infecté par WIN 32/Agent.BCK cheval de troie Résolu/Fermé

Question

Bonjour,je suis infecté par WIN 32/Agent.BCK cheval de troie aidé moi s il vous plait merci d avance.

nardino · Answer

Bonsoir.

Applique ceci
virus methode preliminaire de desinfection version fr
Méthode préliminaire CCM

Et dis-moi d'où tu tiens ces noms ?

aleksandar · Answer

AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	22:24:23 05/10/2007

 + Résultat de l'analyse:	



C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.Downloader.Win32.PopCap.b : Ignoré.
C:\Documents and Settings\ivana\Cookies\ivana@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\ivana\Cookies\ivana@bluestreak[8].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\ivana\Cookies\ivana@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Nettoyé.
C:\Documents and Settings\ivana\Cookies\ivana@cpvfeed[3].txt -> TrackingCookie.Cpvfeed : Nettoyé.
C:\Documents and Settings\ivana\Cookies\ivana@cpvfeed[4].txt -> TrackingCookie.Cpvfeed : Nettoyé.
C:\Documents and Settings\ivana\Cookies\ivana@findwhat[1].txt -> TrackingCookie.Findwhat : Nettoyé.
C:\Documents and Settings\ivana\Cookies\ivana@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\ivana\Cookies\ivana@stats1.reliablestats[3].txt -> TrackingCookie.Reliablestats : Nettoyé.
C:\Documents and Settings\ivana\Cookies\ivana@ad.yieldmanager[3].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\ivana\Cookies\ivana@ad.yieldmanager[4].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\ivana\Cookies\ivana@ad.yieldmanager[5].txt -> TrackingCookie.Yieldmanager : Nettoyé.


Fin du rapport

aleksandar · Answer

d ou je tiens quel nom?

aleksandar · Answer

si tu parle de WIN 32/Agent.BCK cheval de troie c mon anti vrus nod 32

aleksandar · Answer

Rapport d'analyse généré à: Fri, Oct 05, 2007 - 22:33:57
 
 
  
  
 
Voie d'analyse: C:\;D:\;E:\;G:\;H:\;I:\;K:\;
  
  
 
 
  
  
 
Statistiques
 
Temps
 00:31:31
 
Fichiers
 260872
 
Directoires
 5778
 
Secteurs de boot
 4
 
Archives
 3825
 
Paquets programmes
 10931
 
  
  
 
Résultats
 
Virus identifiés
 3
 
Fichiers infectés
 6
 
Fichiers suspects
 0
 
Avertissements
 0
 
Désinfectés
 0
 
Fichiers effacés
 6
 
  
  
 
Info sur les moteurs
 
Définition virus
 825296
 
Version des moteurs
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Analyse des plugins
 14
 
Archive des plugins
 38
 
Unpack des plugins
 7
 
E-mail plugins
 6
 
Système plugins
 1
 
  
  
 
Paramètres d'analyse
 
Première action
 Désinfecté
 
Seconde Action
 Supprimé
 
Heuristique
 Oui
 
Acceptez les avertissements
 Oui
 
Extensions analysées
 *;
 
Excludez les extensions
  
 
Analyse d'emails
 Oui
 
Analyse des Archives
 Oui
 
Analyser paquets programmes
 Oui
 
Analyse des fichiers
 Oui
 
Analyse de boot
 Oui
 
  
  
 
  Fichier analysé
  Statut
 
C:\Program Files\ESET\infected\V5ODCECA.NQF=>(Quarantine-PE)
 Infecté par: Trojan.Fotomoto.E
 
C:\Program Files\ESET\infected\V5ODCECA.NQF=>(Quarantine-PE)
 Echec de la désinfection
 
C:\Program Files\ESET\infected\V5ODCECA.NQF=>(Quarantine-PE)
 Supprimé
 
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP255\A0027978.dll
 Infecté par: Trojan.Vundo.DNI
 
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP255\A0027978.dll
 Supprimé
 
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP259\A0030997.dll
 Infecté par: Trojan.Vundo.DNI
 
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP259\A0030997.dll
 Supprimé
 
C:\WINDOWS\system32\jaqhoquf.dll
 Infecté par: Trojan.Vundo.DNI
 
C:\WINDOWS\system32\jaqhoquf.dll
 Supprimé
 
C:\WINDOWS\system32\qenknuoo.dll
 Infecté par: Trojan.Vundo.DNI
 
C:\WINDOWS\system32\qenknuoo.dll
 Supprimé
 
C:\WINDOWS\system32\yayayvw.dll
 Infecté par: Trojan.Vundo.DNG
 
C:\WINDOWS\system32\yayayvw.dll
 Echec de la désinfection
 
C:\WINDOWS\system32\yayayvw.dll
 Echec de la suppression

aleksandar · Answer

Logfile of HijackThis v1.99.1
Scan saved at 22:41:38, on 05/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=6061228
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=6061228
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ECarteBleueBrowserHelper Class - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {79C29CCC-C25C-49CA-BD86-C3BE791F2E58} - C:\WINDOWS\system32\yayayvw.dll
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\vdtyebda.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: (no name) - {FF460867-78EE-4162-9411-DAFD2705BB69} - C:\WINDOWS\system32\ssttt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\cnitlomn.dll",sitypnow
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab
O16 - DPF: {5308E02B-4ABA-48E4-AA9E-8A7693661473} (GameCtl Class) - http://jeuxenligne.orange.fr/GisActiveX/Ax/GameAx.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.servicesalacarte.orange.fr/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C9E17F58-564C-41C6-989F-AB0FE0D2C9D1} (PopcapLoader Object) - http://jeuxenligne.orange.fr/orange2.0/OnlineHSS/insaniquarium/Popcap.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxenligne.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - file:///C:/Documents%20and%20Settings/ivana/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/popcaploader_v6.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: yayayvw - C:\WINDOWS\SYSTEM32\yayayvw.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\jekfgcij.exe (file missing)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe

aleksandar · Answer

voila les 3 rapports je pense que j ai toujours un virus dans mon ordinateur merci de me repondre.

nardino · Answer

Bonsoir,

Télécharge :

[b]VundoFix[/b] de Atribune: http://www.atribune.org/ccount/click.php?id=4
[b]VirtumondoBegone[/b] : http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
[b]Outil Symantec[/b] : https://www.symantec.com/maintenance/business

Double clic sur Vundofix.exe.
Coche la case [b]Run VundoFix as a task[/b]
Répond OK au popup qui s'ouvre.
Il va se refermer et réouvrir au bout d'une minute environ.
Quand il est rouvert, clique sur [b]Scan for Vundo[/b]
Quand le scan est terminé, clique sur [b]Remove Vundo[/b]
Réponds [b]Yes[/b] à la demande de suppression des fichiers.
Il te sera demandé de redémarrer ton ordinateur, accepte bien sûr.
Copie/colle le rapport (c:\vundofix.txt) dans ta réponse

Si cela n'a pas fonctionné, redémarre en mode sans échec et lance VirtumundoBeGone.exe.
Et passe aussi le désinfecteur de Symantec.

Poste  un nouveau log Hijackthis en mode normal.

aleksandar · Answer

[10/05/2007, 23:17:32] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ivana\Bureau\VirtumundoBeGone.exe" )
[10/05/2007, 23:17:53] - Detected System Information:
[10/05/2007, 23:17:53] -  Windows Version: 5.1.2600, Service Pack 2
[10/05/2007, 23:17:53] -  Current Username: ivana (Admin)
[10/05/2007, 23:17:53] -  Windows is in SAFE mode with Networking.
[10/05/2007, 23:17:53] - Searching for Browser Helper Objects:
[10/05/2007, 23:17:53] -  BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/05/2007, 23:17:53] -  BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[10/05/2007, 23:17:53] -  BHO 3: {2E03C0FD-4C48-43A7-9A54-00240C70FF16} (ECarteBleueBrowserHelper Class)
[10/05/2007, 23:17:53] -  BHO 4: {3B6E63D7-13AF-4D25-BD32-5CB96D1E05C6} ()
[10/05/2007, 23:17:53] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/05/2007, 23:17:53] -  Checking for HKLM\...\Winlogon\Notify\ssttt
[10/05/2007, 23:17:53] -  Key not found: HKLM\...\Winlogon\Notify\ssttt, continuing.
[10/05/2007, 23:17:53] -  BHO 5: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[10/05/2007, 23:17:53] -  BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/05/2007, 23:17:53] -  BHO 7: {79C29CCC-C25C-49CA-BD86-C3BE791F2E58} ()
[10/05/2007, 23:17:53] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/05/2007, 23:17:53] -  Checking for HKLM\...\Winlogon\Notify\yayayvw
[10/05/2007, 23:17:53] -  Found: HKLM\...\Winlogon\Notify\yayayvw - This is probably Virtumundo.
[10/05/2007, 23:17:53] -  Assigning {79C29CCC-C25C-49CA-BD86-C3BE791F2E58} MSEvents Object
[10/05/2007, 23:17:53] - BHO list has been changed! Starting over...
[10/05/2007, 23:17:53] -  BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/05/2007, 23:17:53] -  BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[10/05/2007, 23:17:53] -  BHO 3: {2E03C0FD-4C48-43A7-9A54-00240C70FF16} (ECarteBleueBrowserHelper Class)
[10/05/2007, 23:17:53] -  BHO 4: {3B6E63D7-13AF-4D25-BD32-5CB96D1E05C6} ()
[10/05/2007, 23:17:53] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/05/2007, 23:17:53] -  Checking for HKLM\...\Winlogon\Notify\ssttt
[10/05/2007, 23:17:53] -  Key not found: HKLM\...\Winlogon\Notify\ssttt, continuing.
[10/05/2007, 23:17:53] -  BHO 5: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[10/05/2007, 23:17:53] -  BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/05/2007, 23:17:53] -  BHO 7: {79C29CCC-C25C-49CA-BD86-C3BE791F2E58} (MSEvents Object)
[10/05/2007, 23:17:53] - ALERT: Found MSEvents Object!
[10/05/2007, 23:17:53] -  BHO 8: {CA6319C0-31B7-401E-A518-A07C3DB8F777} (CBrowserHelperObject Object)
[10/05/2007, 23:17:53] - Finished Searching Browser Helper Objects
[10/05/2007, 23:17:53] - *** Detected MSEvents Object
[10/05/2007, 23:17:53] - Trying to remove MSEvents Object...
[10/05/2007, 23:17:54] -    Terminating Process: IEXPLORE.EXE
[10/05/2007, 23:17:54] -    Terminating Process: RUNDLL32.EXE
[10/05/2007, 23:17:54] -    Disabling Automatic Shell Restart
[10/05/2007, 23:17:54] -    Terminating Process: EXPLORER.EXE
[10/05/2007, 23:17:54] -    Suspending the NT Session Manager System Service
[10/05/2007, 23:17:54] -    Terminating Windows NT Logon/Logoff Manager
[10/05/2007, 23:17:54] -    Re-enabling Automatic Shell Restart
[10/05/2007, 23:17:54] -   File to disable: C:\WINDOWS\system32\yayayvw.dll
[10/05/2007, 23:17:54] -  Renaming C:\WINDOWS\system32\yayayvw.dll -> C:\WINDOWS\system32\yayayvw.dll.vir
[10/05/2007, 23:17:55] -  File successfully renamed!
[10/05/2007, 23:17:55] -   Removing HKLM\...\Browser Helper Objects\{79C29CCC-C25C-49CA-BD86-C3BE791F2E58}
[10/05/2007, 23:17:55] -   Removing HKCR\CLSID\{79C29CCC-C25C-49CA-BD86-C3BE791F2E58}
[10/05/2007, 23:17:55] -   Adding Kill Bit for ActiveX for GUID: {79C29CCC-C25C-49CA-BD86-C3BE791F2E58}
[10/05/2007, 23:17:55] -   Deleting ATLEvents/MSEvents Registry entries
[10/05/2007, 23:17:55] -   Removing HKLM\...\Winlogon\Notify\yayayvw
[10/05/2007, 23:17:55] - Searching for Browser Helper Objects:
[10/05/2007, 23:17:55] -  BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/05/2007, 23:17:55] -  BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[10/05/2007, 23:17:55] -  BHO 3: {2E03C0FD-4C48-43A7-9A54-00240C70FF16} (ECarteBleueBrowserHelper Class)
[10/05/2007, 23:17:55] -  BHO 4: {3B6E63D7-13AF-4D25-BD32-5CB96D1E05C6} ()
[10/05/2007, 23:17:55] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/05/2007, 23:17:55] -  Checking for HKLM\...\Winlogon\Notify\ssttt
[10/05/2007, 23:17:55] -  Key not found: HKLM\...\Winlogon\Notify\ssttt, continuing.
[10/05/2007, 23:17:55] -  BHO 5: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[10/05/2007, 23:17:55] -  BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/05/2007, 23:17:55] -  BHO 7: {CA6319C0-31B7-401E-A518-A07C3DB8F777} (CBrowserHelperObject Object)
[10/05/2007, 23:17:55] - Finished Searching Browser Helper Objects
[10/05/2007, 23:17:55] - Finishing up...
[10/05/2007, 23:17:55] - A restart is needed.
[10/05/2007, 23:17:55] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[10/05/2007, 23:17:59] - Attempting to Restart via STOP error (Blue Screen!)

[10/05/2007, 23:22:47] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ivana\Bureau\VirtumundoBeGone.exe" )
[10/05/2007, 23:22:52] - Detected System Information:
[10/05/2007, 23:22:52] -  Windows Version: 5.1.2600, Service Pack 2
[10/05/2007, 23:22:52] -  Current Username: ivana (Admin)
[10/05/2007, 23:22:52] -  Windows is in SAFE mode with Networking.
[10/05/2007, 23:22:52] - Searching for Browser Helper Objects:
[10/05/2007, 23:22:52] -  BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/05/2007, 23:22:52] -  BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[10/05/2007, 23:22:52] -  BHO 3: {2E03C0FD-4C48-43A7-9A54-00240C70FF16} (ECarteBleueBrowserHelper Class)
[10/05/2007, 23:22:52] -  BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[10/05/2007, 23:22:52] -  BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/05/2007, 23:22:52] -  BHO 6: {CA6319C0-31B7-401E-A518-A07C3DB8F777} (CBrowserHelperObject Object)
[10/05/2007, 23:22:52] -  BHO 7: {EEBA7BBA-2B9E-4C12-A4ED-11A10CEA97FA} ()
[10/05/2007, 23:22:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/05/2007, 23:22:52] -  Checking for HKLM\...\Winlogon\Notify\ssttt
[10/05/2007, 23:22:52] -  Key not found: HKLM\...\Winlogon\Notify\ssttt, continuing.
[10/05/2007, 23:22:52] - Finished Searching Browser Helper Objects
[10/05/2007, 23:22:52] - Finishing up...
[10/05/2007, 23:22:52] - Nothing found! Exiting...

[10/05/2007, 23:35:40] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ivana\Bureau\VirtumundoBeGone.exe" )
[10/05/2007, 23:36:11] - Detected System Information:
[10/05/2007, 23:36:11] -  Windows Version: 5.1.2600, Service Pack 2
[10/05/2007, 23:36:11] -  Current Username: ivana (Admin)
[10/05/2007, 23:36:11] -  Windows is in SAFE mode with Networking.
[10/05/2007, 23:36:11] - Searching for Browser Helper Objects:
[10/05/2007, 23:36:11] -  BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/05/2007, 23:36:11] -  BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[10/05/2007, 23:36:11] -  BHO 3: {2E03C0FD-4C48-43A7-9A54-00240C70FF16} (ECarteBleueBrowserHelper Class)
[10/05/2007, 23:36:11] -  BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[10/05/2007, 23:36:11] -  BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/05/2007, 23:36:11] -  BHO 6: {CA6319C0-31B7-401E-A518-A07C3DB8F777} (CBrowserHelperObject Object)
[10/05/2007, 23:36:11] -  BHO 7: {EEBA7BBA-2B9E-4C12-A4ED-11A10CEA97FA} ()
[10/05/2007, 23:36:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/05/2007, 23:36:11] -  Checking for HKLM\...\Winlogon\Notify\ssttt
[10/05/2007, 23:36:11] -  Key not found: HKLM\...\Winlogon\Notify\ssttt, continuing.
[10/05/2007, 23:36:11] - Finished Searching Browser Helper Objects
[10/05/2007, 23:36:11] - Finishing up...
[10/05/2007, 23:36:11] - Nothing found! Exiting...

[10/05/2007, 23:38:27] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ivana\Bureau\VirtumundoBeGone.exe" )
[10/05/2007, 23:38:35] - User choose NOT to continue. Exiting...

[10/05/2007, 23:39:04] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ivana\Bureau\VirtumundoBeGone.exe" )
[10/05/2007, 23:39:05] - Detected System Information:
[10/05/2007, 23:39:05] -  Windows Version: 5.1.2600, Service Pack 2
[10/05/2007, 23:39:05] -  Current Username: ivana (Admin)
[10/05/2007, 23:39:05] -  Windows is in NORMAL mode.
[10/05/2007, 23:39:05] - Searching for Browser Helper Objects:
[10/05/2007, 23:39:05] -  BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/05/2007, 23:39:05] -  BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[10/05/2007, 23:39:05] -  BHO 3: {2E03C0FD-4C48-43A7-9A54-00240C70FF16} (ECarteBleueBrowserHelper Class)
[10/05/2007, 23:39:05] -  BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[10/05/2007, 23:39:05] -  BHO 5: {5EE93049-01C3-44EE-84F4-0889CB810E2B} ()
[10/05/2007, 23:39:05] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/05/2007, 23:39:05] -  Checking for HKLM\...\Winlogon\Notify\ssttt
[10/05/2007, 23:39:05] -  Key not found: HKLM\...\Winlogon\Notify\ssttt, continuing.
[10/05/2007, 23:39:05] -  BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/05/2007, 23:39:05] -  BHO 7: {CA6319C0-31B7-401E-A518-A07C3DB8F777} (CBrowserHelperObject Object)
[10/05/2007, 23:39:05] - Finished Searching Browser Helper Objects
[10/05/2007, 23:39:05] - Finishing up...
[10/05/2007, 23:39:05] - Nothing found! Exiting...

aleksandar · Answer

Symantec Trojan.Vundo Removal Tool 1.5.0

C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\11\11-{C7835277-531F-477B-9BDA-43BA37071CC9}-v11-{C7835277-531F-477B-9BDA-43BA37071CC9}-v11-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\13\13-{C7835277-531F-477B-9BDA-43BA37071CC9}-v13-{C7835277-531F-477B-9BDA-43BA37071CC9}-v13-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\14\14-{C7835277-531F-477B-9BDA-43BA37071CC9}-v14-{C7835277-531F-477B-9BDA-43BA37071CC9}-v14-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\15\15-{C7835277-531F-477B-9BDA-43BA37071CC9}-v15-{C7835277-531F-477B-9BDA-43BA37071CC9}-v15-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\16\16-{C7835277-531F-477B-9BDA-43BA37071CC9}-v16-{C7835277-531F-477B-9BDA-43BA37071CC9}-v16-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\17\17-{C7835277-531F-477B-9BDA-43BA37071CC9}-v17-{C7835277-531F-477B-9BDA-43BA37071CC9}-v17-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\18\18-{C7835277-531F-477B-9BDA-43BA37071CC9}-v18-{C7835277-531F-477B-9BDA-43BA37071CC9}-v18-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\19\19-{C7835277-531F-477B-9BDA-43BA37071CC9}-v19-{C7835277-531F-477B-9BDA-43BA37071CC9}-v19-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\24\12-{B5931A26-325E-4056-BC47-FC070A0653D7}-v24-{C7835277-531F-477B-9BDA-43BA37071CC9}-v12-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\26\26-{B5931A26-325E-4056-BC47-FC070A0653D7}-v26-{B5931A26-325E-4056-BC47-FC070A0653D7}-v26-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\27\27-{B5931A26-325E-4056-BC47-FC070A0653D7}-v27-{B5931A26-325E-4056-BC47-FC070A0653D7}-v27-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\28\28-{B5931A26-325E-4056-BC47-FC070A0653D7}-v28-{B5931A26-325E-4056-BC47-FC070A0653D7}-v28-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\29\29-{B5931A26-325E-4056-BC47-FC070A0653D7}-v29-{B5931A26-325E-4056-BC47-FC070A0653D7}-v29-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\36\36-{B5931A26-325E-4056-BC47-FC070A0653D7}-v36-{B5931A26-325E-4056-BC47-FC070A0653D7}-v36-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\37\137-{B5931A26-325E-4056-BC47-FC070A0653D7}-v137-{B5931A26-325E-4056-BC47-FC070A0653D7}-v137-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\37\237-{B5931A26-325E-4056-BC47-FC070A0653D7}-v237-{B5931A26-325E-4056-BC47-FC070A0653D7}-v237-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\37\37-{B5931A26-325E-4056-BC47-FC070A0653D7}-v37-{B5931A26-325E-4056-BC47-FC070A0653D7}-v37-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\38\138-{B5931A26-325E-4056-BC47-FC070A0653D7}-v138-{B5931A26-325E-4056-BC47-FC070A0653D7}-v138-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\38\238-{B5931A26-325E-4056-BC47-FC070A0653D7}-v238-{B5931A26-325E-4056-BC47-FC070A0653D7}-v238-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\38\38-{B5931A26-325E-4056-BC47-FC070A0653D7}-v38-{B5931A26-325E-4056-BC47-FC070A0653D7}-v38-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\39\139-{B5931A26-325E-4056-BC47-FC070A0653D7}-v139-{B5931A26-325E-4056-BC47-FC070A0653D7}-v139-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\39\239-{B5931A26-325E-4056-BC47-FC070A0653D7}-v239-{B5931A26-325E-4056-BC47-FC070A0653D7}-v239-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\39\39-{B5931A26-325E-4056-BC47-FC070A0653D7}-v39-{B5931A26-325E-4056-BC47-FC070A0653D7}-v39-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\40\140-{B5931A26-325E-4056-BC47-FC070A0653D7}-v140-{B5931A26-325E-4056-BC47-FC070A0653D7}-v140-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\40\240-{B5931A26-325E-4056-BC47-FC070A0653D7}-v240-{B5931A26-325E-4056-BC47-FC070A0653D7}-v240-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\40\40-{B5931A26-325E-4056-BC47-FC070A0653D7}-v40-{B5931A26-325E-4056-BC47-FC070A0653D7}-v40-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\41\141-{B5931A26-325E-4056-BC47-FC070A0653D7}-v141-{B5931A26-325E-4056-BC47-FC070A0653D7}-v141-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\41\241-{B5931A26-325E-4056-BC47-FC070A0653D7}-v241-{B5931A26-325E-4056-BC47-FC070A0653D7}-v241-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\41\41-{B5931A26-325E-4056-BC47-FC070A0653D7}-v41-{B5931A26-325E-4056-BC47-FC070A0653D7}-v41-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\42\142-{B5931A26-325E-4056-BC47-FC070A0653D7}-v142-{B5931A26-325E-4056-BC47-FC070A0653D7}-v142-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\42\242-{B5931A26-325E-4056-BC47-FC070A0653D7}-v242-{B5931A26-325E-4056-BC47-FC070A0653D7}-v242-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\42\42-{B5931A26-325E-4056-BC47-FC070A0653D7}-v42-{B5931A26-325E-4056-BC47-FC070A0653D7}-v42-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\43\143-{B5931A26-325E-4056-BC47-FC070A0653D7}-v143-{B5931A26-325E-4056-BC47-FC070A0653D7}-v143-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\43\243-{B5931A26-325E-4056-BC47-FC070A0653D7}-v243-{B5931A26-325E-4056-BC47-FC070A0653D7}-v243-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\43\43-{B5931A26-325E-4056-BC47-FC070A0653D7}-v43-{B5931A26-325E-4056-BC47-FC070A0653D7}-v43-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\44\144-{B5931A26-325E-4056-BC47-FC070A0653D7}-v144-{B5931A26-325E-4056-BC47-FC070A0653D7}-v144-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\44\244-{B5931A26-325E-4056-BC47-FC070A0653D7}-v244-{B5931A26-325E-4056-BC47-FC070A0653D7}-v244-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\44\44-{B5931A26-325E-4056-BC47-FC070A0653D7}-v44-{B5931A26-325E-4056-BC47-FC070A0653D7}-v44-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\45\145-{B5931A26-325E-4056-BC47-FC070A0653D7}-v145-{B5931A26-325E-4056-BC47-FC070A0653D7}-v145-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\45\245-{B5931A26-325E-4056-BC47-FC070A0653D7}-v245-{B5931A26-325E-4056-BC47-FC070A0653D7}-v245-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\45\45-{B5931A26-325E-4056-BC47-FC070A0653D7}-v45-{B5931A26-325E-4056-BC47-FC070A0653D7}-v45-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\46\146-{B5931A26-325E-4056-BC47-FC070A0653D7}-v146-{B5931A26-325E-4056-BC47-FC070A0653D7}-v146-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\46\246-{B5931A26-325E-4056-BC47-FC070A0653D7}-v246-{B5931A26-325E-4056-BC47-FC070A0653D7}-v246-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\46\46-{B5931A26-325E-4056-BC47-FC070A0653D7}-v46-{B5931A26-325E-4056-BC47-FC070A0653D7}-v46-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\47\147-{B5931A26-325E-4056-BC47-FC070A0653D7}-v147-{B5931A26-325E-4056-BC47-FC070A0653D7}-v147-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\47\247-{B5931A26-325E-4056-BC47-FC070A0653D7}-v247-{B5931A26-325E-4056-BC47-FC070A0653D7}-v247-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\47\47-{B5931A26-325E-4056-BC47-FC070A0653D7}-v47-{B5931A26-325E-4056-BC47-FC070A0653D7}-v47-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\48\148-{B5931A26-325E-4056-BC47-FC070A0653D7}-v148-{B5931A26-325E-4056-BC47-FC070A0653D7}-v148-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\48\248-{B5931A26-325E-4056-BC47-FC070A0653D7}-v248-{B5931A26-325E-4056-BC47-FC070A0653D7}-v248-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\48\48-{B5931A26-325E-4056-BC47-FC070A0653D7}-v48-{B5931A26-325E-4056-BC47-FC070A0653D7}-v48-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\49\149-{B5931A26-325E-4056-BC47-FC070A0653D7}-v149-{B5931A26-325E-4056-BC47-FC070A0653D7}-v149-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\49\249-{B5931A26-325E-4056-BC47-FC070A0653D7}-v249-{B5931A26-325E-4056-BC47-FC070A0653D7}-v249-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\49\49-{B5931A26-325E-4056-BC47-FC070A0653D7}-v49-{B5931A26-325E-4056-BC47-FC070A0653D7}-v49-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\50\150-{B5931A26-325E-4056-BC47-FC070A0653D7}-v150-{B5931A26-325E-4056-BC47-FC070A0653D7}-v150-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\50\250-{B5931A26-325E-4056-BC47-FC070A0653D7}-v250-{B5931A26-325E-4056-BC47-FC070A0653D7}-v250-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\50\50-{B5931A26-325E-4056-BC47-FC070A0653D7}-v50-{B5931A26-325E-4056-BC47-FC070A0653D7}-v50-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\51\151-{B5931A26-325E-4056-BC47-FC070A0653D7}-v151-{B5931A26-325E-4056-BC47-FC070A0653D7}-v151-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\51\251-{B5931A26-325E-4056-BC47-FC070A0653D7}-v251-{B5931A26-325E-4056-BC47-FC070A0653D7}-v251-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\51\51-{B5931A26-325E-4056-BC47-FC070A0653D7}-v51-{B5931A26-325E-4056-BC47-FC070A0653D7}-v51-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\52\152-{B5931A26-325E-4056-BC47-FC070A0653D7}-v152-{B5931A26-325E-4056-BC47-FC070A0653D7}-v152-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\52\252-{B5931A26-325E-4056-BC47-FC070A0653D7}-v252-{B5931A26-325E-4056-BC47-FC070A0653D7}-v252-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\52\52-{B5931A26-325E-4056-BC47-FC070A0653D7}-v52-{B5931A26-325E-4056-BC47-FC070A0653D7}-v52-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\53\153-{B5931A26-325E-4056-BC47-FC070A0653D7}-v153-{B5931A26-325E-4056-BC47-FC070A0653D7}-v153-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\53\253-{B5931A26-325E-4056-BC47-FC070A0653D7}-v253-{B5931A26-325E-4056-BC47-FC070A0653D7}-v253-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\53\53-{B5931A26-325E-4056-BC47-FC070A0653D7}-v53-{B5931A26-325E-4056-BC47-FC070A0653D7}-v53-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\54\154-{B5931A26-325E-4056-BC47-FC070A0653D7}-v154-{B5931A26-325E-4056-BC47-FC070A0653D7}-v154-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\54\254-{B5931A26-325E-4056-BC47-FC070A0653D7}-v254-{B5931A26-325E-4056-BC47-FC070A0653D7}-v254-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\54\54-{B5931A26-325E-4056-BC47-FC070A0653D7}-v54-{B5931A26-325E-4056-BC47-FC070A0653D7}-v54-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\55\155-{B5931A26-325E-4056-BC47-FC070A0653D7}-v155-{B5931A26-325E-4056-BC47-FC070A0653D7}-v155-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\55\255-{B5931A26-325E-4056-BC47-FC070A0653D7}-v255-{B5931A26-325E-4056-BC47-FC070A0653D7}-v255-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\55\55-{B5931A26-325E-4056-BC47-FC070A0653D7}-v55-{B5931A26-325E-4056-BC47-FC070A0653D7}-v55-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\56\156-{B5931A26-325E-4056-BC47-FC070A0653D7}-v156-{B5931A26-325E-4056-BC47-FC070A0653D7}-v156-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\56\256-{B5931A26-325E-4056-BC47-FC070A0653D7}-v256-{B5931A26-325E-4056-BC47-FC070A0653D7}-v256-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\56\56-{B5931A26-325E-4056-BC47-FC070A0653D7}-v56-{B5931A26-325E-4056-BC47-FC070A0653D7}-v56-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\57\157-{B5931A26-325E-4056-BC47-FC070A0653D7}-v157-{B5931A26-325E-4056-BC47-FC070A0653D7}-v157-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\57\257-{B5931A26-325E-4056-BC47-FC070A0653D7}-v257-{B5931A26-325E-4056-BC47-FC070A0653D7}-v257-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\57\57-{B5931A26-325E-4056-BC47-FC070A0653D7}-v57-{B5931A26-325E-4056-BC47-FC070A0653D7}-v57-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\58\158-{B5931A26-325E-4056-BC47-FC070A0653D7}-v158-{B5931A26-325E-4056-BC47-FC070A0653D7}-v158-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\58\258-{B5931A26-325E-4056-BC47-FC070A0653D7}-v258-{B5931A26-325E-4056-BC47-FC070A0653D7}-v258-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\58\58-{B5931A26-325E-4056-BC47-FC070A0653D7}-v58-{B5931A26-325E-4056-BC47-FC070A0653D7}-v58-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\59\159-{B5931A26-325E-4056-BC47-FC070A0653D7}-v159-{B5931A26-325E-4056-BC47-FC070A0653D7}-v159-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\59\259-{B5931A26-325E-4056-BC47-FC070A0653D7}-v259-{B5931A26-325E-4056-BC47-FC070A0653D7}-v259-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\59\59-{B5931A26-325E-4056-BC47-FC070A0653D7}-v59-{B5931A26-325E-4056-BC47-FC070A0653D7}-v59-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\60\160-{B5931A26-325E-4056-BC47-FC070A0653D7}-v160-{B5931A26-325E-4056-BC47-FC070A0653D7}-v160-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\60\260-{B5931A26-325E-4056-BC47-FC070A0653D7}-v260-{B5931A26-325E-4056-BC47-FC070A0653D7}-v260-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\60\60-{B5931A26-325E-4056-BC47-FC070A0653D7}-v60-{B5931A26-325E-4056-BC47-FC070A0653D7}-v60-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\61\161-{B5931A26-325E-4056-BC47-FC070A0653D7}-v161-{B5931A26-325E-4056-BC47-FC070A0653D7}-v161-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\61\261-{B5931A26-325E-4056-BC47-FC070A0653D7}-v261-{B5931A26-325E-4056-BC47-FC070A0653D7}-v261-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\61\61-{B5931A26-325E-4056-BC47-FC070A0653D7}-v61-{B5931A26-325E-4056-BC47-FC070A0653D7}-v61-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\62\162-{B5931A26-325E-4056-BC47-FC070A0653D7}-v162-{B5931A26-325E-4056-BC47-FC070A0653D7}-v162-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\62\262-{B5931A26-325E-4056-BC47-FC070A0653D7}-v262-{B5931A26-325E-4056-BC47-FC070A0653D7}-v262-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\62\62-{B5931A26-325E-4056-BC47-FC070A0653D7}-v62-{B5931A26-325E-4056-BC47-FC070A0653D7}-v62-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\63\163-{B5931A26-325E-4056-BC47-FC070A0653D7}-v163-{B5931A26-325E-4056-BC47-FC070A0653D7}-v163-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\63\263-{B5931A26-325E-4056-BC47-FC070A0653D7}-v263-{B5931A26-325E-4056-BC47-FC070A0653D7}-v263-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\63\63-{B5931A26-325E-4056-BC47-FC070A0653D7}-v63-{B5931A26-325E-4056-BC47-FC070A0653D7}-v63-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\64\164-{B5931A26-325E-4056-BC47-FC070A0653D7}-v164-{B5931A26-325E-4056-BC47-FC070A0653D7}-v164-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\64\264-{B5931A26-325E-4056-BC47-FC070A0653D7}-v264-{B5931A26-325E-4056-BC47-FC070A0653D7}-v264-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\64\64-{B5931A26-325E-4056-BC47-FC070A0653D7}-v64-{B5931A26-325E-4056-BC47-FC070A0653D7}-v64-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\65\165-{B5931A26-325E-4056-BC47-FC070A0653D7}-v165-{B5931A26-325E-4056-BC47-FC070A0653D7}-v165-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\65\265-{B5931A26-325E-4056-BC47-FC070A0653D7}-v265-{B5931A26-325E-4056-BC47-FC070A0653D7}-v265-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\65\65-{B5931A26-325E-4056-BC47-FC070A0653D7}-v65-{B5931A26-325E-4056-BC47-FC070A0653D7}-v65-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\66\166-{B5931A26-325E-4056-BC47-FC070A0653D7}-v166-{B5931A26-325E-4056-BC47-FC070A0653D7}-v166-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\66\266-{B5931A26-325E-4056-BC47-FC070A0653D7}-v266-{B5931A26-325E-4056-BC47-FC070A0653D7}-v266-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\66\66-{B5931A26-325E-4056-BC47-FC070A0653D7}-v66-{B5931A26-325E-4056-BC47-FC070A0653D7}-v66-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\67\167-{B5931A26-325E-4056-BC47-FC070A0653D7}-v167-{B5931A26-325E-4056-BC47-FC070A0653D7}-v167-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\67\267-{B5931A26-325E-4056-BC47-FC070A0653D7}-v267-{B5931A26-325E-4056-BC47-FC070A0653D7}-v267-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\67\67-{B5931A26-325E-4056-BC47-FC070A0653D7}-v67-{B5931A26-325E-4056-BC47-FC070A0653D7}-v67-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\68\168-{B5931A26-325E-4056-BC47-FC070A0653D7}-v168-{B5931A26-325E-4056-BC47-FC070A0653D7}-v168-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\68\268-{B5931A26-325E-4056-BC47-FC070A0653D7}-v268-{B5931A26-325E-4056-BC47-FC070A0653D7}-v268-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\68\68-{B5931A26-325E-4056-BC47-FC070A0653D7}-v68-{B5931A26-325E-4056-BC47-FC070A0653D7}-v68-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\69\169-{B5931A26-325E-4056-BC47-FC070A0653D7}-v169-{B5931A26-325E-4056-BC47-FC070A0653D7}-v169-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\69\269-{B5931A26-325E-4056-BC47-FC070A0653D7}-v269-{B5931A26-325E-4056-BC47-FC070A0653D7}-v269-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\69\69-{B5931A26-325E-4056-BC47-FC070A0653D7}-v69-{B5931A26-325E-4056-BC47-FC070A0653D7}-v69-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\70\170-{B5931A26-325E-4056-BC47-FC070A0653D7}-v170-{B5931A26-325E-4056-BC47-FC070A0653D7}-v170-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\70\270-{B5931A26-325E-4056-BC47-FC070A0653D7}-v270-{B5931A26-325E-4056-BC47-FC070A0653D7}-v270-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\70\70-{B5931A26-325E-4056-BC47-FC070A0653D7}-v70-{B5931A26-325E-4056-BC47-FC070A0653D7}-v70-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\71\171-{B5931A26-325E-4056-BC47-FC070A0653D7}-v171-{B5931A26-325E-4056-BC47-FC070A0653D7}-v171-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\71\271-{B5931A26-325E-4056-BC47-FC070A0653D7}-v271-{B5931A26-325E-4056-BC47-FC070A0653D7}-v271-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\71\71-{B5931A26-325E-4056-BC47-FC070A0653D7}-v71-{B5931A26-325E-4056-BC47-FC070A0653D7}-v71-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\72\172-{B5931A26-325E-4056-BC47-FC070A0653D7}-v172-{B5931A26-325E-4056-BC47-FC070A0653D7}-v172-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\72\272-{B5931A26-325E-4056-BC47-FC070A0653D7}-v272-{B5931A26-325E-4056-BC47-FC070A0653D7}-v272-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\72\72-{B5931A26-325E-4056-BC47-FC070A0653D7}-v72-{B5931A26-325E-4056-BC47-FC070A0653D7}-v72-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\73\173-{B5931A26-325E-4056-BC47-FC070A0653D7}-v173-{B5931A26-325E-4056-BC47-FC070A0653D7}-v173-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\73\273-{B5931A26-325E-4056-BC47-FC070A0653D7}-v273-{B5931A26-325E-4056-BC47-FC070A0653D7}-v273-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\73\73-{B5931A26-325E-4056-BC47-FC070A0653D7}-v73-{B5931A26-325E-4056-BC47-FC070A0653D7}-v73-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\74\174-{B5931A26-325E-4056-BC47-FC070A0653D7}-v174-{B5931A26-325E-4056-BC47-FC070A0653D7}-v174-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\74\274-{B5931A26-325E-4056-BC47-FC070A0653D7}-v274-{B5931A26-325E-4056-BC47-FC070A0653D7}-v274-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\74\74-{B5931A26-325E-4056-BC47-FC070A0653D7}-v74-{B5931A26-325E-4056-BC47-FC070A0653D7}-v74-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\75\175-{B5931A26-325E-4056-BC47-FC070A0653D7}-v175-{B5931A26-325E-4056-BC47-FC070A0653D7}-v175-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\75\275-{B5931A26-325E-4056-BC47-FC070A0653D7}-v275-{B5931A26-325E-4056-BC47-FC070A0653D7}-v275-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\75\75-{B5931A26-325E-4056-BC47-FC070A0653D7}-v75-{B5931A26-325E-4056-BC47-FC070A0653D7}-v75-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\76\176-{B5931A26-325E-4056-BC47-FC070A0653D7}-v176-{B5931A26-325E-4056-BC47-FC070A0653D7}-v176-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\76\276-{B5931A26-325E-4056-BC47-FC070A0653D7}-v276-{B5931A26-325E-4056-BC47-FC070A0653D7}-v276-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\76\76-{B5931A26-325E-4056-BC47-FC070A0653D7}-v76-{B5931A26-325E-4056-BC47-FC070A0653D7}-v76-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\77\177-{B5931A26-325E-4056-BC47-FC070A0653D7}-v177-{B5931A26-325E-4056-BC47-FC070A0653D7}-v177-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\77\277-{B5931A26-325E-4056-BC47-FC070A0653D7}-v277-{B5931A26-325E-4056-BC47-FC070A0653D7}-v277-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\77\77-{B5931A26-325E-4056-BC47-FC070A0653D7}-v77-{B5931A26-325E-4056-BC47-FC070A0653D7}-v77-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\78\178-{B5931A26-325E-4056-BC47-FC070A0653D7}-v178-{B5931A26-325E-4056-BC47-FC070A0653D7}-v178-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\79\179-{B5931A26-325E-4056-BC47-FC070A0653D7}-v179-{B5931A26-325E-4056-BC47-FC070A0653D7}-v179-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\79\79-{B5931A26-325E-4056-BC47-FC070A0653D7}-v79-{B5931A26-325E-4056-BC47-FC070A0653D7}-v79-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\80\180-{B5931A26-325E-4056-BC47-FC070A0653D7}-v180-{B5931A26-325E-4056-BC47-FC070A0653D7}-v180-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\81\181-{B5931A26-325E-4056-BC47-FC070A0653D7}-v181-{B5931A26-325E-4056-BC47-FC070A0653D7}-v181-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\81\81-{B5931A26-325E-4056-BC47-FC070A0653D7}-v81-{B5931A26-325E-4056-BC47-FC070A0653D7}-v81-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\82\182-{B5931A26-325E-4056-BC47-FC070A0653D7}-v182-{B5931A26-325E-4056-BC47-FC070A0653D7}-v182-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\83\183-{B5931A26-325E-4056-BC47-FC070A0653D7}-v183-{B5931A26-325E-4056-BC47-FC070A0653D7}-v183-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\83\83-{B5931A26-325E-4056-BC47-FC070A0653D7}-v83-{B5931A26-325E-4056-BC47-FC070A0653D7}-v83-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\84\184-{B5931A26-325E-4056-BC47-FC070A0653D7}-v184-{B5931A26-325E-4056-BC47-FC070A0653D7}-v184-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\84\84-{B5931A26-325E-4056-BC47-FC070A0653D7}-v84-{B5931A26-325E-4056-BC47-FC070A0653D7}-v84-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\85\185-{B5931A26-325E-4056-BC47-FC070A0653D7}-v185-{B5931A26-325E-4056-BC47-FC070A0653D7}-v185-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\85\85-{B5931A26-325E-4056-BC47-FC070A0653D7}-v85-{B5931A26-325E-4056-BC47-FC070A0653D7}-v85-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\86\186-{B5931A26-325E-4056-BC47-FC070A0653D7}-v186-{B5931A26-325E-4056-BC47-FC070A0653D7}-v186-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\86\86-{B5931A26-325E-4056-BC47-FC070A0653D7}-v86-{B5931A26-325E-4056-BC47-FC070A0653D7}-v86-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\87\187-{B5931A26-325E-4056-BC47-FC070A0653D7}-v187-{B5931A26-325E-4056-BC47-FC070A0653D7}-v187-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\87\87-{B5931A26-325E-4056-BC47-FC070A0653D7}-v87-{B5931A26-325E-4056-BC47-FC070A0653D7}-v87-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\88\188-{B5931A26-325E-4056-BC47-FC070A0653D7}-v188-{B5931A26-325E-4056-BC47-FC070A0653D7}-v188-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\88\88-{B5931A26-325E-4056-BC47-FC070A0653D7}-v88-{B5931A26-325E-4056-BC47-FC070A0653D7}-v88-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\89\189-{B5931A26-325E-4056-BC47-FC070A0653D7}-v189-{B5931A26-325E-4056-BC47-FC070A0653D7}-v189-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\89\89-{B5931A26-325E-4056-BC47-FC070A0653D7}-v89-{B5931A26-325E-4056-BC47-FC070A0653D7}-v89-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\90\190-{B5931A26-325E-4056-BC47-FC070A0653D7}-v190-{B5931A26-325E-4056-BC47-FC070A0653D7}-v190-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\90\90-{B5931A26-325E-4056-BC47-FC070A0653D7}-v90-{B5931A26-325E-4056-BC47-FC070A0653D7}-v90-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\91\191-{B5931A26-325E-4056-BC47-FC070A0653D7}-v191-{B5931A26-325E-4056-BC47-FC070A0653D7}-v191-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\91\91-{B5931A26-325E-4056-BC47-FC070A0653D7}-v91-{B5931A26-325E-4056-BC47-FC070A0653D7}-v91-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\92\192-{B5931A26-325E-4056-BC47-FC070A0653D7}-v192-{B5931A26-325E-4056-BC47-FC070A0653D7}-v192-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\92\92-{B5931A26-325E-4056-BC47-FC070A0653D7}-v92-{B5931A26-325E-4056-BC47-FC070A0653D7}-v92-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\93\193-{B5931A26-325E-4056-BC47-FC070A0653D7}-v193-{B5931A26-325E-4056-BC47-FC070A0653D7}-v193-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\93\93-{B5931A26-325E-4056-BC47-FC070A0653D7}-v93-{B5931A26-325E-4056-BC47-FC070A0653D7}-v93-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\94\194-{B5931A26-325E-4056-BC47-FC070A0653D7}-v194-{B5931A26-325E-4056-BC47-FC070A0653D7}-v194-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\94\94-{B5931A26-325E-4056-BC47-FC070A0653D7}-v94-{B5931A26-325E-4056-BC47-FC070A0653D7}-v94-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\95\195-{B5931A26-325E-4056-BC47-FC070A0653D7}-v195-{B5931A26-325E-4056-BC47-FC070A0653D7}-v195-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\95\495-{B5931A26-325E-4056-BC47-FC070A0653D7}-v495-{B5931A26-325E-4056-BC47-FC070A0653D7}-v495-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\95\95-{B5931A26-325E-4056-BC47-FC070A0653D7}-v95-{B5931A26-325E-4056-BC47-FC070A0653D7}-v95-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\96\196-{B5931A26-325E-4056-BC47-FC070A0653D7}-v196-{B5931A26-325E-4056-BC47-FC070A0653D7}-v196-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\96\96-{B5931A26-325E-4056-BC47-FC070A0653D7}-v96-{B5931A26-325E-4056-BC47-FC070A0653D7}-v96-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\97\197-{B5931A26-325E-4056-BC47-FC070A0653D7}-v197-{B5931A26-325E-4056-BC47-FC070A0653D7}-v197-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\97\97-{B5931A26-325E-4056-BC47-FC070A0653D7}-v97-{B5931A26-325E-4056-BC47-FC070A0653D7}-v97-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\98\198-{B5931A26-325E-4056-BC47-FC070A0653D7}-v198-{B5931A26-325E-4056-BC47-FC070A0653D7}-v198-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\98\98-{B5931A26-325E-4056-BC47-FC070A0653D7}-v98-{B5931A26-325E-4056-BC47-FC070A0653D7}-v98-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\99\199-{B5931A26-325E-4056-BC47-FC070A0653D7}-v199-{B5931A26-325E-4056-BC47-FC070A0653D7}-v199-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\sibylle_18@hotmail.com\DFSR\Staging\CS{0117F3DA-0D78-156E-ED63-060E2E633BD1}\99\99-{B5931A26-325E-4056-BC47-FC070A0653D7}-v99-{B5931A26-325E-4056-BC47-FC070A0653D7}-v99-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\yu_tattoo@hotmail.fr\DFSR\Staging\CS{0AF099B6-5458-CFB9-F480-B3058D1D54E4}\01\10-{0AF099B6-5458-CFB9-F480-B3058D1D54E4}-v1-{B5931A26-325E-4056-BC47-FC070A0653D7}-v10-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\yu_tattoo@hotmail.fr\DFSR\Staging\CS{0AF099B6-5458-CFB9-F480-B3058D1D54E4}\11\11-{B5931A26-325E-4056-BC47-FC070A0653D7}-v11-{B5931A26-325E-4056-BC47-FC070A0653D7}-v11-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\yu_tattoo@hotmail.fr\DFSR\Staging\CS{0AF099B6-5458-CFB9-F480-B3058D1D54E4}\12\12-{B5931A26-325E-4056-BC47-FC070A0653D7}-v12-{B5931A26-325E-4056-BC47-FC070A0653D7}-v12-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\yu_tattoo@hotmail.fr\DFSR\Staging\CS{0AF099B6-5458-CFB9-F480-B3058D1D54E4}\13\13-{B5931A26-325E-4056-BC47-FC070A0653D7}-v13-{B5931A26-325E-4056-BC47-FC070A0653D7}-v13-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\yu_tattoo@hotmail.fr\DFSR\Staging\CS{0AF099B6-5458-CFB9-F480-B3058D1D54E4}\14\14-{B5931A26-325E-4056-BC47-FC070A0653D7}-v14-{B5931A26-325E-4056-BC47-FC070A0653D7}-v14-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Data\Microsoft\Messenger\miskovicivana@hotmail.com\SharingMetadata\yu_tattoo@hotmail.fr\DFSR\Staging\CS{0AF099B6-5458-CFB9-F480-B3058D1D54E4}\15\15-{B5931A26-325E-4056-BC47-FC070A0653D7}-v15-{B5931A26-325E-4056-BC47-FC070A0653D7}-v15-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\ivana\Local Settings\Application Da

aleksandar · Answer

Logfile of HijackThis v1.99.1
Scan saved at 00:03:41, on 06/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=6061228
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=6061228
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ECarteBleueBrowserHelper Class - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: (no name) - {5290A6E3-7BF3-416D-B5B2-AE608A34C912} - C:\WINDOWS\system32\ssttt.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\ghepdiiy.dll",sitypnow
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab
O16 - DPF: {5308E02B-4ABA-48E4-AA9E-8A7693661473} (GameCtl Class) - http://jeuxenligne.orange.fr/GisActiveX/Ax/GameAx.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.servicesalacarte.orange.fr/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C9E17F58-564C-41C6-989F-AB0FE0D2C9D1} (PopcapLoader Object) - http://jeuxenligne.orange.fr/orange2.0/OnlineHSS/insaniquarium/Popcap.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxenligne.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - file:///C:/Documents%20and%20Settings/ivana/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/popcaploader_v6.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\jekfgcij.exe (file missing)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe

nardino · Answer

Bonsoir.

Je ne vois pas le rapport de Vundofix.
Est-ce un oubli dans l'envoi ou dans l'exécution de la procédure ?

Télécharge OTMoveIt : http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe Sur ton bureau. Important.

Tu redémarres en mode sans échec et si tu as oublié passe Vundofix.
https://www.malekal.com/demarrer-windows-mode-sans-echec/
Redémarrer en mode sans échec

Puis lances Hijackthis par Scanner seulement et coches ces lignes :

O2 - BHO: (no name) - {5290A6E3-7BF3-416D-B5B2-AE608A34C912} - C:\WINDOWS\system32\ssttt.dll 
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\ghepdiiy.dll",sitypnow 
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab 
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - file:///C:/Documents%20and%20Settings/ivana/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/popcaploader_v6.cab

Cliques sur Fixer objet, ferme le programme.

Dans Démarrer/Exécuter, tape services.msc et arrête celui-ci:

O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\jekfgcij.exe (file missing) 

Puis double-clique dessus et dans Type de démarrage, désactives-le.

Tu relances Hijackthis par Ouvrir la section outils, Supprimer un service NT et dans le popup colle :

DomainService

Et valides par OK sans tenir compte de l'avertissement.

Tu lances OtMoveIt en cliquant sur le fichier du bureau
Tu inscris ou tu colles le chemin du fichier/dossier à supprimer dans la fenêtre de gauche (Paste List of Files/Folders to be moved) et tu cliques sur MoveIt!.
(La case Unregister Dll's and OCX's doit être cochée.)

C:\WINDOWS\system32\ssttt.dll
C:\WINDOWS\system32\ghepdiiy.dll
C:\WINDOWS\system32\jekfgcij.exe

Le fichier passe alors dans la fenêtre de droite.
Et tu obtiendras à la racine du système un dossier C:\_OTMoveIt
Dans ce dernier il y aura un sous-dossier Moved Files dans lequel il y aura une sauvegarde du/des fichier(s) supprimé(s) et un fichier
 de ce type ********_******.log (mm/jj/aaaa_hh/mm/ss = date et horaire de la suppression) que tu posteras par copier-coller pour contrôle.

Si un redémarrage est demandé, accepte-le sinon tu le provoques.

Une fois en mode normal, il faut procéder à la mise à jour des programmes suivants :

-Java Runtime Environment (JRE)6u3 :
https://www.oracle.com/java/technologies/javase-downloads.html
Clique sur Download Java Runtime Environment (JRE) 6u3
Dans la page suivante coche [b]Iaccept[/b] et télécharge [b] Windows Offline Installation, Multi-language //jre-6u3-windows-i586-p.exe //13.89 MB[/b]
Tu l'installeras navigateur fermé.
Dans Ajout/Suppression des programmes tu supprimes toutes les autres versions. 

-Acrobat Reader 8.1.:
https://get2.adobe.com/reader/otherversions/
Décocher Téléchargez également :Adobe Photoshop® Album Édition
Dans Ajout/Suppression des programmes tu supprimes toutes les autres versions.

Puis tu postes le rapport c:\Vundofix.txt et le rapport qui est dans c:\OtMOveIt\Moved Files  **********_********.log
Et un nouveau rapport Hijackthis avec des nouvelles sur l'évolution de tes problèmes.

@+

aleksandar · Answer

VundoFix V6.5.9

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 22:58:09 05/10/2007

Listing files found while scanning....

C:\WINDOWS\system32bjdutrt.ini
C:\WINDOWS\system32	rtudjbr.dll
C:\WINDOWS\system32\vdtyebda.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32bjdutrt.ini
C:\WINDOWS\system32bjdutrt.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32	rtudjbr.dll
C:\WINDOWS\system32	rtudjbr.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\vdtyebda.dll
C:\WINDOWS\system32\vdtyebda.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 23:55:20 05/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\caqtnwcn.dll
C:\WINDOWS\system32
cwntqac.ini
C:\WINDOWS\system32\wbkouleb.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\caqtnwcn.dll
C:\WINDOWS\system32\caqtnwcn.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32
cwntqac.ini
C:\WINDOWS\system32
cwntqac.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\wbkouleb.dll
C:\WINDOWS\system32\wbkouleb.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 23:58:35 05/10/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...

VundoFix V6.5.9

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 23:02:22 06/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\erqqpanl.dll
C:\WINDOWS\system32\lmxanvjk.dll
C:\WINDOWS\system32\lnapqqre.ini

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\erqqpanl.dll
C:\WINDOWS\system32\erqqpanl.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\lmxanvjk.dll
C:\WINDOWS\system32\lmxanvjk.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\lnapqqre.ini
C:\WINDOWS\system32\lnapqqre.ini Has been deleted!

Performing Repairs to the registry.
Done!

aleksandar · Answer

Logfile of HijackThis v1.99.1
Scan saved at 00:35:12, on 07/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Eset
od32kui.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=6061228
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=6061228
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {25E84652-0567-4800-A637-3BDD60CAE802} - C:\WINDOWS\system32\ssttt.dll
O2 - BHO: ECarteBleueBrowserHelper Class - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\xxavppew.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\pwljvncv.dll",sitypnow
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5308E02B-4ABA-48E4-AA9E-8A7693661473} (GameCtl Class) - http://jeuxenligne.orange.fr/GisActiveX/Ax/GameAx.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.servicesalacarte.orange.fr/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C9E17F58-564C-41C6-989F-AB0FE0D2C9D1} (PopcapLoader Object) - http://jeuxenligne.orange.fr/orange2.0/OnlineHSS/insaniquarium/Popcap.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxenligne.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe

aleksandar · Answer

je n arrive pas a trouvé le rapport de otmoveit merci d avance pour ta reponse.

aleksandar · Answer

O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\ghepdiiy.dll",sitypnow je ne l ai pas trouvé dans hijackthis et et ce que tu m a dis de faire avec otmoveit ca na pas tres bien marché.

nardino · Answer

Bonjour.

OtMoveIt doit être sur le bureau.
Et tu trouveras lerapport dans c:\_OtMoveIt\Moved Files un fichier 200710**_******.log

aleksandar · Answer

bonjour.

Dans le rapport otmoveit je n ai que ca :     Created on 10/06/2007 23:40:29

nardino · Answer

Bonsoir,

Tu recommences avec OtMoveIt

Tu lances OtMoveIt en cliquant sur le fichier du bureau
Tu inscris ou tu colles le chemin du fichier/dossier à supprimer dans la fenêtre de gauche (Paste List of Files/Folders to be moved) et tu cliques sur MoveIt!.
(La case Unregister Dll's and OCX's doit être cochée.)

C:\WINDOWS\system32\ssttt.dll
C:\WINDOWS\system32\pwljvncv.dll

Le fichier passe alors dans la fenêtre de droite.
Et tu obtiendras à la racine du système un dossier C:\_OTMoveIt
Dans ce dernier il y aura un sous-dossier Moved Files dans lequel il y aura une sauvegarde du/des fichier(s) supprimé(s) et un fichier
de ce type ********_******.log (mm/jj/aaaa_hh/mm/ss = date et horaire de la suppression) que tu posteras par copier-coller pour contrôle avec un nouveau log Hijackthis, après redémarrage.

afideg · Answer

up
;)

aleksandar · Answer

LoadLibrary failed for C:\WINDOWS\system32\ssttt.dll
C:\WINDOWS\system32\ssttt.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\ssttt.dll scheduled to be moved on reboot.
File/Folder C:\WINDOWS\system32\pwljvncv.dll not found.
 
Created on 10/08/2007 19:14:50

aleksandar · Answer

Logfile of HijackThis v1.99.1
Scan saved at 19:23:07, on 08/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Eset
od32krn.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\LVComS.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=6061228
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=6061228
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ECarteBleueBrowserHelper Class - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: (no name) - {6465F3F2-6709-44C1-AD4F-E64E86F95E67} - C:\WINDOWS\system32\ssttt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\xxavppew.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32
hsmhapu.dll",sitypnow
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5308E02B-4ABA-48E4-AA9E-8A7693661473} (GameCtl Class) - http://jeuxenligne.orange.fr/GisActiveX/Ax/GameAx.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.servicesalacarte.orange.fr/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C9E17F58-564C-41C6-989F-AB0FE0D2C9D1} (PopcapLoader Object) - http://jeuxenligne.orange.fr/orange2.0/OnlineHSS/insaniquarium/Popcap.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxenligne.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe

nardino · Answer

Bonsoir,

Télécharge Combofix de sUBs : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    - Ferme toutes les applications.
    - Double-clique sur combofix.exe (ne clique pas sur la fenêtre qui s'ouvre)
    - Appuie sur Y pour lancer le scan
    - A la fin du scan (cela peut prendre du temps), un rapport sera créé.
    - Poste ce rapport dans ton prochain message.

aleksandar · Answer

ComboFix 07-10-07.2 - ivana 2007-10-08 20:15:15.1 - NTFSx86 MINIMAL Microsoft Windows XP dition familiale 5.1.2600.2.1252.1.1036.18.828 [GMT 2:00] Running from: C:\Documents and Settings\ivana\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\check_LSA7.txt C:\WINDOWS\cookies.ini C:\WINDOWS\system32\ahkehggg.dll C:\WINDOWS\system32\axahoupq.ini C:\WINDOWS\system32\bguwgxou.dll C:\WINDOWS\system32\caqtnwcn.dll C:\WINDOWS\system32\cnitlomn.dll C:\WINDOWS\system32\deaclvnq.ini C:\WINDOWS\system32\dyumnrae.dll C:\WINDOWS\system32\earnmuyd.ini C:\WINDOWS\system32\efuctyjt.ini C:\WINDOWS\system32\eoywjqot.dll C:\WINDOWS\system32\etcyrlgx.dll C:\WINDOWS\system32\ggghekha.ini C:\WINDOWS\system32\gnyqsvvt.dll C:\WINDOWS\system32\grwhkwjn.dll C:\WINDOWS\system32\ibdjthlr.ini C:\WINDOWS\system32\idbnxeii.dll C:\WINDOWS\system32\idivsfor.dll C:\WINDOWS\system32\iiexnbdi.ini C:\WINDOWS\system32\iqhjcwpw.dll C:\WINDOWS\system32\jdcvraon.ini C:\WINDOWS\system32\jdrydksm.dll C:\WINDOWS\system32\kbjdhwxy.dll C:\WINDOWS\system32\kviseqtp.ini C:\WINDOWS\system32\lkfyteop.dll C:\WINDOWS\system32\mmkdyepr.ini C:\WINDOWS\system32\mskdyrdj.ini C:\WINDOWS\system32 dbteiey.dll C:\WINDOWS\system32 eceybes.ini C:\WINDOWS\system32 hsmhapu.dll C:\WINDOWS\system32 jwkhwrg.ini C:\WINDOWS\system32 moltinc.ini C:\WINDOWS\system32 oarvcdj.dll C:\WINDOWS\system32 qqueoun.ini C:\WINDOWS\system32 uoeuqqn.dll C:\WINDOWS\system32\poetyfkl.ini C:\WINDOWS\system32\pqxojtmr.dll C:\WINDOWS\system32\ptqesivk.dll C:\WINDOWS\system32\qgarcqov.dll C:\WINDOWS\system32\qmswqtvt.dll C:\WINDOWS\system32\qnvlcaed.dll C:\WINDOWS\system32\qpuohaxa.dll C:\WINDOWS\system32 lhtjdbi.dll C:\WINDOWS\system32 mtjoxqp.ini C:\WINDOWS\system32 ofsvidi.ini C:\WINDOWS\system32 peydkmm.dll C:\WINDOWS\system32\sebyecen.dll C:\WINDOWS\system32\sfbvfptw.dll C:\WINDOWS\system32\smsmgmcw.ini C:\WINDOWS\system32\ssttt.dll C:\WINDOWS\system32 jytcufe.dll C:\WINDOWS\system32 nbvtwew.dll C:\WINDOWS\system32 oqjwyoe.ini C:\WINDOWS\system32 rtudjbr.dll C:\WINDOWS\system32 ttss.bak1 C:\WINDOWS\system32 ttss.bak1 C:\WINDOWS\system32 ttss.bak1 C:\WINDOWS\system32 ttss.bak2 C:\WINDOWS\system32 ttss.bak2 C:\WINDOWS\system32 ttss.bak2 C:\WINDOWS\system32 ttss.ini C:\WINDOWS\system32 ttss.ini C:\WINDOWS\system32 ttss.ini C:\WINDOWS\system32 ttss.ini2 C:\WINDOWS\system32 ttss.ini2 C:\WINDOWS\system32 ttss.ini2 C:\WINDOWS\system32 ttss.tmp C:\WINDOWS\system32 ttss.tmp C:\WINDOWS\system32 ttss.tmp C:\WINDOWS\system32 vtqwsmq.ini C:\WINDOWS\system32 vvsqyng.ini C:\WINDOWS\system32\uoxgwugb.ini C:\WINDOWS\system32\upahmshn.ini C:\WINDOWS\system32\vaqcnxvv.ini C:\WINDOWS\system32\vdtyebda.dll C:\WINDOWS\system32\voqcragq.ini C:\WINDOWS\system32\vsqncdry.dll C:\WINDOWS\system32\vvvupyhx.ini C:\WINDOWS\system32\vvxncqav.dll C:\WINDOWS\system32\wbkouleb.dll C:\WINDOWS\system32\wcmgmsms.dll C:\WINDOWS\system32\wewtvbnt.ini C:\WINDOWS\system32\wpwcjhqi.ini C:\WINDOWS\system32\wtpfvbfs.ini C:\WINDOWS\system32\xglrycte.ini C:\WINDOWS\system32\xhypuvvv.dll C:\WINDOWS\system32\xxavppew.dll C:\WINDOWS\system32\yeietbdn.ini C:\WINDOWS\system32\ygrnewty.dll C:\WINDOWS\system32\yrdcnqsv.ini C:\WINDOWS\system32\yxwhdjbk.ini . ((((((((((((((((((((((((((((( Fichiers créés 2007-09-08 to 2007-10-08 )))))))))))))))))))))))))))))))))))) . 2007-10-08 20:14 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-07 19:09 d-------- C:\Program Files\iPod 2007-10-07 19:08 30,336 --a------ C:\WINDOWS\system32\drivers\usbaapl.sys 2007-10-06 17:59 19 --a------ C:\WINDOWS\popcinfo.dat 2007-10-06 17:36 d-------- C:\Documents and Settings\ivana\Application Data\Zylom 2007-10-06 17:35 d-------- C:\Program Files\Zylom Games 2007-10-05 23:10 dr------- C:\Documents and Settings\Administrateur\Mes documents 2007-10-05 23:10 dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer 2007-10-05 23:10 dr------- C:\Documents and Settings\Administrateur\Favoris 2007-10-05 23:10 d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau 2007-10-05 23:10 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression 2007-10-05 23:10 d--h----- C:\Documents and Settings\Administrateur\ModŠles 2007-10-05 23:10 d--h----- C:\Documents and Settings\Administrateur\Application Data\Gtek 2007-10-05 23:10 d-------- C:\Documents and Settings\Administrateur\Bureau 2007-10-05 23:10 d-------- C:\Documents and Settings\Administrateur\Application Data\ATI 2007-10-05 22:58 d-------- C:\VundoFix Backups 2007-10-05 22:41 d-------- C:\Program Files\Hijackthis Version Fran‡aise 2007-10-05 21:29 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-10-05 21:02 d-------- C:\Program Files\Yahoo! 2007-10-05 21:02 d-------- C:\Program Files\CCleaner 2007-09-28 22:45 502,208 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-09-28 22:45 270,336 --a------ C:\WINDOWS\system32\imon.dll 2007-09-26 17:50 d-------- C:\WINDOWS\ERUNT 2007-09-24 18:33 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-09-24 18:15 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-09-24 15:16 d-------- C:\WINDOWS\BDOSCAN8 2007-09-23 19:41 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-09-23 17:05 86,094 --a------ C:\WINDOWS\BPMNT.dll 2007-09-23 17:05 1,163,344 --a------ C:\WINDOWS\vsapi32.dll 2007-09-23 17:05 d-------- C:\WINDOWS\AU_Backup 2007-09-23 17:04 d-------- C:\WINDOWS\AU_Temp 2007-09-23 17:02 69,689 --a------ C:\WINDOWS\UNZIP.DLL 2007-09-23 17:02 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL 2007-09-23 17:02 286,720 --a------ C:\WINDOWS\PATCH.EXE 2007-09-23 17:02 d-------- C:\WINDOWS\AU_Log 2007-09-22 06:29 33,792 --a------ C:\WINDOWS\system32\yayayvw.dll.vir . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-07 19:12 --------- d-------- C:\Program Files\Apple Software Update 2007-10-07 19:10 --------- d-------- C:\Program Files\iTunes 2007-10-07 13:08 --------- d-------- C:\Program Files\Google 2007-10-07 13:08 --------- d-------- C:\Documents and Settings\All Users\Application Data\Google 2007-09-27 18:05 --------- d-------- C:\Program Files\PokerChamps 2007-09-27 18:01 --------- d-------- C:\Program Files\IKEA HomePlanner 2007-09-22 14:14 --------- d-------- C:\Program Files\eMule 2007-08-24 23:48 --------- d-------- C:\Program Files\QuickTime 2007-08-24 23:47 --------- d-------- C:\Program Files\Fichiers communs\Apple 2007-08-24 23:47 --------- d-------- C:\Documents and Settings\All Users\Application Data\Apple 2007-08-16 21:14 --------- d-------- C:\Program Files\MSXML 4.0 1995-09-20 15:16 456976 --a------ C:\Program Files\Fichiers communs\dao3032.dll --------- C:\Program Files\Hijackthis Version Française 2007-06-09 13:13:41 8,192 --sha-w C:\WINDOWS\o2cLicStore.bin 2007-02-16 19:56:23 168 --sh--r C:\WINDOWS\system32\A95D9052E3.sys 2007-02-16 19:56:34 7,670 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 09:15] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 19:41] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 07:20] "ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 18:50] "ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 18:50] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-20 17:00 C:\WINDOWS\stsystra.exe] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-02-12 17:57] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-02-12 17:59] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24] "nod32kui"="C:\Program Files\Eset od32kui.exe" [2007-09-28 22:44] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-10-07 13:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Dell Network Assistant.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Dell Network Assistant.lnk backup=C:\WINDOWS\pss\Dell Network Assistant.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eCarteBleue-CLEO] "C:\Program Files\e-Carte Bleue\LCL\e-Carte Bleue VISA Cleo\ECB-CLEO.exe" /dontopenmycards [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregFre\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregFre\ereg.ini" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe R2 hnmwrlspkt;HomeNet Manager Wireless Protocol;C:\WINDOWS\system32\DRIVERS\hnm_wrls_pkt.sys R2 wsppkt;Wireless Security Protocol;C:\WINDOWS\system32\DRIVERS\wsp_pkt.sys R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2007-10-07 17:05:45 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-08 20:19:33 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-08 20:20:43 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-10-08 20:20 . --- E O F ---

nardino · Answer

Bonsoir.

Sur ce site: https://virusscan.jotti.org/
= Virusscan.jotti-maxi 15mb

C:\WINDOWS\popcinfo.dat
C:\WINDOWS\system32\imon.dll
C:\WINDOWS\vsapi32.dll 
C:\WINDOWS\AU_Temp 
C:\WINDOWS\system32\yayayvw.dll.vir

Tu fais analyser les fichiers suivant et tu enregistres les rapports que tu postes dans la prochaine réponse.
Nous allons en venir à bout.

aleksandar · Answer

pour ce fichier:C:\WINDOWS\system32\yayayvw.dll.vir le rapport et le suivant

Service load:  0%        100%  
 
File:  yayayvw.dll.vir_  
Status:  INFECTED/MALWARE  
MD5:  fbbcda5777dc2f69750e4a4e73909d77  
Packers detected:  - 
Bit9 reports:  File not found  
 
Scanner results  
Scan taken on 08 Oct 2007 20:36:21 (GMT)  
A-Squared  Found Adware.Win32.Virtumonde.vq  
AntiVir  Found TR/Vundo.DNG  
ArcaVir  Found nothing 
Avast  Found nothing 
AVG Antivirus  Found nothing 
BitDefender  Found Trojan.Vundo.DNG  
ClamAV  Found Adware.Virtumonde-141  
CPsecure  Found nothing 
Dr.Web  Found nothing 
F-Prot Antivirus  Found nothing 
F-Secure Anti-Virus  Found nothing 
Fortinet  Found nothing 
Kaspersky Anti-Virus  Found Trojan.Win32.Pakes.ei  
NOD32  Found nothing 
Norman Virus Control  Found W32/Vundo.T  
Panda Antivirus  Found nothing 
Rising Antivirus  Found nothing 
Sophos Antivirus  Found nothing 
VirusBuster  Found nothing 
VBA32  Found nothing

aleksandar · Answer

j ai fait fichier par chier et c est le seul qui a un virus

aleksandar · Answer

Et pour ce fichier C:\WINDOWS\AU_Temp le site ne le scanne pas il me dit:The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

aleksandar · Answer

MERCI D AVANCE POUR TOUT LE TEMP PASSE AVEC MOI

aleksandar · Answer

JE T ENVOI CE RAPPORT JE NE C EST PAS SI JE TE L AI DEJA ENVOYER
[code]
2007-09-22 06:35      310880    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ssttt.dll.vir
2007-09-22 19:24      812525    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32	ttss.bak1.vir
2007-09-24 14:30      86080    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32peydkmm.dll.vir
2007-09-25 07:30      693988    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\mmkdyepr.ini.vir
2007-09-25 07:40      820451    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32	ttss.ini.vir
2007-09-25 13:39      820511    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32	ttss.tmp.vir
2007-09-26 14:50      84032    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\eoywjqot.dll.vir
2007-09-26 15:42      693679    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32	oqjwyoe.ini.vir
2007-09-26 15:51      84032    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\qmswqtvt.dll.vir
2007-09-26 16:06      693421    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32	vtqwsmq.ini.vir
2007-09-26 18:06      693661    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\earnmuyd.ini.vir
2007-09-26 18:06      84032    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\dyumnrae.dll.vir
2007-09-26 21:11      84032    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\etcyrlgx.dll.vir
2007-09-26 21:17      693439    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\xglrycte.ini.vir
2007-09-26 21:19      84032    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\lkfyteop.dll.vir
2007-09-26 21:20      693421    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\poetyfkl.ini.vir
2007-09-26 22:23      693541    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\wewtvbnt.ini.vir
2007-09-26 22:23      84032    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32	nbvtwew.dll.vir
2007-09-28 14:26      85056    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\wcmgmsms.dll.vir
2007-09-28 15:53      693559    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\smsmgmcw.ini.vir
2007-09-28 21:22      85056    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\qnvlcaed.dll.vir
2007-09-28 21:26      693472    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\deaclvnq.ini.vir
2007-09-28 22:45      85056    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ygrnewty.dll.vir
2007-09-29 00:02      85056    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\gnyqsvvt.dll.vir
2007-09-29 00:08      694321    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32	vvsqyng.ini.vir
2007-09-29 09:08      84032    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ptqesivk.dll.vir
2007-09-29 10:15      693679    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\kviseqtp.ini.vir
2007-09-29 10:19      84032    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32
oarvcdj.dll.vir
2007-09-29 17:15      693551    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\jdcvraon.ini.vir
2007-10-01 14:13      87104    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\kbjdhwxy.dll.vir
2007-10-01 14:52      693679    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\yxwhdjbk.ini.vir
2007-10-01 15:46      87104    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\jdrydksm.dll.vir
2007-10-01 18:01      693439    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\mskdyrdj.ini.vir
2007-10-01 21:29      87104    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32	jytcufe.dll.vir
2007-10-01 21:56      693439    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\efuctyjt.ini.vir
2007-10-02 10:35      85056    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32
dbteiey.dll.vir
2007-10-02 17:36      693559    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\yeietbdn.ini.vir
2007-10-02 17:45      77376    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\vdtyebda.dll.vir
2007-10-03 11:15      693661    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\wpwcjhqi.ini.vir
2007-10-03 11:15      86080    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\iqhjcwpw.dll.vir
2007-10-03 18:08      86080    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\vvxncqav.dll.vir
2007-10-03 18:36      693439    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\vaqcnxvv.ini.vir
2007-10-03 18:41      693421    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ggghekha.ini.vir
2007-10-03 18:41      86080    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ahkehggg.dll.vir
2007-10-04 07:14      85056    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\sebyecen.dll.vir
2007-10-04 09:48      693712    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32
eceybes.ini.vir
2007-10-04 15:15      693661    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\wtpfvbfs.ini.vir
2007-10-04 15:15      85056    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\sfbvfptw.dll.vir
2007-10-04 15:49      85056    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\idbnxeii.dll.vir
2007-10-04 18:47      693533    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\iiexnbdi.ini.vir
2007-10-05 13:41      693661    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32ofsvidi.ini.vir
2007-10-05 13:41      87104    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\idivsfor.dll.vir
2007-10-05 14:03      693421    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\axahoupq.ini.vir
2007-10-05 14:03      87104    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\qpuohaxa.dll.vir
2007-10-05 14:19      87104    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\bguwgxou.dll.vir
2007-10-05 22:01      693439    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\uoxgwugb.ini.vir
2007-10-05 22:07      87104    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cnitlomn.dll.vir
2007-10-05 22:39      693533    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32
moltinc.ini.vir
2007-10-05 22:45      87104    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32	rtudjbr.dll.vir
2007-10-05 23:40      76352    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\wbkouleb.dll.vir
2007-10-05 23:46      87104    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\caqtnwcn.dll.vir
2007-10-06 00:14      693421    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32mtjoxqp.ini.vir
2007-10-06 00:14      87104    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\pqxojtmr.dll.vir
2007-10-06 23:45      693421    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ibdjthlr.ini.vir
2007-10-06 23:45      85056    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32lhtjdbi.dll.vir
2007-10-06 23:47      77376    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\xxavppew.dll.vir
2007-10-07 01:05      693421    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\yrdcnqsv.ini.vir
2007-10-07 01:05      85056    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\vsqncdry.dll.vir
2007-10-07 09:19      86080    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\qgarcqov.dll.vir
2007-10-07 09:20      693661    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\voqcragq.ini.vir
2007-10-07 16:49      86080    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32
uoeuqqn.dll.vir
2007-10-07 16:52      693670    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32
qqueoun.ini.vir
2007-10-08 15:02      693781    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32
jwkhwrg.ini.vir
2007-10-08 15:02      85056    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\grwhkwjn.dll.vir
2007-10-08 15:21      85056    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\xhypuvvv.dll.vir
2007-10-08 15:34      693533    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\vvvupyhx.ini.vir
2007-10-08 19:17      555033    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32	ttss.bak2.vir
2007-10-08 19:20      4174    --a------    C:\Qoobox\Quarantine\C\WINDOWS\cookies.ini.vir
2007-10-08 19:20      693721    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\upahmshn.ini.vir
2007-10-08 19:20      83520    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32
hsmhapu.dll.vir
2007-10-08 20:17      560    --a------    C:\Qoobox\Quarantine\catchme.log
2007-10-08 20:17      820511    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32	ttss.ini2.vir
2007-10-08 20:17      845026    --a------    C:\Qoobox\Quarantine\catchme2007-10-08_201911.50.zip
2007-10-08 20:18      1218    --a------    C:\Qoobox\Quarantine\C\check_LSA7.txt.vir


Structure du dossier
Le num‚ro de s‚rie du volume est 78E3-F613
C:\QOOBOX\QUARANTINE
|   catchme.log
|   catchme2007-10-08_201911.50.zip
|   
+---C
|   |   check_LSA7.txt.vir
|   |   
|   \---WINDOWS
|       |   cookies.ini.vir
|       |   
|       \---system32
|               ahkehggg.dll.vir
|               axahoupq.ini.vir
|               bguwgxou.dll.vir
|               caqtnwcn.dll.vir
|               cnitlomn.dll.vir
|               deaclvnq.ini.vir
|               dyumnrae.dll.vir
|               earnmuyd.ini.vir
|               efuctyjt.ini.vir
|               eoywjqot.dll.vir
|               etcyrlgx.dll.vir
|               ggghekha.ini.vir
|               gnyqsvvt.dll.vir
|               grwhkwjn.dll.vir
|               ibdjthlr.ini.vir
|               idbnxeii.dll.vir
|               idivsfor.dll.vir
|               iiexnbdi.ini.vir
|               iqhjcwpw.dll.vir
|               jdcvraon.ini.vir
|               jdrydksm.dll.vir
|               kbjdhwxy.dll.vir
|               kviseqtp.ini.vir
|               lkfyteop.dll.vir
|               mmkdyepr.ini.vir
|               mskdyrdj.ini.vir
|               ndbteiey.dll.vir
|               neceybes.ini.vir
|               nhsmhapu.dll.vir
|               njwkhwrg.ini.vir
|               nmoltinc.ini.vir
|               noarvcdj.dll.vir
|               nqqueoun.ini.vir
|               nuoeuqqn.dll.vir
|               poetyfkl.ini.vir
|               pqxojtmr.dll.vir
|               ptqesivk.dll.vir
|               qgarcqov.dll.vir
|               qmswqtvt.dll.vir
|               qnvlcaed.dll.vir
|               qpuohaxa.dll.vir
|               rlhtjdbi.dll.vir
|               rmtjoxqp.ini.vir
|               rofsvidi.ini.vir
|               rpeydkmm.dll.vir
|               sebyecen.dll.vir
|               sfbvfptw.dll.vir
|               smsmgmcw.ini.vir
|               ssttt.dll.vir
|               tjytcufe.dll.vir
|               tnbvtwew.dll.vir
|               toqjwyoe.ini.vir
|               trtudjbr.dll.vir
|               tttss.bak1.vir
|               tttss.bak2.vir
|               tttss.ini.vir
|               tttss.ini2.vir
|               tttss.tmp.vir
|               tvtqwsmq.ini.vir
|               tvvsqyng.ini.vir
|               uoxgwugb.ini.vir
|               upahmshn.ini.vir
|               vaqcnxvv.ini.vir
|               vdtyebda.dll.vir
|               voqcragq.ini.vir
|               vsqncdry.dll.vir
|               vvvupyhx.ini.vir
|               vvxncqav.dll.vir
|               wbkouleb.dll.vir
|               wcmgmsms.dll.vir
|               wewtvbnt.ini.vir
|               wpwcjhqi.ini.vir
|               wtpfvbfs.ini.vir
|               xglrycte.ini.vir
|               xhypuvvv.dll.vir
|               xxavppew.dll.vir
|               yeietbdn.ini.vir
|               ygrnewty.dll.vir
|               yrdcnqsv.ini.vir
|               yxwhdjbk.ini.vir
|               
\---Registry_backups
[/code]

nardino · Answer

Bonsoir,

Script Combofix

    - Ouvre le bloc-note et colles-y les lignes écrites en citation ci-dessous :
    
      File::
      C:\WINDOWS\system32\ssttt.dll  
      C:\WINDOWS\system32\yayayvw.dll.vir 

      Folder::
      C:\VundoFix Backups

      Registry::
      [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ssttt.dll]
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "SearchIndexer"=-


    - Enregistre-le sous CFScript.txt, sur le bureau
    - Comme sur l'image présentée ici, fais glisser CFScript.txt dans Combofix.exe
	http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
    - Poste le résultat et un nouveau rapport HijackThis !

aleksandar · Answer

ComboFix 07-10-07.2 - ivana 2007-10-08 23:58:51.2 - NTFSx86 Microsoft Windows XP dition familiale 5.1.2600.2.1252.1.1036.18.557 [GMT 2:00] Running from: C:\Documents and Settings\ivana\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\ivana\Bureau\CFScript.txt * Created a new restore point FILE:: C:\WINDOWS\system32\ssttt.dll C:\WINDOWS\system32\yayayvw.dll.vir . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\yayayvw.dll.vir . ((((((((((((((((((((((((((((( Fichiers créés 2007-09-08 to 2007-10-08 )))))))))))))))))))))))))))))))))))) . 2007-10-08 20:14 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-07 19:09 d-------- C:\Program Files\iPod 2007-10-07 19:08 30,336 --a------ C:\WINDOWS\system32\drivers\usbaapl.sys 2007-10-06 17:59 19 --a------ C:\WINDOWS\popcinfo.dat 2007-10-06 17:36 d-------- C:\Documents and Settings\ivana\Application Data\Zylom 2007-10-06 17:35 d-------- C:\Program Files\Zylom Games 2007-10-05 23:10 dr------- C:\Documents and Settings\Administrateur\Mes documents 2007-10-05 23:10 dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer 2007-10-05 23:10 dr------- C:\Documents and Settings\Administrateur\Favoris 2007-10-05 23:10 d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau 2007-10-05 23:10 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression 2007-10-05 23:10 d--h----- C:\Documents and Settings\Administrateur\ModŠles 2007-10-05 23:10 d--h----- C:\Documents and Settings\Administrateur\Application Data\Gtek 2007-10-05 23:10 d-------- C:\Documents and Settings\Administrateur\Bureau 2007-10-05 23:10 d-------- C:\Documents and Settings\Administrateur\Application Data\ATI 2007-10-05 22:41 d-------- C:\Program Files\Hijackthis Version Fran‡aise 2007-10-05 21:29 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-10-05 21:02 d-------- C:\Program Files\Yahoo! 2007-10-05 21:02 d-------- C:\Program Files\CCleaner 2007-09-28 22:45 502,208 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-09-28 22:45 270,336 --a------ C:\WINDOWS\system32\imon.dll 2007-09-26 17:50 d-------- C:\WINDOWS\ERUNT 2007-09-24 18:33 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-09-24 18:15 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-09-24 15:16 d-------- C:\WINDOWS\BDOSCAN8 2007-09-23 19:41 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-09-23 17:05 86,094 --a------ C:\WINDOWS\BPMNT.dll 2007-09-23 17:05 1,163,344 --a------ C:\WINDOWS\vsapi32.dll 2007-09-23 17:05 d-------- C:\WINDOWS\AU_Backup 2007-09-23 17:04 d-------- C:\WINDOWS\AU_Temp 2007-09-23 17:02 69,689 --a------ C:\WINDOWS\UNZIP.DLL 2007-09-23 17:02 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL 2007-09-23 17:02 286,720 --a------ C:\WINDOWS\PATCH.EXE 2007-09-23 17:02 d-------- C:\WINDOWS\AU_Log . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-07 19:12 --------- d-------- C:\Program Files\Apple Software Update 2007-10-07 19:10 --------- d-------- C:\Program Files\iTunes 2007-10-07 13:08 --------- d-------- C:\Program Files\Google 2007-10-07 13:08 --------- d-------- C:\Documents and Settings\All Users\Application Data\Google 2007-09-27 18:05 --------- d-------- C:\Program Files\PokerChamps 2007-09-27 18:01 --------- d-------- C:\Program Files\IKEA HomePlanner 2007-09-22 14:14 --------- d-------- C:\Program Files\eMule 2007-08-24 23:48 --------- d-------- C:\Program Files\QuickTime 2007-08-24 23:47 --------- d-------- C:\Program Files\Fichiers communs\Apple 2007-08-24 23:47 --------- d-------- C:\Documents and Settings\All Users\Application Data\Apple 2007-08-16 21:14 --------- d-------- C:\Program Files\MSXML 4.0 1995-09-20 15:16 456976 --a------ C:\Program Files\Fichiers communs\dao3032.dll --------- C:\Program Files\Hijackthis Version Française 2007-06-09 13:13:41 8,192 --sha-w C:\WINDOWS\o2cLicStore.bin 2007-02-16 19:56:23 168 --sh--r C:\WINDOWS\system32\A95D9052E3.sys 2007-02-16 19:56:34 7,670 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 09:15] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 19:41] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 07:20] "ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 18:50] "ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 18:50] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-20 17:00 C:\WINDOWS\stsystra.exe] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-02-12 17:57] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-02-12 17:59] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24] "nod32kui"="C:\Program Files\Eset od32kui.exe" [2007-09-28 22:44] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-10-07 13:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Dell Network Assistant.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Dell Network Assistant.lnk backup=C:\WINDOWS\pss\Dell Network Assistant.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eCarteBleue-CLEO] "C:\Program Files\e-Carte Bleue\LCL\e-Carte Bleue VISA Cleo\ECB-CLEO.exe" /dontopenmycards [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregFre\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregFre\ereg.ini" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe R2 hnmwrlspkt;HomeNet Manager Wireless Protocol;C:\WINDOWS\system32\DRIVERS\hnm_wrls_pkt.sys R2 wsppkt;Wireless Security Protocol;C:\WINDOWS\system32\DRIVERS\wsp_pkt.sys R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2007-10-07 17:05:45 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-09 00:01:46 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-09 0:02:31 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-10-09 00:02 . --- E O F ---

aleksandar · Answer

Logfile of HijackThis v1.99.1
Scan saved at 00:04:31, on 09/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=6061228
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ECarteBleueBrowserHelper Class - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5308E02B-4ABA-48E4-AA9E-8A7693661473} (GameCtl Class) - http://jeuxenligne.orange.fr/GisActiveX/Ax/GameAx.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.servicesalacarte.orange.fr/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C9E17F58-564C-41C6-989F-AB0FE0D2C9D1} (PopcapLoader Object) - http://jeuxenligne.orange.fr/orange2.0/OnlineHSS/insaniquarium/Popcap.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxenligne.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe

nardino · Answer

Bonsoir.

Ton problème est-il résolu ?

aleksandar · Answer

Je pense que oui tout va bien je n ai plus aucun probleme je te remercie beaucoup sans toi je n y serai jamais arriver merci encore une fois NARDINO.Juste une question les programmes que tu m a fait telecharger je dois en garder certain ou tous les effacé?

nardino · Answer

Bonsoir,

Super.
Tu cliques sur OtMoveIt et puis sur le bouton CleanUp.
Puis dans le popup [b]Cleanup list download successful. Begin cleanup process ?[/b], accepte par [b]Yes[/b]

Il va supprimer tout ce qu'il est inutile de conserver et même s'auto-détruire, c'est pas beau çà !
Tu redémarres et voilà.
Pour finir, je te conseille l'installation d'un pare-feu:
http://www.personalfirewall.comodo.com/
Comodo™ Firewall

Et puis la navigation avec Firefox et deux trois extensions:
http://www.mozilla-europe.org/fr/products/firefox/
Mozilla Firefox 2.0

https://addons.mozilla.org/fr/firefox/addon/2497
CookieSafe 

https://www.hugedomains.com/domain_profile.cfm?d=geckozone&e=org
NoScript 

https://www.hugedomains.com/domain_profile.cfm?d=geckozone&e=org
Adblock

aleksandar · Answer

ok c fait mais il me reste pas mal de programme comme vundofix fixvundo ccleaner avg antispyware hijack combofix j en fait quoi?

nardino · Answer

Bonjour.

Si tu as bien supprimer OtMoveIt, il doit aussi avoir effacé, VundoFix et Combofix.
Si ce n'est pas le cas fais-le manuellement.
Tu peux conserver AVGAS, Hijackthis et CCleaner.
Un petit nettoyage par semaine avec ce dernier n'est pas inutile.
Tu peux aussi mettre à jour ta version de Adobe Reader:
 -Acrobat Reader 8.1.:
https://get2.adobe.com/reader/otherversions/
Décocher Téléchargez également :Adobe Photoshop® Album Édition
Dans Ajout/Suppression des programmes tu supprimes toutes les autres versions.

Infecté par WIN 32/Agent.BCK cheval de troie

38 réponses

Discussions similaires