProcessID          : 120
    ThreadCreationTime : 20-12-2006 13:03:01
    BasePriority       : Normal


#:17 [ashserv.exe]
    FilePath           : C:\Program Files\Alwil Software\Avast4\
    ProcessID          : 224
    ThreadCreationTime : 20-12-2006 13:03:02
    BasePriority       : High
    FileVersion        : 4, 7, 889, 0
    ProductVersion     : 4, 7, 0, 0
    ProductName        : avast! Antivirus 
    FileDescription    : avast! antivirus service
    InternalName       : aswServ
    LegalCopyright     : Copyright (c) 2006 ALWIL Software
    OriginalFilename   : aswServ.exe

#:18 [soundman.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 376
    ThreadCreationTime : 20-12-2006 13:03:05
    BasePriority       : Normal
    FileVersion        : 5, 1, 0, 46
    ProductVersion     : 5, 1, 0, 46
    ProductName        : Realtek Sound Manager
    CompanyName        : Realtek Semiconductor Corp.
    FileDescription    : Realtek Sound Manager
    InternalName       : ALSMTray
    LegalCopyright     : Copyright (c) 2001-2004 Realtek Semiconductor Corp.
    OriginalFilename   : ALSMTray.exe
    Comments           : Realtek AC97 Audio Sound Manager

#:19 [atiptaxx.exe]
    FilePath           : C:\ATI Technologies\ATI Control Panel\
    ProcessID          : 384
    ThreadCreationTime : 20-12-2006 13:03:05
    BasePriority       : Normal
    FileVersion        : 6.14.10.5157
    ProductVersion     : 6.14.10.5157
    ProductName        : ATI Desktop Component
    CompanyName        : ATI Technologies, Inc.
    FileDescription    : ATI Desktop Control Panel
    InternalName       : Atiptaxx.exe
    LegalCopyright     : Copyright (C) 1998-2005 ATI Technologies Inc.
    OriginalFilename   : Atiptaxx.exe

#:20 [jusched.exe]
    FilePath           : C:\Program Files\Java\jre1.5.0_06\bin\
    ProcessID          : 396
    ThreadCreationTime : 20-12-2006 13:03:05
    BasePriority       : Normal


#:21 [monitor.exe]
    FilePath           : C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\
    ProcessID          : 408
    ThreadCreationTime : 20-12-2006 13:03:05
    BasePriority       : Normal
    FileVersion        : 2.0.0.0
    ProductVersion     : 2.0.0.0
    ProductName        : Ulead AutoDetector
    CompanyName        : Ulead Systems, Inc.
    FileDescription    : AutoDetector
    InternalName       : AutoDetector
    LegalCopyright     : Copyright (c)1992-2004. Ulead Systems, Inc. All rights reserved.
    LegalTrademarks    : Ulead Systems, MediaStudio and Ulead Photo Explorer are registered trademarks of Ulead Systems, Inc.
    OriginalFilename   : MONITOR.EXE

#:22 [guard.exe]
    FilePath           : C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\
    ProcessID          : 468
    ThreadCreationTime : 20-12-2006 13:03:05
    BasePriority       : Normal
    FileVersion        : 7, 5, 0, 47
    ProductVersion     : 7, 5, 0, 47
    ProductName        : AVG Anti-Spyware
    CompanyName        : Anti-Malware Development a.s.
    FileDescription    : AVG Anti-Spyware guard
    InternalName       : AVG Anti-Spyware guard
    LegalCopyright     : Copyright © 2006 Anti-Malware Development a.s.
    OriginalFilename   : guard.exe

#:23 [pcmservice.exe]
    FilePath           : C:\Apps\Powercinema\
    ProcessID          : 488
    ThreadCreationTime : 20-12-2006 13:03:05
    BasePriority       : Normal
    FileVersion        : 4.0.0.0000
    ProductVersion     : 4.0.0.0000
    ProductName        : Cyberlink PowerCinema
    CompanyName        : CyberLink Corp.
    FileDescription    : CyberLink PowerCinema Resident Program
    InternalName       : CyberLink PowerCinema Resident Program
    LegalCopyright     : Copyright (c) 2005 CyberLink Corp.
    OriginalFilename   : PCMService.exe

#:24 [aboard.exe]
    FilePath           : C:\apps\ABoard\
    ProcessID          : 504
    ThreadCreationTime : 20-12-2006 13:03:06
    BasePriority       : Normal
    FileVersion        : 1, 2, 0, 0
    ProductVersion     : 1, 2, 0, 0
    ProductName        :  Activboard Application
    CompanyName        : NEC Computers International
    FileDescription    : Activboard Application
    InternalName       : Activboard
    LegalCopyright     : Copyright (C) 2003
    OriginalFilename   : ABoard.exe

#:25 [ashdisp.exe]
    FilePath           : C:\PROGRA~1\ALWILS~1\Avast4\
    ProcessID          : 516
    ThreadCreationTime : 20-12-2006 13:03:06
    BasePriority       : Normal
    FileVersion        : 5, 0, 0, 0
    ProductVersion     : 5, 0, 0, 0
    ProductName        : avast! Antivirus
    FileDescription    : avast! service GUI component
    InternalName       : aswDisp
    LegalCopyright     : Copyright (c) 2006 ALWIL Software
    OriginalFilename   : aswDisp.exe

#:26 [qttask.exe]
    FilePath           : C:\Program Files\QuickTime\
    ProcessID          : 524
    ThreadCreationTime : 20-12-2006 13:03:06
    BasePriority       : Normal
    FileVersion        : 7.1.3
    ProductVersion     : QuickTime 7.1.3
    ProductName        : QuickTime
    CompanyName        : Apple Computer, Inc.
    FileDescription    : QuickTime Task
    InternalName       : QuickTime Task
    LegalCopyright     : Copyright Apple Computer, Inc. 1989-2006
    OriginalFilename   : QTTask.exe

#:27 [aosd.exe]
    FilePath           : C:\apps\ABoard\
    ProcessID          : 536
    ThreadCreationTime : 20-12-2006 13:03:06
    BasePriority       : Below Normal
    FileVersion        : 1, 2, 0, 0
    ProductVersion     : 1, 2, 0, 0
    ProductName        :  ActivOSD Application
    CompanyName        : NEC Computers International
    FileDescription    : ActivOSD Application
    InternalName       : ActivOSD
    LegalCopyright     : Copyright (C) 2003
    OriginalFilename   : ActivOSD.exe

#:28 [ituneshelper.exe]
    FilePath           : C:\Program Files\iTunes\
    ProcessID          : 548
    ThreadCreationTime : 20-12-2006 13:03:07
    BasePriority       : Normal
    FileVersion        : 7.0.2.16
    ProductVersion     : 7.0.2.16
    ProductName        : iTunes
    CompanyName        : Apple Computer, Inc.
    FileDescription    : iTunesHelper Module
    InternalName       : iTunesHelper
    LegalCopyright     : © 2003-2006 Apple Computer, Inc. All Rights Reserved.
    OriginalFilename   : iTunesHelper.exe

#:29 [avgas.exe]
    FilePath           : C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\
    ProcessID          : 584
    ThreadCreationTime : 20-12-2006 13:03:07
    BasePriority       : Normal
    FileVersion        : 7, 5, 0, 50
    ProductVersion     : 7, 5, 0, 50
    ProductName        : AVG Anti-Spyware
    CompanyName        : Anti-Malware Development a.s.
    FileDescription    : AVG Anti-Spyware
    InternalName       : AVG Anti-Spyware
    LegalCopyright     : Copyright © 2006 Anti-Malware Development a.s.
    OriginalFilename   : avgas.exe

#:30 [clcapsvc.exe]
    FilePath           : c:\APPS\Powercinema\Kernel\TV\
    ProcessID          : 596
    ThreadCreationTime : 20-12-2006 13:03:07
    BasePriority       : Normal
    FileVersion        : 4.00.1710
    ProductVersion     : 4.00.1710
    ProductName        : CLCapSvc Module
    FileDescription    : CLCapSvc Module
    InternalName       : CLCapSvc
    LegalCopyright     : Copyright 2004
    OriginalFilename   : CLCapSvc.EXE

#:31 [clmlserver.exe]
    FilePath           : C:\Program Files\CyberLink\Shared Files\CLML_NTService\
    ProcessID          : 628
    ThreadCreationTime : 20-12-2006 13:03:08
    BasePriority       : Normal
    FileVersion        : 1, 1, 0, 1619
    ProductVersion     : 1, 1, 0, 1619
    ProductName        : Cyberlink Media Library Server
    CompanyName        : Cyberlink
    FileDescription    : NT CLMLServer
    InternalName       : NT CLMLServer
    LegalCopyright     : Copyright c 2004
    OriginalFilename   : CLMLServer.exe

#:32 [clmlservice.exe]
    FilePath           : C:\Program Files\CyberLink\Shared Files\CLML_NTService\
    ProcessID          : 720
    ThreadCreationTime : 20-12-2006 13:03:09
    BasePriority       : Normal
    FileVersion        : 1, 1, 0, 1619
    ProductVersion     : 1, 1, 0, 1619
    ProductName        : Cyberlink MediaLibrary NT Service
    CompanyName        : Cyberlink
    FileDescription    : Cyberlink MediaLibrary NT Service
    InternalName       : CLMLService
    LegalCopyright     : Copyright c 2004
    OriginalFilename   : CLMLService.exe

#:33 [hidservice.exe]
    FilePath           : c:\APPS\HIDSERVICE\
    ProcessID          : 760
    ThreadCreationTime : 20-12-2006 13:03:09
    BasePriority       : Normal


#:34 [smpsys.exe]
    FilePath           : C:\APPS\SMP\
    ProcessID          : 1376
    ThreadCreationTime : 20-12-2006 13:03:11
    BasePriority       : Normal
    FileVersion        : 1.0.0.0
    ProductVersion     : 1.0.0.0
    ProductName        : Setup my PC
    CompanyName        : Packard Bell BV
    FileDescription    : SmpSys.exe
    InternalName       : Setup my PC Systray
    LegalCopyright     : Packard Bell BV
    LegalTrademarks    : Packard Bell BV
    OriginalFilename   : SmpSys.exe

#:35 [msnmsgr.exe]
    FilePath           : C:\Program Files\MSN Messenger\
    ProcessID          : 1476
    ThreadCreationTime : 20-12-2006 13:03:12
    BasePriority       : Normal
    FileVersion        : 8.0.0812.00
    ProductVersion     : 8.0.0812
    ProductName        : Messenger
    CompanyName        : Microsoft Corporation
    FileDescription    : Messenger
    InternalName       : msnmsgr.exe
    LegalCopyright     : Copyright (c) Microsoft Corporation.  All rights reserved.
    OriginalFilename   : msnmsgr.exe

#:36 [ulcdrsvr.exe]
    FilePath           : C:\Program Files\Fichiers communs\Ulead Systems\DVD\
    ProcessID          : 1504
    ThreadCreationTime : 20-12-2006 13:03:12
    BasePriority       : Normal
    FileVersion        : 1, 0, 0, 3
    ProductVersion     : 1, 0, 0, 3
    ProductName        : Ulead Systems ULCDRSvr
    CompanyName        : Ulead Systems, Inc.
    FileDescription    : ULCDRSvr
    InternalName       : ULCDRSvr
    LegalCopyright     : Copyright © 2002 Ulead Systems, Inc.
    OriginalFilename   : ULCDRSvr.exe

#:37 [ctfmon.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1500
    ThreadCreationTime : 20-12-2006 13:03:12
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : CTF Loader
    InternalName       : CTFMON
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : CTFMON.EXE

#:38 [reader_sl.exe]
    FilePath           : C:\Program Files\Adobe\Acrobat 7.0\Reader\
    ProcessID          : 1860
    ThreadCreationTime : 20-12-2006 13:03:15
    BasePriority       : Normal
    FileVersion        : 7.0.5.2005092300
    ProductVersion     : 7.0.5.2005092300
    ProductName        : Adobe Acrobat
    CompanyName        : Adobe Systems Incorporated
    FileDescription    : Adobe Acrobat SpeedLauncher
    LegalCopyright     : Copyright 1984-2005 Adobe Systems Incorporated and its licensors. All rights reserved.
    OriginalFilename   : AcroSpeedLaunch.exe

#:39 [clsched.exe]
    FilePath           : c:\APPS\Powercinema\Kernel\TV\
    ProcessID          : 2040
    ThreadCreationTime : 20-12-2006 13:03:17
    BasePriority       : Normal
    FileVersion        : 4.00.1710
    ProductVersion     : 4.00.1710
    ProductName        : CLSched Module
    FileDescription    : CLSched Module
    InternalName       : CLSched
    LegalCopyright     : Copyright 2004
    OriginalFilename   : CLSched.EXE

#:40 [wmiprvse.exe]
    FilePath           : C:\WINDOWS\system32\wbem\
    ProcessID          : 2188
    ThreadCreationTime : 20-12-2006 13:03:42
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : WMI
    InternalName       : Wmiprvse.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : Wmiprvse.exe

#:41 [ipodservice.exe]
    FilePath           : C:\Program Files\iPod\bin\
    ProcessID          : 2216
    ThreadCreationTime : 20-12-2006 13:03:45
    BasePriority       : Normal
    FileVersion        : 7.0.2.16
    ProductVersion     : 7.0.2.16
    ProductName        : iTunes
    CompanyName        : Apple Computer, Inc.
    FileDescription    : iPodService Module
    InternalName       : iPodService
    LegalCopyright     : © 2003-2006 Apple Computer, Inc. All Rights Reserved.
    OriginalFilename   : iPodService.exe

#:42 [ashmaisv.exe]
    FilePath           : C:\Program Files\Alwil Software\Avast4\
    ProcessID          : 2368
    ThreadCreationTime : 20-12-2006 13:03:46
    BasePriority       : Normal


#:43 [ashwebsv.exe]
    FilePath           : C:\Program Files\Alwil Software\Avast4\
    ProcessID          : 2480
    ThreadCreationTime : 20-12-2006 13:03:48
    BasePriority       : Normal


#:44 [alg.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 2744
    ThreadCreationTime : 20-12-2006 13:03:49
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Application Layer Gateway Service
    InternalName       : ALG.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : ALG.exe

#:45 [wmiprvse.exe]
    FilePath           : C:\WINDOWS\system32\wbem\
    ProcessID          : 3440
    ThreadCreationTime : 20-12-2006 13:04:03
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : WMI
    InternalName       : Wmiprvse.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : Wmiprvse.exe

#:46 [ad-aware.exe]
    FilePath           : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
    ProcessID          : 3620
    ThreadCreationTime : 20-12-2006 13:04:06
    BasePriority       : Normal
    FileVersion        : 6.2.0.236
    ProductVersion     : SE 106
    ProductName        : Lavasoft Ad-Aware SE
    CompanyName        : Lavasoft Sweden
    FileDescription    : Ad-Aware SE Core application
    InternalName       : Ad-Aware.exe
    LegalCopyright     : Copyright © Lavasoft AB Sweden
    OriginalFilename   : Ad-Aware.exe
    Comments           : All Rights Reserved

#:47 [wuauclt.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 3752
    ThreadCreationTime : 20-12-2006 13:04:11
    BasePriority       : Normal
    FileVersion        : 5.8.0.2469 built by: lab01_n(wmbla)
    ProductVersion     : 5.8.0.2469
    ProductName        : Système d'exploitation Microsoft® Windows®
    CompanyName        : Microsoft Corporation
    FileDescription    : Mises à jour automatiques
    InternalName       : wuauclt.exe
    LegalCopyright     : © Microsoft Corporation. Tous droits réservés.
    OriginalFilename   : wuauclt.exe

#:48 [avast.setup]
    FilePath           : C:\Program Files\Alwil Software\Avast4\setup\
    ProcessID          : 3772
    ThreadCreationTime : 20-12-2006 13:04:12
    BasePriority       : Below Normal


Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 11


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 11


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 11


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : flo@atdmt[2].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:3
    Value              : Cookie:flo@atdmt.com/
    Expires            : 19-12-2011 01:00:00
    LastSync           : Hits:3
    UseCount           : 0
    Hits               : 3

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : flo@bluestreak[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:1
    Value              : Cookie:flo@bluestreak.com/
    Expires            : 17-12-2016 05:54:28
    LastSync           : Hits:1
    UseCount           : 0
    Hits               : 1

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : flo@doubleclick[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:1
    Value              : Cookie:flo@doubleclick.net/
    Expires            : 20-12-2006 11:50:10
    LastSync           : Hits:1
    UseCount           : 0
    Hits               : 1

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 3
Objects found so far: 14



Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 14


Deep scanning and examining files (D:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for D:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 14


Deep scanning and examining files (F:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for F:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 14


Deep scanning and examining files (G:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for G:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 14


Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 14




Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 14

14:12:56 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:08:37.719
Objects scanned:186843
Objects identified:3
Objects ignored:0
New critical objects:3

salwa5 · Answer

sur le scan il n'y rien  !! 

concernant  adaware il faut supprimer ce qu'il a trouvé . 

apres le scan il va t'affiché une liste des spyware trouver , tu coches tout ensuite clic sur suivant pour les suuprimer voici un tutorial tres bien illustré 
http://pageperso.aol.fr/balltrap34/adwseflash.zip 

concernant avast peu tu faire un copié collé de l'alerte

a+++

rOgé · Answer

D:\DOCUME~1\Flo\LOCALS~1\Temp\AAWTMP\C1975000\1E0F2B\kwf501p.exe\[UPX]


il me le trouve là !!

salwa5 · Answer

il se situe dans les fichier  temporaire tu peu le supprimé sans probleme avec ca 

https://www.malekal.com/tutoriel-ccleaner/ 


il faut absolument installé un parefeu pour bloqué ce genre d'intrusion

a+++

rOgé · Answer

bon j'ai mis kerio ... mais dès que je redémarre et que je scan avec ad aware il me retrouve ce fichier avec sality !!!

j'ai l'impression de passer ma vie a scanner .... j'suis vraiment un boulet !!!

salwa5 · Answer

adaware te le trouve ou? esqu'il te propose de le supprimer?

a++++

rOgé · Answer

ben il me le trouve où je t'ai dit plus haut et c'est avast ki se déclenche et me propose de le supprimer ou quaranatine ou  réparation,en + avec  alerte audio :  "alerte il y a un virus sur votre ordinateur"

salwa5 · Answer

ok je propose d'analysé ce fichier ici

http://www.virustotal.com/xhtml/virustotal_en.html 
Clik sur parcourir 
Recherche ceci : 


D:\Documents and Settings\Flo\local settings \Temp\AAWTMP\C1975000\1E0F2B\kwf501p.exe

ensuite colle le resultat ici


a+++

rOgé · Answer

Complete scanning result of "kwf501p.exe", received in VirusTotal at 12.20.2006, 16:46:01 (CET).

Antivirus	Version	Update	Result
AntiVir	7.3.0.19	12.20.2006	no virus found
Authentium	4.93.8	12.20.2006	no virus found
Avast	4.7.892.0	12.20.2006	no virus found
AVG	386	12.19.2006	no virus found
BitDefender	7.2	12.20.2006	no virus found
CAT-QuickHeal	8.00	12.20.2006	no virus found
ClamAV	devel-20060426	12.20.2006	no virus found
DrWeb	4.33	12.20.2006	no virus found
eSafe	7.0.14.0	12.19.2006	no virus found
eTrust-InoculateIT	23.73.91	12.20.2006	no virus found
eTrust-Vet	30.3.3264	12.20.2006	no virus found
Ewido	4.0	12.20.2006	no virus found
Fortinet	2.82.0.0	12.20.2006	no virus found
F-Prot	3.16f	12.20.2006	no virus found
F-Prot4	4.2.1.29	12.20.2006	no virus found
Ikarus	T3.1.0.27	12.20.2006	no virus found
Kaspersky	4.0.2.24	12.20.2006	no virus found
McAfee	4922	12.19.2006	no virus found
Microsoft	1.1904	12.20.2006	no virus found
NOD32v2	1931	12.20.2006	no virus found
Norman	5.80.02	12.20.2006	no virus found
Panda	9.0.0.4	12.19.2006	no virus found
Prevx1	V2	12.20.2006	no virus found
Sophos	4.12.0	12.18.2006	no virus found
Sunbelt	2.2.907.0	12.18.2006	no virus found
TheHacker	6.0.3.135	12.20.2006	no virus found
UNA	1.83	12.19.2006	no virus found
VBA32	3.11.1	12.19.2006	no virus found
VirusBuster	4.3.19:9	12.20.2006	no virus found

Aditional Information
File size: 0 bytes
MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709


enfin, il me dit qu'il ne s'agit pas d'un virus ...... c'est bizarre

salwa5 · Answer

oui la plupart des antivirus ne le consider pas comme un virus peu etre qu' adaware s'enflamme pour rien ...

 tu as 2 partition ( le C: et D:) 

il faut que tu fasse un netoyage des fichier temporaire dans la partition D:

donc lance ccleaner dans la partion D:  redemare et dit moi ce que ca donne

a+++

salwa5 · Answer

si t'arrive pas a passé ccleaner dans la partition D:
dans ce cas supprime le toi meme comme ceci

va dans :

D:\Documents and Settings\Flo\local settings \Temp  vide tout le contenue de ce dossier (temp) ensuite vide la corebeille


redemare / refait un scan adware et dit moi si il te le detecte toujour :)

a+++

rOgé · Answer

bon le sality est tjs là ....

en plus avec ccleaner j'ai fait disparaitre des icones de mon bureau et  de mon menu demarrer  (genre microsoft upadate et tt ce qui est de la partie haute de ce menu, plus des raccourcis de programmes.....)

salwa5 · Answer

esqu'il est possible de demarrer a partir de la partition D:?

a++++

rOgé · Answer

c'est à dire ? redémarrer sous D ? comment ont fait?

salwa5 · Answer

je sais pas comment demarrer aprtir d'une autre partition

c'est pas grave on va essayé autrement :)


tout d'abord 
va dans 
D:\Documents and Settings\Flo\local settings \Temp vide tout le contenue de ce dossier (temp)

ensuite va dans post de travail click droit sur lecteur D: 

ensuite clic sur proprietes /  netoyage du disque / coches tout  et clic sur ok 
normalement il va supprimer tout les fichier inutiles

a+++

rOgé · Answer

ok c'est fait 
mais je suis sur que si je reboot il va revenir
(et pour mes raccourcis dans le menu demarrer?)

salwa5 · Answer

pour les racourci 

ouvre le menu demarrer / tout les programes ensuite tu clic sur le programe que tu veut sans laché le bouton gauche de la souris ensuite tu le glisse a gauche ( en haut du menu demarrer) 

pour le virus avant de redemarer desactive la restauration dans le lecteur D:

clic droit sur le post de travail / dans l'onglet restauration du system choisi le lecteur D: / clic sur parametres / coche desactiver la restauration du system sur ce lecteur 

clic sur ok et appliquer 

redemare et dit moi ce que ca donne :)

a+++

rOgé · Answer

avast ne me détecte plus en mode désactivation de la restauration de D 
 : )
 mais ad aware le détecte : 

D:\Docume~1\Flo\Locals~1\Temp\AATMP\C1275609\36FE79


que dois je faire maintenant?

Lyonnais92 · Answer

Bonjour,

Je crois que le passage sur Virustotal est mal passé (p29 File size: 0 bytes). Tu peux le refaire.

Salwa, tu peux lui faire fixer les 016 seagate et akamai et en profiter pour demander un log HijackThis un peu plus récent.

Un petit coup de blacklight. On a l'impression d'un retour à chaque démarrage. Rootkit ?

Bonne suite.

salwa5 · Answer

bonjour tout le monde :) 

ok remet un nouveau  log hijack stp :)

a++++

rOgé · Answer

oui chef !


Logfile of HijackThis v1.99.1
Scan saved at 13:27:42, on 21/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\APPS\SMP\SmpSys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
D:\Documents and Settings\Flo\Mes documents\emule\emule\emule.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Flo\Bureau\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=6&key=SEARCH
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {275D2217-FFE8-46B5-8FD2-B18CA0B7EE36} (Seagate SeaTools Online French) - file:///C:/DRIVERS/snapsys/HDDDiag/bin/npseatools.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4902/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

salwa5 · Answer

une derniere question avant de commencer le netoyage

esque c  possible de deplacer le programe hijackthis a l'interieur de la partition D: et faire un scan dedant?

a++++

rOgé · Answer

bon, je l'ai mis sous D mes documents mais je sais pas s'il a scanner D voici  le scan 

Logfile of HijackThis v1.99.1
Scan saved at 17:56:43, on 21/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\APPS\SMP\SmpSys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
D:\Documents and Settings\Flo\Mes documents\emule\emule\emule.exe
C:\WINDOWS\system32\svchost.exe
D:\Documents and Settings\Flo\Mes documents\Hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=6&key=SEARCH
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {275D2217-FFE8-46B5-8FD2-B18CA0B7EE36} (Seagate SeaTools Online French) - file:///C:/DRIVERS/snapsys/HDDDiag/bin/npseatools.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4902/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

salwa5 · Answer

ok maintenant  Télécharge Blacklight (de F-Secure) 
https://www.f-secure.com/en
https://europe.f-secure.com/exclude/blacklight/index.shtml 


et sauvegarde le sur ton Bureau. 

Double-clique blbeta.exe et accepte la licence ; laisse [X]scan through Windows Explorer activé ; clique Scan puis Next 

Tu verras une liste de fichiers détectés apparaître. Tu verras également un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres). 

Copie et colle le contenu de ce rapport dans ta prochaine réponse 


a++

rOgé · Answer

12/21/06 18:41:04 [Info]: BlackLight Engine 1.0.47 initialized
12/21/06 18:41:04 [Info]: OS: 5.1 build 2600 (Service Pack 2)
12/21/06 18:41:05 [Note]: 7019 4
12/21/06 18:41:05 [Note]: 7005 0
12/21/06 18:41:22 [Note]: 7006 0
12/21/06 18:41:22 [Note]: 7011 1956
12/21/06 18:41:23 [Note]: 7026 0
12/21/06 18:41:23 [Note]: 7026 0
12/21/06 18:41:29 [Note]: FSRAW library version 1.7.1020
12/21/06 18:45:40 [Note]: 7007 0

salwa5 · Answer

ree :)

on va essayé de faire le netoyage en mode sans echec

redemare en mode sans echec (redemarrage + tapotte sans arret sur la touche F8 desque l'ordi s'allume)

va dans

D:\Documents and Settings\Flo\local settings \Temp vide tout le contenue de ce dossier (temp)  


ensuite vide la corbeille ( tres important)

redemare en mode normal et dit moi ce que ca donne

a+++

rOgé · Answer

désolé masi je ne serais pas pret de mon pc pour les fêtes..... donc je te recontact dans une dizaine de jours 

merci pour tout 

à bientôt

salwa5 · Answer

bonjour :) 

Fais un scan en ligne avec Panda et colle le resultat ici :) https://www.pandasecurity.com/?ref=www.pandasoftware.com/activescan/fr/activescan_principal.htm

Tutorial a suivre ( provenant du site a Malekal_Morte ) :

https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId237368 


a+++

rOgé · Answer

ok voila le scan panda : 


Incident                                                                        Statut                        Analyse                                                                                                                                                                                                                                                         

Virus:W32/SlowMy.A.worm                                                         Désinfecté                    Système d’exploitation                                                                                                                                                                                                                                          
Virus:W32/SlowMy.A.worm                                                         Désinfecté                    C:\MS32DLL.dll.vbs                                                                                                                                                                                                                                              
Virus:W32/SlowMy.A.worm                                                         Désinfecté                    C:\WINDOWS\MS32DLL.dll.vbs                                                                                                                                                                                                                                      
Spyware:Cookie/Xiti                                                             No Désinfecté                 D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt[.xiti.com/]                                                                                                                                                
Spyware:Cookie/RealMedia                                                        No Désinfecté                 D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt[.247realmedia.com/]                                                                                                                                        
Spyware:Cookie/Doubleclick                                                      No Désinfecté                 D:\Documents and Settings\Flo\Application Data\Mozilla\Firefox\Profiles\kjmej6q7.default\cookies.txt[.doubleclick.net/]                                                                                                                                         
Virus:W32/SlowMy.A.worm                                                         Désinfecté                    D:\MS32DLL.dll.vbs                                                                                                                                                                                                                                              
Virus:W32/SlowMy.A.worm                                                         Désinfecté                    F:\MS32DLL.dll.vbs                                                                                                                                                                                                                                              
Virus:W32/SlowMy.A.worm                                                         Désinfecté                    G:\MS32DLL.dll.vbs                                                                                                                                                                                                                                              
Virus:W32/SlowMy.A.worm                                                         Désinfecté                    H:\MS32DLL.dll.vbs

salwa5 · Answer

bonjour :)


redemare en mode sans echec (redemarrage + tapotte sans arret sur la touche F8 desque l'ordi s'allume)

cherches et supprime les fichiers en gras :

D:\MS32DLL.dll.vbs 
F:\MS32DLL.dll.vbs 
G:\MS32DLL.dll.vbs 
H:\MS32DLL.dll.vbs
 C:\MS32DLL.dll.vbs 
C:\WINDOWS\MS32DLL.dll.vbs 


lance ccleaner 


redemare en mode normal et dit moi ce que ca donne

a+++++

rOgé · Answer

J'ai réussi a supprimer C:\WINDOWS\MS32DLL.dll.vbs via ccleaner (outils dans demarrage, une entrée du registre) mais les autres impossible.
Je ne pouvais pas acceder à mes disques en dble cliquant "script MS32DLL.dll.vsb invalide"

Merci 

Pour la suite?

salwa5 · Answer

supprime les avec the killbox


telecharge killbox https://www.generation-nt.com/killbox-telechargement-25430.html 

redemare en mode sans echec (redemarrage + tapotte sans arret sur la touche F8 desque l'ordi s'allume) 

Double clic sur killbox.exe (Pocket Killbox) 

- Dans "Full Path of File to Delete" 
copie et colle: 

C:\MS32DLL.dll.vbs 

-clique sur single file 
- clique sur la croix rouge 
- une fenêtre va apparaître pour confirmation de suppression clique sur YES 


tu fait pareil avec ces fichier

D:\MS32DLL.dll.vbs 
F:\MS32DLL.dll.vbs 
G:\MS32DLL.dll.vbs 
H:\MS32DLL.dll.vbs 
C:\WINDOWS\MS32DLL.dll.vbs 



ensuite va dans post de travail / lecteur C: cherche et supprime le dossier \!KillBox

a+++

rOgé · Answer

ok ! mais maintenant je n'arrive tjs pas a accéder a mes disques en dble cliquant je peux en faisant clic droit ouvrir. sinon il me dit impossible de trouver le script " lettre du disc \MS32DLL.dll.vbs" ......   : (

salwa5 · Answer

mais maintenant je n'arrive tjs pas a accéder a mes disques en dble cliquant 

depuis quand tu as ce probleme ? 
a++

rOgé · Answer

je pense depuis ke j'ai supprimer avec ccleaner une entrée du registre du demarrage : C:\windows\MS32.dll.vbs ; Il me semble, je ne suis pas sur et je ne crois pas que ça a un rapport avec mon virus ....

salwa5 · Answer

je ne connais pas ccleaner mais je suis sure qu'il y'a une option pour restaurer les clée supprimé par erreur ... :p

a++++

rOgé · Answer

ok ! merci, mais pour mon sality on a tout essayé alors  ?

salwa5 · Answer

essay pour voir si il est bien partie :) 

on a pas encore tout essayé , j'ai prevu un scan bitedefender pour la suite ;)

a+++

rOgé · Answer

aller bitdefender alors !!!!!

salwa5 · Answer

voila :) http://www.bitdefender.fr/scan/license.php

a++++

rOgé · Answer

bon j'ai fait mon scan avec bitdefender, il m'a trouvé des Worms qu'il a éliminé. Je n'ai pas gardé le rapport ....... mais j'ai toujours sality après verfication

a++

salwa5 · Answer

bonjour :) ton antivirus le trouve ou? 

a+++

rOgé · Answer

salut !

il me le trouve dans  mes docs sous D Temp\AAWTMP\C21733671\2BA0B4\kwf501p.exe\[UPX]"file

salwa5 · Answer

ree :)

- Télécharge eScan Antivirus Toolkit https://www.malekal.com/tutorial-escan-antivirus-toolkit/

Redémarre en mode sans échec pour cela redémarre l'ordinateur. 
Avant le logo Windows, tapote sur la touche F8 
Un menu va apparaître choisis : Mode sans échec avec prise en charge réseau. 

- Installe le dans le dossier C:\Kaspersky 
- Rends toi dans le dossier C:\Kaspersky et double-clic sur kavupd.exe pour le mettre à jour 


- Ouvre le dossier C:\Kaspersky 
- double-clique sur le fichier mwavscan.com 
- Coche les options comme indiquées sur cette page https://www.malekal.com/fichiers/eScan/eScan3.png
- puis en bas à droite, clic sur Scan Clean pour démarrer le scan 
- A la fin du scan clic sur le bouton view log, enregistre le fichier à l'endroit que tu le souhaites 

- Redémarre l'ordinateur 
- Copie/colle le contenu le rapport de scan que tu as sauvegardé 

a++

rOgé · Answer

Re !! : )

Voici le scan :   je n'ai mis que la fin, je ne sais pas si le reste t'intéresse , car le coller fait bugger firefox ! tiens moi au courant 


Sun Jan 07 21:45:35 2007 => ***** Checking for specific ITW Viruses *****
Sun Jan 07 21:45:35 2007 => Checking for Welchia Virus...
Sun Jan 07 21:45:35 2007 => Checking for LovGate Virus...
Sun Jan 07 21:45:35 2007 => Checking for CodeRed Virus...
Sun Jan 07 21:45:35 2007 => Checking for OpaServ Virus...
Sun Jan 07 21:45:35 2007 => Checking for Sobig.e Virus...
Sun Jan 07 21:45:35 2007 => Checking for Winupie Virus...
Sun Jan 07 21:45:35 2007 => Checking for Swen Virus...
Sun Jan 07 21:45:35 2007 => Checking for JS.Fortnight Virus...
Sun Jan 07 21:45:35 2007 => Checking for Novarg Virus...
Sun Jan 07 21:45:35 2007 => Checking for Pagabot Virus...
Sun Jan 07 21:45:35 2007 => Checking for Parite.b Virus...
Sun Jan 07 21:45:35 2007 => Checking for Parite.a Virus...
 
Sun Jan 07 21:45:35 2007 => ***** Scanning complete. *****
 
Sun Jan 07 21:45:35 2007 => Total Number of Files Scanned: 97953
Sun Jan 07 21:45:35 2007 => Total Number of Virus(es) Found: 0
Sun Jan 07 21:45:35 2007 => Total Number of Disinfected Files: 0
Sun Jan 07 21:45:35 2007 => Total Number of Files Renamed: 0
Sun Jan 07 21:45:35 2007 => Total Number of Deleted Files: 0
Sun Jan 07 21:45:35 2007 => Total Number of Errors: 231
Sun Jan 07 21:45:35 2007 => Time Elapsed: 01:09:12
Sun Jan 07 21:45:35 2007 => Virus Database Date: 2006/12/28
Sun Jan 07 21:45:35 2007 => Virus Database Count: 254631
 
Sun Jan 07 21:45:35 2007 => Scan Completed.

salwa5 · Answer

aparement ton pc est propre :) 

pour enlever le doute fait un dernier scan avec ceci


Télécharge gmer : https://www.majorgeeks.com/files/details/gmer.html
Déconnecte toi d'internet  et ferme tous les programmes.
Décompresse le fichier zip et double-clic sur gmer.exe
IMPORTANT: Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.
Clic sur l'onglet "rootkit"
A droite, coche "Files" et "Services"
Clic sur Scan
Lorsque le scan est terminé, clic sur "copy"

Ouvre le bloc-note et clic sur le Menu Edition / Coller
Le rapport doit alors apparaître.
Enregistre le fichier sur ton bureau et copie/colle le contenu ici.

a+++

rOgé · Answer

ok, voilà : 


GMER 1.0.12.12011 - http://www.gmer.net
Rootkit scan 2007-01-07 22:45:43
Windows 5.1.2600 Service Pack 2


---- Files - GMER 1.0.12 ----

ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\01\10-{1786F034-296F-9366-E811-1301CB302B7B}-v1-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v10-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\12\11-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v12-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v11-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\12\11-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v12-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v11-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\13\12-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v13-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v12-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\13\12-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v13-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v12-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\14\13-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v14-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v13-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\14\13-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v14-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v13-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\15\14-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v15-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v14-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\15\14-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v15-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v14-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\16\15-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v16-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v15-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\16\15-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v16-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v15-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\17\16-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v17-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v16-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\17\16-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v17-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v16-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\18\18-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v18-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v18-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\18\18-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v18-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v18-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\19\20-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v19-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v20-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\19\20-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v19-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v20-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\20\21-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v20-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v21-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\20\21-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v20-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v21-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\21\23-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v21-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v23-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\21\23-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v21-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v23-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\22\22-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v22-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v22-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\22\22-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v22-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v22-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\23\24-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v23-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v24-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\23\24-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v23-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v24-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\24\25-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v24-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v25-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\24\25-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v24-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v25-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\25\26-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v25-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v26-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\25\26-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v25-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v26-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\26\27-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v26-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v27-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\26\27-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v26-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v27-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\27\28-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v27-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v28-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\27\28-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v27-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v28-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\28\29-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v28-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v29-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\28\29-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v28-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v29-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\29\30-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v29-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v30-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\29\30-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v29-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v30-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\30\31-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v30-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v31-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\30\31-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v30-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v31-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\31\32-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v31-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v32-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\31\32-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v31-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v32-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\32\33-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v32-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v33-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\32\33-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v32-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v33-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\33\35-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v33-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v35-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\33\35-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v33-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v35-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\34\36-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v34-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v36-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\34\36-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v34-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v36-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\35\37-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v35-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v37-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\35\37-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v35-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v37-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\36\38-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v36-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v38-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\36\38-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v36-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v38-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\37\41-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v37-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v41-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\37\41-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v37-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v41-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\38\42-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v38-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v42-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\38\42-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v38-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v42-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\39\43-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v39-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v43-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\39\43-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v39-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v43-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\40\40-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v40-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v40-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\40\44-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v40-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v44-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\40\44-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v40-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v44-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\41\45-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v41-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v45-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\41\45-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v41-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v45-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\42\46-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v42-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v46-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\42\46-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v42-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v46-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\43\47-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v43-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v47-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\43\47-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v43-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v47-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\44\51-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v44-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v51-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\44\51-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v44-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v51-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\45\52-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v45-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v52-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\45\52-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v45-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v52-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\46\53-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v46-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v53-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\46\53-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v46-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v53-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\47\54-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v47-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v54-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\47\54-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v47-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v54-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\48\55-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v48-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v55-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\48\55-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v48-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v55-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\49\56-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v49-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v56-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\49\56-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v49-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v56-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\50\57-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v50-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v57-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\50\57-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v50-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v57-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\51\60-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v51-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v60-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\51\60-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v51-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v60-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\52\61-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v52-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v61-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\52\61-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v52-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v61-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\53\62-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v53-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v62-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\53\62-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v53-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v62-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\54\63-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v54-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v63-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\54\63-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v54-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v63-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\55\64-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v55-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v64-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\55\64-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v55-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v64-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\56\65-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v56-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v65-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\56\65-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v56-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v65-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\57\66-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v57-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v66-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\57\66-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v57-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v66-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\58\67-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v58-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v67-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\58\67-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v58-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v67-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\59\68-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v59-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v68-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\59\68-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v59-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v68-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\60\69-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v60-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v69-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\60\69-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v60-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v69-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\61\75-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v61-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v75-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\61\75-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v61-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v75-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\62\76-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v62-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v76-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\62\76-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v62-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v76-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\63\77-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v63-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v77-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\63\77-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v63-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v77-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\64\78-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v64-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v78-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\64\78-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v64-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v78-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\65\79-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v65-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v79-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\65\79-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v65-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v79-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\66\84-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v66-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v84-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\66\84-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v66-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v84-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\67\85-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v67-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v85-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\67\85-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v67-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v85-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\68\86-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v68-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v86-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\68\86-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v68-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v86-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\69\87-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v69-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v87-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\69\87-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v69-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v87-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\70\88-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v70-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v88-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\70\88-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v70-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v88-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\71\89-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v71-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v89-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\71\89-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v71-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v89-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\72\90-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v72-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v90-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\72\90-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v72-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v90-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\73\91-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v73-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v91-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\73\91-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v73-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v91-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\74\92-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v74-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v92-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\74\92-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v74-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v92-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\75\93-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v75-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v93-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\75\93-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v75-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v93-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\76\94-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v76-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v94-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\76\94-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v76-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v94-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\77\95-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v77-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v95-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\77\95-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v77-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v95-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\78\97-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v78-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v97-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\78\97-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v78-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v97-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\79\98-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v79-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v98-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1     
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\79\98-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v79-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v98-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\80\103-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v80-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v103-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\80\103-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v80-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v103-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\81\104-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v81-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v104-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\81\104-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v81-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v104-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\82\105-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v82-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v105-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\82\105-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v82-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v105-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\83\106-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v83-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v106-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\83\106-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v83-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v106-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\84\109-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v84-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v109-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\84\109-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v84-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v109-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\85\110-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v85-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v110-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\85\110-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v85-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v110-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\86\111-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v86-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v111-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\86\111-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v86-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v111-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\87\112-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v87-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v112-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\87\112-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v87-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v112-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\88\121-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v88-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v121-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\cordiercamila@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{1786F034-296F-9366-E811-1301CB302B7B}\88\121-{D479D235-0896-40D2-8B91-BF5A72EAF269}-v88-{4EE84C8C-394F-4BA4-9AF1-A18DCB1BEE69}-v121-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  D:\Documents and Settings\Flo\Local Settings\Application Data\Microsoft\Messenger\roger_labite@hotmail.com\SharingMetadata\francinnette@hotmail.com\DFSR\Staging\CS{BA20F934-367A-9593-C9B4-49834491E961}\01\10-{BA20F934-367A-9593-C9B4-49834491E961}-v1-{011BA273-7A82-4AAC-8C20-49264EEF8AF8}-v10-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      

---- EOF - GMER 1.0.12 ----

salwa5 · Answer

rien a signalé non plus


desactive la restauration du system du lecteur  D:

clic droit sur le post de travail / dans l'onglet restauration du system choisi le lecteur D: / clic sur parametres / coche desactiver la restauration du system sur ce lecteur 

clic sur ok et appliquer 


ensuite a l'aide de l'explorer va dans post de travail et suis ce chemin : 

D:\Documents and Settings\Flo\local settings \Temp supprime tout ce qu'il y'a a l'interieur de ce dossier (temp) 

ensuite va dans post de travail click droit sur lecteur D: 

ensuite clic sur proprietes / netoyage du disque / coches tout et clic sur ok 
normalement il va supprimer tout les fichier inutiles 


tu fait pareil avec les autre partition  C , H , G , F

a++++

rOgé · Answer

salut !

ok c'est fait mais il est tjs là !!.......... tant pis

en cas est-ce qu'il est possible de l'erradiquer en "réparant" windows avec les cd d'installations?

ou autres solutions?

merci

salwa5 · Answer

bonsoir :) franchement avec tout  les testes antivirus que je t'ai fait faire je suis absolument sure que ce n'est pas un virus :p je pense que adaware s'en flame pour rien . 

le virus win 32 sality comme je le connais , a pour effet d' endomager tout le system et le scan kaspersky l'aurai detecté car c'est un des plus puissant scan en ligne qui existe :) 

essay une derniere chose :) , reactive la restauration du lecteur c: comme ceci

clike droit sur post de travaille/proprietes/restauration system et la tu decoche desactiver la restauration du systeme tu applique et 

ensuite ferme tout les programes + toute les pages d'internet explorer

et execute ce fix

http://www.techsupportforum.com/sectools/Hacked_by_Godzilla_Remover.exe


noramalement il devrais reglé ton probleme de lecteurs

a+++

rOgé · Answer

Merciiiiiiiii  pour mes lecteurs !!

Bon, ben je vais rester comme ça avec mon faux sality alors ...

Merci pour tout 

à +++

salwa5 · Answer

de rien :) 

si tu as d'autre problemes n'hesite pas a revenir ;)

a++

abdellah · Answer

bonjour j'ai un pbl apparemment avec un cheval de troie et j'arrive pas a m'en debarrasser voici mon log avec hijack
merci d'avance


Logfile of HijackThis v1.99.1
Scan saved at 12:09:16, on 26/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
D:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
D:\WINDOWS\system32undll32.exe
D:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\lclock.exe
D:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
D:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
D:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
D:\PROGRA~1\Norton Internet Security\Norton AntiVirus
avw32.exe
D:\WINDOWS	snp2std.exe
D:\WINDOWS\vsnp2std.exe
D:\WINDOWS\FixCamera.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
D:\PROGRA~1\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Documents and Settings\ab\Local Settings\Temporary Internet Files\Content.IE5\QFMTYL6R\HijackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://melanthios-ana.com/zcvisitor/1624d318-3614-11eb-87b9-12a1ab6c324d/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=47f83760-f118-11ea-9bc8-0ac2bbf4ada7
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - D:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - D:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - D:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - D:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [tsnp2std] D:\WINDOWS	snp2std.exe
O4 - HKLM\..\Run: [snp2std] D:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [zBrowser Launcher] D:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\RunOnce: [InstallShieldSetup] "D:\PROGRA~1\InstallShield Installation Information\{5809E7CF-4DCF-11D4-9875-00105ACE7734}\setup.exe" -reboot"D:\PROGRA~1\InstallShield Installation Information\{5809E7CF-4DCF-11D4-9875-00105ACE7734}eboot.ini"  -l0x40c
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [LDM] D:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = D:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - D:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - D:\PROGRA~1\Symantec\LiveUpdate\LuComServer_3_0.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

Infection win32 sality q

73 réponses

Discussions similaires