Win32 + "your computer may be infected...&quoRésolu/Fermé

Question

Bonjour, 
Depuis quelque temps, j'ai des fenêtres qui s'affichent sur mes pages internet à la place des publicités avec le message suivant : "your computer may be infected..." avec une croix rouge.
Par ailleurs, j'ai des pages qui s'ouvrent toute seules avec des propositions pour des antivirus ou des publicités pour des ordinateurs (VLAZE), des régimes, des sites de rencontre...
Mon antivirus (avast) me dit que mon ordi est infecté par win32... 
Que faire ?
merci pour la réponse précise car je ne m'y connais pas en informatique.

Utilisateur anonyme · Answer

Salut cath69,
Lis ceci pour commencer, et réponds-moi au 3 petites questions, merci
http://leblogdeclaude.blogspot.com/2007/06/bienvenue-sur-ccm.html
----------------------------------------------------------------------------------------
ensuite, fais ceci:
https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html
copies le rapport ici

cath69 · Answer

Bonsoir, 
Voici le réponses aux 3 questions
mon PC est du groupe : b 
Mon fire-wall est de catégorie : e
Mes connaissances : a

Utilisateur anonyme · Answer

bien, n'oublies pas la suite !
ensuite, fais ceci:
https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html
copies le rapport ici

cath69 · Answer

Bonjour, 

Voilà la suite. Je suis un peu lente parceque je lis ton blog en même temps. J'espère ne rien oublier...


Logfile of HijackThis v1.99.1
Scan saved at 18:37:19, on 29/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/advanced_search?hl=fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\lydhtoqk.dll
O2 - BHO: (no name) - {9E52125A-395F-4CC1-82B3-0EFE98BF918D} - C:\WINDOWS\system32\mljjk.dll
O2 - BHO: (no name) - {A8FA9FB3-E789-40F2-B9CA-E58728552E85} - C:\WINDOWS\system32\mljjk.dll
O2 - BHO: (no name) - {C29D81FE-9F69-4186-BBD3-709038660815} - (no file)
O2 - BHO: (no name) - {F424FB20-C093-4AAC-B7E5-42E454C910E7} - (no file)
O3 - Toolbar: (no name) - {BAE9A6FD-565C-4CB5-98AD-3BFA5E7C332D} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [94f2b825] rundll32.exe "C:\WINDOWS\system32\fatxosvt.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potg_x.cab
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://www.m6video.fr/1click/install/files/installer2.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c009316.dat
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

Utilisateur anonyme · Answer

joli !
fais ceci:
https://leblogdeclaude.blogspot.com/2007/05/procdure-vundofix.html
si  il détecte quelque chose,  tu passes directement à  "remove Vundo"

cath69 · Answer

Quel cri du coeur ! Est-ce grave docteur ? Je poursuis...

cath69 · Answer

Inutile de préciser qu'il à trouvé qq chose...mais les fenêtres sont toujours là ! Est-ce que je dois poursuivre avec l'outil symantec ? Faut-il supprimer vundofix avant ? 


VundoFix V6.5.9

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 18:52:05 06/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\utessgrk.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\utessgrk.dll
C:\WINDOWS\system32\utessgrk.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\utessgrk.dll
C:\WINDOWS\system32\utessgrk.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 19:27:51 06/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\xdxileun.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\xdxileun.dll
C:\WINDOWS\system32\xdxileun.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 08:28:21 07/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\serchgno.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\serchgno.dll
C:\WINDOWS\system32\serchgno.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 18:28:09 11/10/2007

Listing files found while scanning....

C:\WINDOWS\system32	exohwyp.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32	exohwyp.dll
C:\WINDOWS\system32	exohwyp.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.10

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 09:06:51 21/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\amftdplr.dll
C:\WINDOWS\system32\hbvzlxit.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\amftdplr.dll
C:\WINDOWS\system32\amftdplr.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\hbvzlxit.dll
C:\WINDOWS\system32\hbvzlxit.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.10

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 09:21:30 21/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\alrtppjf.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\alrtppjf.dll
C:\WINDOWS\system32\alrtppjf.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.10

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 16:48:49 21/10/2007

Listing files found while scanning....

C:\WINDOWS\system32ypmusqn.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32ypmusqn.dll
C:\WINDOWS\system32ypmusqn.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.10

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 20:52:36 21/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\vbfwiqxs.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\vbfwiqxs.dll
C:\WINDOWS\system32\vbfwiqxs.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.10

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 20:58:14 21/10/2007

Listing files found while scanning....

No infected files were found.


VundoFix V6.5.10

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 21:28:55 21/10/2007

Listing files found while scanning....

No infected files were found.


VundoFix V6.5.10

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 18:54:53 22/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\bbttlwey.dll

Beginning removal...

Performing Repairs to the registry.
Done!

VundoFix V6.5.10

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 19:29:13 22/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\idmkuwcn.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\idmkuwcn.dll
C:\WINDOWS\system32\idmkuwcn.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.10

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 18:02:46 23/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\xbyuteir.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\xbyuteir.dll
C:\WINDOWS\system32\xbyuteir.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.10

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 20:48:48 23/10/2007

Listing files found while scanning....

No infected files were found.


VundoFix V6.5.10

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 12:00:43 27/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\otosmssm.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\otosmssm.dll
C:\WINDOWS\system32\otosmssm.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.10

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 08:34:08 28/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\lydhtoqk.dll

VundoFix V6.5.11

Checking Java version...

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 21:34:52 29/10/2007

Listing files found while scanning....

C:\windows\system32\gfxsbcxk.ini
C:\windows\system32\hjqphtwi.dll
C:\windows\system32\kxcbsxfg.dll
C:\WINDOWS\system32\lydhtoqk.dll

Beginning removal...

 Attempting to delete C:\windows\system32\gfxsbcxk.ini
C:\windows\system32\gfxsbcxk.ini Has been deleted!

 Attempting to delete C:\windows\system32\hjqphtwi.dll
C:\windows\system32\hjqphtwi.dll Has been deleted!

 Attempting to delete C:\windows\system32\kxcbsxfg.dll
C:\windows\system32\kxcbsxfg.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\lydhtoqk.dll
C:\WINDOWS\system32\lydhtoqk.dll Has been deleted!

Performing Repairs to the registry.
Done!

cath69 · Answer

Merci pour l'aide apportée aujourd'hui. 
Avast vient de se déclencher pour m'annoncer la présence de "Win32:Agent-LAP [Trj]"...A demain pour la suite.

Utilisateur anonyme · Answer

pas de panique, on n'a pas fini, ne tiens pas compte des alertes virus pour le moment.
fais ceci dans ma page.
 VirtumundoBeGone est un autre outil très efficace pour cette infection.
https://leblogdeclaude.blogspot.com/2007/05/procdure-vundofix.html

cath69 · Answer

Voilà, j'ai terminé le scan. Il a trouvé qq chose et l'a détruit... a priori...Que dois-je faire maintnant ?

Utilisateur anonyme · Answer

Bien,
fais ceci:
https://leblogdeclaude.blogspot.com/2007/03/informatique-procdure-navifix.html
postes le rapport

cath69 · Answer

Search Navipromo version 3.3.3 commencé le 30/10/2007 à 19:29:55,32

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 30.10.2007 à 19h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 


*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\Catherine Theiller\Application Data ***


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun fichier trouvé dans :

- C:\WINDOWS\system32
- C:\DOCUME~1\CATHER~1\LOCALS~1\APPLIC~1



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans C:\DOCUME~1\CATHER~1\LOCALS~1\APPLIC~1 *



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:
C:\WINDOWS\system32\kjjlm.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\kjjlm.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\klnmp.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\opqss.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\kjjlm.bak2 trouvé ! infection Vundo possible non traitée par cet outil !

2)Recherche Heuristique :

C:\WINDOWS\system32\dmbafoiq.exe trouvé !


3)Recherche Certificats :

Certificat Egroup absent !


*** Analyse terminée le 30/10/2007 à 19:30:31,90 ***

Utilisateur anonyme · Answer

Bien fait l'option 2
et postes le rapport
--------ensuite à l'aide du premier outils Vundo en mode sans échec.(sinon, ils risquent d'être lockés !)

dans la fenêtre blanche, celle qui est vide, fais un clic droit,tu auras en gris "Add files ?" (ajouter des fichiers ?)
ajoute ceci.


C:\WINDOWS\system32\kjjlm.ini2
C:\WINDOWS\system32\kjjlm.bak1
C:\WINDOWS\system32\klnmp.bak1
C:\WINDOWS\system32\opqss.bak1
C:\WINDOWS\system32\kjjlm.bak2

https://leblogdeclaude.blogspot.com/2007/05/procdure-vundofix.html
si ça n'est pas encore clean, faudra le faire en manuel.

cath69 · Answer

Je viens de terminer l'ensemble...et une fenêtre vient de surgir....grrrrrrrr

Search Navipromo version 3.3.3 commencé le 30/10/2007 à 20:40:37,89

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 30.10.2007 à 19h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 


*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\Catherine Theiller\Application Data ***


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun fichier trouvé dans :

- C:\WINDOWS\system32
- C:\DOCUME~1\CATHER~1\LOCALS~1\APPLIC~1



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans C:\DOCUME~1\CATHER~1\LOCALS~1\APPLIC~1 *



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:
C:\WINDOWS\system32\kjjlm.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\kjjlm.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\klnmp.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\opqss.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\kjjlm.bak2 trouvé ! infection Vundo possible non traitée par cet outil !

2)Recherche Heuristique :

C:\WINDOWS\system32\dmbafoiq.exe trouvé !


3)Recherche Certificats :

Certificat Egroup absent !


*** Analyse terminée le 30/10/2007 à 20:41:36,07 ***

cath69 · Answer

Bonne nuit, à demain et encore merci pour ton aide.

Utilisateur anonyme · Answer

refais l'option 2 de Smifraud en mode sans échec.
--------------------------------------------------------------
--------ensuite à l'aide du premier outils Vundo en mode sans échec.(sinon, ils risquent d'être lockés !)

dans la fenêtre blanche, celle qui est vide, fais un clic droit,tu auras en gris "Add files ?" (ajouter des fichiers ?)
ajoute ceci.


C:\WINDOWS\system32\kjjlm.ini2
C:\WINDOWS\system32\kjjlm.bak1
C:\WINDOWS\system32\klnmp.bak1
C:\WINDOWS\system32\opqss.bak1
C:\WINDOWS\system32\kjjlm.bak2 
---------------------------------------------------------

cath69 · Answer

Hello !

Clean Navipromo version 3.3.3 commencé le 31/10/2007 à 18:09:52,73

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 30.10.2007 à 19h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11

Mode suppression automatique 


 
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
 

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans C:\WINDOWS\System32 *


* Suppression dans C:\DOCUME~1\CATHER~1\LOCALS~1\APPLIC~1 *



*** Suppression dossiers dans C:\WINDOWS ***


*** Suppression dossiers dans C:\Program Files ***


*** Suppression dossiers dans C:\Documents and Settings\All Users\Application Data ***


*** Suppression dossiers dans C:\Documents and Settings\Catherine Theiller\Application Data ***


*** Suppression dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Catherine Theiller\Local Settings\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

C:\WINDOWS\system32\kjjlm.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\kjjlm.bak2 trouvé ! infection Vundo possible non traitée par cet outil !

2)Recherche, création sauvegardes et suppression Heuristique :


*** Sauvegarde du Registre vers dossier Backupnavi ***

sauvegarde du Registre réalisé avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !

*** Nettoyage terminé le 31/10/2007 à 18:12:41,71 ***

Utilisateur anonyme · Answer

il reste ceci:

-ensuite à l'aide du premier outils Vundo en mode sans échec.(sinon, ils risquent d'être lockés !)
https://leblogdeclaude.blogspot.com/2007/05/procdure-vundofix.html

dans la fenêtre blanche, celle qui est vide, fais un clic droit,tu auras en gris "Add files ?" (ajouter des fichiers ?)
ajoute ceci.

C:\WINDOWS\system32\kjjlm.ini2
C:\WINDOWS\system32\kjjlm.bak2

cath69 · Answer

C'est fait...

Utilisateur anonyme · Answer

refaits un Navipromo
https://leblogdeclaude.blogspot.com/2007/03/informatique-procdure-navifix.html

cath69 · Answer

AAArrrrggg (cri de désespoir), ils sont encore là !

Search Navipromo version 3.3.3 commencé le 31/10/2007 à 20:42:57,68

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 30.10.2007 à 19h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 


*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\Catherine Theiller\Application Data ***


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun fichier trouvé dans :

- C:\WINDOWS\system32
- C:\DOCUME~1\CATHER~1\LOCALS~1\APPLIC~1



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans C:\DOCUME~1\CATHER~1\LOCALS~1\APPLIC~1 *



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:
C:\WINDOWS\system32\kjjlm.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\kjjlm.bak2 trouvé ! infection Vundo possible non traitée par cet outil !

2)Recherche Heuristique :



3)Recherche Certificats :

Certificat Egroup absent !


*** Analyse terminée le 31/10/2007 à 20:43:32,50 ***

Utilisateur anonyme · Answer

et pafff !
1)Recherche fichiers connus:
C:\WINDOWS\system32\kjjlm.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\kjjlm.bak2 trouvé ! infection Vundo possible non traitée par cet outil ! 
------------
fais ceci dans ma page.
VirtumundoBeGone est un autre outil très efficace pour cette infection.
https://leblogdeclaude.blogspot.com/2007/05/procdure-vundofix.html

si non faudra passer par oad.exe

cath69 · Answer

Le scan est terminé. Une fenêtre m'a informé que Vundo a été retiré avec succès...dois-je faire un "Navipromo" pour vérifier ? Qu'est-ce que oad.exe ?

Utilisateur anonyme · Answer

" Vundo a été retiré avec succès"
bonne nouvelle !
ok,
fais un Navipromo.
oad est un chercheur....
sur le DD et dans la base de registre.

cath69 · Answer

Salut !
Bhou ! ils sont là


Search Navipromo version 3.3.3 commencé le 01/11/2007 à  9:11:25,15

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 30.10.2007 à 19h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 


*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\Catherine Theiller\Application Data ***


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun fichier trouvé dans :

- C:\WINDOWS\system32
- C:\DOCUME~1\CATHER~1\LOCALS~1\APPLIC~1



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans C:\DOCUME~1\CATHER~1\LOCALS~1\APPLIC~1 *



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:
C:\WINDOWS\system32\kjjlm.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\kjjlm.bak2 trouvé ! infection Vundo possible non traitée par cet outil !

2)Recherche Heuristique :



3)Recherche Certificats :

Certificat Egroup absent !


*** Analyse terminée le 01/11/2007 à  9:12:02,37 ***

Utilisateur anonyme · Answer

!!!
Argh !
télécharges oad.exe
--------------------------------
Télécharge OAD ici:
http://sosvirus.changelog.fr/OAD.exe
Et enregistre le sur ton bureau
Puis:
Lance OAD.exe avec des droits administrateur:
Clic droit sur OAD.exe > Propriétés > onglet Compatibilité > Niveau de privilège
Coches "Exécuter ce programme en tant qu'administrateur".

Une fois le programme lancé:

- Dans "nom de fichier à rechercher" tape -> kjjlm
- Dans "Type de recherche" : choisis l'option 6 puis valide avec Entrée.

Le rapport s'affichera automatiquement à dès que la recherche sera terminée.

- Copie/colle le rapport dans ton prochain message.

cath69 · Answer

Quand je fais clic droit, je n'ai pas "Niveau de privilège" dans l'onglet Compatibilité. j'ai 3 possibilités : mode de compatibilité, paramètres d'affichage et paramètres de saisie.

Utilisateur anonyme · Answer

Essayes comme ça , on verra bien si tu as les droits.

cath69 · Answer

01/11/2007 ---- 10:06:23,45  

----------------------------------
§§§§§§ [kjjlm] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************

c:\VundoFix Backups\kjjlm.bak1.bad
c:\VundoFix Backups\kjjlm.bak2.bad
c:\VundoFix Backups\kjjlm.ini2.bad
c:\WINDOWS\system32\kjjlm.bak2
c:\WINDOWS\system32\kjjlm.ini
c:\WINDOWS\system32\kjjlm.ini2
c:\WINDOWS\system32\kjjlm.tmp


*********************
     [Même date] 
*********************

[11/10/2007 ] ---> C:\WINDOWS\system32\bdod.bin   
[11/10/2007 ] ---> C:\WINDOWS\system32\bdss.log   
[11/10/2007 ] ---> C:\WINDOWS\system32\kjjlm.tmp   
[11/10/2007 ] ---> C:\WINDOWS\system32\yqrdrpcv.ini   
[12/10/2007 ] ---> C:\WINDOWS\system32\kjjlm.ini   
[30/10/2007 ] --- REP ---> C:\Program Files\Navilog1   
[30/10/2007 ] ---> C:\WINDOWS\system32\__c0092A77.dat   
[30/10/2007 ] ---> C:\WINDOWS\system32\__c0098B8.dat   
[30/10/2007 ] ---> C:\WINDOWS\system32\__c009ED10.dat   
[30/10/2007 ] ---> C:\WINDOWS\system32\__c00CEAAF.dat   
[30/10/2007 ] ---> C:\WINDOWS\system32\__c00D9661.dat   
[30/10/2007 ] ---> C:\WINDOWS\system32\bepoqrtc.dll   
[30/10/2007 ] ---> C:\WINDOWS\system32\bmlkyngv.dll   
[30/10/2007 ] ---> C:\WINDOWS\system32\egbovnid.ini   
[30/10/2007 ] ---> C:\WINDOWS\system32\egmuoeok.dll   
[30/10/2007 ] ---> C:\WINDOWS\system32\ehmxjkex.dll   
[30/10/2007 ] ---> C:\WINDOWS\system32\eqwterkr.dll   
[30/10/2007 ] ---> C:\WINDOWS\system32\gqkjhqqe.ini   
[30/10/2007 ] ---> C:\WINDOWS\system32\hlhjibqq.ini   
[30/10/2007 ] ---> C:\WINDOWS\system32
ubciyrm.dll   
[30/10/2007 ] ---> C:\WINDOWS\system32\plwttvwn.ini   
[30/10/2007 ] ---> C:\WINDOWS\system32\pprtvwle.dll   
[30/10/2007 ] ---> C:\WINDOWS\system32\quslmblx.dll   
[30/10/2007 ] ---> C:\WINDOWS\system32	nilytue.dll   
[30/10/2007 ] ---> C:\WINDOWS\system32\wdiyputf.dll   
[30/10/2007 ] ---> C:\WINDOWS\system32\wqwwnvth.ini   
[31/10/2007 ] ---> C:\vundofix.txt   
[31/10/2007 ] ---> C:\WINDOWS\system32\__c0035560.dat   
[31/10/2007 ] ---> C:\WINDOWS\system32\__c004CECC.dat   
[31/10/2007 ] ---> C:\WINDOWS\system32\__c009207A.dat   
[31/10/2007 ] ---> C:\WINDOWS\system32\__c00BC8CD.dat   
[31/10/2007 ] ---> C:\WINDOWS\system32\__c00C8440.dat   
[31/10/2007 ] ---> C:\WINDOWS\system32\ahbacpwq.dll   
[31/10/2007 ] ---> C:\WINDOWS\system32\cibqriml.ini   
[31/10/2007 ] ---> C:\WINDOWS\system32\cnffjkof.dll   
[31/10/2007 ] ---> C:\WINDOWS\system32\ddspreoq.ini   
[31/10/2007 ] ---> C:\WINDOWS\system32\dtatcrpp.dll   
[31/10/2007 ] ---> C:\WINDOWS\system32\ebuhnvqm.dll   
[31/10/2007 ] ---> C:\WINDOWS\system32\ftuaaaum.dll   
[31/10/2007 ] ---> C:\WINDOWS\system32\gohbdpwe.dll   
[31/10/2007 ] ---> C:\WINDOWS\system32\ithblgeb.dll   
[31/10/2007 ] ---> C:\WINDOWS\system32\kjjlm.bak2   
[31/10/2007 ] ---> C:\WINDOWS\system32\kjjlm.ini2   
[31/10/2007 ] ---> C:\WINDOWS\system32\muaaautf.ini   
[31/10/2007 ] ---> C:\WINDOWS\system32
ydcgipw.ini   
[31/10/2007 ] ---> C:\WINDOWS\system32\qgcsmqsr.dll   
[31/10/2007 ] ---> C:\WINDOWS\system32rnskyqk.dll   
[31/10/2007 ] ---> C:\WINDOWS\system32\sqpkmhra.dll   
[31/10/2007 ] ---> C:\WINDOWS\system32	igjcail.dll   
[31/10/2007 ] ---> C:\WINDOWS\system32\uyciuxfm.dll   



Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

Utilisateur anonyme · Answer

Argghh !
les bestioles sont à jour, et ça grouille !
fais ceci:
télécharges clean
http://www.malekal.com/download/clean.zip
décompresses-le sur le bureau.
Lance clean.cmd
option  1
postes le rapport

cath69 · Answer

1/11/2007 a 10:55:35,56 
 
*** Recherche des fichiers dans C: 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
C:\WINDOWS\system32\bdod.bin FOUND 
C:\WINDOWS\system32\mcrh.tmp FOUND 
"C:\WINDOWS\Downloaded Program Files\CONFLICT.1" FOUND 
 
*** Recherche des fichiers dans C:\Program Files 
*** Fin du rapport !

Utilisateur anonyme · Answer

Bien, refais la même chose avec l'option 2
postes le rapport.
de préférence en mode sans échec...

cath69 · Answer

Avant de partir, voici le rapport demandé. retour cet après-midi pour la suite. 
Bon appétit !

Script execute en mode sans echec 
Rapport clean par Malekal_morte - http://www.malekal.com 
Script execute en mode sans echec 01/11/2007 a 11:27:59,12 

Microsoft Windows XP [version 5.1.2600]
 
*** Suppression des fichiers dans C: 
 
*** Suppression des fichiers dans C:\WINDOWS\ 
 
*** Suppression des fichiers dans C:\WINDOWS\system32 
tentative de suppression de C:\WINDOWS\system32\bdod.bin 
tentative de suppression de C:\WINDOWS\system32\mcrh.tmp 
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.1" 
 
*** Suppression des fichiers dans C:\Program Files 
 
*** Suppression des clefs du registre effectuee.. 
*** Fin du rapport !

Utilisateur anonyme · Answer

bien, télécharges The Avenger
http://www.geekstogo.com/forum/files/file/393-the-avenger-by-swandog46/
---------------------------------------------------------------------
Décompresses-le + install
-----------------------------------------
ouvre ton notepad.exe
copie exactement ceci:
enregistre-le en : fix.txt sur ton bureau
------------------------
Files to Delete:
C:\WINDOWS\system32\__c0035560.dat
C:\WINDOWS\system32\__c004CECC.dat
C:\WINDOWS\system32\__c009207A.dat
C:\WINDOWS\system32\__c00BC8CD.dat
C:\WINDOWS\system32\__c00C8440.dat
C:\WINDOWS\system32\ahbacpwq.dll
C:\WINDOWS\system32\cibqriml.ini
C:\WINDOWS\system32\cnffjkof.dll
C:\WINDOWS\system32\ddspreoq.ini
C:\WINDOWS\system32\dtatcrpp.dll
C:\WINDOWS\system32\ebuhnvqm.dll
C:\WINDOWS\system32\ftuaaaum.dll
C:\WINDOWS\system32\gohbdpwe.dll
C:\WINDOWS\system32\ithblgeb.dll
C:\WINDOWS\system32\kjjlm.bak2
C:\WINDOWS\system32\kjjlm.ini2
C:\WINDOWS\system32\kjjlm.ini 
c:\WINDOWS\system32\kjjlm.tmp 
C:\WINDOWS\system32\muaaautf.ini
C:\WINDOWS\system32
ydcgipw.ini
C:\WINDOWS\system32\qgcsmqsr.dll
C:\WINDOWS\system32rnskyqk.dll
C:\WINDOWS\system32\sqpkmhra.dll
C:\WINDOWS\system32	igjcail.dll
C:\WINDOWS\system32\uyciuxfm.dll 
C:\WINDOWS\system32\__c0092A77.dat
C:\WINDOWS\system32\__c0098B8.dat
C:\WINDOWS\system32\__c009ED10.dat
C:\WINDOWS\system32\__c00CEAAF.dat
C:\WINDOWS\system32\__c00D9661.dat
C:\WINDOWS\system32\bepoqrtc.dll
C:\WINDOWS\system32\bmlkyngv.dll
C:\WINDOWS\system32\egbovnid.ini
C:\WINDOWS\system32\egmuoeok.dll
C:\WINDOWS\system32\ehmxjkex.dll
C:\WINDOWS\system32\eqwterkr.dll
C:\WINDOWS\system32\gqkjhqqe.ini
C:\WINDOWS\system32\hlhjibqq.ini
C:\WINDOWS\system32
ubciyrm.dll
C:\WINDOWS\system32\plwttvwn.ini
C:\WINDOWS\system32\pprtvwle.dll
C:\WINDOWS\system32\quslmblx.dll
C:\WINDOWS\system32	nilytue.dll
C:\WINDOWS\system32\wdiyputf.dll
C:\WINDOWS\system32\wqwwnvth.ini 
C:\WINDOWS\system32\kjjlm.tmp
C:\WINDOWS\system32\yqrdrpcv.ini


-----------------------------------------------------------------------------------
lance The Avenger.
coche load script fron file (lire un script à partir d'un fichier) recherche alors fix.txt qui est sur ton bureau.
Ensuite lance-le avec l'icone du feu vert.

titanic2 · Answer

mon PC est du groupe :a
Mon fire-wall est de catégorie d (livebox)
mes connaissances , b





Logfile of HijackThis v1.99.1
Scan saved at 13:35:06, on 01/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Video Add-on\icthis.exe
C:\Program Files\Video Add-on\isfmntr.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Video Add-on\icmntr.exe
C:\Program Files\Netlog 24\Notifier\Netlog24Notifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Video Add-on\isfmm.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?product=ssearch&src_id=370&client_id=243C40C001C818A8001CCA0E&version=4.5.6.0&it=1193496378&loc=&qry=&url=about%3Ablank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} - C:\Program Files\Starware370\bin\Starware370.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B499D34E-58EF-4927-AB9F-7AF52B2C4C82} - C:\Program Files\Video Add-on\isfmdl.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Starware Toolbar Musique - {1962c5bc-e475-465b-823b-133e711bceb9} - C:\Program Files\Starware370\bin\Starware370.dll
O3 - Toolbar: IE Custom Tools - {6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16} - C:\Program Files\Video Add-on\ictmdl.dll
O4 - HKLM\..\Run: [EPSON Stylus CX6600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE /P26 "EPSON Stylus CX6600 Series" /O5 "LPT1:" /M "Stylus CX6600"
O4 - HKLM\..\Run: [EPSON Stylus CX6600 Series (Copie 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE /P36 "EPSON Stylus CX6600 Series (Copie 1)" /O6 "USB001" /M "Stylus CX6600"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Netlog 24] C:\Program Files\Netlog 24\Notifier\Netlog24Notifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?b7b2f3afd26d432a8b24059071a485ae
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?b7b2f3afd26d432a8b24059071a485ae
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/2.0.1.14/cfweb_activex.camfrogweb.com-advanced-2.0.1.14_instmodule.exe
O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/flashax.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe

Utilisateur anonyme · Answer

salut  titanic2, le jeudi 1 novembre 2007 à 13h50:22,
tu as anticipé je vois !
Seulement tu as oublié une petite chose, on ne poste pas à l'intérieur d'un topic en cours.
Il m'est impossible d'y voir clair, et de gérer la désinfection de plusieurs PC sur un seul topic  !
Donc je vais te demander de faire ceci:
décris le problème informatique avec le plus de précisions possible, dans le temps et dans les faits.
Ensuite et seulement ensuite,

Comment faire ?
http://leblogdeclaude.blogspot.com/2007/07/crer-un-nouveau-messgage-sur-ccm.html
je te remercie.
Donc ne postes plus ici, ok ?

titanic2 · Answer

re c'est titanic2 
donc voila mon probleme 
j'ai un triangle jaune avec un point d'exclamtion qui clignotte et a coter un icone rouge avec une croix blanche dedans 
plein de page'qui s'ouvre  en anglais 

http://content.onerateld.com/winsecureav.com/WinSecureAv/install_en.exe
security warning:new variant of spybot@mxt
il me demande d'installer 
http://www.antispyshield.com/?advid=177
y'a aussi des pub qui viennent se greffer dessus erotic
je peut plu acceder a mes videos j'ai que des rapport d'erreur des beug en tout genre et sa fait 3 jours que sa dure

j'ai avast en antivirus j'y est plannifier qui apres me dit que j'ai des chevausx de troi  apres j'ai fait ad awaire 
et la il me demande de faire une annalyse et des telechargement qui se declenche tout seul 
donc voila j'espere avoir bien expliquer

Utilisateur anonyme · Answer

tu expliques bien ton soucis, mais tu n'as pas capté !!!!
"Donc ne postes plus ici, ok ? "
bien,
vas ici:
http://www.commentcamarche.net/forum/forum 7#ecrire
tu peux copier/coller ton 37.
;-)

cath69 · Answer

Salut titanic2,  ouvre un autre message dans le forum, sinon ce sera compliqué !!

Philo2100, me revoilà avec le scan avenger : Oups ....File C:\WINDOWS\system32\kjjlm.tmp not found! Deletion of file C:\WINDOWS\system32\kjjlm.tmp failed!....ça n'annonce rien de bon !



Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\gwpmwjfa

*******************

Script file located at: \??\C:\Documents and Settings\ymsrhgwp.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\__c0035560.dat deleted successfully.
File C:\WINDOWS\system32\__c004CECC.dat deleted successfully.
File C:\WINDOWS\system32\__c009207A.dat deleted successfully.
File C:\WINDOWS\system32\__c00BC8CD.dat deleted successfully.
File C:\WINDOWS\system32\__c00C8440.dat deleted successfully.
File C:\WINDOWS\system32\ahbacpwq.dll deleted successfully.
File C:\WINDOWS\system32\cibqriml.ini deleted successfully.
File C:\WINDOWS\system32\cnffjkof.dll deleted successfully.
File C:\WINDOWS\system32\ddspreoq.ini deleted successfully.
File C:\WINDOWS\system32\dtatcrpp.dll deleted successfully.
File C:\WINDOWS\system32\ebuhnvqm.dll deleted successfully.


File C:\WINDOWS\system32\ftuaaaum.dll not found!
Deletion of file C:\WINDOWS\system32\ftuaaaum.dll failed!

Could not process line:
C:\WINDOWS\system32\ftuaaaum.dll
Status: 0xc0000034

File C:\WINDOWS\system32\gohbdpwe.dll deleted successfully.
File C:\WINDOWS\system32\ithblgeb.dll deleted successfully.
File C:\WINDOWS\system32\kjjlm.bak2 deleted successfully.
File C:\WINDOWS\system32\kjjlm.ini2 deleted successfully.
File C:\WINDOWS\system32\kjjlm.ini deleted successfully.
File c:\WINDOWS\system32\kjjlm.tmp deleted successfully.
File C:\WINDOWS\system32\muaaautf.ini deleted successfully.
File C:\WINDOWS\system32
ydcgipw.ini deleted successfully.
File C:\WINDOWS\system32\qgcsmqsr.dll deleted successfully.
File C:\WINDOWS\system32rnskyqk.dll deleted successfully.
File C:\WINDOWS\system32\sqpkmhra.dll deleted successfully.
File C:\WINDOWS\system32	igjcail.dll deleted successfully.
File C:\WINDOWS\system32\uyciuxfm.dll deleted successfully.
File C:\WINDOWS\system32\__c0092A77.dat deleted successfully.
File C:\WINDOWS\system32\__c0098B8.dat deleted successfully.
File C:\WINDOWS\system32\__c009ED10.dat deleted successfully.
File C:\WINDOWS\system32\__c00CEAAF.dat deleted successfully.
File C:\WINDOWS\system32\__c00D9661.dat deleted successfully.
File C:\WINDOWS\system32\bepoqrtc.dll deleted successfully.
File C:\WINDOWS\system32\bmlkyngv.dll deleted successfully.
File C:\WINDOWS\system32\egbovnid.ini deleted successfully.
File C:\WINDOWS\system32\egmuoeok.dll deleted successfully.
File C:\WINDOWS\system32\ehmxjkex.dll deleted successfully.
File C:\WINDOWS\system32\eqwterkr.dll deleted successfully.
File C:\WINDOWS\system32\gqkjhqqe.ini deleted successfully.
File C:\WINDOWS\system32\hlhjibqq.ini deleted successfully.
File C:\WINDOWS\system32
ubciyrm.dll deleted successfully.
File C:\WINDOWS\system32\plwttvwn.ini deleted successfully.
File C:\WINDOWS\system32\pprtvwle.dll deleted successfully.
File C:\WINDOWS\system32\quslmblx.dll deleted successfully.
File C:\WINDOWS\system32	nilytue.dll deleted successfully.
File C:\WINDOWS\system32\wdiyputf.dll deleted successfully.
File C:\WINDOWS\system32\wqwwnvth.ini deleted successfully.


File C:\WINDOWS\system32\kjjlm.tmp not found!
Deletion of file C:\WINDOWS\system32\kjjlm.tmp failed!

Could not process line:
C:\WINDOWS\system32\kjjlm.tmp
Status: 0xc0000034

File C:\WINDOWS\system32\yqrdrpcv.ini deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.

Utilisateur anonyme · Answer

Bien ! fameuse deletation !!!
Bravo pour ton suivi !


pas de panique je tiens bon...
on reprend:
Lance OAD.exe 


Une fois le programme lancé:

- Dans "nom de fichier à rechercher" tape -> kjjlm
- Dans "Type de recherche" : choisis l'option 6 puis valide avec Entrée.

Le rapport s'affichera automatiquement à dès que la recherche sera terminée.

- Copie/colle le rapport dans ton prochain message.

cath69 · Answer

Grâce à toi, je suis en train de me réconcilier avec ma machine. Tout ce que tu expliques semble si simple...je tiens bon aussi ;)

01/11/2007 ---- 16:50:53,12  

----------------------------------
§§§§§§ [kjjlm ] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

Utilisateur anonyme · Answer

N'a plus ???
-----------
refais la même chose avec ceci:
ftuaaaum

cath69 · Answer

N'a plus celui-là non plus ??!

01/11/2007 ---- 16:58:19,39  

----------------------------------
§§§§§§ [ftuaaaum ] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

Utilisateur anonyme · Answer

n'a plus....Piouffffffti !
fais ceci:
https://leblogdeclaude.blogspot.com/2007/04/informatique-procdure-smitfraud.html
copies le rapport

cath69 · Answer

SmitFraudFix v2.246

Rapport fait à 17:11:54,14, 01/11/2007
Executé à partir de C:\Documents and Settings\Catherine Theiller\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Catherine Theiller


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Catherine Theiller\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CATHER~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte VIA PCI 10/100Mo Fast Ethernet - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.2.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{6DF7D03D-7185-4610-9D87-88A30506C4C7}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6DF7D03D-7185-4610-9D87-88A30506C4C7}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{6DF7D03D-7185-4610-9D87-88A30506C4C7}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

clean, de ce coté.
refais ceci:
VirtumundoBeGone est un autre outil très efficace pour cette infection.
https://leblogdeclaude.blogspot.com/2007/05/procdure-vundofix.html 
histoire de voir si ça ne se multiplie pas...

cath69 · Answer

J'ai encore les pages de pub qui s'affichent mais je ne vois plus les croix bleues et rouges avec le message "your computer..."
Résultat :


Trojan.Vundo has been sucessfully removed from your computer !
here is the report:
The total number of the scanned files: 44046
The number of deleted files: 0
The number of viral processes terminated: 1
The number of viral threads terminated: 0
The number of registry entries fixed: 0

Utilisateur anonyme · Answer

Questions...tu utilises Mozilla-firefox  (je l'espère ?)
en cas de doute du pourquoi ?
https://leblogdeclaude.blogspot.com/2006/10/informatique-comment-se-protger-si-on.html
--------------
refaits un log Hijackthis

cath69 · Answer

heuuu, bennnn, heuuuuuuuuuuu, je vais changer alors....la réponse est non. Je connais pas Machin-firefox mais je vais lire avec une grande attention (et même plus) ton blog.
Logfile of HijackThis v1.99.1
Scan saved at 18:07:30, on 01/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/advanced_search?hl=fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5A6D72CF-5932-444A-BC6B-EDF9B0E161C2} - C:\WINDOWS\system32\mljjk.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32	igjcail.dll (file missing)
O2 - BHO: (no name) - {C29D81FE-9F69-4186-BBD3-709038660815} - (no file)
O2 - BHO: (no name) - {F424FB20-C093-4AAC-B7E5-42E454C910E7} - (no file)
O3 - Toolbar: (no name) - {BAE9A6FD-565C-4CB5-98AD-3BFA5E7C332D} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [94f2b825] rundll32.exe "C:\WINDOWS\system32	aekoxms.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potg_x.cab
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://www.m6video.fr/1click/install/files/installer2.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

Utilisateur anonyme · Answer

C:\Program Files\Internet Explorer\iexplore.exe 
je vois ça !!!!
donc Installes vite fais Mozilla !
Et ne surfe plus qu'avec lui..



cocher+ fixer.
-----------------------------------------------------------------
O2 - BHO: (no name) - {5A6D72CF-5932-444A-BC6B-EDF9B0E161C2} - C:\WINDOWS\system32\mljjk.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file) 
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32	igjcail.dll (file missing)
O2 - BHO: (no name) - {C29D81FE-9F69-4186-BBD3-709038660815} - (no file)
O2 - BHO: (no name) - {F424FB20-C093-4AAC-B7E5-42E454C910E7} - (no file)
O3 - Toolbar: (no name) - {BAE9A6FD-565C-4CB5-98AD-3BFA5E7C332D} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [94f2b825] rundll32.exe "C:\WINDOWS\system32	aekoxms.dll",b 
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE 
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potg_x.cab
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://www.m6video.fr/1click/install/files/installer2.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab 
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
--------------------------------------
avec les cible ci dessous
Lance OAD.exe

Une fois le programme lancé:

- Dans "nom de fichier à rechercher" tape ->mljjk 
- Dans "Type de recherche" : choisis l'option 6 puis valide avec Entrée.

Le rapport s'affichera automatiquement à dès que la recherche sera terminée.

- Copie/colle le rapport dans ton prochain message.

------------------------------------
ensuite avec ceci, 1 rapport pour chaque. (donc 3 rapports oad )
----------------------------------------------------
tigjcail
taekoxms

cath69 · Answer

Rapport n° 1 avec mljjk :


 01/11/2007 ---- 18:55:23,39  

----------------------------------
§§§§§§ [mljjk ] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

cath69 · Answer

Rapport n° 2 avec  tigjcail

01/11/2007 ---- 18:57:57,06  

----------------------------------
§§§§§§ [tigjcail] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

cath69 · Answer

Rapport n° 3 avec taekoxms

 01/11/2007 ---- 19:00:53,21  

----------------------------------
§§§§§§ [taekoxms] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************

c:\WINDOWS\system32	aekoxms.dll


*********************
     [Même date] 
*********************

[01/11/2007 ] ---> C:\avenger.txt   
[01/11/2007 ] ---> C:\fixnavi.txt   
[01/11/2007 ] ---> C:apport.txt   
[01/11/2007 ] ---> C:apport_clean.txt   
[01/11/2007 ] ---> C:apport_clean1.txt   
[01/11/2007 ] ---> C:esultat.txt   
[01/11/2007 ] ---> C:esultat_clean.txt   
[01/11/2007 ] ---> C:\upload_moi_NOM-1607AC21F06.tar.gz   
[01/11/2007 ] ---> C:\WINDOWS\0.log   
[01/11/2007 ] ---> C:\WINDOWS\system32\__c00721F6.dat   
[01/11/2007 ] ---> C:\WINDOWS\system32\__c00B6B3A.dat   
[01/11/2007 ] ---> C:\WINDOWS\system32\__c00D012B.dat   
[01/11/2007 ] ---> C:\WINDOWS\system32\aclmcrqq.dll   
[01/11/2007 ] ---> C:\WINDOWS\system32\btoufkpj.dll   
[01/11/2007 ] ---> C:\WINDOWS\system32\daedkdfh.ini   
[01/11/2007 ] ---> C:\WINDOWS\system32\dxwmknfi.dll   
[01/11/2007 ] ---> C:\WINDOWS\system32\epqikmdv.dll   
[01/11/2007 ] ---> C:\WINDOWS\system32\kjjlm.bak1   
[01/11/2007 ] ---> C:\WINDOWS\system32\kjjlm.ini   
[01/11/2007 ] ---> C:\WINDOWS\system32\ogawugbm.dll   
[01/11/2007 ] ---> C:\WINDOWS\system32\smxokeat.ini   
[01/11/2007 ] ---> C:\WINDOWS\system32	aekoxms.dll   
[01/11/2007 ] ---> C:\WINDOWS\system32\wbakockh.ini   
[01/11/2007 ] ---> C:\WINDOWS\WindowsUpdate.log   



Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

Utilisateur anonyme · Answer

on recommence:
--------------------------------------
supprimes fix.txt  que normalement tu as encore sur ton bureau.
-------------------------------------------------------------------------------
bien, télécharges The Avenger (déjà fait normalement)
http://www.geekstogo.com/forum/files/file/393-the-avenger-by-swandog46/
---------------------------------------------------------------------
Décompresses-le + install (déjà fait)
-----------------------------------------
ouvre ton notepad.exe
copie exactement ceci:
enregistre-le en : fix.txt sur ton bureau 
-----------------------------------------------------------------------------------
Files to Delete: 
C:\avenger.txt
C:\fixnavi.txt
C:apport.txt
C:apport_clean.txt
C:apport_clean1.txt
C:esultat.txt
C:esultat_clean.txt
C:\upload_moi_NOM-1607AC21F06.tar.gz
C:\WINDOWS\0.log
C:\WINDOWS\system32\__c00721F6.dat
C:\WINDOWS\system32\__c00B6B3A.dat
C:\WINDOWS\system32\__c00D012B.dat
C:\WINDOWS\system32\aclmcrqq.dll
C:\WINDOWS\system32\btoufkpj.dll
C:\WINDOWS\system32\daedkdfh.ini
C:\WINDOWS\system32\dxwmknfi.dll
C:\WINDOWS\system32\epqikmdv.dll
C:\WINDOWS\system32\kjjlm.bak1
C:\WINDOWS\system32\kjjlm.ini
C:\WINDOWS\system32\ogawugbm.dll
C:\WINDOWS\system32\smxokeat.ini
C:\WINDOWS\system32	aekoxms.dll
C:\WINDOWS\system32\wbakockh.ini
C:\WINDOWS\WindowsUpdate.log 

----------------------------------------------------------------------------
-----------------------------------------------------------------------------------
mets ta machine en mode sans échec.
https://leblogdeclaude.blogspot.com/2007/04/informatique-rebooter-xp-en-mode-sans.html
-----------------------------------------------------------------------------
lance The Avenger.
coche load script fron file (lire un script à partir d'un fichier) recherche alors fix.txt qui est sur ton bureau.
Ensuite lance-le avec l'icone du feu vert.

cath69 · Answer

Hello !
Sniiiiiffffffffff, c'est pô fini, ils font des petits dans notre dos...

rapport Avenger demandé :

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\shqkwblv

*******************

Script file located at: \??\C:\WINDOWS\mkxgtxtd.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open file C:\avenger.txt for deletion
Deletion of file C:\avenger.txt failed!

Could not process line:
C:\avenger.txt
Status: 0xc0000043

File C:\fixnavi.txt deleted successfully.
File C:apport.txt deleted successfully.
File C:apport_clean.txt deleted successfully.
File C:apport_clean1.txt deleted successfully.
File C:esultat.txt deleted successfully.
File C:esultat_clean.txt deleted successfully.
File C:\upload_moi_NOM-1607AC21F06.tar.gz deleted successfully.
File C:\WINDOWS\0.log deleted successfully.
File C:\WINDOWS\system32\__c00721F6.dat deleted successfully.
File C:\WINDOWS\system32\__c00B6B3A.dat deleted successfully.
File C:\WINDOWS\system32\__c00D012B.dat deleted successfully.
File C:\WINDOWS\system32\aclmcrqq.dll deleted successfully.
File C:\WINDOWS\system32\btoufkpj.dll deleted successfully.
File C:\WINDOWS\system32\daedkdfh.ini deleted successfully.
File C:\WINDOWS\system32\dxwmknfi.dll deleted successfully.
File C:\WINDOWS\system32\epqikmdv.dll deleted successfully.
File C:\WINDOWS\system32\kjjlm.bak1 deleted successfully.
File C:\WINDOWS\system32\kjjlm.ini deleted successfully.
File C:\WINDOWS\system32\ogawugbm.dll deleted successfully.
File C:\WINDOWS\system32\smxokeat.ini deleted successfully.
File C:\WINDOWS\system32	aekoxms.dll deleted successfully.
File C:\WINDOWS\system32\wbakockh.ini deleted successfully.
File C:\WINDOWS\WindowsUpdate.log deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.

cath69 · Answer

Bonjour,
Comme conseillé sur ton site, j'ai installé Mozilla Firefox.
Pour l'instant, je n'ai plus de pop-up "bandarama", "smiley", "vista print" et autres . Quel changement ! 
Concernant les fenêtres indiquant "Your computer may be infected..." pffffuuuuittt disparues et mon anti-virus ne m'indique plus d'attaque de WIN32.
Est-ce un miracle ou juste une accalmie avant la tempête de virus ? En tout cas, je ne regrette pas la manip (en plus super facile).
Avant de me réjouir, j'attends tes nouveaux conseils.
Merci encore

Utilisateur anonyme · Answer

fais ceci avec Iexplorer (Internet explorer) ben, oui pas moyen avec Mozilla!
http://support.f-secure.fr/fra/home/ols.shtml
tuto
https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId974416
---------------
Fonce sur-----> la restauration système et fais un oint de restauration.
-----

Démarrer-->Programmes/Accessoires/Outils systèmes/Restauration Système
ou taper : %SystemRoot%\System32\restore\rstrui.exe
dans Exécuter.
ceci s'ouvre:
--------------------------
coche créer un point de restauration....
-

cath69 · Answer

27 virus nettoyés plus tard :

Scanning Report
Saturday, November 03, 2007 17:39:22 - 18:17:55

Computer name: NOM-1607AC21F06
Scanning type: Scan system for viruses, rootkits, spyware
Target: C:\
Result: 27 malware found
Trojan-Downloader.JS.Psyme.ls (virus)

    * C:\DOCUMENTS AND SETTINGS\WWW.NOM-1607AC21F06\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\3POQRLGM\ZE[1].HTM (Renamed & Submitted) 

Trojan.Win32.Agent.bck (virus)

    * C:\PROGRAM FILES\NAVILOG1\BACKUPNAVI\DMBAFOIQ.EXE (Renamed & Submitted) 

Vundo.gen38 (virus)

    * C:\WINDOWS\SYSTEM32\APNLHWGU.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\AQDHXWHU.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\BJVFYWOG.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\CPLNMTUW.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\DIDWFMLR.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\GMVTFNMW.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\HYPXSGTP.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\LOTSVJEX.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\NUPABWJK.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\PFINFNBB.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\SWGHWSWS.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\XBYLJKSA.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\YJSJMYBG.INI 

Vundo.gen39 (virus)

    * C:\WINDOWS\SYSTEM32\KBJPYSSY.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\LAUNFGTI.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\LHVUGTEC.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\RAMAOCGS.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\THFSCVKV.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\UCEPDDTW.INI (Submitted)
    * C:\WINDOWS\SYSTEM32\XFMOWBGM.INI (Submitted) 

Vundo.gen41 (virus)

    * C:\WINDOWS\SYSTEM32\MLJJK.DLL (Submitted)
    * C:\PROGRAM FILES\HIJACKTHIS VERSION FRAN&#65533;AISE\BACKUPS\BACKUP-20071101-184942-461.DLL (Submitted) 

Vundo.gen44 (virus)

    * C:\WINDOWS\SYSTEM32\SERCHGNO.DLL (Submitted)
    * C:\WINDOWS\SYSTEM32\TEXOHWYP.DLL (Submitted)
    * C:\WINDOWS\SYSTEM32\XDXILEUN.DLL 

Statistics
Scanned:

    * Files: 24682
    * System: 0
    * Not scanned: 193 

Actions:

    * Disinfected: 0
    * Renamed: 2
    * Deleted: 0
    * None: 25
    * Submitted: 25 

Files not scanned:

    * x&#65533;8&#65533;\AGEFILE.SYS C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
    * C:\WINDOWS\SOFTWAREDISTRIBUTION\EVENTCACHE\{3694DD1A-8B43-435E-A084-706E92173644}.BIN
    * C:\DOCUMENTS AND SETTINGS\VINCENT SDRAULIG\LOCAL SETTINGS\TEMP\HSPERFDATA_VINCENT SDRAULIG\3748
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0095D7A9F84C223574117D3F7C06DDEE_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\02306DD131E26FE850C076539FAAF3C2_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0323B66526679DC4AE57A7C31C2D8B1B_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\04DF871AC90F0ACA8222B3F7658A633B_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\06CF7290B21E0EB0CF6D227D069CB636_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\07F70AABA9F579B8C1C051922E293DE7_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\095CB473F36A56389272C2C0D016EFCF_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0B470E95798A387FEC89C23FF5F0B9CA_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0C4BCADA9C4AFACF4BDDDE8D54ACA2ED_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0E21CAB3B013BBB5B842E911EE80105A_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0EEDCF34117D36B211788D645BBAD8B5_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0FFF822273E73C22DBEEEF2C6D774B04_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\116FDBCC1528CA952897B4AE6114030D_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\13DCC4ED1A57CEA9ADEF8FEC18B642E5_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\13F06E3432497D9690B6353DA4931915_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1466BEC7501CBB905F81590C44E22733_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\14D9975C222D792F031287C12A98A8B4_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1788CD81E453BC8AE709919BDCA5780B_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\19245B0057CC0ECB01FEE8F858A9B812_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1AC0458BCBF47C3458D1D36CA7365426_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1B2381DA0C8D29336D5CE485C98E312A_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1D09413892B779CB2A2EE749345F8348_F2B933DB-E6C7-4EF7-AB2F-4EE2E20512FC
    * C:\DOCUME;&#65533;AD

Options
Scanning engines:

    * F-Secure Libra: 2.4.2, 2007-11-02
    * F-Secure AVP: 7.0.171, 2007-11-02
    * F-Secure Orion: 1.2.37, 2007-11-02
    * F-Secure Blacklight: 1.0.64
    * F-Secure Pegasus: 1.19.0, 2007-10-01 

Scanning options:

    * Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD LSP MAP MHT MIF PHP POT WMF NWS TAR
    * Use Advanced heuristics

cath69 · Answer

point de "Restauration 3_11_07" effectué...

Utilisateur anonyme · Answer

pas bon....
 * Disinfected: 0 
mais Merci F-secure pour la piste !


on recommence donc------>
--------------------------------------
supprimes fix.txt que normalement tu as encore sur ton bureau.
-------------------------------------------------------------------------------
bien, télécharges The Avenger (déjà fait normalement)
http://www.geekstogo.com/forum/files/file/393-the-avenger-by-swandog46/
---------------------------------------------------------------------
Décompresses-le + install (déjà fait)
-----------------------------------------
ouvre ton notepad.exe
copie exactement ceci:
enregistre-le en : fix.txt sur ton bureau 
-------------------------------------------------------------------------------
Files to Delete: 
C:\WINDOWS\SYSTEM32\APNLHWGU.INI 
C:\WINDOWS\SYSTEM32\AQDHXWHU.INI
C:\WINDOWS\SYSTEM32\BJVFYWOG.INI
C:\WINDOWS\SYSTEM32\CPLNMTUW.INI
C:\WINDOWS\SYSTEM32\DIDWFMLR.INI
C:\WINDOWS\SYSTEM32\GMVTFNMW.INI
C:\WINDOWS\SYSTEM32\HYPXSGTP.INI
C:\WINDOWS\SYSTEM32\LOTSVJEX.INI
C:\WINDOWS\SYSTEM32\NUPABWJK.INI
C:\WINDOWS\SYSTEM32\PFINFNBB.INI
C:\WINDOWS\SYSTEM32\SWGHWSWS.INI
C:\WINDOWS\SYSTEM32\XBYLJKSA.INI
C:\WINDOWS\SYSTEM32\YJSJMYBG.INI
C:\WINDOWS\SYSTEM32\KBJPYSSY.INI
C:\WINDOWS\SYSTEM32\LAUNFGTI.INI
C:\WINDOWS\SYSTEM32\LHVUGTEC.INI
C:\WINDOWS\SYSTEM32\RAMAOCGS.INI
C:\WINDOWS\SYSTEM32\THFSCVKV.INI
C:\WINDOWS\SYSTEM32\UCEPDDTW.INI
C:\WINDOWS\SYSTEM32\XFMOWBGM.INI
C:\WINDOWS\SYSTEM32\SERCHGNO.DLL
C:\WINDOWS\SYSTEM32\TEXOHWYP.DLL
C:\WINDOWS\SYSTEM32\XDXILEUN.DLL 
------------------------------------------------------------------
----------------------------------------------------------------------------------
mets ta machine en mode sans échec.
https://leblogdeclaude.blogspot.com/
-----------------------------------------------------------------------------
lance The Avenger.
coche load script fron file (lire un script à partir d'un fichier) recherche alors fix.txt qui est sur ton bureau.
Ensuite lance-le avec l'icone du feu vert.

-----------------------------------------------------------

cath69 · Answer

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\jpelajfa

*******************

Script file located at: \??\C:\WINDOWS\rqgtawxf.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\SYSTEM32\APNLHWGU.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\AQDHXWHU.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\BJVFYWOG.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\CPLNMTUW.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\DIDWFMLR.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\GMVTFNMW.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\HYPXSGTP.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\LOTSVJEX.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\NUPABWJK.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\PFINFNBB.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\SWGHWSWS.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\XBYLJKSA.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\YJSJMYBG.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\KBJPYSSY.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\LAUNFGTI.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\LHVUGTEC.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\RAMAOCGS.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\THFSCVKV.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\UCEPDDTW.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\XFMOWBGM.INI deleted successfully.
File C:\WINDOWS\SYSTEM32\SERCHGNO.DLL deleted successfully.
File C:\WINDOWS\SYSTEM32\TEXOHWYP.DLL deleted successfully.
File C:\WINDOWS\SYSTEM32\XDXILEUN.DLL deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.

Utilisateur anonyme · Answer

Parfait le script a bien fonctionné...comme quoi l'anglais ça sert !
* Disinfected: 0
* Renamed: 2
* Deleted: 0
* None: 25
* Submitted: 25 

----->submitted mais pas désinfecté!!! 

Sérieusement jamais vu une telle infection Vundo incapable d'être virée par les outils spécifique !
C'est quoi ton Fire-wall ?
je suis inquiet ...de ta réponse ?

e) je ne sais pas.
Tu vas courir vers ceci:
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm
installes-le sur ton PC.

cath69 · Answer

Avant l'infection, j'avais Mc Affe (payé très cher pour le résultat que tu connais). Je l'ai désinstallé pour mettre avast...je ne sais pas si j'ai bien fait.

Utilisateur anonyme · Answer

Vires Avast et met ANTIVIR
http://www.commentcamarche.net/telecharger/telecharger 55 antivir
et le fire-wall c'est fait ?


*****Dans chaque église, il y a toujours quelque chose qui cloche******
Je n'ai pas la prétention de résoudre les problèmes, j'essaie simplement de rendre service ;-)

cath69 · Answer

AAAAAAAAAArrrghhhhhhh ! J'ai installé Antivir et là, grosse catastrophe : il a détecté quelque chose et a ouvert plein de fenêtres me demandant une mise en quarantaine ou une suppression. Il n'a pas été capable de faire ni l'un ni l'autre donc  il a ouvert en boucle lesdites fenêtres jusqu'à ce que l'ordinateur plante. 
Conclusion, je l'ai désinstallé en mode sans échec et laissé avast.
Pour la réponse à ta question sur le fire wall, je ne sais pas...

Utilisateur anonyme · Answer

Donc ton PC est encore infecté et Avast ne le détecte pas.
tu as pris note du fichier en question ?
Fais ceci (absolument)
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm
Le tuto est ici:
http://www.commentcamarche.net/faq/sujet 2612 firewall installation et configuration du pare feu zonealarm

cath69 · Answer

Non je n'ai pas noté...

Utilisateur anonyme · Answer

:-/
installes toujours en urgence le fire-wall
On complètera par un scan Panda.

cath69 · Answer

Bonjour,
Wahooo ! que de problèmes hier soir avec l'installation du fire-wall.
Après l'installation de ZoneAlarm, l'anti-virus-anti-espion s'est mis en route et à détecté 18 virus et 6 espions. Il a automatiquement mis en quarantaine les virus (réparation impossible) et a supprimé les espions. Lorsque j'ai relancé la machine : 
- l'ordinateur ne s'éteignait plus,
- 10 minutes pour rebooter
- lenteur extrême...
quand il a bien voulu s'allumer, vers 23h00, avast me disait qu'il était en conflit, je l'ai donc enlevé. Depuis, lenteurs pour s'éteindre, s'allumer et naviguer sur internet persistent...Arrgh
Seule bonne nouvelle j'ai maintenant un fire-wall...mais ce n'est pas encore gagné !
(grosse fatigue pour aujourd'hui mais je tiens bon et prend les choses avec PHILO-sophie)

Utilisateur anonyme · Answer

je ne suis pas là !
de quel logiciel sagit-il ?
" l'anti-virus-anti-espion s'est mis en route et à détecté 18 virus et 6 espions."

je pense que tu t'es auto-réinfecté en cours de route.
Il va falloir vérifer que le fire-wall de XP est désactivé !
regardes ici:
https://www.informatruc.com

cath69 · Answer

Il s'agit de ZoneAlarm

Utilisateur anonyme · Answer

pas mal !
l'anti-virus-anti-espion----> c'est le Fire-wall
L'antivirus c'est Avast.
Tu peux me dire de quels fichier il sagit ?
Il doit avoir un journal des alertes dans Zone-Alarm
Je crois qu'on doit pouvoir y avoir accès sans trop de soucis.
Lis aussi ceci :
http://www.commentcamarche.net/faq/sujet 3907 mythes zonealarm et avast sont incompatibles
copies-moi le journal des alertes de Zone-Alarm
Il doit être  en mode txt dans---->
c:\Windows\Internet Logs\ZAlog.txt

"Zone Alarm vous offre la possibilité d'enregistrer dans un fichier "log" ("journal") toutes les alertes que vous subissez. Pour y arriver, il suffit de cocher la case à côté de "Log alerts..." La ligne suivante précise à quel endroit de votre PC est stocké le "log". Un logiciel comme Wordpad suffit pour le consulter.

Si vous cochez également la case en regard de "Show the alert popup window", vous aurez droit à un message "popup" chaque fois qu'une nouvelle alerte sera enregistrée. Je vous conseil de décocher cette case parce que ca devient agaçant à la longue. "

cath69 · Answer

ZoneAlarm Logging Client v7.0.362.000
Windows XP-5.1.2600-Service Pack 2-SP
type,date,time,source,destination,transport (Security)
type,date,time,virus name,file name,mode,e-mail id (Anti-Virus)
type,date,time,source,destination,action,service (IM Security)
type,date,time,source,destination,program,action (Malicious Code Protection)
type,date,time,action,product,file,event,subevent,class,data,data,... (OSFirewall)
type,date,time,name,type,mode (Anti-Spyware)
PE,2007/11/03,21:22:58 +1:00 GMT,Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,192.168.2.1:53,N/A
FWOUT,2007/11/03,21:23:10 +1:00 GMT,192.168.2.147:1151,192.168.2.164:139,TCP (flags:S)
FWOUT,2007/11/03,21:24:02 +1:00 GMT,192.168.2.147:1153,192.168.2.164:139,TCP (flags:S)
ACCESS,2007/11/03,21:24:36 +1:00 GMT,Generic Host Process for Win32 Services a été temporairement bloqué depuis envoyer des données vers Internet  (192.168.2.1:DNS).,N/A,N/A
FWOUT,2007/11/03,21:24:52 +1:00 GMT,192.168.2.147:1155,192.168.2.164:139,TCP (flags:S)
FWIN,2007/11/03,21:25:18 +1:00 GMT,192.168.2.1:53,192.168.2.147:1108,UDP
PE,2007/11/03,21:25:18 +1:00 GMT,Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,192.168.2.1:53,N/A
ACCESS,2007/11/03,21:25:18 +1:00 GMT,Generic Host Process for Win32 Services n'a pas pu obtenir l'autorisation pour envoyer des données vers Internet  (192.168.2.1:DNS) ; l'accès a été refusé.,N/A,N/A
PE,2007/11/03,21:25:20 +1:00 GMT,Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,192.168.2.1:53,N/A
PE,2007/11/03,21:25:22 +1:00 GMT,Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,192.168.2.1:53,N/A
PE,2007/11/03,21:25:22 +1:00 GMT,Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,0.0.0.0:135,N/A
PE,2007/11/03,21:25:22 +1:00 GMT,Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,127.0.0.1:1037,N/A
ACCESS,2007/11/03,21:25:30 +1:00 GMT,Generic Host Process for Win32 Services a été temporairement bloqué depuis envoyer des données vers Internet  (192.168.2.1:DNS).,N/A,N/A
ACCESS,2007/11/03,21:25:30 +1:00 GMT,Generic Host Process for Win32 Services a été temporairement bloqué depuis se connecter à Internet  (192.168.2.1:DNS).,N/A,N/A
ACCESS,2007/11/03,21:25:44 +1:00 GMT,Generic Host Process for Win32 Services a été temporairement bloqué depuis se connecter à la zone locale  (127.0.0.1:Port 1037).,N/A,N/A
ACCESS,2007/11/03,21:25:44 +1:00 GMT,Generic Host Process for Win32 Services a été temporairement bloqué depuis se connecter à la zone locale  (127.0.0.1:Port 1052).,N/A,N/A
ACCESS,2007/11/03,21:25:44 +1:00 GMT,Generic Host Process for Win32 Services a été temporairement bloqué depuis se connecter à la zone locale  (127.0.0.1:Port 1051).,N/A,N/A
ACCESS,2007/11/03,21:25:44 +1:00 GMT,Generic Host Process for Win32 Services a été temporairement bloqué depuis se connecter à la zone locale  (127.0.0.1:Port 1038).,N/A,N/A
OSFW,2007/11/03,21:27:04 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
OSFW,2007/11/03,21:27:08 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
PE,2007/11/03,21:27:08 +1:00 GMT,avast! antivirus service,C:\Program Files\Alwil Software\Avast4\ashServ.exe,74.86.125.40:0,N/A
AV/treatment,2007/11/03,21:27:08 +1:00 GMT,,,,Auto
OSFW,2007/11/03,21:27:08 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,MODIFY,SRC,KL1
OSFW,2007/11/03,21:27:08 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,MODIFY,SRC,KL1
OSFW,2007/11/03,21:27:08 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,MODIFY,SRC,KL1
OSFW,2007/11/03,21:27:08 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,MODIFY,SRC,KL1
PE,2007/11/03,21:27:14 +1:00 GMT,avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,74.86.125.40:53,N/A
PE,2007/11/03,21:28:14 +1:00 GMT,Firefox,C:\Program Files\Mozilla Firefox\firefox.exe,127.0.0.1:1172,N/A
PE,2007/11/03,21:28:20 +1:00 GMT,Firefox,C:\Program Files\Mozilla Firefox\firefox.exe,209.85.5.41:53,N/A
PE,2007/11/03,21:28:20 +1:00 GMT,avast! Web Scanner,C:\Program Files\Alwil Software\Avast4\ashWebSv.exe,209.85.135.147:80,N/A
OSFW,2007/11/03,21:29:46 +1:00 GMT,UNKNOWN(0),LSA Shell (Export Version),C:\WINDOWS\system32\lsass.exe,PROCESS,OPENPROCESS,DST,C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
OSFW,2007/11/03,21:29:46 +1:00 GMT,UNKNOWN(0),LSA Shell (Export Version),C:\WINDOWS\system32\lsass.exe,PROCESS,OPENPROCESS,DST,C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
ZLUpdate,2007/11/03,21:30:28 +1:00 GMT,,,Manual
AV/update,2007/11/03,21:33:12 +1:00 GMT,,Update Install Completed,Manual
ZLUpdate,2007/11/03,21:34:00 +1:00 GMT,,,Manual
OSFW,2007/11/03,21:35:04 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
OSFW,2007/11/03,21:35:04 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
OSFW,2007/11/03,21:35:04 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
OSFW,2007/11/03,21:35:04 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
OSFW,2007/11/03,21:35:04 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
OSFW,2007/11/03,21:35:04 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
OSFW,2007/11/03,21:35:04 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
OSFW,2007/11/03,21:35:04 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
OSFW,2007/11/03,21:35:04 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
OSFW,2007/11/03,21:35:04 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
OSFW,2007/11/03,21:35:04 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
OSFW,2007/11/03,21:35:04 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
AV/treatment,2007/11/03,21:35:08 +1:00 GMT,not-a-virus:AdWare.Win32.Virtumonde.agh,C:\avenger\backup-03.11.2007-20.11.12,23.zip,Infecté,Manuel
AV/treatment,2007/11/03,21:36:32 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\Documents and Settings\Catherine Theiller\Bureau\SmitfraudFix.exe,Infecté,Manuel
PE,2007/11/03,21:41:02 +1:00 GMT,ZoneAlarm Client,C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe,62.161.94.103:53,N/A
FWOUT,2007/11/03,21:41:02 +1:00 GMT,192.168.2.147:1108,192.168.2.1:53,UDP
AV/treatment,2007/11/03,21:45:14 +1:00 GMT,Trojan-Downloader.JS.Psyme.ls,C:\Documents and Settings\www.NOM-1607AC21F06\Local Settings\Temporary Internet Files\Content.IE5\3POQRLGM\ZE[1].0TM,Échec de réparation du fichier,Manuel
,2007/11/03,21:45:16 +1:00 GMT,
AV/treatment,2007/11/03,22:07:16 +1:00 GMT,Trojan.Win32.Agent.bck,C:\Program Files\Navilog1\Backupnavi\DMBAFOIQ.0XE,Échec de réparation du fichier,Manuel
,2007/11/03,22:07:16 +1:00 GMT,
AV/treatment,2007/11/03,22:07:18 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\Program Files\Navilog1\reboot.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:07:54 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP1\A0000064.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:07:58 +1:00 GMT,not-a-virus:AdWare.Win32.SecToolBar.h,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP2\A0000098.dll,Infecté,Manuel
AV/treatment,2007/11/03,22:08:04 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP3\A0000248.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:08:08 +1:00 GMT,Trojan.Win32.Agent.bck,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP3\A0001405.exe,Échec de réparation du fichier,Manuel
,2007/11/03,22:08:08 +1:00 GMT,
AV/treatment,2007/11/03,22:08:10 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP3\A0001468.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:08:16 +1:00 GMT,not-a-virus:AdWare.Win32.Virtumonde.agh,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001532.dll,Infecté,Manuel
AV/treatment,2007/11/03,22:08:18 +1:00 GMT,not-a-virus:RiskTool.Win32.PsKill.k,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001589.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:08:18 +1:00 GMT,not-a-virus:AdWare.Win32.Virtumonde.agh,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001600.dll,Infecté,Manuel
AV/treatment,2007/11/03,22:08:20 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001634.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:08:24 +1:00 GMT,not-a-virus:AdWare.Win32.Virtumonde.agh,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP5\A0001681.dll,Infecté,Manuel
AV/treatment,2007/11/03,22:08:24 +1:00 GMT,not-a-virus:AdWare.Win32.Virtumonde.agh,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP5\A0001690.dll,Infecté,Manuel
AV/treatment,2007/11/03,22:08:28 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP6\A0001736.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:08:42 +1:00 GMT,not-a-virus:AdWare.Win32.SecToolBar.h,C:\VundoFix Backups\hjqphtwi.dll.bad,Infecté,Manuel
AV/scan,2007/11/03,22:24:20 +1:00 GMT,Plusieurs fichiers,Analyse effectuée,Manuel
AV/treatment,2007/11/03,22:27:50 +1:00 GMT,not-a-virus:AdWare.Win32.SecToolBar.h,C:\VundoFix Backups\hjqphtwi.dll.bad,Infecté,Manuel
AV/treatment,2007/11/03,22:27:50 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP6\A0001736.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:27:50 +1:00 GMT,not-a-virus:AdWare.Win32.Virtumonde.agh,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP5\A0001690.dll,Infecté,Manuel
AV/treatment,2007/11/03,22:27:50 +1:00 GMT,not-a-virus:AdWare.Win32.Virtumonde.agh,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP5\A0001681.dll,Infecté,Manuel
AV/treatment,2007/11/03,22:27:50 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001634.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:27:50 +1:00 GMT,not-a-virus:AdWare.Win32.Virtumonde.agh,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001600.dll,Infecté,Manuel
AV/treatment,2007/11/03,22:27:50 +1:00 GMT,not-a-virus:RiskTool.Win32.PsKill.k,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001589.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:27:50 +1:00 GMT,not-a-virus:AdWare.Win32.Virtumonde.agh,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001532.dll,Infecté,Manuel
AV/treatment,2007/11/03,22:27:52 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP3\A0001468.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:27:52 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP3\A0000248.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:27:52 +1:00 GMT,not-a-virus:AdWare.Win32.SecToolBar.h,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP2\A0000098.dll,Infecté,Manuel
AV/treatment,2007/11/03,22:27:52 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP1\A0000064.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:27:52 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\Program Files\Navilog1\reboot.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:27:52 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\Documents and Settings\Catherine Theiller\Bureau\SmitfraudFix.exe,Infecté,Manuel
AV/treatment,2007/11/03,22:27:54 +1:00 GMT,not-a-virus:AdWare.Win32.Virtumonde.agh,C:\avenger\backup-03.11.2007-20.11.12,23.zip,Infecté,Manuel
AV/scan,2007/11/03,22:27:54 +1:00 GMT,Plusieurs fichiers,Analyse effectuée,Manuel
,2007/11/03,22:28:00 +1:00 GMT,
,2007/11/03,22:28:00 +1:00 GMT,
,2007/11/03,22:28:00 +1:00 GMT,
,2007/11/03,22:28:00 +1:00 GMT,
,2007/11/03,22:28:00 +1:00 GMT,
,2007/11/03,22:28:00 +1:00 GMT,
,2007/11/03,22:28:00 +1:00 GMT,
,2007/11/03,22:28:02 +1:00 GMT,
,2007/11/03,22:28:02 +1:00 GMT,
,2007/11/03,22:28:02 +1:00 GMT,
,2007/11/03,22:28:02 +1:00 GMT,
,2007/11/03,22:28:02 +1:00 GMT,
,2007/11/03,22:28:02 +1:00 GMT,
,2007/11/03,22:28:02 +1:00 GMT,
,2007/11/03,22:28:02 +1:00 GMT,
OSFW,2007/11/03,22:28:50 +1:00 GMT,UNKNOWN(0),Client Server Runtime Process,C:\WINDOWS\system32\csrss.exe,PROCESS,TERMINATEPROCESS,DST,C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
OSFW,2007/11/03,22:35:42 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
AV/treatment,2007/11/03,22:35:48 +1:00 GMT,,,,Auto
PE,2007/11/03,22:36:00 +1:00 GMT,Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,192.168.2.1:53,N/A
OSFW,2007/11/03,22:36:04 +1:00 GMT,UNKNOWN(0),Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,DRIVER,LOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\Rdbss
OSFW,2007/11/03,22:37:58 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
AV/treatment,2007/11/03,22:38:04 +1:00 GMT,,,,Auto
OSFW,2007/11/03,22:38:20 +1:00 GMT,UNKNOWN(0),Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,DRIVER,LOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\Rdbss
OSFW,2007/11/03,22:42:28 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
AV/treatment,2007/11/03,22:42:34 +1:00 GMT,,,,Auto
OSFW,2007/11/03,22:42:46 +1:00 GMT,UNKNOWN(0),Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,DRIVER,LOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\Rdbss
OSFW,2007/11/03,22:42:56 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\SYSTEM32\SVCHOST.EXE
OSFW,2007/11/03,22:43:02 +1:00 GMT,UNKNOWN(0),Application d'ouverture de session Windows NT,C:\WINDOWS\system32\winlogon.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\SYSTEM32\USERINIT.EXE
PE,2007/11/03,22:45:06 +1:00 GMT,Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,207.46.197.32:123,N/A
OSFW,2007/11/03,22:45:12 +1:00 GMT,UNKNOWN(0),Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,PROCESS,OPENPROCESS,DST,C:\WINDOWS\system32\winlogon.exe
OSFW,2007/11/03,22:45:36 +1:00 GMT,UNKNOWN(0),Notifications Windows Genuine Advantage,C:\WINDOWS\system32\WgaTray.exe,PHYSMEM,MAP,SRC
OSFW,2007/11/03,22:45:56 +1:00 GMT,UNKNOWN(0),Exécuter une DLL en tant qu'application,C:\WINDOWS\system32\rundll32.exe,EXECUTION,GLOBALWINDOWSHOOK,SRC
PE,2007/11/03,22:46:04 +1:00 GMT,Windows Messenger,C:\Program Files\Messenger\msmsgs.exe,65.54.239.20:1863,N/A
PE,2007/11/03,22:46:56 +1:00 GMT,Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,0.0.0.0:135,N/A
OSFW,2007/11/03,22:47:32 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,CREATE,SRC,AVASTTESTSERVICE
OSFW,2007/11/03,22:47:32 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,AVASTTESTSERVICE
OSFW,2007/11/03,22:50:08 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,ASWTDI\PARAMETERS
OSFW,2007/11/03,22:50:08 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,ASWTDI\ENUM
OSFW,2007/11/03,22:50:08 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,ASWTDI
OSFW,2007/11/03,22:50:36 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,ASWRDR\PARAMETERS
OSFW,2007/11/03,22:50:38 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,ASWRDR\PARAMETERS2
OSFW,2007/11/03,22:50:38 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,ASWRDR\ENUM
OSFW,2007/11/03,22:50:38 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,ASWRDR
OSFW,2007/11/03,22:50:38 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,ASWMON2\ENUM
OSFW,2007/11/03,22:50:38 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,ASWMON2
OSFW,2007/11/03,22:50:40 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,AAVMKER4\ENUM
OSFW,2007/11/03,22:50:40 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,AAVMKER4
OSFW,2007/11/03,22:50:40 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,REGISTRY,DELVALUE,SRC,HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN,avast!
OSFW,2007/11/03,22:50:42 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,EVENTLOG\ANTIVIRUS\AVAST!
OSFW,2007/11/03,22:50:42 +1:00 GMT,UNKNOWN(0),avast! antivirus Update,C:\Program Files\Alwil Software\Avast4\Setup\avast.setup,DRIVER,DELETE,SRC,EVENTLOG\ANTIVIRUS
OSFW,2007/11/03,22:56:16 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
AV/treatment,2007/11/03,22:56:24 +1:00 GMT,,,,Auto
OSFW,2007/11/03,22:56:32 +1:00 GMT,UNKNOWN(0),Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,DRIVER,LOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\Rdbss
OSFW,2007/11/03,22:57:04 +1:00 GMT,UNKNOWN(0),Application d'ouverture de session Windows NT,C:\WINDOWS\system32\winlogon.exe,PROCESS,OPENPROCESS,DST,C:\WINDOWS\system32\services.exe
OSFW,2007/11/03,22:57:18 +1:00 GMT,UNKNOWN(0),Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,PROCESS,OPENPROCESS,DST,C:\WINDOWS\System32\svchost.exe
OSFW,2007/11/03,22:57:34 +1:00 GMT,UNKNOWN(0),Explorateur Windows,C:\WINDOWS\explorer.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\system32\rundll32.exe,f5402cd4-7b7389dd-c21f9211-9a906eee,ee,a66fc
OSFW,2007/11/03,23:12:58 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
AV/treatment,2007/11/03,23:12:58 +1:00 GMT,,,,Auto
OSFW,2007/11/03,23:12:58 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,MODIFY,SRC,KL1
OSFW,2007/11/03,23:13:14 +1:00 GMT,UNKNOWN(0),Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,PROCESS,OPENPROCESS,DST,C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
OSFW,2007/11/03,23:13:16 +1:00 GMT,UNKNOWN(0),Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,PROCESS,OPENPROCESS,DST,C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
OSFW,2007/11/03,23:15:00 +1:00 GMT,UNKNOWN(0),Application d'ouverture de session Windows NT,C:\WINDOWS\system32\winlogon.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\SYSTEM32\TASKMGR.EXE
OSFW,2007/11/03,23:15:00 +1:00 GMT,UNKNOWN(0),Application d'ouverture de session Windows NT,C:\WINDOWS\system32\winlogon.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\SYSTEM32\TASKMGR.EXE
OSFW,2007/11/03,23:20:44 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
OSFW,2007/11/03,23:20:44 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,DRIVER,UNLOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\KLIF
AV/treatment,2007/11/03,23:20:46 +1:00 GMT,,,,Auto
OSFW,2007/11/03,23:21:02 +1:00 GMT,UNKNOWN(0),Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,DRIVER,LOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\Rdbss
OSFW,2007/11/03,23:21:16 +1:00 GMT,UNKNOWN(0),Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,PROCESS,OPENPROCESS,DST,C:\WINDOWS\System32\svchost.exe
OSFW,2007/11/03,23:21:18 +1:00 GMT,UNKNOWN(0),Explorateur Windows,C:\WINDOWS\explorer.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\system32\rundll32.exe,f5402cd4-7b7389dd-c21f9211-9a906eee,ee,a66fc
OSFW,2007/11/03,23:21:38 +1:00 GMT,UNKNOWN(0),Application d'ouverture de session Windows NT,C:\WINDOWS\system32\winlogon.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\SYSTEM32\WGATRAY.EXE
OSFW,2007/11/03,23:34:18 +1:00 GMT,UNKNOWN(0),Applications Services et Contrôleur,C:\WINDOWS\system32\services.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
AV/treatment,2007/11/03,23:34:22 +1:00 GMT,,,,Auto
OSFW,2007/11/03,23:34:36 +1:00 GMT,UNKNOWN(0),Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,DRIVER,LOAD,SRC,\Registry\Machine\System\CurrentControlSet\Services\Rdbss
OSFW,2007/11/03,23:34:52 +1:00 GMT,UNKNOWN(0),Generic Host Process for Win32 Services,C:\WINDOWS\system32\svchost.exe,PROCESS,OPENPROCESS,DST,C:\WINDOWS\System32\svchost.exe
OSFW,2007/11/03,23:35:20 +1:00 GMT,UNKNOWN(0),Application d'ouverture de session Windows NT,C:\WINDOWS\system32\winlogon.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\SYSTEM32\WGATRAY.EXE
OSFW,2007/11/03,23:47:24 +1:00 GMT,UNKNOWN(0),Application d'ouverture de session Windows NT,C:\WINDOWS\system32\winlogon.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\SYSTEM32\LOGON.SCR
ZLUpdate,2007/11/03,23:51:04 +1:00 GMT,,,Auto
ZLUpdate,2007/11/03,23:51:10 +1:00 GMT,,,Auto
AV/update,2007/11/04,12:00:48 +1:00 GMT,,Update Install Completed,Auto
AV/scan,2007/11/04,13:14:20 +1:00 GMT,Plusieurs fichiers,Analyse effectuée,Auto
AV/update,2007/11/04,13:17:30 +1:00 GMT,,Update Install Completed,Auto
AV/update,2007/11/04,14:00:42 +1:00 GMT,,Update Install Completed,Auto
AV/update,2007/11/04,15:00:46 +1:00 GMT,,Update Install Completed,Auto
PE,2007/11/04,15:23:42 +1:00 GMT,Firefox,C:\Program Files\Mozilla Firefox\firefox.exe,127.0.0.1:1412,N/A
PE,2007/11/04,15:23:54 +1:00 GMT,Firefox,C:\Program Files\Mozilla Firefox\firefox.exe,195.95.194.8:53,N/A
OSFW,2007/11/04,15:47:42 +1:00 GMT,UNKNOWN(0),CCleaner,C:\Program Files\CCleaner\CCleaner.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\system32\rundll32.exe,f5402cd4-7b7389dd-c21f9211-9a906eee,ee,a66fc
OSFW,2007/11/04,15:47:50 +1:00 GMT,BLOCKED,CCleaner,C:\Program Files\CCleaner\CCleaner.exe,FILE,WRITE,SRC,WINDIR\Internet Logs\ZALog.txt
OSFW,2007/11/04,15:47:50 +1:00 GMT,BLOCKED,CCleaner,C:\Program Files\CCleaner\CCleaner.exe,FILE,WRITE,SRC,WINDIR\Internet Logs\ZALog.txt
OSFW,2007/11/04,15:47:54 +1:00 GMT,UNKNOWN(0),CCleaner,C:\Program Files\CCleaner\CCleaner.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\system32\rundll32.exe,f5402cd4-7b7389dd-c21f9211-9a906eee,ee,a66fc
OSFW,2007/11/04,15:47:56 +1:00 GMT,BLOCKED,CCleaner,C:\Program Files\CCleaner\CCleaner.exe,FILE,WRITE,SRC,WINDIR\Internet Logs\ZALog.txt
OSFW,2007/11/04,15:47:56 +1:00 GMT,BLOCKED,CCleaner,C:\Program Files\CCleaner\CCleaner.exe,FILE,WRITE,SRC,WINDIR\Internet Logs\ZALog.txt
OSFW,2007/11/04,15:50:44 +1:00 GMT,UNKNOWN(0),Application d'ouverture de session Windows NT,C:\WINDOWS\system32\winlogon.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\SYSTEM32\USERINIT.EXE
OSFW,2007/11/04,15:50:54 +1:00 GMT,UNKNOWN(0),Explorateur Windows,C:\WINDOWS\explorer.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\system32\rundll32.exe,f5402cd4-7b7389dd-c21f9211-9a906eee,ee,a66fc
OSFW,2007/11/04,15:53:54 +1:00 GMT,UNKNOWN(0),Panneau de configuration Windows,C:\WINDOWS\system32\control.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\system32\rundll32.exe,f5402cd4-7b7389dd-c21f9211-9a906eee,ee,a66fc
OSFW,2007/11/04,15:54:30 +1:00 GMT,UNKNOWN(0),Panneau de configuration Windows,C:\WINDOWS\system32\control.exe,PROCESS,SPAWNPROCESS,SRC,C:\WINDOWS\system32\rundll32.exe,f5402cd4-7b7389dd-c21f9211-9a906eee,ee,a66fc

Utilisateur anonyme · Answer

La majorité de ces alertes sont des faux positif...
-----------
GMT,not-a-virus:AdWare.Win32.Virtumonde.agh,C:\avenger\backup-03.11.2007-20.11.12,23.zip,I nfecté,Manuel
AV/treatment,2007/11/03,21:36:32 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\Documents and Settings\Catherine Theiller\Bureau\SmitfraudFix.exe,Infecté,Manuel 
AV/treatment,2007/11/03,22:07:16 +1:00 GMT,Trojan.Win32.Agent.bck,C:\Program Files\Navilog1\Backupnavi\DMBAFOIQ.0XE,Échec de réparation du fichier,Manuel
,2007/11/03,22:07:16 +1:00 GMT,
AV/treatment,2007/11/03,22:07:18 +1:00 GMT,not-a-virus:RiskTool.Win32.Reboot.f,C:\Program Files\Navilog1\reboot.exe,Infecté,Manuel 
--------------------
pas de panique avec ça !
de plus tes points de restaurations aussi sont infectés
Mais une chose à la fois !
fais ceci:
https://www.pandasecurity.com/?ref=www.pandasoftware.com/activescan/
tuto
https://www.malekal.com/scan-antivirus-ligne-nod32/
copies le rapport

cath69 · Answer

Avant de commencer, qu'est-ce que je fais avec mon fire-wall (zone alarm), l'anti virus de zone alarm (qui est actif) et avast (que j'ai désinstallé hier soir) ??

Utilisateur anonyme · Answer

pour le moment fais le scan avec Panda.
Peut-être tu devras désactiver ZA , pour le scan en ligne,  ?

cath69 · Answer

Incident                                                                        Status                        Location                                                                                                                                                                                                                                                        

Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c00361F1.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/ahbacpwq.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/bepoqrtc.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/bmlkyngv.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/dtatcrpp.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/ebuhnvqm.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/ehmxjkex.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/eqwterkr.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/gohbdpwe.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/ithblgeb.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/nubciyrm.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/pprtvwle.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/qgcsmqsr.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/quslmblx.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/rrnskyqk.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/sqpkmhra.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/tnilytue.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/uyciuxfm.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/wdiyputf.dll]                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/__c0035560.dat]                                                                                                                                                                                            
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/__c004CECC.dat]                                                                                                                                                                                            
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/__c009207A.dat]                                                                                                                                                                                            
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/__c0092A77.dat]                                                                                                                                                                                            
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/__c0098B8.dat]                                                                                                                                                                                             
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/__c009ED10.dat]                                                                                                                                                                                            
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/__c00BC8CD.dat]                                                                                                                                                                                            
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/__c00C8440.dat]                                                                                                                                                                                            
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/__c00CEAAF.dat]                                                                                                                                                                                            
Adware:Adware/PurityScan                                                        Not disinfected               C:\avenger\backup-02.11.2007-18.43.04,45.zip[avenger/__c00D9661.dat]                                                                                                                                                                                            
Spyware:Cookie/Xiti                                                             Not disinfected               C:\Documents and Settings\Catherine Theiller\Application Data\Mozilla\Firefox\Profiles\qczg3145.default\cookies.txt[.xiti.com/]                                                                                                                                 
Spyware:Cookie/Advertising                                                      Not disinfected               C:\Documents and Settings\Catherine Theiller\Application Data\Mozilla\Firefox\Profiles\qczg3145.default\cookies.txt[.advertising.com/]                                                                                                                          
Spyware:Cookie/Clickbank                                                        Not disinfected               C:\Documents and Settings\Catherine Theiller\Cookies\catherine_theiller@clickbank[1].txt                                                                                                                                                                        
Spyware:Cookie/Tradedoubler                                                     Not disinfected               C:\Documents and Settings\Catherine Theiller\Cookies\catherine_theiller@tradedoubler[2].txt                                                                                                                                                                     
Spyware:Cookie/Weborama                                                         Not disinfected               C:\Documents and Settings\Catherine Theiller\Cookies\catherine_theiller@weborama[1].txt                                                                                                                                                                         
Spyware:Cookie/Xiti                                                             Not disinfected               C:\Documents and Settings\Catherine Theiller\Cookies\catherine_theiller@xiti[1].txt                                                                                                                                                                             
Adware:Adware/PurityScan                                                        Not disinfected               C:\Documents and Settings\Catherine Theiller\Local Settings\Temporary Internet Files\Content.IE5\2Z3OK9IT\mosx1024[1]                                                                                                                                           
Spyware:Cookie/Ccbill                                                           Not disinfected               C:\Documents and Settings\www.NOM-1607AC21F06\Cookies\www@ccbill[1].txt                                                                                                                                                                                         
Spyware:Cookie/Sextracker                                                       Not disinfected               C:\Documents and Settings\www.NOM-1607AC21F06\Cookies\www@counter16.sextracker[1].txt                                                                                                                                                                           
Spyware:Cookie/Sextracker                                                       Not disinfected               C:\Documents and Settings\www.NOM-1607AC21F06\Cookies\www@counter7.sextracker[1].txt                                                                                                                                                                            
Spyware:Cookie/Sextracker                                                       Not disinfected               C:\Documents and Settings\www.NOM-1607AC21F06\Cookies\www@counter9.sextracker[2].txt                                                                                                                                                                            
Spyware:Cookie/Hitbox                                                           Not disinfected               C:\Documents and Settings\www.NOM-1607AC21F06\Cookies\www@hg1.hitbox[2].txt                                                                                                                                                                                     
Spyware:Cookie/SexList                                                          Not disinfected               C:\Documents and Settings\www.NOM-1607AC21F06\Cookies\www@sexlist[1].txt                                                                                                                                                                                        
Spyware:Cookie/Sextracker                                                       Not disinfected               C:\Documents and Settings\www.NOM-1607AC21F06\Cookies\www@sextracker[2].txt                                                                                                                                                                                     
Spyware:Cookie/Statcounter                                                      Not disinfected               C:\Documents and Settings\www.NOM-1607AC21F06\Cookies\www@statcounter[1].txt                                                                                                                                                                                    
Spyware:Cookie/Cgi-bin                                                          Not disinfected               C:\Documents and Settings\www.NOM-1607AC21F06\Cookies\www@www6.addfreestats[1].txt                                                                                                                                                                              
Spyware:Cookie/XXXCounter                                                       Not disinfected               C:\Documents and Settings\www.NOM-1607AC21F06\Cookies\www@xxxcounter[2].txt                                                                                                                                                                                     
Spyware:Cookie/Yadro                                                            Not disinfected               C:\Documents and Settings\www.NOM-1607AC21F06\Cookies\www@yadro[2].txt                                                                                                                                                                                          
Potentially unwanted tool:Application/Processor                                 Not disinfected               C:\Program Files\Navilog1\Process.exe                                                                                                                                                                                                                           
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\aadahyoj.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\afohxoil.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\bmmgbegi.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\bstdbokt.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\bwfyguui.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\cnjdpdpx.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\cyinxixs.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\dqdlicws.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\eerckoxv.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\ffqouxqy.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\fkggiqcr.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\fusxiodf.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\ggksxrmb.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\jdfligxo.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\jpdgiqmi.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\jvtdugqi.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\lpirbsjf.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\mnxucybn.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32
aglngpv.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\oejekabc.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\ouscwkdd.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\pmfoputf.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\qupfcsdy.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\swcpeaxc.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\uahacpja.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\vedlptwt.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\wnvpcmqm.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\ynqvvihr.dll                                                                                                                                                                                                                                
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c0015F6F.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c0021113.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c00218B1.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c0030B8C.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c003E8D6.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c004A3C8.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c004C6E2.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c0050F30.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c00583B.dat                                                                                                                                                                                                                               
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c005AEDB.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c007FC01.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c00862A.dat                                                                                                                                                                                                                               
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c009316.dat                                                                                                                                                                                                                               
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c00B5BD8.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c00B95F5.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c00C2B0A.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c00DBC59.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c00E9E09.dat                                                                                                                                                                                                                              
Adware:Adware/PurityScan                                                        Not disinfected               C:\WINDOWS\system32\__c00F1E64.dat

Utilisateur anonyme · Answer

mets ta machine en mode sans échec.
https://leblogdeclaude.blogspot.com/
-----------------------------------------------------------------------------
ouvre ton notepad.exe
copie exactement ceci:
enregistre-le en : fix.txt sur ton bureau (efface l'ancien)
-------------------------------------------------------------------------------
Files to Delete: 
C:\WINDOWS\system32
aglngpv.dll
C:\WINDOWS\system32\oejekabc.dll
C:\WINDOWS\system32\ouscwkdd.dll
C:\WINDOWS\system32\pmfoputf.dll
C:\WINDOWS\system32\qupfcsdy.dll
C:\WINDOWS\system32\swcpeaxc.dll
C:\WINDOWS\system32\uahacpja.dll
C:\WINDOWS\system32\vedlptwt.dll
C:\WINDOWS\system32\wnvpcmqm.dll
C:\WINDOWS\system32\ynqvvihr.dll
C:\WINDOWS\system32\__c0015F6F.dat
C:\WINDOWS\system32\__c0021113.dat
C:\WINDOWS\system32\__c00218B1.dat
C:\WINDOWS\system32\__c0030B8C.dat
C:\WINDOWS\system32\__c003E8D6.dat
C:\WINDOWS\system32\__c004A3C8.dat
C:\WINDOWS\system32\__c004C6E2.dat
C:\WINDOWS\system32\__c0050F30.dat
C:\WINDOWS\system32\__c00583B.dat
C:\WINDOWS\system32\__c005AEDB.dat
C:\WINDOWS\system32\__c007FC01.dat
C:\WINDOWS\system32\__c00862A.dat
C:\WINDOWS\system32\__c009316.dat
C:\WINDOWS\system32\__c00B5BD8.dat
C:\WINDOWS\system32\__c00B95F5.dat
C:\WINDOWS\system32\__c00C2B0A.dat
C:\WINDOWS\system32\__c00DBC59.dat
C:\WINDOWS\system32\__c00E9E09.dat
C:\WINDOWS\system32\__c00F1E64.dat
-----------------------------------------

lance The Avenger.
coche load script fron file (lire un script à partir d'un fichier) recherche alors fix.txt qui est sur ton bureau.
Ensuite lance-le avec l'icone du feu vert.
copies le rapport

cath69 · Answer

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\wexbwkyf

*******************

Script file located at: \??\C:\WINDOWS\iwoyqlsb.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32
aglngpv.dll deleted successfully.
File C:\WINDOWS\system32\oejekabc.dll deleted successfully.
File C:\WINDOWS\system32\ouscwkdd.dll deleted successfully.
File C:\WINDOWS\system32\pmfoputf.dll deleted successfully.
File C:\WINDOWS\system32\qupfcsdy.dll deleted successfully.
File C:\WINDOWS\system32\swcpeaxc.dll deleted successfully.
File C:\WINDOWS\system32\uahacpja.dll deleted successfully.
File C:\WINDOWS\system32\vedlptwt.dll deleted successfully.
File C:\WINDOWS\system32\wnvpcmqm.dll deleted successfully.
File C:\WINDOWS\system32\ynqvvihr.dll deleted successfully.
File C:\WINDOWS\system32\__c0015F6F.dat deleted successfully.
File C:\WINDOWS\system32\__c0021113.dat deleted successfully.
File C:\WINDOWS\system32\__c00218B1.dat deleted successfully.
File C:\WINDOWS\system32\__c0030B8C.dat deleted successfully.
File C:\WINDOWS\system32\__c003E8D6.dat deleted successfully.
File C:\WINDOWS\system32\__c004A3C8.dat deleted successfully.
File C:\WINDOWS\system32\__c004C6E2.dat deleted successfully.
File C:\WINDOWS\system32\__c0050F30.dat deleted successfully.
File C:\WINDOWS\system32\__c00583B.dat deleted successfully.
File C:\WINDOWS\system32\__c005AEDB.dat deleted successfully.
File C:\WINDOWS\system32\__c007FC01.dat deleted successfully.
File C:\WINDOWS\system32\__c00862A.dat deleted successfully.
File C:\WINDOWS\system32\__c009316.dat deleted successfully.
File C:\WINDOWS\system32\__c00B5BD8.dat deleted successfully.
File C:\WINDOWS\system32\__c00B95F5.dat deleted successfully.
File C:\WINDOWS\system32\__c00C2B0A.dat deleted successfully.
File C:\WINDOWS\system32\__c00DBC59.dat deleted successfully.
File C:\WINDOWS\system32\__c00E9E09.dat deleted successfully.
File C:\WINDOWS\system32\__c00F1E64.dat deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.

Utilisateur anonyme · Answer

je voudrais que tu tentes la réinstallation de Antivir
http://www.commentcamarche.net/telecharger/telecharger 55 antivir
Fais la mise à jour, et scannes ta machine en mode sans échec.
Postes le rapport

cath69 · Answer

Ouf ! Antivir est réinstallé. J'ai fait le scan mais sans avoir pu remettre à jour avant (plantage comme hier à cause de C:\WINDOWS\systeme32\_c00361F1.dat -> le même qu'hier). Donc le scan présenté c'est sans la mise à jour d'antivir...
Depuis que j'ai redémarré, j'ai une alerte Antivir avec C:\WINDOWS\systeme32\mljjk.dll.



AntiVir PersonalEdition Classic
Report file date: dimanche 4 novembre 2007  19:51

Scanning for 835736 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         SYSTEM
Computer name:    NOM-1607AC21F06

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.0.1        2048 Bytes  13/09/2007 14:27:04
ANTIVIR3.VDF : 7.0.0.2        2048 Bytes  13/09/2007 14:27:13
AVEWIN32.DLL : 7.6.0.15    2806272 Bytes  17/09/2007 17:43:56
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: dimanche 4 novembre 2007  19:52

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'update.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'mantispm.exe' - '1' Module(s) have been scanned
Scan process 'WgaTray.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'ScanningProcess.exe' - '0' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'ScanningProcess.exe' - '0' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
30 processes with 30 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '18' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!


End of the scan: dimanche 4 novembre 2007  19:52
Used time: 00:43 min

The scan has been canceled!

    129 Scanning directories
    536 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
    536 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

Utilisateur anonyme · Answer

C:\WINDOWS\systeme32\mljjk.dll
vires le manuellment en mode sans échec.
avec Explorer tu le cherches et tu le supprimes.

cath69 · Answer

Voilà ! 
Globalement, c'est sans commune mesure avec l'état d'hier. J'ai gagné en rapidité. Peut être commençons nous à voir le bout du tunnel ??

Utilisateur anonyme · Answer

Je te souhaite.
Le fire-wall te protège en théorie d'une réinfection ...
Le soucis est de mettre Antivir à jour.
Si tu as une alerte note de quoi il sagit, quoiqu'en proncipe il doit aussi avoir un journal d'alerte.
Antivir et ton Fire-wall doivent ABSOLUMENT être actif quand tu te connectes au Net.
Mets Antivir à jour.
Refaits un scan déconnecté du Net ensuite et en mode normal.
Si tu as des alertes, soit tu les notes, soit tu me colles le journal des alertes de Antivir.

cath69 · Answer

Scan réalisé après mise à jour d'antivir :

AntiVir PersonalEdition Classic
Report file date: dimanche 4 novembre 2007  20:29

Scanning for 914349 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         SYSTEM
Computer name:    NOM-1607AC21F06

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.0.140    940544 Bytes  26/10/2007 18:54:15
ANTIVIR3.VDF : 7.0.0.166    137728 Bytes  04/11/2007 18:54:15
AVEWIN32.DLL : 7.6.0.30    3056128 Bytes  04/11/2007 18:54:17
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: dimanche 4 novembre 2007  20:29

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'mantispm.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
25 processes with 25 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '18' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\avenger\backup-04.11.2007-18.10.55,67.zip
  [0] Archive type: ZIP
  --> avenger/SERCHGNO.DLL
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
  --> avenger/TEXOHWYP.DLL
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
  --> avenger/XDXILEUN.DLL
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      The file was moved to '47911e14.qua'!
C:\Program Files\Hijackthis Version Française\backups\backup-20071101-184942-461.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '47912240.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001538.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2574.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001540.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2579.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001541.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e257b.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001545.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e257d.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001546.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e257f.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001549.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2581.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001550.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2583.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001551.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2586.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001554.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2588.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001557.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e258b.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001560.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e258d.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001561.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2591.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001562.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2594.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001563.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2597.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001564.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2598.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001566.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e259a.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001567.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e259d.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP4\A0001568.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e259f.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP5\A0001683.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25a7.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP5\A0001685.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25a9.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP5\A0001686.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25ab.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP5\A0001688.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25ae.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP7\A0001783.DLL
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      The file was moved to '475e25c0.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP7\A0001785.DLL
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      The file was moved to '475e25c3.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP7\A0001789.DLL
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      The file was moved to '475e25c5.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP8\A0010007.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25e0.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP8\A0010008.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25e4.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP8\A0010009.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25e7.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP8\A0010010.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25ea.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP8\A0010011.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25ed.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP8\A0010012.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25ef.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP8\A0010013.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25f2.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP8\A0010014.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25f5.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP8\A0010015.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25f8.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP8\A0010016.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e25fb.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011005.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2606.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011006.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e260a.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011007.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e260c.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011008.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e260f.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011009.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2611.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011010.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2614.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011011.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2617.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011012.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e261a.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011013.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e261c.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011014.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2627.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011015.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e262f.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011016.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '46239d80.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011017.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2630.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011018.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '46239d81.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011019.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2632.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011020.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '46239d83.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011021.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '475e2631.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011022.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '46239d82.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011023.dll
      [DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738
      [INFO]      The file was moved to '475e2633.qua'!
C:\System Volume Information\_restore{7B02C464-3C0C-453D-9D98-C360AC408D0F}\RP9\A0011068.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '46239d84.qua'!


End of the scan: dimanche 4 novembre 2007  21:21
Used time: 51:34 min

The scan has been done completely.

   3297 Scanning directories
 208177 Files were scanned
     59 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
     57 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 208118 Files not concerned
   6156 Archives were scanned
      1 Warnings
      2 Notes

Utilisateur anonyme · Answer

Bon, à part des faux positifs et les points de restauration infectés (pas étonnant en fait !) rien de dangereux en soi.
comment se comporte le PC à ce point ?

cath69 · Answer

Quelques lenteurs au démarrage, sinon c'est bien.

Utilisateur anonyme · Answer

tu as fait ceci ?
https://leblogdeclaude.blogspot.com/2007/03/informatique-supprimer-des-logiciels-au.html
si non fais-le.

cath69 · Answer

C'est normal si je n'ai pas de zone "verte" ??

cath69 · Answer

Oui c'est mieux...
C'est normal si je n'ai plus l'icone de mon antivirus en bas à droite ? bhou !

Est-ce que je peux désinstaller Vundofix, Navilog, Fixvundo, OAD, Clean.cmd, Hijackthis ..??

Utilisateur anonyme · Answer

apparemment tu aurais virer l'antivirus au démarrage !
--------------------> tu dois le remettre.
En général la liste verte est sans danger.
Si tu n'en a pas il te reste le jaune .
Mais procède par étape !
Une marche arrière est trés facile  avec Sypbot
------------------------------------------------------
refaits un log Hijackthis

cath69 · Answer

Logfile of HijackThis v1.99.1
Scan saved at 19:17:57, on 06/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/advanced_search?hl=fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: {60d425f4-8f37-cc28-a4a4-1d415678f406} - {604f8765-14d1-4a4a-82cc-73f84f524d06} - C:\WINDOWS\system32\cpvtvivf.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {8E9FEB71-7588-4FE7-94C1-E84C27FB5671} - C:\WINDOWS\system32\mljjk.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A4069847-C342-48E2-9257-01A24E5C78EA} (F-Secure Online Scanner 3.2) - https://www.f-secure.com/en/home/support
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00361F1.dat
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

Bien, je vois  le fire-wall et l'Antivir+tea-timer.
--------------------------------------------------

cocher + fixer
--------------------------------
O2 - BHO: (no name) - {8E9FEB71-7588-4FE7-94C1-E84C27FB5671} - C:\WINDOWS\system32\mljjk.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) 
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) 
-------------------
mets à jour ta vesion Java:
jre1.6.0_02 on est à la 03
https://leblogdeclaude.blogspot.com/2007/07/mettre-jour-votre-version-java.html
----------------------------
reboot ta machine.
fais une recherche avec oad.exe sur ceci------->
mljjk.dll 
postes le rapport oad.exe
-----------------------------
en même temps 
Repostes un log Hijackthis

cath69 · Answer

Recherche oad :

 06/11/2007 ---- 20:05:19,93  

----------------------------------
§§§§§§ [mljjk.dll ] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

cath69 · Answer

Logfile of HijackThis v1.99.1
Scan saved at 20:06:45, on 06/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/advanced_search?hl=fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: {60d425f4-8f37-cc28-a4a4-1d415678f406} - {604f8765-14d1-4a4a-82cc-73f84f524d06} - C:\WINDOWS\system32\cpvtvivf.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin
pjpi160_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin
pjpi160_03.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A4069847-C342-48E2-9257-01A24E5C78EA} (F-Secure Online Scanner 3.2) - https://www.f-secure.com/en/home/support
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00361F1.dat
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

oufti !
j'ai eu chaud !
Bon, ça m'a l'air correct.
Reposte un log Hijackthis.

cath69 · Answer

Oups !
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00361F1.dat

c'est le fichier qu'antivir bloquait l'autre fois quand j'essayais de l'installer

Utilisateur anonyme · Answer

recherche __c00361F1.dat 
avec oad.exe
postes le rapport

cath69 · Answer

06/11/2007 ---- 20:43:30,85  

----------------------------------
§§§§§§ [__c00361F1.dat] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\system32\__c00361F1.dat"

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

cath69 · Answer

Logfile of HijackThis v1.99.1
Scan saved at 20:43:55, on 06/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/advanced_search?hl=fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: {60d425f4-8f37-cc28-a4a4-1d415678f406} - {604f8765-14d1-4a4a-82cc-73f84f524d06} - C:\WINDOWS\system32\cpvtvivf.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin
pjpi160_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin
pjpi160_03.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A4069847-C342-48E2-9257-01A24E5C78EA} (F-Secure Online Scanner 3.2) - https://www.f-secure.com/en/home/support
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00361F1.dat
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

Bien, fais ceci:
ouvres notepad.exe
copie exactement le texte:
-------------------------------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=-

------------------------------------
enregistre sur le bureau sous:
fix.reg
---------------
double clic et acceptes fusionner
-------------------
ensuite,
cocher+ fixer  cette ligne dans Hijackthis
O2 - BHO: {60d425f4-8f37-cc28-a4a4-1d415678f406} - {604f8765-14d1-4a4a-82cc-73f84f524d06} - C:\WINDOWS\system32\cpvtvivf.dll (file missing) 
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00361F1.dat 
------------------------------------

effaces ce fichier avec Hijackthis:
C:\WINDOWS\system32\__c00361F1.dat 
et 
C:\WINDOWS\system32\cpvtvivf.dll 
comment faire ?
https://leblogdeclaude.blogspot.com/2007/03/informatique-supprimer-un-programme.html
-----------------------------------
reboot ta machine+repost un Log Hijackthis
-------------------------------------------
recherches ceci avec OAD.exe
cpvtvivf
postes le rapport en+







*****Dans chaque église, il y a toujours quelque chose qui cloche******
Je n'ai pas la prétention de résoudre les problèmes, j'essaie simplement de rendre service ;-)

cath69 · Answer

Logfile of HijackThis v1.99.1
Scan saved at 17:59:00, on 07/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/advanced_search?hl=fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin
pjpi160_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin
pjpi160_03.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A4069847-C342-48E2-9257-01A24E5C78EA} (F-Secure Online Scanner 3.2) - https://www.f-secure.com/en/home/support
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

cath69 · Answer

07/11/2007 ---- 18:01:58,95  

----------------------------------
§§§§§§ [cpvtvivf ] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

Utilisateur anonyme · Answer

Bien, on avance.
télécharge ceci:
http://www.malekal.com/download/clean.zip
Décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier dénommé "clean ".
Redémarre en mode sans échec. ( note bien ce que tu as à faire ).
Ouvre le dossier « clean » qui se trouve sur ton bureau.
Double-clic sur « clean.cmd ».
Une fenêtre noire va apparaitre, suis les consignes
Choisis l’option 1.
Clean va travailler.
Il est possible que clean trouve des "bestioles", je conseille de poster un rapport sur CCM, ou de passer à l'option 2 pour nettoyer (poster le rapport de nettoyage, dans ce cas)

Où est le rapport clean ? : « Poste de travail » / double clic sur disque « C / » double-clic sur « rapport_clean.txt » et « copier/coller le contenu » sur le forum.

--------------------------------------------------------------------------

cath69 · Answer

07/11/2007 a 21:05:13,23 
 
*** Recherche des fichiers dans C: 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
 
*** Recherche des fichiers dans C:\Program Files 
*** Fin du rapport !

Utilisateur anonyme · Answer

bien comment se comporte ton pc ?

cath69 · Answer

Pour l'instant, tout va bien

Utilisateur anonyme · Answer

je voudrais savoir si ce qu'on a fait t'a été utile et résolu ton souci ?

cath69 · Answer

Un grand merci pour ton aide. Mon problème semble résolu à 200 % !

Utilisateur anonyme · Answer

Bien, fais ceci:
https://leblogdeclaude.blogspot.com/2007/03/informatique-procdure-navifix.html
poste le rapport+ ceci:
https://leblogdeclaude.blogspot.com/2007/04/informatique-procdure-smitfraud.html
-------------
histoire de voir si rien ne se réactive...

cath69 · Answer

Search Navipromo version 3.3.5 commencé le 13/11/2007 à 17:55:11,37

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 08.11.2007 à 18h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 


*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\Catherine Theiller\Application Data ***


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun fichier trouvé dans :

- C:\WINDOWS\system32
- C:\DOCUME~1\CATHER~1\LOCALS~1\APPLIC~1



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans C:\DOCUME~1\CATHER~1\LOCALS~1\APPLIC~1 *



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:
C:\WINDOWS\system32\kjjlm.bak2 trouvé ! infection Vundo possible non traitée par cet outil !

2)Recherche Heuristique :



3)Recherche Certificats :

Certificat Egroup absent !


*** Analyse terminée le 13/11/2007 à 17:55:51,85 ***

cath69 · Answer

SmitFraudFix v2.252

Rapport fait à 17:59:02,04, 13/11/2007
Executé à partir de C:\Documents and Settings\Catherine Theiller\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1	legal-at-spybot.info
127.0.0.1	www.legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Catherine Theiller


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Catherine Theiller\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CATHER~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte VIA PCI 10/100Mo Fast Ethernet - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.2.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{6DF7D03D-7185-4610-9D87-88A30506C4C7}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6DF7D03D-7185-4610-9D87-88A30506C4C7}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{6DF7D03D-7185-4610-9D87-88A30506C4C7}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

bien, refais un Smitfraud avec l'option 2 en mode sans échec.
postes le rapport.
---------------------
fais ceci ensuite:
recherches avec oad.exe
kjjlm
postes le rapport

cath69 · Answer

SmitFraudFix v2.252

Rapport fait à 19:54:18,01, 13/11/2007
Executé à partir de C:\Documents and Settings\Catherine Theiller\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost
127.0.0.1	007guard.com
127.0.0.1	www.007guard.com
127.0.0.1	008i.com
127.0.0.1	008k.com
127.0.0.1	www.008k.com
127.0.0.1	00hq.com
127.0.0.1	www.00hq.com
127.0.0.1	010402.com
127.0.0.1	032439.com
127.0.0.1	www.032439.com
127.0.0.1	1001-search.info
127.0.0.1	www.1001-search.info
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	100sexlinks.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	123topsearch.com
127.0.0.1	www.123topsearch.com
127.0.0.1	132.com
127.0.0.1	www.132.com
127.0.0.1	136136.net
127.0.0.1	www.136136.net
127.0.0.1	139mm.com
127.0.0.1	www.139mm.com
127.0.0.1	163ns.com
127.0.0.1	www.163ns.com
127.0.0.1	171203.com
127.0.0.1	17-plus.com
127.0.0.1	1800searchonline.com
127.0.0.1	www.1800searchonline.com
127.0.0.1	180searchassistant.com
127.0.0.1	www.180searchassistant.com
127.0.0.1	180solutions.com
127.0.0.1	www.180solutions.com
127.0.0.1	181.365soft.info
127.0.0.1	www.181.365soft.info
127.0.0.1	1987324.com
127.0.0.1	www.1987324.com
127.0.0.1	1-domains-registrations.com
127.0.0.1	www.1-domains-registrations.com
127.0.0.1	1-extreme.biz
127.0.0.1	www.1-extreme.biz
127.0.0.1	1sexparty.com
127.0.0.1	www.1sexparty.com
127.0.0.1	1stantivirus.com
127.0.0.1	www.1stantivirus.com
127.0.0.1	1stpagehere.com
127.0.0.1	www.1stpagehere.com
127.0.0.1	1stsearchportal.com
127.0.0.1	www.1stsearchportal.com
127.0.0.1	2.82211.net
127.0.0.1	www.2006ooo.com
127.0.0.1	2007-download.com
127.0.0.1	www.2007-download.com
127.0.0.1	2020search.com
127.0.0.1	www.2020search.com
127.0.0.1	20x2p.com
127.0.0.1	24.365soft.info
127.0.0.1	www.24.365soft.info
127.0.0.1	24-7pharmacy.info
127.0.0.1	www.24-7pharmacy.info
127.0.0.1	24-7searching-and-more.com
127.0.0.1	www.24-7searching-and-more.com
127.0.0.1	24teen.com
127.0.0.1	www.24teen.com
127.0.0.1	2every.net
127.0.0.1	www.2every.net
127.0.0.1	2ndpower.com
127.0.0.1	2search.com
127.0.0.1	www.2search.com
127.0.0.1	2search.org
127.0.0.1	www.2search.org
127.0.0.1	2squared.com
127.0.0.1	www.2squared.com
127.0.0.1	3322.org
127.0.0.1	www.3322.org
127.0.0.1	365soft.info
127.0.0.1	36site.com
127.0.0.1	www.36site.com
127.0.0.1	3721.com
127.0.0.1	39-93.com
127.0.0.1	3abetterinternet.com
127.0.0.1	www.3abetterinternet.com
127.0.0.1	3bay.it
127.0.0.1	www.3bay.it
127.0.0.1	3ebay.it
127.0.0.1	www.3ebay.it
127.0.0.1	404dns.com
127.0.0.1	www.404dns.com
127.0.0.1	4199.com
127.0.0.1	www.4199.com
127.0.0.1	4corn.net
127.0.0.1	www.4corn.net
127.0.0.1	4ebay.it
127.0.0.1	www.4ebay.it
127.0.0.1	4klm.com
127.0.0.1	4repubblica.it
127.0.0.1	www.4repubblica.it
127.0.0.1	4softget.com
127.0.0.1	www.4softget.com
127.0.0.1	5iscali.it
127.0.0.1	www.5iscali.it
127.0.0.1	5repubblica.it
127.0.0.1	www.5repubblica.it
127.0.0.1	5starvideos.com
127.0.0.1	www.5starvideos.com
127.0.0.1	5tiscali.it
127.0.0.1	www.5tiscali.it
127.0.0.1	5zgmu7o20kt5d8yq.com
127.0.0.1	www.5zgmu7o20kt5d8yq.com
127.0.0.1	6iscali.it
127.0.0.1	www.6iscali.it
127.0.0.1	6sek.com
127.0.0.1	www.6sek.com
127.0.0.1	6tiscali.it
127.0.0.1	www.6tiscali.it
127.0.0.1	7322.com
127.0.0.1	www.7322.com
127.0.0.1	75tz.com
127.0.0.1	777search.com
127.0.0.1	www.777search.com
127.0.0.1	777top.com
127.0.0.1	www.777top.com
127.0.0.1	7939.com
127.0.0.1	www.7939.com
127.0.0.1	7search.com
127.0.0.1	www.7search.com
127.0.0.1	80gw6ry3i3x3qbrkwhxhw.032439.com
127.0.0.1	82211.net
127.0.0.1	8866.org
127.0.0.1	888.com
127.0.0.1	www.888.com
127.0.0.1	8ad.com
127.0.0.1	www.8ad.com
127.0.0.1	9505.com
127.0.0.1	www.9505.com
127.0.0.1	971searchbox.com
127.0.0.1	www.971searchbox.com
127.0.0.1	a.bestmanage.org
127.0.0.1	aaasexypics.com
127.0.0.1	aaawebfinder.com
127.0.0.1	www.aaawebfinder.com
127.0.0.1	aavc.com
127.0.0.1	abc-find.info
127.0.0.1	www.abc-find.info
127.0.0.1	abetterinternet.com
127.0.0.1	www.abetterinternet.com
127.0.0.1	abnetsoft.info
127.0.0.1	www.abnetsoft.info
127.0.0.1	aboutclicker.com
127.0.0.1	www.aboutclicker.com
127.0.0.1	abrp.net
127.0.0.1	www.abrp.net
127.0.0.1	absolutee.com
127.0.0.1	www.absolutee.com
127.0.0.1	abyssmedia.com
127.0.0.1	www.abyssmedia.com
127.0.0.1	ac66.cn
127.0.0.1	www.ac66.cn
127.0.0.1	access.Navinetwork.com
127.0.0.1	access.rapid-pass.net
127.0.0.1	accessactivexvideo.com
127.0.0.1	www.accessactivexvideo.com
127.0.0.1	accessclips.com
127.0.0.1	www.accessclips.com
127.0.0.1	access-dvd.com
127.0.0.1	www.access-dvd.com
127.0.0.1	accesskeygenerator.com
127.0.0.1	www.accesskeygenerator.com
127.0.0.1	accessorygeeks.com
127.0.0.1	www.accessorygeeks.com
127.0.0.1	accessthefuture.net
127.0.0.1	www.accessthefuture.net
127.0.0.1	accessvid.net
127.0.0.1	www.accessvid.net
127.0.0.1	acemedic.com
127.0.0.1	www.acemedic.com
127.0.0.1	ace-webmaster.com
127.0.0.1	www.ace-webmaster.com
127.0.0.1	acjp.com
127.0.0.1	acrobat-2007.com
127.0.0.1	www.acrobat-2007.com
127.0.0.1	acrobat-8.com
127.0.0.1	www.acrobat-8.com
127.0.0.1	acrobat-center.com
127.0.0.1	www.acrobat-center.com
127.0.0.1	acrobat-hq.com
127.0.0.1	www.acrobat-hq.com
127.0.0.1	acrobatreader-8.com
127.0.0.1	www.acrobatreader-8.com
127.0.0.1	acrobat-reader-8.de
127.0.0.1	www.acrobat-reader-8.de
127.0.0.1	acrobat-stop.com
127.0.0.1	www.acrobat-stop.com
127.0.0.1	actionbreastcancer.org
127.0.0.1	www.actionbreastcancer.org
127.0.0.1	activesearcher.info
127.0.0.1	www.activesearcher.info
127.0.0.1	activexaccessobject.com
127.0.0.1	www.activexaccessobject.com
127.0.0.1	activexaccessvideo.com
127.0.0.1	www.activexaccessvideo.com
127.0.0.1	activexemedia.com
127.0.0.1	www.activexemedia.com
127.0.0.1	activexmediaobject.com
127.0.0.1	www.activexmediaobject.com
127.0.0.1	activexmediapro.com
127.0.0.1	www.activexmediapro.com
127.0.0.1	activexmediasite.com
127.0.0.1	www.activexmediasite.com
127.0.0.1	activexmediasoftware.com
127.0.0.1	www.activexmediasoftware.com
127.0.0.1	activexmediasource.com
127.0.0.1	www.activexmediasource.com
127.0.0.1	activexmediatool.com
127.0.0.1	www.activexmediatool.com
127.0.0.1	activexmediatour.com
127.0.0.1	www.activexmediatour.com
127.0.0.1	activexsoftwares.com
127.0.0.1	www.activexsoftwares.com
127.0.0.1	activexsource.com
127.0.0.1	www.activexsource.com
127.0.0.1	activexupdate.com
127.0.0.1	www.activexupdate.com
127.0.0.1	activexvideo.com
127.0.0.1	www.activexvideo.com
127.0.0.1	activexvideotool.com
127.0.0.1	www.activexvideotool.com
127.0.0.1	ad.marketingsector.com
127.0.0.1	www.ad.marketingsector.com
127.0.0.1	ad.mokead.com
127.0.0.1	www.ad.mokead.com
127.0.0.1	ad.yieldmanager.com
127.0.0.1	www.ad.yieldmanager.com
127.0.0.1	ad25.com
127.0.0.1	ad45.com
127.0.0.1	ad77.com
127.0.0.1	ad86.com
127.0.0.1	adamsupportgroup.org
127.0.0.1	www.adamsupportgroup.org
127.0.0.1	adarmor.com
127.0.0.1	www.adarmor.com
127.0.0.1	adasearch.com
127.0.0.1	www.adasearch.com
127.0.0.1	adaware.cc
127.0.0.1	adawarenow.com
127.0.0.1	www.adawarenow.com
127.0.0.1	addictivetechnologies.com
127.0.0.1	www.addictivetechnologies.com
127.0.0.1	addictivetechnologies.net
127.0.0.1	www.addictivetechnologies.net
127.0.0.1	add-manager.com
127.0.0.1	www.add-manager.com
127.0.0.1	adgate.info
127.0.0.1	www.adgate.info
127.0.0.1	adipics.com
127.0.0.1	www.adipics.com
127.0.0.1	admin2cash.biz
127.0.0.1	www.admin2cash.biz
127.0.0.1	adnet-plus.com
127.0.0.1	adobe-download-now.com
127.0.0.1	adobe-downloads.com
127.0.0.1	www.adobe-downloads.com
127.0.0.1	adobe-reader-8.fr
127.0.0.1	www.adobe-reader-8.fr
127.0.0.1	adprotect.com
127.0.0.1	www.adprotect.com
127.0.0.1	ads.centralmedia.ws
127.0.0.1	ads.k8l.info
127.0.0.1	ads.kmpads.com
127.0.0.1	ads.marketingsector.com
127.0.0.1	ads.searchingbooth.com
127.0.0.1	ads.z-quest.com
127.0.0.1	ads183.com
127.0.0.1	www.ads183.com
127.0.0.1	adscontex.com
127.0.0.1	www.adscontex.com
127.0.0.1	adservices1.enhance.com
127.0.0.1	www.adservices1.enhance.com
127.0.0.1	adservs.com
127.0.0.1	adsextend.net
127.0.0.1	www.adsextend.net
127.0.0.1	adshttp.com
127.0.0.1	www.adshttp.com
127.0.0.1	adsonwww.com
127.0.0.1	www.adsonwww.com
127.0.0.1	adspics.com
127.0.0.1	www.adspics.com
127.0.0.1	adtrak.net
127.0.0.1	www.adtrak.net
127.0.0.1	adtrgt.com
127.0.0.1	adult777search.info
127.0.0.1	www.adult777search.info
127.0.0.1	adultan.com
127.0.0.1	www.adultan.com
127.0.0.1	adult-engine-search.com
127.0.0.1	www.adult-engine-search.com
127.0.0.1	adult-erotic-guide.net
127.0.0.1	www.adult-erotic-guide.net
127.0.0.1	adultfilmsite.com
127.0.0.1	www.adultfilmsite.com
127.0.0.1	adult-friends-finder.net
127.0.0.1	www.adult-friends-finder.net
127.0.0.1	adultgambling.org
127.0.0.1	adult-host.org
127.0.0.1	adulthyperlinks.com
127.0.0.1	www.adulthyperlinks.com
127.0.0.1	adultmovieplus.com
127.0.0.1	www.adultmovieplus.com
127.0.0.1	adult-personal.us
127.0.0.1	adultsgames.net
127.0.0.1	adultsper.com
127.0.0.1	www.adultsper.com
127.0.0.1	adulttds.com
127.0.0.1	www.adulttds.com
127.0.0.1	adultzoneworld.com
127.0.0.1	www.adultzoneworld.com
127.0.0.1	advcash.biz
127.0.0.1	www.advcash.biz
127.0.0.1	advert.exaccess.ru
127.0.0.1	advertisemoney.info
127.0.0.1	www.advertisemoney.info
127.0.0.1	advertising.paltalk.com
127.0.0.1	advertising-money.info
127.0.0.1	www.advertising-money.info
127.0.0.1	ad-ware.cc
127.0.0.1	ad-w-a-r-e.com
127.0.0.1	www.ad-w-a-r-e.com
127.0.0.1	a-d-w-a-r-e.com
127.0.0.1	www.a-d-w-a-r-e.com
127.0.0.1	adwarebazooka.com
127.0.0.1	www.adwarebazooka.com
127.0.0.1	adwarefinder.com
127.0.0.1	www.adwarefinder.com
127.0.0.1	adwareprotectionsite.com
127.0.0.1	www.adwareprotectionsite.com
127.0.0.1	adwarepunisher.com
127.0.0.1	www.adwarepunisher.com
127.0.0.1	aflgate.com
127.0.0.1	www.aflgate.com
127.0.0.1	africaspromise.org
127.0.0.1	agava.com
127.0.0.1	agava.ru
127.0.0.1	agentstudio.com
127.0.0.1	aginegialle.it
127.0.0.1	www.aginegialle.it
127.0.0.1	www.aifind.info
127.0.0.1	aifind.info
127.0.0.1	airtleworld.com
127.0.0.1	www.airtleworld.com
127.0.0.1	aitalia.it
127.0.0.1	www.aitalia.it
127.0.0.1	akamai.downloadv3.com
127.0.0.1	aklitalia.it
127.0.0.1	www.aklitalia.it
127.0.0.1	akril.com
127.0.0.1	alcatel.ws
127.0.0.1	alfacleaner.com
127.0.0.1	www.alfacleaner.com
127.0.0.1	alfa-search.com
127.0.0.1	alialia.it
127.0.0.1	www.alialia.it
127.0.0.1	aliotalia.it
127.0.0.1	www.aliotalia.it
127.0.0.1	alirtalia.it
127.0.0.1	www.alirtalia.it
127.0.0.1	alitaia.it
127.0.0.1	www.alitaia.it
127.0.0.1	alitaklia.it
127.0.0.1	www.alitaklia.it
127.0.0.1	alitala.it
127.0.0.1	www.alitala.it
127.0.0.1	alitali.it
127.0.0.1	www.alitali.it
127.0.0.1	alitaliaq.it
127.0.0.1	www.alitaliaq.it
127.0.0.1	alitalias.it
127.0.0.1	www.alitalias.it
127.0.0.1	alitaliaz.it
127.0.0.1	www.alitaliaz.it
127.0.0.1	alitalioa.it
127.0.0.1	www.alitalioa.it
127.0.0.1	alitalisa.it
127.0.0.1	www.alitalisa.it
127.0.0.1	alitaliua.it
127.0.0.1	www.alitaliua.it
127.0.0.1	alitalkia.it
127.0.0.1	www.alitalkia.it
127.0.0.1	alitaloia.it
127.0.0.1	www.alitaloia.it
127.0.0.1	alitaluia.it
127.0.0.1	www.alitaluia.it
127.0.0.1	alitaslia.it
127.0.0.1	www.alitaslia.it
127.0.0.1	alitlia.it
127.0.0.1	www.alitlia.it
127.0.0.1	alitralia.it
127.0.0.1	www.alitralia.it
127.0.0.1	alitsalia.it
127.0.0.1	www.alitsalia.it
127.0.0.1	aliutalia.it
127.0.0.1	www.aliutalia.it
127.0.0.1	ALL1COUNT.NET
127.0.0.1	www.ALL1COUNT.NET
127.0.0.1	all4internet.com
127.0.0.1	www.all4internet.com
127.0.0.1	allabtcars.com
127.0.0.1	allabtjeeps.com
127.0.0.1	all-bittorrent.com
127.0.0.1	www.all-bittorrent.com
127.0.0.1	www.allcybersearch.com
127.0.0.1	allcybersearch.com
127.0.0.1	alldnserrors.com
127.0.0.1	www.alldnserrors.com
127.0.0.1	all-downloads-now.com
127.0.0.1	www.all-downloads-now.com
127.0.0.1	all-edonkey.com
127.0.0.1	www.all-edonkey.com
127.0.0.1	allforadult.com
127.0.0.1	allhyperlinks.com
127.0.0.1	alliesecurity.com
127.0.0.1	www.alliesecurity.com
127.0.0.1	all-inet.com
127.0.0.1	allinternetbusiness.com
127.0.0.1	all-limewire.com
127.0.0.1	www.all-limewire.com
127.0.0.1	allmegabucks.com
127.0.0.1	www.allmegabucks.com
127.0.0.1	allprotections.com
127.0.0.1	www.allprotections.com
127.0.0.1	allresultz.net
127.0.0.1	www.allresultz.net
127.0.0.1	allsecuritynotes.com
127.0.0.1	www.allsecuritynotes.com
127.0.0.1	allsecuritysite.com
127.0.0.1	www.allsecuritysite.com
127.0.0.1	allstarsvideos.net
127.0.0.1	www.allstarsvideos.net
127.0.0.1	alltruesoftware.com
127.0.0.1	www.alltruesoftware.com
127.0.0.1	allvideoactivex.com
127.0.0.1	www.allvideoactivex.com
127.0.0.1	almanah.biz
127.0.0.1	www.almanah.biz
127.0.0.1	almarvideos.com
127.0.0.1	aloitalia.it
127.0.0.1	www.aloitalia.it
127.0.0.1	aluitalia.it
127.0.0.1	www.aluitalia.it
127.0.0.1	amaena.com
127.0.0.1	www.amaena.com
127.0.0.1	amandamountains.com
127.0.0.1	amateurliveshow.com
127.0.0.1	www.amateurliveshow.com
127.0.0.1	amediasoftware.com
127.0.0.1	www.amediasoftware.com
127.0.0.1	amediasource.com
127.0.0.1	www.amediasource.com
127.0.0.1	americancarbargains.com
127.0.0.1	www.americancarbargains.com
127.0.0.1	american-teens.net
127.0.0.1	amigeek.com
127.0.0.1	amisbusiness.com
127.0.0.1	ampmsearch.com
127.0.0.1	www.ampmsearch.com
127.0.0.1	analcord.com
127.0.0.1	www.analcord.com
127.0.0.1	analmovi.com
127.0.0.1	anarchylolita.com
127.0.0.1	www.anarchylolita.com
127.0.0.1	anarchyporn.com
127.0.0.1	andromedical.com
127.0.0.1	www.andromedical.com
127.0.0.1	animepornmag.com
127.0.0.1	www.animepornmag.com
127.0.0.1	anin.org
127.0.0.1	anjpn-avxiz.biz
127.0.0.1	www.anjpn-avxiz.biz
127.0.0.1	anjpnzqav.biz
127.0.0.1	www.anjpnzqav.biz
127.0.0.1	anjpn-zqav.biz
127.0.0.1	www.anjpn-zqav.biz
127.0.0.1	annaromeo.com
127.0.0.1	antiddos.us
127.0.0.1	www.antiddos.us
127.0.0.1	Antiespiadorado.com
127.0.0.1	www.Antiespiadorado.com
127.0.0.1	Antiespionspack.com
127.0.0.1	www.Antiespionspack.com
127.0.0.1	Antigusanos2008.com
127.0.0.1	www.Antigusanos2008.com
127.0.0.1	Antispionage.com
127.0.0.1	www.Antispionage.com
127.0.0.1	Antispionagepro.com
127.0.0.1	www.Antispionagepro.com
127.0.0.1	antispydns.biz
127.0.0.1	www.antispydns.biz
127.0.0.1	antispylab.com
127.0.0.1	www.antispylab.com
127.0.0.1	antispysolutions.com
127.0.0.1	www.antispysolutions.com
127.0.0.1	antispyware.com
127.0.0.1	www.antispyware.com
127.0.0.1	antispywarebot.com
127.0.0.1	www.antispywarebot.com
127.0.0.1	antispywarebox.com
127.0.0.1	www.antispywarebox.com
127.0.0.1	antispywaredownloads.com
127.0.0.1	www.antispywaredownloads.com
127.0.0.1	Antispywaresuite.com
127.0.0.1	www.Antispywaresuite.com
127.0.0.1	Antispyweb.net
127.0.0.1	www.Antispyweb.net
127.0.0.1	Antiver2008.com
127.0.0.1	www.Antiver2008.com
127.0.0.1	antivermins.com
127.0.0.1	www.antivermins.com
127.0.0.1	anti-vermins.com
127.0.0.1	www.anti-vermins.com
127.0.0.1	antivir2007.com
127.0.0.1	www.antivir2007.com
127.0.0.1	antivirgear.com
127.0.0.1	www.antivirgear.com
127.0.0.1	antivirus.fastfreedownload.com
127.0.0.1	www.antivirus.fastfreedownload.com
127.0.0.1	antivirusgolden.com
127.0.0.1	www.antivirusgolden.com
127.0.0.1	antivirus-hq.net
127.0.0.1	www.antivirus-hq.net
127.0.0.1	anti-virus-pro.com
127.0.0.1	www.anti-virus-pro.com
127.0.0.1	antivirusprotector.com
127.0.0.1	www.antivirusprotector.com
127.0.0.1	antivirussecuritypro.com
127.0.0.1	www.antivirussecuritypro.com
127.0.0.1	antivirus-stop.com
127.0.0.1	www.antivirus-stop.com
127.0.0.1	Antiworm2008.com
127.0.0.1	www.Antiworm2008.com
127.0.0.1	Antiwurm2008.com
127.0.0.1	www.Antiwurm2008.com
127.0.0.1	antrocity.com
127.0.0.1	anyofus.com
127.0.0.1	www.anyofus.com
127.0.0.1	anysn.seproger.com
127.0.0.1	www.anysn.seproger.com
127.0.0.1	anything4health.com
127.0.0.1	apicpreview.com
127.0.0.1	www.apicpreview.com
127.0.0.1	appealcircuit.com
127.0.0.1	www.appealcircuit.com
127.0.0.1	approvedlinks.com
127.0.0.1	www.approvedlinks.com
127.0.0.1	apps.deskwizz.com
127.0.0.1	apps.webservicehost.com
127.0.0.1	aprotectedpage.com
127.0.0.1	www.aprotectedpage.com
127.0.0.1	apsua.com
127.0.0.1	archiviosex.net
127.0.0.1	www.archiviosex.net
127.0.0.1	aregay.com
127.0.0.1	ares-freebie.com
127.0.0.1	www.ares-freebie.com
127.0.0.1	arespro2007.com
127.0.0.1	www.arespro2007.com
127.0.0.1	aresultra.com
127.0.0.1	www.aresultra.com
127.0.0.1	ares-usa.com
127.0.0.1	www.ares-usa.com
127.0.0.1	arheo.com
127.0.0.1	arizonaweb.org
127.0.0.1	armitageinn.com
127.0.0.1	arquivojpgs.smtp.ru
127.0.0.1	www.arquivojpgs.smtp.ru
127.0.0.1	artachnid.com
127.0.0.1	art-func.com
127.0.0.1	art-xxx.com
127.0.0.1	asafebrowser.com
127.0.0.1	www.asafebrowser.com
127.0.0.1	asafetynotice.com
127.0.0.1	www.asafetynotice.com
127.0.0.1	asafetypage.com
127.0.0.1	www.asafetypage.com
127.0.0.1	asdbiz.biz
127.0.0.1	www.asdbiz.biz
127.0.0.1	asdeykuddq.com
127.0.0.1	www.asdeykuddq.com
127.0.0.1	asecurebar.com
127.0.0.1	www.asecurebar.com
127.0.0.1	asecureboard.com
127.0.0.1	www.asecureboard.com
127.0.0.1	asecurevalue.com
127.0.0.1	www.asecurevalue.com
127.0.0.1	asecurityissue.com
127.0.0.1	www.asecurityissue.com
127.0.0.1	asecuritynotice.com
127.0.0.1	www.asecuritynotice.com
127.0.0.1	asecuritypaper.com
127.0.0.1	www.asecuritypaper.com
127.0.0.1	asecuritystuff.com
127.0.0.1	www.asecuritystuff.com
127.0.0.1	asiankingkong.com
127.0.0.1	asianpornmag.com
127.0.0.1	www.asianpornmag.com
127.0.0.1	asiantoolbar.com
127.0.0.1	www.asiantoolbar.com
127.0.0.1	asidseiupc.com
127.0.0.1	www.asidseiupc.com
127.0.0.1	aslitalia.it
127.0.0.1	www.aslitalia.it
127.0.0.1	ass-gals.com
127.0.0.1	assureprotection.com
127.0.0.1	www.assureprotection.com
127.0.0.1	asta-killer.com
127.0.0.1	asupereva.it
127.0.0.1	www.asupereva.it
127.0.0.1	athenrye.com
127.0.0.1	atotalsafety.com
127.0.0.1	www.atotalsafety.com
127.0.0.1	atrueprotection.com
127.0.0.1	www.atrueprotection.com
127.0.0.1	atruesecurity.com
127.0.0.1	www.atruesecurity.com
127.0.0.1	attackware.com
127.0.0.1	www.attackware.com
127.0.0.1	attrezzi.biz
127.0.0.1	www.attrezzi.biz
127.0.0.1	aulde.net
127.0.0.1	www.aulde.net
127.0.0.1	aupereva.it
127.0.0.1	www.aupereva.it
127.0.0.1	autocontext.begun.ru
127.0.0.1	www.autocontext.begun.ru
127.0.0.1	autoescrowpay.com
127.0.0.1	avast.free-software-center.com
127.0.0.1	www.avast.free-software-center.com
127.0.0.1	avast-2007.com
127.0.0.1	www.avast-2007.com
127.0.0.1	avast-downloads.com
127.0.0.1	www.avast-downloads.com
127.0.0.1	avast-hq.com
127.0.0.1	www.avast-hq.com
127.0.0.1	avforce.com
127.0.0.1	www.avforce.com
127.0.0.1	avg.grab-it-today.net
127.0.0.1	www.avg.grab-it-today.net
127.0.0.1	avg.softwarecenterz.com
127.0.0.1	www.avg.softwarecenterz.com
127.0.0.1	avg-secure.com
127.0.0.1	www.avg-secure.com
127.0.0.1	avian-ads.com
127.0.0.1	avideoaxaccess.com
127.0.0.1	www.avideoaxaccess.com
127.0.0.1	avideosurfer.com
127.0.0.1	www.avideosurfer.com
127.0.0.1	aviewersoft.com
127.0.0.1	www.aviewersoft.com
127.0.0.1	avpcheckupdate.com
127.0.0.1	www.avpcheckupdate.com
127.0.0.1	avxizaaqada.biz
127.0.0.1	www.avxizaaqada.biz
127.0.0.1	avxiz-anjpn.biz
127.0.0.1	www.avxiz-anjpn.biz
127.0.0.1	avxizueorn.biz
127.0.0.1	www.avxizueorn.biz
127.0.0.1	avxiz-ueorn.biz
127.0.0.1	www.avxiz-ueorn.biz
127.0.0.1	avxiz-vtvcp.biz
127.0.0.1	www.avxiz-vtvcp.biz
127.0.0.1	avxiz-ygco.biz
127.0.0.1	www.avxiz-ygco.biz
127.0.0.1	avxiz-zqav.biz
127.0.0.1	www.avxiz-zqav.biz
127.0.0.1	awarninglist.com
127.0.0.1	www.awarninglist.com
127.0.0.1	awbeta.net-nucleus.com
127.0.0.1	awesomehomepage.com
127.0.0.1	www.awesomehomepage.com
127.0.0.1	awmcash.biz
127.0.0.1	awmdabest.com
127.0.0.1	axemediasoftware.com
127.0.0.1	www.axemediasoftware.com
127.0.0.1	aximageobject.com
127.0.0.1	www.aximageobject.com
127.0.0.1	axmediaproject.com
127.0.0.1	www.axmediaproject.com
127.0.0.1	axmediasoftware.com
127.0.0.1	www.axmediasoftware.com
127.0.0.1	axmediasolutions.com
127.0.0.1	www.axmediasolutions.com
127.0.0.1	axobjectpage.com
127.0.0.1	www.axobjectpage.com
127.0.0.1	axobjectsource.com
127.0.0.1	www.axobjectsource.com
127.0.0.1	axsoftwaretool.com
127.0.0.1	www.axsoftwaretool.com
127.0.0.1	axvideoproject.com
127.0.0.1	www.axvideoproject.com
127.0.0.1	axvideosetup.com
127.0.0.1	www.axvideosetup.com
127.0.0.1	ayakawamura.com
127.0.0.1	ayb.dns-look-up.com
127.0.0.1	ayb.netbios-wait.com
127.0.0.1	ayumitaniguchi.com
127.0.0.1	azebar.com
127.0.0.1	azureusclub.com
127.0.0.1	www.azureusclub.com
127.0.0.1	azureus-freebie.com
127.0.0.1	www.azureus-freebie.com
127.0.0.1	azzetta.it
127.0.0.1	www.azzetta.it
127.0.0.1	b.casalemedia.com
127.0.0.1	babe.k-lined.com
127.0.0.1	www.babe.k-lined.com
127.0.0.1	babe.the-killer.bz
127.0.0.1	www.babe.the-killer.bz
127.0.0.1	babenet.com
127.0.0.1	www.babenet.com
127.0.0.1	babespornmag.com
127.0.0.1	www.babespornmag.com
127.0.0.1	babeweb.de
127.0.0.1	www.babeweb.de
127.0.0.1	baccarat-other.info
127.0.0.1	www.baccarat-other.info
127.0.0.1	Backstripgirls.com
127.0.0.1	www.Backstripgirls.com
127.0.0.1	backup.mabou.org
127.0.0.1	balotierra.com
127.0.0.1	www.balotierra.com
127.0.0.1	bannedhost.net
127.0.0.1	barbudafarms.com
127.0.0.1	bardownload.com
127.0.0.1	www.bardownload.com
127.0.0.1	barnandfence.com
127.0.0.1	batsearch.com
127.0.0.1	baygraphicsllc.com
127.0.0.1	bbbsearch.com
127.0.0.1	bb-search.com
127.0.0.1	bdsmlibrary.net
127.0.0.1	bdsmpornmag.com
127.0.0.1	www.bdsmpornmag.com
127.0.0.1	bearshare.download-me.info
127.0.0.1	www.bearshare.download-me.info
127.0.0.1	bearshare.mp3-muzic.com
127.0.0.1	www.bearshare.mp3-muzic.com
127.0.0.1	bearshare-download.org
127.0.0.1	www.bearshare-download.org
127.0.0.1	bearshare-downloads.net
127.0.0.1	www.bearshare-downloads.net
127.0.0.1	bearsharelive.co.uk
127.0.0.1	www.bearsharelive.co.uk
127.0.0.1	bearshare-music-downloads.com
127.0.0.1	www.bearshare-music-downloads.com
127.0.0.1	bearsharepro2007.com
127.0.0.1	www.bearsharepro2007.com
127.0.0.1	bearshare-usa.com
127.0.0.1	www.bearshare-usa.com
127.0.0.1	bedhome.com
127.0.0.1	bediadance.com
127.0.0.1	beebappyy.biz
127.0.0.1	www.beebappyy.biz
127.0.0.1	begin2search.com
127.0.0.1	www.begin2search.com
127.0.0.1	bellabasketsfl.com
127.0.0.1	bernaolatwin.com
127.0.0.1	best-counter.com
127.0.0.1	bestcrawler.com
127.0.0.1	bestfor.ru
127.0.0.1	best-hardpics.com
127.0.0.1	bestmanage.org
127.0.0.1	www.bestmanage.org
127.0.0.1	bestmanage0.org
127.0.0.1	www.bestmanage0.org
127.0.0.1	bestmanage1.org
127.0.0.1	www.bestmanage1.org
127.0.0.1	bestmanage2.org
127.0.0.1	www.bestmanage2.org
127.0.0.1	bestmanage3.org
127.0.0.1	www.bestmanage3.org
127.0.0.1	bestmanage4.org
127.0.0.1	www.bestmanage4.org
127.0.0.1	bestmanage5.org
127.0.0.1	www.bestmanage5.org
127.0.0.1	bestmanage6.org
127.0.0.1	www.bestmanage6.org
127.0.0.1	bestmanage7.org
127.0.0.1	www.bestmanage7.org
127.0.0.1	bestmanage8.org
127.0.0.1	www.bestmanage8.org
127.0.0.1	bestmanage9.org
127.0.0.1	www.bestmanage9.org
127.0.0.1	bestporngate.com
127.0.0.1	bestsafetyguide.net
127.0.0.1	www.bestsafetyguide.net
127.0.0.1	best-spyware.info
127.0.0.1	www.best-spyware.info
127.0.0.1	best-targeted-traffic.com
127.0.0.1	www.best-targeted-traffic.com
127.0.0.1	best-voyeur.info
127.0.0.1	www.best-voyeur.info
127.0.0.1	bestweblinks.com
127.0.0.1	best-winning-casino.com
127.0.0.1	bestworldgirls-for-u.net
127.0.0.1	www.bestworldgirls-for-u.net
127.0.0.1	bestxporno.com
127.0.0.1	bettersearch.biz
127.0.0.1	www.bettersearch.biz
127.0.0.1	bgazzetta.it
127.0.0.1	www.bgazzetta.it
127.0.0.1	bgoogle.it
127.0.0.1	www.bgoogle.it
127.0.0.1	bigtrafficnetwork.com
127.0.0.1	www.bigtrafficnetwork.com
127.0.0.1	bigwww.com
127.0.0.1	www.bigwww.com
127.0.0.1	bin.errorprotector.com
127.0.0.1	bins.media-motor.net
127.0.0.1	bins2.media-motor.net
127.0.0.1	bis.180solutions.com
127.0.0.1	bitchesonline.net
127.0.0.1	bitcomet-freebie.com
127.0.0.1	www.bitcomet-freebie.com
127.0.0.1	biz.biz
127.0.0.1	blackblues00.com
127.0.0.1	www.blackblues00.com
127.0.0.1	blackhats.tc
127.0.0.1	www.blackhats.tc
127.0.0.1	blackhawksoftware.com
127.0.0.1	www.blackhawksoftware.com
127.0.0.1	blackjack-free.net
127.0.0.1	blazefind.com
127.0.0.1	blender.xu.pl
127.0.0.1	blondetgp.com
127.0.0.1	blue-elefant.com
127.0.0.1	www.blue-elefant.com
127.0.0.1	bm.theaimonline.com
127.0.0.1	www.bm.theaimonline.com
127.0.0.1	bnmgate.com
127.0.0.1	www.bnmgate.com
127.0.0.1	bodaciousbabette.com
127.0.0.1	bonzi.com
127.0.0.1	www.bonzi.com
127.0.0.1	boobdoll.com
127.0.0.1	boobsandtits.com
127.0.0.1	boobsclub.com
127.0.0.1	bookedspace.com
127.0.0.1	www.bookedspace.com
127.0.0.1	boom.com.vn
127.0.0.1	www.boom.com.vn
127.0.0.1	boredlife.com
127.0.0.1	bowlofogumbo.com
127.0.0.1	bpfq02.com
127.0.0.1	www.bpfq02.com
127.0.0.1	bqgate.com
127.0.0.1	www.bqgate.com
127.0.0.1	br.errorsafe.com
127.0.0.1	br.winantivirus.com
127.0.0.1	br.winfixer.com
127.0.0.1	bradcoem.org
127.0.0.1	braincodec.com
127.0.0.1	www.braincodec.com
127.0.0.1	brandiyoung.com
127.0.0.1	bravesentry.com
127.0.0.1	www.bravesentry.com
127.0.0.1	breenten.biz
127.0.0.1	www.breenten.biz
127.0.0.1	brodbfm.net
127.0.0.1	www.brodbfm.net
127.0.0.1	brookeburn.com
127.0.0.1	browserwise.com
127.0.0.1	www.browserwise.com
127.0.0.1	bucps.com
127.0.0.1	buhartes.info
127.0.0.1	buldog-stats.com
127.0.0.1	bullseye-network.com
127.0.0.1	www.bullseye-network.com
127.0.0.1	burgerkingbigscreen.com
127.0.0.1	burnsrecyclinginc.com
127.0.0.1	www.burnsrecyclinginc.com
127.0.0.1	buscards.net
127.0.0.1	bustyrussell.com
127.0.0.1	busysearch.net
127.0.0.1	www.busysearch.net
127.0.0.1	buttejazz.org
127.0.0.1	buy-find.info
127.0.0.1	www.buy-find.info
127.0.0.1	buyselldomain.net
127.0.0.1	buytraff.biz
127.0.0.1	www.buytraff.biz
127.0.0.1	buz.ru
127.0.0.1	bvirgilio.it
127.0.0.1	www.bvirgilio.it
127.0.0.1	c.centralmedia.ws
127.0.0.1	c.enhance.com
127.0.0.1	www.c.enhance.com
127.0.0.1	c.goclick.com
127.0.0.1	c4tdownload.com
127.0.0.1	www.c4tdownload.com
127.0.0.1	c5.www4free.info
127.0.0.1	www.c5.www4free.info
127.0.0.1	cache.surfaccuracy.com
127.0.0.1	www.cache.surfaccuracy.com
127.0.0.1	cache.ysbweb.com
127.0.0.1	calcioturris.com
127.0.0.1	calendaralerts.net
127.0.0.1	www.calendaralerts.net
127.0.0.1	cameouk.co.uk
127.0.0.1	www.cameouk.co.uk
127.0.0.1	cameup.com
127.0.0.1	camouflageclothingonline.net
127.0.0.1	www.camouflageclothingonline.net
127.0.0.1	camup.net
127.0.0.1	canberracricketcoaching.com
127.0.0.1	candycantaloupes.com
127.0.0.1	canidetect.org
127.0.0.1	www.canidetect.org
127.0.0.1	cantfind.com
127.0.0.1	www.cantfind.com
127.0.0.1	careers.dulcineasystems.net
127.0.0.1	carsands.com
127.0.0.1	carsrentals.net
127.0.0.1	cartoes.uol.com.br
127.0.0.1	casalemedia.com
127.0.0.1	www.casalemedia.com
127.0.0.1	cashdeluxe.net
127.0.0.1	www.cashdeluxe.net
127.0.0.1	cashengines.com
127.0.0.1	www.cashengines.com
127.0.0.1	cashsearch.biz
127.0.0.1	cashsurfers.com
127.0.0.1	www.cashsurfers.com
127.0.0.1	CashUnlim.com
127.0.0.1	www.CashUnlim.com
127.0.0.1	casino.com.free.game.pogo.gratisdownloads.nl
127.0.0.1	casino2win.net
127.0.0.1	casino-gambling-1.net
127.0.0.1	casino-gambling-2.net
127.0.0.1	casinomidas.net
127.0.0.1	casinonline.net
127.0.0.1	casino-onlines.net
127.0.0.1	castingsamateur.com
127.0.0.1	www.castingsamateur.com
127.0.0.1	catallogue.com
127.0.0.1	catch-dc.info
127.0.0.1	www.catch-dc.info
127.0.0.1	categories.mygeek.com
127.0.0.1	catsss.da.ru
127.0.0.1	caxa.ru
127.0.0.1	cc.panet.org
127.0.0.1	ccecaedbebfcaf.com
127.0.0.1	www.ccecaedbebfcaf.com
127.0.0.1	cclebali.org
127.0.0.1	ccorriere.it
127.0.0.1	www.ccorriere.it
127.0.0.1	cdegate.com
127.0.0.1	www.cdegate.com
127.0.0.1	cdn.drivecleaner.com
127.0.0.1	cdn.errorsafe.com
127.0.0.1	cdn.movies-etc.com
127.0.0.1	cdn.winsoftware.com
127.0.0.1	cdn2.movies-etc.com
127.0.0.1	cdorriere.it
127.0.0.1	www.cdorriere.it
127.0.0.1	ceewawires.org
127.0.0.1	centralmedia.ws
127.0.0.1	certumgroup.com
127.0.0.1	cforriere.it
127.0.0.1	www.cforriere.it
127.0.0.1	check.jupitersatellites.biz
127.0.0.1	www.check.jupitersatellites.biz
127.0.0.1	checkin100.com
127.0.0.1	www.checkin100.com
127.0.0.1	checkssecurity.com
127.0.0.1	www.checkssecurity.com
127.0.0.1	chelancatering.com
127.0.0.1	chenshijituan.com
127.0.0.1	www.chenshijituan.com
127.0.0.1	childrenvilla.com
127.0.0.1	chips-4-free.com
127.0.0.1	chrisswasey.com
127.0.0.1	chriswallace.net
127.0.0.1	cia-trjn.myvnc.com
127.0.0.1	www.cia-trjn.myvnc.com
127.0.0.1	ciorriere.it
127.0.0.1	www.ciorriere.it
127.0.0.1	cirriere.it
127.0.0.1	www.cirriere.it
127.0.0.1	ckick4thumbs.com
127.0.0.1	cl55.biz
127.0.0.1	clackamasliteraryreview.com
127.0.0.1	cleansoftwares.com
127.0.0.1	www.cleansoftwares.com
127.0.0.1	clearsearch.cc
127.0.0.1	clearsearch.net
127.0.0.1	clickaire.com
127.0.0.1	click-codec.com
127.0.0.1	www.click-codec.com
127.0.0.1	clickhere4search.com
127.0.0.1	www.clickhere4search.com
127.0.0.1	click-now.net
127.0.0.1	clickspring.net
127.0.0.1	www.clickspring.net
127.0.0.1	click-to-download.com
127.0.0.1	www.click-to-download.com
127.0.0.1	clicktomakeasearch.com
127.0.0.1	www.clicktomakeasearch.com
127.0.0.1	clickyestoenter.net
127.0.0.1	client.exeupdate.com
127.0.0.1	client.myadultexplorer.com
127.0.0.1	cliks.org
127.0.0.1	www.cliks.org
127.0.0.1	clorriere.it
127.0.0.1	www.clorriere.it
127.0.0.1	clrsch.com
127.0.0.1	clubxxxvideo.com
127.0.0.1	www.clubxxxvideo.com
127.0.0.1	clusif.free.fr
127.0.0.1	cmtapestry.com
127.0.0.1	cnetadd.com
127.0.0.1	www.cnetadd.com
127.0.0.1	cnzz.com
127.0.0.1	www.cnzz.com
127.0.0.1	code.ignphrases.com
127.0.0.1	codec.ninoa.com
127.0.0.1	codecdvd.net
127.0.0.1	www.codecdvd.net
127.0.0.1	codec-fun.com
127.0.0.1	www.codec-fun.com
127.0.0.1	codecsoft.net
127.0.0.1	www.codecsoft.net
127.0.0.1	codrriere.it
127.0.0.1	www.codrriere.it
127.0.0.1	coeriere.it
127.0.0.1	www.coeriere.it
127.0.0.1	coerriere.it
127.0.0.1	www.coerriere.it
127.0.0.1	cofrriere.it
127.0.0.1	www.cofrriere.it
127.0.0.1	cogrriere.it
127.0.0.1	www.cogrriere.it
127.0.0.1	coirriere.it
127.0.0.1	www.coirriere.it
127.0.0.1	command.adservs.com
127.0.0.1	www.commonname.com
127.0.0.1	computerpcgames.net
127.0.0.1	www.computerpcgames.net
127.0.0.1	computerrecover.com
127.0.0.1	www.computerrecover.com
127.0.0.1	config.180solutions.com
127.0.0.1	content.dollarrevenue.com
127.0.0.1	www.content.dollarrevenue.com
127.0.0.1	content.ireit.com
127.0.0.1	www.content.ireit.com
127.0.0.1	content.onerateld.com
127.0.0.1	contentmatch.net
127.0.0.1	www.contentmatch.net
127.0.0.1	contra-virus.com
127.0.0.1	www.contra-virus.com
127.0.0.1	controlmeh.com
127.0.0.1	www.controlmeh.com
127.0.0.1	cooldeskalert.com
127.0.0.1	www.cooldeskalert.com
127.0.0.1	coolfetishsite.com
127.0.0.1	coolfreehost.com
127.0.0.1	coolfreepage.com
127.0.0.1	coolfreepages.com
127.0.0.1	cool-homepage.co
127.0.0.1	cool-homepage.com
127.0.0.1	coolmoneysearch.com
127.0.0.1	coolpornsearch.com
127.0.0.1	cool-search.net
127.0.0.1	cool-search.netfartpost.com
127.0.0.1	coolsearcher.info
127.0.0.1	coolservecorp.net
127.0.0.1	www.coolservecorp.net
127.0.0.1	coolwebsearch.com
127.0.0.1	www.coolwebsearch.com
127.0.0.1	cool-web-search.com
127.0.0.1	coolwebsearsh.com
127.0.0.1	coolwwwsearch.com
127.0.0.1	www.coolwwwsearch.com
127.0.0.1	cool-xxx.net
127.0.0.1	coorriere.it
127.0.0.1	www.coorriere.it
127.0.0.1	copmtraine.com
127.0.0.1	coprriere.it
127.0.0.1	www.coprriere.it
127.0.0.1	core.psyche-evolution.com
127.0.0.1	www.core.psyche-evolution.com
127.0.0.1	coreiere.it
127.0.0.1	www.coreiere.it
127.0.0.1	coreriere.it
127.0.0.1	www.coreriere.it
127.0.0.1	corrdiere.it
127.0.0.1	www.corrdiere.it
127.0.0.1	correiere.it
127.0.0.1	www.correiere.it
127.0.0.1	corrfiere.it
127.0.0.1	www.corrfiere.it
127.0.0.1	corrgiere.it
127.0.0.1	www.corrgiere.it
127.0.0.1	corridere.it
127.0.0.1	www.corridere.it
127.0.0.1	corriedre.it
127.0.0.1	www.corriedre.it
127.0.0.1	corriee.it
127.0.0.1	www.corriee.it
127.0.0.1	corrieere.it
127.0.0.1	www.corrieere.it
127.0.0.1	corriefre.it
127.0.0.1	www.corriefre.it
127.0.0.1	corriegre.it
127.0.0.1	www.corriegre.it
127.0.0.1	corrierde.it
127.0.0.1	www.corrierde.it
127.0.0.1	corriered.it
127.0.0.1	www.corriered.it
127.0.0.1	corrieree.it
127.0.0.1	www.corrieree.it
127.0.0.1	corrieref.it
127.0.0.1	www.corrieref.it
127.0.0.1	corrierer.it
127.0.0.1	www.corrierer.it
127.0.0.1	corrieres.it
127.0.0.1	www.corrieres.it
127.0.0.1	corrierew.it
127.0.0.1	www.corrierew.it
127.0.0.1	corrierfe.it
127.0.0.1	www.corrierfe.it
127.0.0.1	corrierge.it
127.0.0.1	www.corrierge.it
127.0.0.1	corrierr.it
127.0.0.1	www.corrierr.it
127.0.0.1	corrierre.it
127.0.0.1	www.corrierre.it
127.0.0.1	corrierse.it
127.0.0.1	www.corrierse.it
127.0.0.1	corrierte.it
127.0.0.1	www.corrierte.it
127.0.0.1	corrierw.it
127.0.0.1	www.corrierw.it
127.0.0.1	corrierwe.it
127.0.0.1	www.corrierwe.it
127.0.0.1	corriesre.it
127.0.0.1	www.corriesre.it
127.0.0.1	corriete.it
127.0.0.1	www.corriete.it
127.0.0.1	corrietre.it
127.0.0.1	www.corrietre.it
127.0.0.1	corriewre.it
127.0.0.1	www.corriewre.it
127.0.0.1	corrifere.it
127.0.0.1	www.corrifere.it
127.0.0.1	corriiere.it
127.0.0.1	www.corriiere.it
127.0.0.1	corrilere.it
127.0.0.1	www.corrilere.it
127.0.0.1	corrioere.it
127.0.0.1	www.corrioere.it
127.0.0.1	corrire.it
127.0.0.1	www.corrire.it
127.0.0.1	corrirere.it
127.0.0.1	www.corrirere.it
127.0.0.1	corrirre.it
127.0.0.1	www.corrirre.it
127.0.0.1	corrisere.it
127.0.0.1	www.corrisere.it
127.0.0.1	corriuere.it
127.0.0.1	www.corriuere.it
127.0.0.1	corriwere.it
127.0.0.1	www.corriwere.it
127.0.0.1	corriwre.it
127.0.0.1	www.corriwre.it
127.0.0.1	corrliere.it
127.0.0.1	www.corrliere.it
127.0.0.1	corroere.it
127.0.0.1	www.corroere.it
127.0.0.1	corroiere.it
127.0.0.1	www.corroiere.it
127.0.0.1	corrriere.it
127.0.0.1	www.corrriere.it
127.0.0.1	corrtiere.it
127.0.0.1	www.corrtiere.it
127.0.0.1	corruere.it
127.0.0.1	www.corruere.it
127.0.0.1	corruiere.it
127.0.0.1	www.corruiere.it
127.0.0.1	cortiere.it
127.0.0.1	www.cortiere.it
127.0.0.1	cortriere.it
127.0.0.1	www.cortriere.it
127.0.0.1	costrike.com
127.0.0.1	www.costrike.com
127.0.0.1	cotriere.it
127.0.0.1	www.cotriere.it
127.0.0.1	cotrriere.it
127.0.0.1	www.cotrriere.it
127.0.0.1	couldnotfind.com
127.0.0.1	count.cc
127.0.0.1	count.hitscount.net
127.0.0.1	count-all.com
127.0.0.1	countdutycall.info
127.0.0.1	www.countdutycall.info
127.0.0.1	counter.sexmaniack.com
127.0.0.1	cporriere.it
127.0.0.1	www.cporriere.it
127.0.0.1	cprriere.it
127.0.0.1	www.cprriere.it
127.0.0.1	cpvfeed.com
127.0.0.1	cracks.me.uk
127.0.0.1	cracks4all.com
127.0.0.1	www.cracks4all.com
127.0.0.1	crapsgold.info
127.0.0.1	www.crapsgold.info
127.0.0.1	Crazygirls-world.com
127.0.0.1	crazywinnings.com
127.0.0.1	www.crazywinnings.com
127.0.0.1	creamedcutties.com
127.0.0.1	createaccesskey.com
127.0.0.1	www.createaccesskey.com
127.0.0.1	creditsearchonline.com
127.0.0.1	crestring.com
127.0.0.1	crooder.com
127.0.0.1	crriere.it
127.0.0.1	www.crriere.it
127.0.0.1	crystalysmedia.com
127.0.0.1	www.crystalysmedia.com
127.0.0.1	csx.adservs.com
127.0.0.1	www.csx.adservs.com
127.0.0.1	cts.180solutions.com
127.0.0.1	cuisinartoven.com
127.0.0.1	www.cuisinartoven.com
127.0.0.1	curedc.info
127.0.0.1	www.curedc.info
127.0.0.1	curepcsolutions.com
127.0.0.1	www.curepcsolutions.com
127.0.0.1	curvedspaces.com
127.0.0.1	cutadult.com
127.0.0.1	www.cutadult.com
127.0.0.1	cvirgilio.it
127.0.0.1	www.cvirgilio.it
127.0.0.1	cvorriere.it
127.0.0.1	www.cvorriere.it
127.0.0.1	cvs.jps.ru
127.0.0.1	cvsymphony.com
127.0.0.1	cxorriere.it
127.0.0.1	www.cxorriere.it
127.0.0.1	cyberrape.com
127.0.0.1	www.cyberrape.com
127.0.0.1	cydom.com
127.0.0.1	cydoor.com
127.0.0.1	www.cydoor.com
127.0.0.1	daily-gals.com
127.0.0.1	dailypornmag.com
127.0.0.1	www.dailypornmag.com
127.0.0.1	dailyteenspic.com
127.0.0.1	dailytoolbar.com
127.0.0.1	www.dailytoolbar.com
127.0.0.1	dancingbabycd.com
127.0.0.1	data-hoster.com
127.0.0.1	www.data-hoster.com
127.0.0.1	datanotary.com
127.0.0.1	datareco.com
127.0.0.1	dating-galaxy.info
127.0.0.1	www.dating-galaxy.info
127.0.0.1	dating-search.net
127.0.0.1	davemarshall.org
127.0.0.1	db105.com
127.0.0.1	dbdecicated.com
127.0.0.1	www.dbdecicated.com
127.0.0.1	dbxcompany.com
127.0.0.1	www.dbxcompany.com
127.0.0.1	dcdl.dmcast.com
127.0.0.1	dcfitusa.com
127.0.0.1	dcorriere.it
127.0.0.1	www.dcorriere.it
127.0.0.1	dcurtis.com
127.0.0.1	www.dcurtis.com
127.0.0.1	dcww.dmcast.com
127.0.0.1	de.ag
127.0.0.1	de.drivecleaner.com
127.0.0.1	de.errorsafe.com
127.0.0.1	de.winantivirus.com
127.0.0.1	de98.remsys.org
127.0.0.1	debay.it
127.0.0.1	www.debay.it
127.0.0.1	dedmazay.3322.org
127.0.0.1	dedsearch.com
127.0.0.1	www.dedsearch.com
127.0.0.1	defaultsearch.net
127.0.0.1	Defensaantimalware.com
127.0.0.1	www.Defensaantimalware.com
127.0.0.1	deja-rue.com
127.0.0.1	www.deja-rue.com
127.0.0.1	derklaif.biz
127.0.0.1	www.derklaif.biz
127.0.0.1	derrari.it
127.0.0.1	www.derrari.it
127.0.0.1	desarrollocreativo.com
127.0.0.1	deskbar.worldtostart.com
127.0.0.1	www.deskbar.worldtostart.com
127.0.0.1	deskwizz.com
127.0.0.1	www.deskwizz.com
127.0.0.1	dev.ntcor.com
127.0.0.1	develip.com
127.0.0.1	dewis.spb.ru
127.0.0.1	dewis.us
127.0.0.1	df809jow4wj2304lfd0sf9fsd0a2t4ldf809jow4wj2304lfd0sf9fsd0a2t4ld.biz
127.0.0.1	dgbusiness.com
127.0.0.1	www.dgbusiness.com
127.0.0.1	dialer2004.com
127.0.0.1	dialerclub.com
127.0.0.1	www.dialerclub.com
127.0.0.1	dialer-shop.com
127.0.0.1	www.dialer-shop.com
127.0.0.1	dialoff.com
127.0.0.1	www.dialoff.com
127.0.0.1	did.i-used.cc
127.0.0.1	www.did.i-used.cc
127.0.0.1	dietpills4free.com
127.0.0.1	dietpussy.com
127.0.0.1	digikeygen.com
127.0.0.1	www.digikeygen.com
127.0.0.1	digistreamsa.com
127.0.0.1	digitalcoders.net
127.0.0.1	www.digitalcoders.net
127.0.0.1	www.digitalfan.com
127.0.0.1	digital-pornography.com
127.0.0.1	dionforvalleycouncil.org
127.0.0.1	directdvdpro.com
127.0.0.1	www.directdvdpro.com
127.0.0.1	directporta.info
127.0.0.1	www.directporta.info
127.0.0.1	directsearchzone.com
127.0.0.1	www.directsearchzone.com
127.0.0.1	dist.checkin100.com
127.0.0.1	dl.ad-ware.cc
127.0.0.1	dl.malwarewipe.com
127.0.0.1	dl.targetsaver.com
127.0.0.1	www.dl.targetsaver.com
127.0.0.1	dl.web-nexus.net
127.0.0.1	dl1.antivermins.com
127.0.0.1	dl1.antivirgear.com
127.0.0.1	dl1.spydawn.com
127.0.0.1	dl1.virusprotectpro.com
127.0.0.1	dl10.spyfalcon.com
127.0.0.1	dl16.spyfalcon.com
127.0.0.1	dl2.spyfalcon.com
127.0.0.1	dl2.spyheal.com
127.0.0.1	dl2.spywarestrike.com
127.0.0.1	dl3.spyfalcon.com
127.0.0.1	dl3.spyheal.com
127.0.0.1	dl3.spywarestrike.com
127.0.0.1	dl4.spyfalcon.com
127.0.0.1	dl4.spywarestrike.com
127.0.0.1	dl5.spyfalcon.com
127.0.0.1	dl5.spywarestrike.com
127.0.0.1	dl6.spywarestrike.com
127.0.0.1	dl7.spywarestrike.com
127.0.0.1	dl8.spyheal.com
127.0.0.1	dl8.spywarestrike.com
127.0.0.1	dl9.spyfalcon.com
127.0.0.1	dmcast.com
127.0.0.1	www.dmcast.com
127.0.0.1	dnaads.com
127.0.0.1	www.dnaads.com
127.0.0.1	dnl.mabou.org
127.0.0.1	dns-look-up.com
127.0.0.1	www.dns-look-up.com
127.0.0.1	doctorwaldron.com
127.0.0.1	document-not-found.pornpic.org
127.0.0.1	doggyaction.com
127.0.0.1	dogproblemswebsite.com
127.0.0.1	www.dogproblemswebsite.com
127.0.0.1	doktorxxx.com
127.0.0.1	dollarrevenue.com
127.0.0.1	domaincar.com
127.0.0.1	www.domaincar.com
127.0.0.1	domains2003.net
127.0.0.1	domains-for-you-online.com
127.0.0.1	domain-your-registration.com
127.0.0.1	domkrat.com
127.0.0.1	dotcomtoolbar.com
127.0.0.1	www.dotcomtoolbar.com
127.0.0.1	down.136136.net
127.0.0.1	download.abetterinternet.com
127.0.0.1	download.antispywarebot.com
127.0.0.1	www.download.antispywarebot.com
127.0.0.1	download.bardownload.com
127.0.0.1	www.download.bardownload.com
127.0.0.1	download.bravesentry.com
127.0.0.1	www.download.bravesentry.com
127.0.0.1	download.cdn.drivecleaner.com
127.0.0.1	download.cdn.errorsafe.com
127.0.0.1	download.cdn.winsoftware.com
127.0.0.1	download.errorsafe.com
127.0.0.1	download.jupitersatellites.biz
127.0.0.1	www.download.jupitersatellites.biz
127.0.0.1	download.searchtabs.net
127.0.0.1	download.secureyournet.biz
127.0.0.1	www.download.secureyournet.biz
127.0.0.1	download.spyonthis.net
127.0.0.1	download.spy-shredder.com
127.0.0.1	download.systemdoctor.com
127.0.0.1	download.winantispyware.com
127.0.0.1	download.winantivirus.com
127.0.0.1	download.windrivecleaner.com
127.0.0.1	download.winfixer.com
127.0.0.1	download10.spywarequake.com
127.0.0.1	download11.spywarequake.com
127.0.0.1	download12.spywarequake.com
127.0.0.1	download13.spywarequake.com
127.0.0.1	download15.spywarequake.com
127.0.0.1	download2.spywarequake.com
127.0.0.1	download-2007.com
127.0.0.1	www.download-2007.com
127.0.0.1	download3.spyaxe.com
127.0.0.1	download3.spywarequake.com
127.0.0.1	download4.spyaxe.com
127.0.0.1	download4.spywarequake.com
127.0.0.1	download5.spyaxe.com
127.0.0.1	download5.spywarequake.com
127.0.0.1	download6.spyaxe.com
127.0.0.1	download7.spywarequake.com
127.0.0.1	download8.spywarequake.com
127.0.0.1	download9.spywarequake.com
127.0.0.1	download-ad-aware.com
127.0.0.1	www.download-ad-aware.com
127.0.0.1	download-all-4-free.com
127.0.0.1	www.download-all-4-free.com
127.0.0.1	download-all-area.com
127.0.0.1	www.download-all-area.com
127.0.0.1	download-antivir.com
127.0.0.1	www.download-antivir.com
127.0.0.1	downloadanysong.com
127.0.0.1	www.downloadanysong.com
127.0.0.1	download-avast.com
127.0.0.1	www.download-avast.com
127.0.0.1	downloadcorporation.com
127.0.0.1	www.downloadcorporation.com
127.0.0.1	download-dvdshrink.com
127.0.0.1	www.download-dvdshrink.com
127.0.0.1	download-for-free.net
127.0.0.1	www.download-for-free.net
127.0.0.1	downloadfreesoft.com
127.0.0.1	www.downloadfreesoft.com
127.0.0.1	downloadfreeway.com
127.0.0.1	www.downloadfreeway.com
127.0.0.1	downloadimesh.com
127.0.0.1	www.downloadimesh.com
127.0.0.1	download-itunes-now.com
127.0.0.1	www.download-itunes-now.com
127.0.0.1	download-limewire.org
127.0.0.1	www.download-limewire.org
127.0.0.1	downloadlost.tv
127.0.0.1	www.downloadlost.tv
127.0.0.1	downloadmax.net
127.0.0.1	www.downloadmax.net
127.0.0.1	download-mcafee.com
127.0.0.1	www.download-mcafee.com
127.0.0.1	download-me.info
127.0.0.1	downloadmediaax.com
127.0.0.1	www.downloadmediaax.com
127.0.0.1	downloadpics.net
127.0.0.1	www.downloadpics.net
127.0.0.1	download-real-player.com
127.0.0.1	www.download-real-player.com
127.0.0.1	downloads.180solutions.com
127.0.0.1	downloads.adaware.cc
127.0.0.1	downloadservicearea.com
127.0.0.1	www.downloadservicearea.com
127.0.0.1	downloads-free.org
127.0.0.1	www.downloads-free.org
127.0.0.1	downloadsglobe.com
127.0.0.1	www.downloadsglobe.com
127.0.0.1	download-this.us
127.0.0.1	www.download-this.us
127.0.0.1	download-trillian.com
127.0.0.1	www.download-trillian.com
127.0.0.1	downloadv3.com
127.0.0.1	www.downloadv3.com
127.0.0.1	downloadvax.com
127.0.0.1	www.downloadvax.com
127.0.0.1	download-windvd.com
127.0.0.1	www.download-windvd.com
127.0.0.1	download-winrar.com
127.0.0.1	www.download-winrar.com
127.0.0.1	downloadwizard.com
127.0.0.1	downloadzcenter.com
127.0.0.1	downloadzcentral.com
127.0.0.1	downloadzfree.com
127.0.0.1	www.downloadzfree.com
127.0.0.1	downloadznow.net
127.0.0.1	download-zone-free.com
127.0.0.1	www.download-zone-free.com
127.0.0.1	download-zone-free.net
127.0.0.1	www.download-zone-free.net
127.0.0.1	dp-host.com
127.0.0.1	dr.mcboo.com
127.0.0.1	dr.webhancer.com
127.0.0.1	www.dr.webhancer.com
127.0.0.1	dr2.webhancer.com
127.0.0.1	www.dr2.webhancer.com
127.0.0.1	dr38.mcboo.com
127.0.0.1	dr47.mcboo.com
127.0.0.1	dragqueen.gay-clan.com
127.0.0.1	drepubblica.it
127.0.0.1	www.drepubblica.it
127.0.0.1	drivecleaner.com
127.0.0.1	www.drivecleaner.com
127.0.0.1	drivecleanr.com
127.0.0.1	www.drivecleanr.com
127.0.0.1	drocherway.com
127.0.0.1	dropspam.com
127.0.0.1	www.dropspam.com
127.0.0.1	drug-sources-exposed.com
127.0.0.1	drvvv.com
127.0.0.1	dsupereva.it
127.0.0.1	www.dsupereva.it
127.0.0.1	dtlproduct.com
127.0.0.1	www.dtlproduct.com
127.0.0.1	dudu.com
127.0.0.1	www.dudu.com
127.0.0.1	dulcineasystems.net
127.0.0.1	dumpserv.com
127.0.0.1	duolaimi.net
127.0.0.1	dutch-sex.com
127.0.0.1	dvdaccess.net
127.0.0.1	www.dvdaccess.net
127.0.0.1	dvdbank.org
127.0.0.1	dvdcodec.net
127.0.0.1	www.dvdcodec.net
127.0.0.1	dvdsmovies.net
127.0.0.1	www.dvdsmovies.net
127.0.0.1	dvdsvideos.net
127.0.0.1	www.dvdsvideos.net
127.0.0.1	dvdtocdsite.com
127.0.0.1	www.dvdtocdsite.com
127.0.0.1	dynamique.drivecleaner.com
127.0.0.1	e3bay.it
127.0.0.1	www.e3bay.it
127.0.0.1	e4bay.it
127.0.0.1	www.e4bay.it
127.0.0.1	eager-sex.com
127.0.0.1	earthllnk.net
127.0.0.1	www.earthllnk.net
127.0.0.1	eases.net
127.0.0.1	easyantispy.com
127.0.0.1	easybestdeals.com
127.0.0.1	www.easybestdeals.com
127.0.0.1	easycategories.com
127.0.0.1	easymp3musicnow.com
127.0.0.1	www.easymp3musicnow.com
127.0.0.1	easy-pharmacy.info
127.0.0.1	www.easy-pharmacy.info
127.0.0.1	easy-search.net
127.0.0.1	easysearch4you.com
127.0.0.1	www.easysearch4you.com
127.0.0.1	easysearchingtips.com
127.0.0.1	easyspyware.com
127.0.0.1	www.easyspyware.com
127.0.0.1	easywww.info
127.0.0.1	www.easywww.info
127.0.0.1	eba6y.it
127.0.0.1	www.eba6y.it
127.0.0.1	eba7y.it
127.0.0.1	www.eba7y.it
127.0.0.1	ebaay.it
127.0.0.1	www.ebaay.it
127.0.0.1	ebagy.it
127.0.0.1	www.ebagy.it
127.0.0.1	ebahy.it
127.0.0.1	www.ebahy.it
127.0.0.1	ebajy.it
127.0.0.1	www.ebajy.it
127.0.0.1	ebaqy.it
127.0.0.1	www.ebaqy.it
127.0.0.1	ebasy.it
127.0.0.1	www.ebasy.it
127.0.0.1	ebaty.it
127.0.0.1	www.ebaty.it
127.0.0.1	ebauy.it
127.0.0.1	www.ebauy.it
127.0.0.1	ebav.com
127.0.0.1	ebaw.com
127.0.0.1	ebawy.it
127.0.0.1	www.ebawy.it
127.0.0.1	ebaxy.it
127.0.0.1	www.ebaxy.it
127.0.0.1	ebay6.it
127.0.0.1	www.ebay6.it
127.0.0.1	ebay7.it
127.0.0.1	www.ebay7.it
127.0.0.1	ebayg.it
127.0.0.1	www.ebayg.it
127.0.0.1	ebayh.it
127.0.0.1	www.ebayh.it
127.0.0.1	ebayj.it
127.0.0.1	www.ebayj.it
127.0.0.1	ebayt.it
127.0.0.1	www.ebayt.it
127.0.0.1	ebayu.it
127.0.0.1	www.ebayu.it
127.0.0.1	ebazy.it
127.0.0.1	www.ebazy.it
127.0.0.1	ebch.com
127.0.0.1	ebdv.com
127.0.0.1	ebdw.com
127.0.0.1	ebestfind.org
127.0.0.1	www.ebestfind.org
127.0.0.1	ebgay.it
127.0.0.1	www.ebgay.it
127.0.0.1	ebgo.com
127.0.0.1	ebhay.it
127.0.0.1	www.ebhay.it
127.0.0.1	ebjp.com
127.0.0.1	ebkb.com
127.0.0.1	ebkn.com
127.0.0.1	ebky.com
127.0.0.1	eblv.com
127.0.0.1	ebmu.com
127.0.0.1	ebnay.it
127.0.0.1	www.ebnay.it
127.0.0.1	ebony-pornmag.com
127.0.0.1	www.ebony-pornmag.com
127.0.0.1	ebonypornmag.com
127.0.0.1	www.ebonypornmag.com
127.0.0.1	ebqay.it
127.0.0.1	www.ebqay.it
127.0.0.1	ebsay.it
127.0.0.1	www.ebsay.it
127.0.0.1	ebsy.it
127.0.0.1	www.ebsy.it
127.0.0.1	ebvay.it
127.0.0.1	www.ebvay.it
127.0.0.1	ebvr.com
127.0.0.1	ebway.it
127.0.0.1	www.ebway.it
127.0.0.1	ebxay.it
127.0.0.1	www.ebxay.it
127.0.0.1	ebzay.it
127.0.0.1	www.ebzay.it
127.0.0.1	ecmh.com
127.0.0.1	ecmp.com
127.0.0.1	ecosrioplatenses.org
127.0.0.1	ecpm.com
127.0.0.1	ecstasyporn.net
127.0.0.1	ecwz.com
127.0.0.1	ecyb.com
127.0.0.1	edbay.it
127.0.0.1	www.edbay.it
127.0.0.1	edhq.com
127.0.0.1	edietprogram.com
127.0.0.1	www.edietprogram.com
127.0.0.1	edty.com
127.0.0.1	eduy.com
127.0.0.1	eebay.it
127.0.0.1	www.eebay.it
127.0.0.1	eeev.com
127.0.0.1	eepubblica.it
127.0.0.1	www.eepubblica.it
127.0.0.1	efbay.it
127.0.0.1	www.efbay.it
127.0.0.1	egbay.it
127.0.0.1	www.egbay.it
127.0.0.1	ehbay.it
127.0.0.1	www.ehbay.it
127.0.0.1	eikokoike.com
127.0.0.1	elitecodec.com
127.0.0.1	www.elitecodec.com
127.0.0.1	elitemediagroup.net
127.0.0.1	www.elitemediagroup.net
127.0.0.1	e-localad.com
127.0.0.1	emailicon.org
127.0.0.1	www.emailicon.org
127.0.0.1	emch.com
127.0.0.1	emcodec.com
127.0.0.1	www.emcodec.com
127.0.0.1	emediacodec.com
127.0.0.1	www.emediacodec.com
127.0.0.1	emule.mp3-muzic.com
127.0.0.1	www.emule.mp3-muzic.com
127.0.0.1	emuledownloadhome.com
127.0.0.1	www.emuledownloadhome.com
127.0.0.1	emule-freebie.com
127.0.0.1	www.emule-freebie.com
127.0.0.1	enay.it
127.0.0.1	www.enay.it
127.0.0.1	enbay.it
127.0.0.1	www.enbay.it
127.0.0.1	energy-factor.com
127.0.0.1	www.energy-factor.com
127.0.0.1	engineplay.com
127.0.0.1	www.engineplay.com
127.0.0.1	engine-ticket.com
127.0.0.1	www.engine-ticket.com
127.0.0.1	enhance.com
127.0.0.1	www.enhance.com
127.0.0.1	enhancevideos.com
127.0.0.1	www.enhancevideos.com
127.0.0.1	enitinvest.net
127.0.0.1	enjoywebsurf.com
127.0.0.1	entertainsite.net
127.0.0.1	www.entertainsite.net
127.0.0.1	enterthesearch.com
127.0.0.1	www.enterthesearch.com
127.0.0.1	e-plus.cc
127.0.0.1	epornsex.com
127.0.0.1	eprotectionline.com
127.0.0.1	www.eprotectionline.com
127.0.0.1	eprotectpage.com
127.0.0.1	www.eprotectpage.com
127.0.0.1	erbay.it
127.0.0.1	www.erbay.it
127.0.0.1	erepubblica.it
127.0.0.1	www.erepubblica.it
127.0.0.1	ergosites.com
127.0.0.1	erossoalice.it
127.0.0.1	www.erossoalice.it
127.0.0.1	errari.it
127.0.0.1	www.errari.it
127.0.0.1	error404site.com
127.0.0.1	www.error404site.com
127.0.0.1	error404site.net
127.0.0.1	www.error404site.net
127.0.0.1	errorkiller.com
127.0.0.1	www.errorkiller.com
127.0.0.1	errorprotector.com
127.0.0.1	www.errorprotector.com
127.0.0.1	errorsafe.com
127.0.0.1	www.errorsafe.com
127.0.0.1	errorsdns.com
127.0.0.1	www.errorsdns.com
127.0.0.1	ert0003.e76.163ns.com
127.0.0.1	ertikadeswiokinganfujas.com
127.0.0.1	www.ertikadeswiokinganfujas.com
127.0.0.1	es.winantivirus.com
127.0.0.1	es0-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es1-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es2-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es3-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es4-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es5-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es6-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es7-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es8-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es9-www.5zgmu7o20kt5d8yq.com
127.0.0.1	esafetylist.com
127.0.0.1	www.esafetylist.com
127.0.0.1	esafetypage.com
127.0.0.1	www.esafetypage.com
127.0.0.1	esbay.it
127.0.0.1	www.esbay.it
127.0.0.1	esearch2005.com
127.0.0.1	www.esearch2005.com
127.0.0.1	esecuritynote.com
127.0.0.1	www.esecuritynote.com
127.0.0.1	esecuritypage.com
127.0.0.1	www.esecuritypage.com
127.0.0.1	esupereva.it
127.0.0.1	www.esupereva.it
127.0.0.1	etomi.all-downloads-now.com
127.0.0.1	www.etomi.all-downloads-now.com
127.0.0.1	eupdatepage.com
127.0.0.1	www.eupdatepage.com
127.0.0.1	euuu.com
127.0.0.1	evbay.it
127.0.0.1	www.evbay.it
127.0.0.1	evidence-detector.biz
127.0.0.1	evilspidercomics.com
127.0.0.1	evko.biz
127.0.0.1	www.evko.biz
127.0.0.1	ewbay.it
127.0.0.1	www.ewbay.it
127.0.0.1	ewebsearch.net
127.0.0.1	e-websitesolutions.com
127.0.0.1	ewizard.cc
127.0.0.1	exaccess.ru
127.0.0.1	www.exaccess.ru
127.0.0.1	excellentsckin.com
127.0.0.1	exeupdate.com
127.0.0.1	www.exeupdate.com
127.0.0.1	exflow.org
127.0.0.1	www.exflow.org
127.0.0.1	exit.megago.com
127.0.0.1	expandvideo.com
127.0.0.1	www.expandvideo.com
127.0.0.1	exportplay.com
127.0.0.1	www.exportplay.com
127.0.0.1	extremepaidsurveys.com
127.0.0.1	www.extremepaidsurveys.com
127.0.0.1	extremeseek.net
127.0.0.1	eza1netsearch.com
127.0.0.1	www.eza1netsearch.com
127.0.0.1	ezcybersearch.com
127.0.0.1	www.ezcybersearch.com
127.0.0.1	ez-searching.com
127.0.0.1	ezwebsearching.com
127.0.0.1	www.ezwebsearching.com
127.0.0.1	f1.bestmanage.org
127.0.0.1	f1.truth-is-out-there.org
127.0.0.1	f1organizer.com
127.0.0.1	www.f1organizer.com
127.0.0.1	f2.bestmanage.org
127.0.0.1	f2.truth-is-out-there.org
127.0.0.1	f3.bestmanage.org
127.0.0.1	f3.truth-is-out-there.org
127.0.0.1	f4.bestmanage.org
127.0.0.1	f4.truth-is-out-there.org
127.0.0.1	f5.bestmanage.org
127.0.0.1	f5.truth-is-out-there.org
127.0.0.1	f6.bestmanage.org
127.0.0.1	f7.bestmanage.org
127.0.0.1	f7.truth-is-out-there.org
127.0.0.1	f8.bestmanage.org
127.0.0.1	f8.truth-is-out-there.org
127.0.0.1	f9.bestmanage.org
127.0.0.1	f9.truth-is-out-there.org
127.0.0.1	fairsearcher.com
127.0.0.1	www.fairsearcher.com
127.0.0.1	faithstevens.com
127.0.0.1	fantasiewelten.com
127.0.0.1	farmacept32.phpnet.us
127.0.0.1	farmsteadbandb.com
127.0.0.1	farse.com
127.0.0.1	fartpost.com
127.0.0.1	fastfreedownload.com
127.0.0.1	fastmetasearch.com
127.0.0.1	www.fastmetasearch.com
127.0.0.1	fastssearch.com
127.0.0.1	www.fastssearch.com
127.0.0.1	fastwebfinder.com
127.0.0.1	faxporn.com
127.0.0.1	fazzetta.it
127.0.0.1	www.fazzetta.it
127.0.0.1	fcorriere.it
127.0.0.1	www.fcorriere.it
127.0.0.1	featured-results.com
127.0.0.1	febay.it
127.0.0.1	www.febay.it
127.0.0.1	feed.dedsearch.com
127.0.0.1	feeds.2search.com
127.0.0.1	www.feeds.2search.com
127.0.0.1	feeds2.2search.org
127.0.0.1	www.feeds2.2search.org
127.0.0.1	ferraeri.it
127.0.0.1	www.ferraeri.it
127.0.0.1	ferrai.it
127.0.0.1	www.ferrai.it
127.0.0.1	ferrarei.it
127.0.0.1	www.ferrarei.it
127.0.0.1	ferrarti.it
127.0.0.1	www.ferrarti.it
127.0.0.1	ferrasri.it
127.0.0.1	www.ferrasri.it
127.0.0.1	ferratri.it
127.0.0.1	www.ferratri.it
127.0.0.1	ferreari.it
127.0.0.1	www.ferreari.it
127.0.0.1	ferrri.it
127.0.0.1	www.ferrri.it
127.0.0.1	ferrsari.it
127.0.0.1	www.ferrsari.it
127.0.0.1	ferrtari.it
127.0.0.1	www.ferrtari.it
127.0.0.1	fetrrari.it
127.0.0.1	www.fetrrari.it
127.0.0.1	fgazzetta.it
127.0.0.1	www.fgazzetta.it
127.0.0.1	fgoogle.it
127.0.0.1	www.fgoogle.it
127.0.0.1	fhg.panet.org
127.0.0.1	fhgate.com
127.0.0.1	www.fhgate.com
127.0.0.1	fickenisgeil.de
127.0.0.1	file.unionsms.net
127.0.0.1	filestore.com
127.0.0.1	www.filestore.com
127.0.0.1	filetretporn.com
127.0.0.1	www.filetretporn.com
127.0.0.1	Filtrodetrojan.com
127.0.0.1	www.Filtrodetrojan.com
127.0.0.1	finalfantasyactionfigures.com
127.0.0.1	www.finalfantasyactionfigures.com
127.0.0.1	finance-loans.com
127.0.0.1	find4u.net
127.0.0.1	find-52.com
127.0.0.1	www.find-52.com
127.0.0.1	findanyshow.org
127.0.0.1	www.findanyshow.org
127.0.0.1	find-find-777.net
127.0.0.1	www.find-find-777.net
127.0.0.1	find-itnow.com
127.0.0.1	findit-now.com
127.0.0.1	findloss.com
127.0.0.1	findthesite.com
127.0.0.1	findthewebsiteyouneed.com
127.0.0.1	www.findthewebsiteyouneed.com
127.0.0.1	find-uk-health.co.uk
127.0.0.1	findwapsite.org
127.0.0.1	www.findwapsite.org
127.0.0.1	findwhatevernow.com
127.0.0.1	www.findwhatevernow.com
127.0.0.1	fined.biz
127.0.0.1	fine-search.net
127.0.0.1	fionasteel.com
127.0.0.1	firefoxdownload-now.com
127.0.0.1	www.firefoxdownload-now.com
127.0.0.1	firehunt.com
127.0.0.1	www.firehunt.com
127.0.0.1	firgilio.it
127.0.0.1	www.firgilio.it
127.0.0.1	firstbookmark.net
127.0.0.1	firstgoodsearch.com
127.0.0.1	www.firstgoodsearch.com
127.0.0.1	fitness-free.com
127.0.0.1	fixerantispy.com
127.0.0.1	www.fixerantispy.com
127.0.0.1	fjsynebcod.com
127.0.0.1	www.fjsynebcod.com
127.0.0.1	flashdollars.com
127.0.0.1	www.flashdollars.com
127.0.0.1	flashflashmx.3322.org
127.0.0.1	floorsovertexas.com
127.0.0.1	www.floorsovertexas.com
127.0.0.1	floproject.com
127.0.0.1	www.floproject.com
127.0.0.1	flrxtools.greatnuke.com
127.0.0.1	flrx-tools.net
127.0.0.1	www.flrx-tools.net
127.0.0.1	fn777.greatbahamas.com
127.0.0.1	www.fn777.greatbahamas.com
127.0.0.1	foodvacations.net
127.0.0.1	forex.jps.ru
127.0.0.1	forexcredit.com
127.0.0.1	forexcredit.ru
127.0.0.1	formingfusions.com
127.0.0.1	forsythfire.net
127.0.0.1	forthline.com
127.0.0.1	foxmin.com
127.0.0.1	www.foxmin.com
127.0.0.1	fp.gad-network.com
127.0.0.1	fr.drivecleaner.com
127.0.0.1	www.fr.drivecleaner.com
127.0.0.1	fr.winantivirus.com
127.0.0.1	fr.winfixer.com
127.0.0.1	frame.crazywinnings.com
127.0.0.1	free4porno.net
127.0.0.1	free64all.com
127.0.0.1	free-adobe-download-support.com
127.0.0.1	www.free-adobe-download-support.com
127.0.0.1	free-avg.org
127.0.0.1	www.free-avg.org
127.0.0.1	free-avg-download.com
127.0.0.1	www.free-avg-download.com
127.0.0.1	free-bearshares.com
127.0.0.1	www.free-bearshares.com
127.0.0.1	freebookmark.net
127.0.0.1	freebookmarks.net
127.0.0.1	freecat.biz
127.0.0.1	www.freecat.biz
127.0.0.1	freecategories.com
127.0.0.1	free-chipes.com
127.0.0.1	freecj.com
127.0.0.1	freecoolhost.com
127.0.0.1	freedownloadhq.com
127.0.0.1	www.freedownloadhq.com
127.0.0.1	freedownloadpage.com
127.0.0.1	www.freedownloadpage.com
127.0.0.1	free-download-place.com
127.0.0.1	www.free-download-place.com
127.0.0.1	free-download-support.com
127.0.0.1	www.free-download-support.com
127.0.0.1	freedownloadzone.com
127.0.0.1	www.freedownloadzone.com
127.0.0.1	free-hit.com
127.0.0.1	freehqm

Utilisateur anonyme · Answer

Bien,  postes le rapport oad

cath69 · Answer

Ho ! qu'est ce que c'est tout ces "host" avec des sites sur lesquels je ne vais jamais ??? Qu'est-ce que celà veut dire ?

cath69 · Answer

13/11/2007 ---- 20:10:00,75  

----------------------------------
§§§§§§ [kjjlm ] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

Utilisateur anonyme · Answer

pas de panique....
ce que je trouve curieux c'est ceci:
127.0.0.1 df809jow4wj2304lfd0sf9fsd0a2t4ldf809jow4wj2304lfd0sf9fsd0a2t4ld.biz 
--------------------------------------
bien, normalement ton fichier Host est remis à zéro.


---------
fais ceci:
Tout d'abord, pour vous faciliter le travail, on va créer un raccourcis sur le Bureau pour éditer directement le fameux fichier host.
Clic droit sur le bureau à un emplacement vide !> Nouveau > Raccourci
Dans le champ "Emplacement" (ou "Cible"), coller ceci (tel quelle!)
"C:\Program Files\Windows NT\Accessoires\wordpad.exe" "C:\WINDOWS\system32\drivers\etc\hosts"
Donnez ensuite le nom; Host ou Editer mon Host
En cliquant sur le raccourcis , vous obtenez ceci:

# Copyright © 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
#
127.0.0.1 localhost
----------------------------------------------------------------------
https://leblogdeclaude.blogspot.com/2007/04/informatique-diter-son-fichier-host.html

cath69 · Answer

Voilà, j'espère avoir tout compris...

Utilisateur anonyme · Answer

En fait c'est pas chinois...
tu crées le nouveau raccourcis
tu colles ça dans le champs:
"C:\Program Files\Windows NT\Accessoires\wordpad.exe" "C:\WINDOWS\system32\drivers\etc\hosts" 
et hop tu clic sur le raccourcis et ton fichier host va s'éditer tout seul !
tu me le copies ici.

cath69 · Answer

# Copyright (c) 1993-1999 Microsoft Corp.
#
# Ceci est un exemple de fichier HOSTS utilisé par Microsoft TCP/IP
# pour Windows.
#
# Ce fichier contient les correspondances des adresses IP aux noms d'hôtes.
# Chaque entrée doit être sur une ligne propre. L'adresse IP doit être placée
# dans la première colonne, suivie par le nom d'hôte correspondant. L'adresse
# IP et le nom d'hôte doivent être séparés par au moins un espace.
#
# De plus, des commentaires (tels que celui-ci) peuvent être insérés sur des
# lignes propres ou après le nom d'ordinateur. Ils sont indiqué par le
# symbole '#'.
#
# Par exemple :
#
#      102.54.94.97     rhino.acme.com          # serveur source
#       38.25.63.10     x.acme.com              # hôte client x

127.0.0.1       localhost
# Start of entries inserted by Spybot - Search & Destroy
127.0.0.1	007guard.com
127.0.0.1	www.007guard.com
127.0.0.1	008i.com
127.0.0.1	008k.com
127.0.0.1	www.008k.com
127.0.0.1	00hq.com
127.0.0.1	www.00hq.com
127.0.0.1	010402.com
127.0.0.1	032439.com
127.0.0.1	www.032439.com
127.0.0.1	1001-search.info
127.0.0.1	www.1001-search.info
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	100sexlinks.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	123topsearch.com
127.0.0.1	www.123topsearch.com
127.0.0.1	132.com
127.0.0.1	www.132.com
127.0.0.1	136136.net
127.0.0.1	www.136136.net
127.0.0.1	139mm.com
127.0.0.1	www.139mm.com
127.0.0.1	163ns.com
127.0.0.1	www.163ns.com
127.0.0.1	171203.com
127.0.0.1	17-plus.com
127.0.0.1	1800searchonline.com
127.0.0.1	www.1800searchonline.com
127.0.0.1	180searchassistant.com
127.0.0.1	www.180searchassistant.com
127.0.0.1	180solutions.com
127.0.0.1	www.180solutions.com
127.0.0.1	181.365soft.info
127.0.0.1	www.181.365soft.info
127.0.0.1	1987324.com
127.0.0.1	www.1987324.com
127.0.0.1	1-domains-registrations.com
127.0.0.1	www.1-domains-registrations.com
127.0.0.1	1-extreme.biz
127.0.0.1	www.1-extreme.biz
127.0.0.1	1sexparty.com
127.0.0.1	www.1sexparty.com
127.0.0.1	1stantivirus.com
127.0.0.1	www.1stantivirus.com
127.0.0.1	1stpagehere.com
127.0.0.1	www.1stpagehere.com
127.0.0.1	1stsearchportal.com
127.0.0.1	www.1stsearchportal.com
127.0.0.1	2.82211.net
127.0.0.1	www.2006ooo.com
127.0.0.1	2007-download.com
127.0.0.1	www.2007-download.com
127.0.0.1	2020search.com
127.0.0.1	www.2020search.com
127.0.0.1	20x2p.com
127.0.0.1	24.365soft.info
127.0.0.1	www.24.365soft.info
127.0.0.1	24-7pharmacy.info
127.0.0.1	www.24-7pharmacy.info
127.0.0.1	24-7searching-and-more.com
127.0.0.1	www.24-7searching-and-more.com
127.0.0.1	24teen.com
127.0.0.1	www.24teen.com
127.0.0.1	2every.net
127.0.0.1	www.2every.net
127.0.0.1	2ndpower.com
127.0.0.1	2search.com
127.0.0.1	www.2search.com
127.0.0.1	2search.org
127.0.0.1	www.2search.org
127.0.0.1	2squared.com
127.0.0.1	www.2squared.com
127.0.0.1	3322.org
127.0.0.1	www.3322.org
127.0.0.1	365soft.info
127.0.0.1	36site.com
127.0.0.1	www.36site.com
127.0.0.1	3721.com
127.0.0.1	39-93.com
127.0.0.1	3abetterinternet.com
127.0.0.1	www.3abetterinternet.com
127.0.0.1	3bay.it
127.0.0.1	www.3bay.it
127.0.0.1	3ebay.it
127.0.0.1	www.3ebay.it
127.0.0.1	404dns.com
127.0.0.1	www.404dns.com
127.0.0.1	4199.com
127.0.0.1	www.4199.com
127.0.0.1	4corn.net
127.0.0.1	www.4corn.net
127.0.0.1	4ebay.it
127.0.0.1	www.4ebay.it
127.0.0.1	4klm.com
127.0.0.1	4repubblica.it
127.0.0.1	www.4repubblica.it
127.0.0.1	4softget.com
127.0.0.1	www.4softget.com
127.0.0.1	5iscali.it
127.0.0.1	www.5iscali.it
127.0.0.1	5repubblica.it
127.0.0.1	www.5repubblica.it
127.0.0.1	5starvideos.com
127.0.0.1	www.5starvideos.com
127.0.0.1	5tiscali.it
127.0.0.1	www.5tiscali.it
127.0.0.1	5zgmu7o20kt5d8yq.com
127.0.0.1	www.5zgmu7o20kt5d8yq.com
127.0.0.1	6iscali.it
127.0.0.1	www.6iscali.it
127.0.0.1	6sek.com
127.0.0.1	www.6sek.com
127.0.0.1	6tiscali.it
127.0.0.1	www.6tiscali.it
127.0.0.1	7322.com
127.0.0.1	www.7322.com
127.0.0.1	75tz.com
127.0.0.1	777search.com
127.0.0.1	www.777search.com
127.0.0.1	777top.com
127.0.0.1	www.777top.com
127.0.0.1	7939.com
127.0.0.1	www.7939.com
127.0.0.1	7search.com
127.0.0.1	www.7search.com
127.0.0.1	80gw6ry3i3x3qbrkwhxhw.032439.com
127.0.0.1	82211.net
127.0.0.1	8866.org
127.0.0.1	888.com
127.0.0.1	www.888.com
127.0.0.1	8ad.com
127.0.0.1	www.8ad.com
127.0.0.1	9505.com
127.0.0.1	www.9505.com
127.0.0.1	971searchbox.com
127.0.0.1	www.971searchbox.com
127.0.0.1	a.bestmanage.org
127.0.0.1	aaasexypics.com
127.0.0.1	aaawebfinder.com
127.0.0.1	www.aaawebfinder.com
127.0.0.1	aavc.com
127.0.0.1	abc-find.info
127.0.0.1	www.abc-find.info
127.0.0.1	abetterinternet.com
127.0.0.1	www.abetterinternet.com
127.0.0.1	abnetsoft.info
127.0.0.1	www.abnetsoft.info
127.0.0.1	aboutclicker.com
127.0.0.1	www.aboutclicker.com
127.0.0.1	abrp.net
127.0.0.1	www.abrp.net
127.0.0.1	absolutee.com
127.0.0.1	www.absolutee.com
127.0.0.1	abyssmedia.com
127.0.0.1	www.abyssmedia.com
127.0.0.1	ac66.cn
127.0.0.1	www.ac66.cn
127.0.0.1	access.Navinetwork.com
127.0.0.1	access.rapid-pass.net
127.0.0.1	accessactivexvideo.com
127.0.0.1	www.accessactivexvideo.com
127.0.0.1	accessclips.com
127.0.0.1	www.accessclips.com
127.0.0.1	access-dvd.com
127.0.0.1	www.access-dvd.com
127.0.0.1	accesskeygenerator.com
127.0.0.1	www.accesskeygenerator.com
127.0.0.1	accessorygeeks.com
127.0.0.1	www.accessorygeeks.com
127.0.0.1	accessthefuture.net
127.0.0.1	www.accessthefuture.net
127.0.0.1	accessvid.net
127.0.0.1	www.accessvid.net
127.0.0.1	acemedic.com
127.0.0.1	www.acemedic.com
127.0.0.1	ace-webmaster.com
127.0.0.1	www.ace-webmaster.com
127.0.0.1	acjp.com
127.0.0.1	acrobat-2007.com
127.0.0.1	www.acrobat-2007.com
127.0.0.1	acrobat-8.com
127.0.0.1	www.acrobat-8.com
127.0.0.1	acrobat-center.com
127.0.0.1	www.acrobat-center.com
127.0.0.1	acrobat-hq.com
127.0.0.1	www.acrobat-hq.com
127.0.0.1	acrobatreader-8.com
127.0.0.1	www.acrobatreader-8.com
127.0.0.1	acrobat-reader-8.de
127.0.0.1	www.acrobat-reader-8.de
127.0.0.1	acrobat-stop.com
127.0.0.1	www.acrobat-stop.com
127.0.0.1	actionbreastcancer.org
127.0.0.1	www.actionbreastcancer.org
127.0.0.1	activesearcher.info
127.0.0.1	www.activesearcher.info
127.0.0.1	activexaccessobject.com
127.0.0.1	www.activexaccessobject.com
127.0.0.1	activexaccessvideo.com
127.0.0.1	www.activexaccessvideo.com
127.0.0.1	activexemedia.com
127.0.0.1	www.activexemedia.com
127.0.0.1	activexmediaobject.com
127.0.0.1	www.activexmediaobject.com
127.0.0.1	activexmediapro.com
127.0.0.1	www.activexmediapro.com
127.0.0.1	activexmediasite.com
127.0.0.1	www.activexmediasite.com
127.0.0.1	activexmediasoftware.com
127.0.0.1	www.activexmediasoftware.com
127.0.0.1	activexmediasource.com
127.0.0.1	www.activexmediasource.com
127.0.0.1	activexmediatool.com
127.0.0.1	www.activexmediatool.com
127.0.0.1	activexmediatour.com
127.0.0.1	www.activexmediatour.com
127.0.0.1	activexsoftwares.com
127.0.0.1	www.activexsoftwares.com
127.0.0.1	activexsource.com
127.0.0.1	www.activexsource.com
127.0.0.1	activexupdate.com
127.0.0.1	www.activexupdate.com
127.0.0.1	activexvideo.com
127.0.0.1	www.activexvideo.com
127.0.0.1	activexvideotool.com
127.0.0.1	www.activexvideotool.com
127.0.0.1	ad.marketingsector.com
127.0.0.1	www.ad.marketingsector.com
127.0.0.1	ad.mokead.com
127.0.0.1	www.ad.mokead.com
127.0.0.1	ad.yieldmanager.com
127.0.0.1	www.ad.yieldmanager.com
127.0.0.1	ad25.com
127.0.0.1	ad45.com
127.0.0.1	ad77.com
127.0.0.1	ad86.com
127.0.0.1	adamsupportgroup.org
127.0.0.1	www.adamsupportgroup.org
127.0.0.1	adarmor.com
127.0.0.1	www.adarmor.com
127.0.0.1	adasearch.com
127.0.0.1	www.adasearch.com
127.0.0.1	adaware.cc
127.0.0.1	adawarenow.com
127.0.0.1	www.adawarenow.com
127.0.0.1	addictivetechnologies.com
127.0.0.1	www.addictivetechnologies.com
127.0.0.1	addictivetechnologies.net
127.0.0.1	www.addictivetechnologies.net
127.0.0.1	add-manager.com
127.0.0.1	www.add-manager.com
127.0.0.1	adgate.info
127.0.0.1	www.adgate.info
127.0.0.1	adipics.com
127.0.0.1	www.adipics.com
127.0.0.1	admin2cash.biz
127.0.0.1	www.admin2cash.biz
127.0.0.1	adnet-plus.com
127.0.0.1	adobe-download-now.com
127.0.0.1	adobe-downloads.com
127.0.0.1	www.adobe-downloads.com
127.0.0.1	adobe-reader-8.fr
127.0.0.1	www.adobe-reader-8.fr
127.0.0.1	adprotect.com
127.0.0.1	www.adprotect.com
127.0.0.1	ads.centralmedia.ws
127.0.0.1	ads.k8l.info
127.0.0.1	ads.kmpads.com
127.0.0.1	ads.marketingsector.com
127.0.0.1	ads.searchingbooth.com
127.0.0.1	ads.z-quest.com
127.0.0.1	ads183.com
127.0.0.1	www.ads183.com
127.0.0.1	adscontex.com
127.0.0.1	www.adscontex.com
127.0.0.1	adservices1.enhance.com
127.0.0.1	www.adservices1.enhance.com
127.0.0.1	adservs.com
127.0.0.1	adsextend.net
127.0.0.1	www.adsextend.net
127.0.0.1	adshttp.com
127.0.0.1	www.adshttp.com
127.0.0.1	adsonwww.com
127.0.0.1	www.adsonwww.com
127.0.0.1	adspics.com
127.0.0.1	www.adspics.com
127.0.0.1	adtrak.net
127.0.0.1	www.adtrak.net
127.0.0.1	adtrgt.com
127.0.0.1	adult777search.info
127.0.0.1	www.adult777search.info
127.0.0.1	adultan.com
127.0.0.1	www.adultan.com
127.0.0.1	adult-engine-search.com
127.0.0.1	www.adult-engine-search.com
127.0.0.1	adult-erotic-guide.net
127.0.0.1	www.adult-erotic-guide.net
127.0.0.1	adultfilmsite.com
127.0.0.1	www.adultfilmsite.com
127.0.0.1	adult-friends-finder.net
127.0.0.1	www.adult-friends-finder.net
127.0.0.1	adultgambling.org
127.0.0.1	adult-host.org
127.0.0.1	adulthyperlinks.com
127.0.0.1	www.adulthyperlinks.com
127.0.0.1	adultmovieplus.com
127.0.0.1	www.adultmovieplus.com
127.0.0.1	adult-personal.us
127.0.0.1	adultsgames.net
127.0.0.1	adultsper.com
127.0.0.1	www.adultsper.com
127.0.0.1	adulttds.com
127.0.0.1	www.adulttds.com
127.0.0.1	adultzoneworld.com
127.0.0.1	www.adultzoneworld.com
127.0.0.1	advcash.biz
127.0.0.1	www.advcash.biz
127.0.0.1	advert.exaccess.ru
127.0.0.1	advertisemoney.info
127.0.0.1	www.advertisemoney.info
127.0.0.1	advertising.paltalk.com
127.0.0.1	advertising-money.info
127.0.0.1	www.advertising-money.info
127.0.0.1	ad-ware.cc
127.0.0.1	ad-w-a-r-e.com
127.0.0.1	www.ad-w-a-r-e.com
127.0.0.1	a-d-w-a-r-e.com
127.0.0.1	www.a-d-w-a-r-e.com
127.0.0.1	adwarebazooka.com
127.0.0.1	www.adwarebazooka.com
127.0.0.1	adwarefinder.com
127.0.0.1	www.adwarefinder.com
127.0.0.1	adwareprotectionsite.com
127.0.0.1	www.adwareprotectionsite.com
127.0.0.1	adwarepunisher.com
127.0.0.1	www.adwarepunisher.com
127.0.0.1	aflgate.com
127.0.0.1	www.aflgate.com
127.0.0.1	africaspromise.org
127.0.0.1	agava.com
127.0.0.1	agava.ru
127.0.0.1	agentstudio.com
127.0.0.1	aginegialle.it
127.0.0.1	www.aginegialle.it
127.0.0.1	www.aifind.info
127.0.0.1	aifind.info
127.0.0.1	airtleworld.com
127.0.0.1	www.airtleworld.com
127.0.0.1	aitalia.it
127.0.0.1	www.aitalia.it
127.0.0.1	akamai.downloadv3.com
127.0.0.1	aklitalia.it
127.0.0.1	www.aklitalia.it
127.0.0.1	akril.com
127.0.0.1	alcatel.ws
127.0.0.1	alfacleaner.com
127.0.0.1	www.alfacleaner.com
127.0.0.1	alfa-search.com
127.0.0.1	alialia.it
127.0.0.1	www.alialia.it
127.0.0.1	aliotalia.it
127.0.0.1	www.aliotalia.it
127.0.0.1	alirtalia.it
127.0.0.1	www.alirtalia.it
127.0.0.1	alitaia.it
127.0.0.1	www.alitaia.it
127.0.0.1	alitaklia.it
127.0.0.1	www.alitaklia.it
127.0.0.1	alitala.it
127.0.0.1	www.alitala.it
127.0.0.1	alitali.it
127.0.0.1	www.alitali.it
127.0.0.1	alitaliaq.it
127.0.0.1	www.alitaliaq.it
127.0.0.1	alitalias.it
127.0.0.1	www.alitalias.it
127.0.0.1	alitaliaz.it
127.0.0.1	www.alitaliaz.it
127.0.0.1	alitalioa.it
127.0.0.1	www.alitalioa.it
127.0.0.1	alitalisa.it
127.0.0.1	www.alitalisa.it
127.0.0.1	alitaliua.it
127.0.0.1	www.alitaliua.it
127.0.0.1	alitalkia.it
127.0.0.1	www.alitalkia.it
127.0.0.1	alitaloia.it
127.0.0.1	www.alitaloia.it
127.0.0.1	alitaluia.it
127.0.0.1	www.alitaluia.it
127.0.0.1	alitaslia.it
127.0.0.1	www.alitaslia.it
127.0.0.1	alitlia.it
127.0.0.1	www.alitlia.it
127.0.0.1	alitralia.it
127.0.0.1	www.alitralia.it
127.0.0.1	alitsalia.it
127.0.0.1	www.alitsalia.it
127.0.0.1	aliutalia.it
127.0.0.1	www.aliutalia.it
127.0.0.1	ALL1COUNT.NET
127.0.0.1	www.ALL1COUNT.NET
127.0.0.1	all4internet.com
127.0.0.1	www.all4internet.com
127.0.0.1	allabtcars.com
127.0.0.1	allabtjeeps.com
127.0.0.1	all-bittorrent.com
127.0.0.1	www.all-bittorrent.com
127.0.0.1	www.allcybersearch.com
127.0.0.1	allcybersearch.com
127.0.0.1	alldnserrors.com
127.0.0.1	www.alldnserrors.com
127.0.0.1	all-downloads-now.com
127.0.0.1	www.all-downloads-now.com
127.0.0.1	all-edonkey.com
127.0.0.1	www.all-edonkey.com
127.0.0.1	allforadult.com
127.0.0.1	allhyperlinks.com
127.0.0.1	alliesecurity.com
127.0.0.1	www.alliesecurity.com
127.0.0.1	all-inet.com
127.0.0.1	allinternetbusiness.com
127.0.0.1	all-limewire.com
127.0.0.1	www.all-limewire.com
127.0.0.1	allmegabucks.com
127.0.0.1	www.allmegabucks.com
127.0.0.1	allprotections.com
127.0.0.1	www.allprotections.com
127.0.0.1	allresultz.net
127.0.0.1	www.allresultz.net
127.0.0.1	allsecuritynotes.com
127.0.0.1	www.allsecuritynotes.com
127.0.0.1	allsecuritysite.com
127.0.0.1	www.allsecuritysite.com
127.0.0.1	allstarsvideos.net
127.0.0.1	www.allstarsvideos.net
127.0.0.1	alltruesoftware.com
127.0.0.1	www.alltruesoftware.com
127.0.0.1	allvideoactivex.com
127.0.0.1	www.allvideoactivex.com
127.0.0.1	almanah.biz
127.0.0.1	www.almanah.biz
127.0.0.1	almarvideos.com
127.0.0.1	aloitalia.it
127.0.0.1	www.aloitalia.it
127.0.0.1	aluitalia.it
127.0.0.1	www.aluitalia.it
127.0.0.1	amaena.com
127.0.0.1	www.amaena.com
127.0.0.1	amandamountains.com
127.0.0.1	amateurliveshow.com
127.0.0.1	www.amateurliveshow.com
127.0.0.1	amediasoftware.com
127.0.0.1	www.amediasoftware.com
127.0.0.1	amediasource.com
127.0.0.1	www.amediasource.com
127.0.0.1	americancarbargains.com
127.0.0.1	www.americancarbargains.com
127.0.0.1	american-teens.net
127.0.0.1	amigeek.com
127.0.0.1	amisbusiness.com
127.0.0.1	ampmsearch.com
127.0.0.1	www.ampmsearch.com
127.0.0.1	analcord.com
127.0.0.1	www.analcord.com
127.0.0.1	analmovi.com
127.0.0.1	anarchylolita.com
127.0.0.1	www.anarchylolita.com
127.0.0.1	anarchyporn.com
127.0.0.1	andromedical.com
127.0.0.1	www.andromedical.com
127.0.0.1	animepornmag.com
127.0.0.1	www.animepornmag.com
127.0.0.1	anin.org
127.0.0.1	anjpn-avxiz.biz
127.0.0.1	www.anjpn-avxiz.biz
127.0.0.1	anjpnzqav.biz
127.0.0.1	www.anjpnzqav.biz
127.0.0.1	anjpn-zqav.biz
127.0.0.1	www.anjpn-zqav.biz
127.0.0.1	annaromeo.com
127.0.0.1	antiddos.us
127.0.0.1	www.antiddos.us
127.0.0.1	Antiespiadorado.com
127.0.0.1	www.Antiespiadorado.com
127.0.0.1	Antiespionspack.com
127.0.0.1	www.Antiespionspack.com
127.0.0.1	Antigusanos2008.com
127.0.0.1	www.Antigusanos2008.com
127.0.0.1	Antispionage.com
127.0.0.1	www.Antispionage.com
127.0.0.1	Antispionagepro.com
127.0.0.1	www.Antispionagepro.com
127.0.0.1	antispydns.biz
127.0.0.1	www.antispydns.biz
127.0.0.1	antispylab.com
127.0.0.1	www.antispylab.com
127.0.0.1	antispysolutions.com
127.0.0.1	www.antispysolutions.com
127.0.0.1	antispyware.com
127.0.0.1	www.antispyware.com
127.0.0.1	antispywarebot.com
127.0.0.1	www.antispywarebot.com
127.0.0.1	antispywarebox.com
127.0.0.1	www.antispywarebox.com
127.0.0.1	antispywaredownloads.com
127.0.0.1	www.antispywaredownloads.com
127.0.0.1	Antispywaresuite.com
127.0.0.1	www.Antispywaresuite.com
127.0.0.1	Antispyweb.net
127.0.0.1	www.Antispyweb.net
127.0.0.1	Antiver2008.com
127.0.0.1	www.Antiver2008.com
127.0.0.1	antivermins.com
127.0.0.1	www.antivermins.com
127.0.0.1	anti-vermins.com
127.0.0.1	www.anti-vermins.com
127.0.0.1	antivir2007.com
127.0.0.1	www.antivir2007.com
127.0.0.1	antivirgear.com
127.0.0.1	www.antivirgear.com
127.0.0.1	antivirus.fastfreedownload.com
127.0.0.1	www.antivirus.fastfreedownload.com
127.0.0.1	antivirusgolden.com
127.0.0.1	www.antivirusgolden.com
127.0.0.1	antivirus-hq.net
127.0.0.1	www.antivirus-hq.net
127.0.0.1	anti-virus-pro.com
127.0.0.1	www.anti-virus-pro.com
127.0.0.1	antivirusprotector.com
127.0.0.1	www.antivirusprotector.com
127.0.0.1	antivirussecuritypro.com
127.0.0.1	www.antivirussecuritypro.com
127.0.0.1	antivirus-stop.com
127.0.0.1	www.antivirus-stop.com
127.0.0.1	Antiworm2008.com
127.0.0.1	www.Antiworm2008.com
127.0.0.1	Antiwurm2008.com
127.0.0.1	www.Antiwurm2008.com
127.0.0.1	antrocity.com
127.0.0.1	anyofus.com
127.0.0.1	www.anyofus.com
127.0.0.1	anysn.seproger.com
127.0.0.1	www.anysn.seproger.com
127.0.0.1	anything4health.com
127.0.0.1	apicpreview.com
127.0.0.1	www.apicpreview.com
127.0.0.1	appealcircuit.com
127.0.0.1	www.appealcircuit.com
127.0.0.1	approvedlinks.com
127.0.0.1	www.approvedlinks.com
127.0.0.1	apps.deskwizz.com
127.0.0.1	apps.webservicehost.com
127.0.0.1	aprotectedpage.com
127.0.0.1	www.aprotectedpage.com
127.0.0.1	apsua.com
127.0.0.1	archiviosex.net
127.0.0.1	www.archiviosex.net
127.0.0.1	aregay.com
127.0.0.1	ares-freebie.com
127.0.0.1	www.ares-freebie.com
127.0.0.1	arespro2007.com
127.0.0.1	www.arespro2007.com
127.0.0.1	aresultra.com
127.0.0.1	www.aresultra.com
127.0.0.1	ares-usa.com
127.0.0.1	www.ares-usa.com
127.0.0.1	arheo.com
127.0.0.1	arizonaweb.org
127.0.0.1	armitageinn.com
127.0.0.1	arquivojpgs.smtp.ru
127.0.0.1	www.arquivojpgs.smtp.ru
127.0.0.1	artachnid.com
127.0.0.1	art-func.com
127.0.0.1	art-xxx.com
127.0.0.1	asafebrowser.com
127.0.0.1	www.asafebrowser.com
127.0.0.1	asafetynotice.com
127.0.0.1	www.asafetynotice.com
127.0.0.1	asafetypage.com
127.0.0.1	www.asafetypage.com
127.0.0.1	asdbiz.biz
127.0.0.1	www.asdbiz.biz
127.0.0.1	asdeykuddq.com
127.0.0.1	www.asdeykuddq.com
127.0.0.1	asecurebar.com
127.0.0.1	www.asecurebar.com
127.0.0.1	asecureboard.com
127.0.0.1	www.asecureboard.com
127.0.0.1	asecurevalue.com
127.0.0.1	www.asecurevalue.com
127.0.0.1	asecurityissue.com
127.0.0.1	www.asecurityissue.com
127.0.0.1	asecuritynotice.com
127.0.0.1	www.asecuritynotice.com
127.0.0.1	asecuritypaper.com
127.0.0.1	www.asecuritypaper.com
127.0.0.1	asecuritystuff.com
127.0.0.1	www.asecuritystuff.com
127.0.0.1	asiankingkong.com
127.0.0.1	asianpornmag.com
127.0.0.1	www.asianpornmag.com
127.0.0.1	asiantoolbar.com
127.0.0.1	www.asiantoolbar.com
127.0.0.1	asidseiupc.com
127.0.0.1	www.asidseiupc.com
127.0.0.1	aslitalia.it
127.0.0.1	www.aslitalia.it
127.0.0.1	ass-gals.com
127.0.0.1	assureprotection.com
127.0.0.1	www.assureprotection.com
127.0.0.1	asta-killer.com
127.0.0.1	asupereva.it
127.0.0.1	www.asupereva.it
127.0.0.1	athenrye.com
127.0.0.1	atotalsafety.com
127.0.0.1	www.atotalsafety.com
127.0.0.1	atrueprotection.com
127.0.0.1	www.atrueprotection.com
127.0.0.1	atruesecurity.com
127.0.0.1	www.atruesecurity.com
127.0.0.1	attackware.com
127.0.0.1	www.attackware.com
127.0.0.1	attrezzi.biz
127.0.0.1	www.attrezzi.biz
127.0.0.1	aulde.net
127.0.0.1	www.aulde.net
127.0.0.1	aupereva.it
127.0.0.1	www.aupereva.it
127.0.0.1	autocontext.begun.ru
127.0.0.1	www.autocontext.begun.ru
127.0.0.1	autoescrowpay.com
127.0.0.1	avast.free-software-center.com
127.0.0.1	www.avast.free-software-center.com
127.0.0.1	avast-2007.com
127.0.0.1	www.avast-2007.com
127.0.0.1	avast-downloads.com
127.0.0.1	www.avast-downloads.com
127.0.0.1	avast-hq.com
127.0.0.1	www.avast-hq.com
127.0.0.1	avforce.com
127.0.0.1	www.avforce.com
127.0.0.1	avg.grab-it-today.net
127.0.0.1	www.avg.grab-it-today.net
127.0.0.1	avg.softwarecenterz.com
127.0.0.1	www.avg.softwarecenterz.com
127.0.0.1	avg-secure.com
127.0.0.1	www.avg-secure.com
127.0.0.1	avian-ads.com
127.0.0.1	avideoaxaccess.com
127.0.0.1	www.avideoaxaccess.com
127.0.0.1	avideosurfer.com
127.0.0.1	www.avideosurfer.com
127.0.0.1	aviewersoft.com
127.0.0.1	www.aviewersoft.com
127.0.0.1	avpcheckupdate.com
127.0.0.1	www.avpcheckupdate.com
127.0.0.1	avxizaaqada.biz
127.0.0.1	www.avxizaaqada.biz
127.0.0.1	avxiz-anjpn.biz
127.0.0.1	www.avxiz-anjpn.biz
127.0.0.1	avxizueorn.biz
127.0.0.1	www.avxizueorn.biz
127.0.0.1	avxiz-ueorn.biz
127.0.0.1	www.avxiz-ueorn.biz
127.0.0.1	avxiz-vtvcp.biz
127.0.0.1	www.avxiz-vtvcp.biz
127.0.0.1	avxiz-ygco.biz
127.0.0.1	www.avxiz-ygco.biz
127.0.0.1	avxiz-zqav.biz
127.0.0.1	www.avxiz-zqav.biz
127.0.0.1	awarninglist.com
127.0.0.1	www.awarninglist.com
127.0.0.1	awbeta.net-nucleus.com
127.0.0.1	awesomehomepage.com
127.0.0.1	www.awesomehomepage.com
127.0.0.1	awmcash.biz
127.0.0.1	awmdabest.com
127.0.0.1	axemediasoftware.com
127.0.0.1	www.axemediasoftware.com
127.0.0.1	aximageobject.com
127.0.0.1	www.aximageobject.com
127.0.0.1	axmediaproject.com
127.0.0.1	www.axmediaproject.com
127.0.0.1	axmediasoftware.com
127.0.0.1	www.axmediasoftware.com
127.0.0.1	axmediasolutions.com
127.0.0.1	www.axmediasolutions.com
127.0.0.1	axobjectpage.com
127.0.0.1	www.axobjectpage.com
127.0.0.1	axobjectsource.com
127.0.0.1	www.axobjectsource.com
127.0.0.1	axsoftwaretool.com
127.0.0.1	www.axsoftwaretool.com
127.0.0.1	axvideoproject.com
127.0.0.1	www.axvideoproject.com
127.0.0.1	axvideosetup.com
127.0.0.1	www.axvideosetup.com
127.0.0.1	ayakawamura.com
127.0.0.1	ayb.dns-look-up.com
127.0.0.1	ayb.netbios-wait.com
127.0.0.1	ayumitaniguchi.com
127.0.0.1	azebar.com
127.0.0.1	azureusclub.com
127.0.0.1	www.azureusclub.com
127.0.0.1	azureus-freebie.com
127.0.0.1	www.azureus-freebie.com
127.0.0.1	azzetta.it
127.0.0.1	www.azzetta.it
127.0.0.1	b.casalemedia.com
127.0.0.1	babe.k-lined.com
127.0.0.1	www.babe.k-lined.com
127.0.0.1	babe.the-killer.bz
127.0.0.1	www.babe.the-killer.bz
127.0.0.1	babenet.com
127.0.0.1	www.babenet.com
127.0.0.1	babespornmag.com
127.0.0.1	www.babespornmag.com
127.0.0.1	babeweb.de
127.0.0.1	www.babeweb.de
127.0.0.1	baccarat-other.info
127.0.0.1	www.baccarat-other.info
127.0.0.1	Backstripgirls.com
127.0.0.1	www.Backstripgirls.com
127.0.0.1	backup.mabou.org
127.0.0.1	balotierra.com
127.0.0.1	www.balotierra.com
127.0.0.1	bannedhost.net
127.0.0.1	barbudafarms.com
127.0.0.1	bardownload.com
127.0.0.1	www.bardownload.com
127.0.0.1	barnandfence.com
127.0.0.1	batsearch.com
127.0.0.1	baygraphicsllc.com
127.0.0.1	bbbsearch.com
127.0.0.1	bb-search.com
127.0.0.1	bdsmlibrary.net
127.0.0.1	bdsmpornmag.com
127.0.0.1	www.bdsmpornmag.com
127.0.0.1	bearshare.download-me.info
127.0.0.1	www.bearshare.download-me.info
127.0.0.1	bearshare.mp3-muzic.com
127.0.0.1	www.bearshare.mp3-muzic.com
127.0.0.1	bearshare-download.org
127.0.0.1	www.bearshare-download.org
127.0.0.1	bearshare-downloads.net
127.0.0.1	www.bearshare-downloads.net
127.0.0.1	bearsharelive.co.uk
127.0.0.1	www.bearsharelive.co.uk
127.0.0.1	bearshare-music-downloads.com
127.0.0.1	www.bearshare-music-downloads.com
127.0.0.1	bearsharepro2007.com
127.0.0.1	www.bearsharepro2007.com
127.0.0.1	bearshare-usa.com
127.0.0.1	www.bearshare-usa.com
127.0.0.1	bedhome.com
127.0.0.1	bediadance.com
127.0.0.1	beebappyy.biz
127.0.0.1	www.beebappyy.biz
127.0.0.1	begin2search.com
127.0.0.1	www.begin2search.com
127.0.0.1	bellabasketsfl.com
127.0.0.1	bernaolatwin.com
127.0.0.1	best-counter.com
127.0.0.1	bestcrawler.com
127.0.0.1	bestfor.ru
127.0.0.1	best-hardpics.com
127.0.0.1	bestmanage.org
127.0.0.1	www.bestmanage.org
127.0.0.1	bestmanage0.org
127.0.0.1	www.bestmanage0.org
127.0.0.1	bestmanage1.org
127.0.0.1	www.bestmanage1.org
127.0.0.1	bestmanage2.org
127.0.0.1	www.bestmanage2.org
127.0.0.1	bestmanage3.org
127.0.0.1	www.bestmanage3.org
127.0.0.1	bestmanage4.org
127.0.0.1	www.bestmanage4.org
127.0.0.1	bestmanage5.org
127.0.0.1	www.bestmanage5.org
127.0.0.1	bestmanage6.org
127.0.0.1	www.bestmanage6.org
127.0.0.1	bestmanage7.org
127.0.0.1	www.bestmanage7.org
127.0.0.1	bestmanage8.org
127.0.0.1	www.bestmanage8.org
127.0.0.1	bestmanage9.org
127.0.0.1	www.bestmanage9.org
127.0.0.1	bestporngate.com
127.0.0.1	bestsafetyguide.net
127.0.0.1	www.bestsafetyguide.net
127.0.0.1	best-spyware.info
127.0.0.1	www.best-spyware.info
127.0.0.1	best-targeted-traffic.com
127.0.0.1	www.best-targeted-traffic.com
127.0.0.1	best-voyeur.info
127.0.0.1	www.best-voyeur.info
127.0.0.1	bestweblinks.com
127.0.0.1	best-winning-casino.com
127.0.0.1	bestworldgirls-for-u.net
127.0.0.1	www.bestworldgirls-for-u.net
127.0.0.1	bestxporno.com
127.0.0.1	bettersearch.biz
127.0.0.1	www.bettersearch.biz
127.0.0.1	bgazzetta.it
127.0.0.1	www.bgazzetta.it
127.0.0.1	bgoogle.it
127.0.0.1	www.bgoogle.it
127.0.0.1	bigtrafficnetwork.com
127.0.0.1	www.bigtrafficnetwork.com
127.0.0.1	bigwww.com
127.0.0.1	www.bigwww.com
127.0.0.1	bin.errorprotector.com
127.0.0.1	bins.media-motor.net
127.0.0.1	bins2.media-motor.net
127.0.0.1	bis.180solutions.com
127.0.0.1	bitchesonline.net
127.0.0.1	bitcomet-freebie.com
127.0.0.1	www.bitcomet-freebie.com
127.0.0.1	biz.biz
127.0.0.1	blackblues00.com
127.0.0.1	www.blackblues00.com
127.0.0.1	blackhats.tc
127.0.0.1	www.blackhats.tc
127.0.0.1	blackhawksoftware.com
127.0.0.1	www.blackhawksoftware.com
127.0.0.1	blackjack-free.net
127.0.0.1	blazefind.com
127.0.0.1	blender.xu.pl
127.0.0.1	blondetgp.com
127.0.0.1	blue-elefant.com
127.0.0.1	www.blue-elefant.com
127.0.0.1	bm.theaimonline.com
127.0.0.1	www.bm.theaimonline.com
127.0.0.1	bnmgate.com
127.0.0.1	www.bnmgate.com
127.0.0.1	bodaciousbabette.com
127.0.0.1	bonzi.com
127.0.0.1	www.bonzi.com
127.0.0.1	boobdoll.com
127.0.0.1	boobsandtits.com
127.0.0.1	boobsclub.com
127.0.0.1	bookedspace.com
127.0.0.1	www.bookedspace.com
127.0.0.1	boom.com.vn
127.0.0.1	www.boom.com.vn
127.0.0.1	boredlife.com
127.0.0.1	bowlofogumbo.com
127.0.0.1	bpfq02.com
127.0.0.1	www.bpfq02.com
127.0.0.1	bqgate.com
127.0.0.1	www.bqgate.com
127.0.0.1	br.errorsafe.com
127.0.0.1	br.winantivirus.com
127.0.0.1	br.winfixer.com
127.0.0.1	bradcoem.org
127.0.0.1	braincodec.com
127.0.0.1	www.braincodec.com
127.0.0.1	brandiyoung.com
127.0.0.1	bravesentry.com
127.0.0.1	www.bravesentry.com
127.0.0.1	breenten.biz
127.0.0.1	www.breenten.biz
127.0.0.1	brodbfm.net
127.0.0.1	www.brodbfm.net
127.0.0.1	brookeburn.com
127.0.0.1	browserwise.com
127.0.0.1	www.browserwise.com
127.0.0.1	bucps.com
127.0.0.1	buhartes.info
127.0.0.1	buldog-stats.com
127.0.0.1	bullseye-network.com
127.0.0.1	www.bullseye-network.com
127.0.0.1	burgerkingbigscreen.com
127.0.0.1	burnsrecyclinginc.com
127.0.0.1	www.burnsrecyclinginc.com
127.0.0.1	buscards.net
127.0.0.1	bustyrussell.com
127.0.0.1	busysearch.net
127.0.0.1	www.busysearch.net
127.0.0.1	buttejazz.org
127.0.0.1	buy-find.info
127.0.0.1	www.buy-find.info
127.0.0.1	buyselldomain.net
127.0.0.1	buytraff.biz
127.0.0.1	www.buytraff.biz
127.0.0.1	buz.ru
127.0.0.1	bvirgilio.it
127.0.0.1	www.bvirgilio.it
127.0.0.1	c.centralmedia.ws
127.0.0.1	c.enhance.com
127.0.0.1	www.c.enhance.com
127.0.0.1	c.goclick.com
127.0.0.1	c4tdownload.com
127.0.0.1	www.c4tdownload.com
127.0.0.1	c5.www4free.info
127.0.0.1	www.c5.www4free.info
127.0.0.1	cache.surfaccuracy.com
127.0.0.1	www.cache.surfaccuracy.com
127.0.0.1	cache.ysbweb.com
127.0.0.1	calcioturris.com
127.0.0.1	calendaralerts.net
127.0.0.1	www.calendaralerts.net
127.0.0.1	cameouk.co.uk
127.0.0.1	www.cameouk.co.uk
127.0.0.1	cameup.com
127.0.0.1	camouflageclothingonline.net
127.0.0.1	www.camouflageclothingonline.net
127.0.0.1	camup.net
127.0.0.1	canberracricketcoaching.com
127.0.0.1	candycantaloupes.com
127.0.0.1	canidetect.org
127.0.0.1	www.canidetect.org
127.0.0.1	cantfind.com
127.0.0.1	www.cantfind.com
127.0.0.1	careers.dulcineasystems.net
127.0.0.1	carsands.com
127.0.0.1	carsrentals.net
127.0.0.1	cartoes.uol.com.br
127.0.0.1	casalemedia.com
127.0.0.1	www.casalemedia.com
127.0.0.1	cashdeluxe.net
127.0.0.1	www.cashdeluxe.net
127.0.0.1	cashengines.com
127.0.0.1	www.cashengines.com
127.0.0.1	cashsearch.biz
127.0.0.1	cashsurfers.com
127.0.0.1	www.cashsurfers.com
127.0.0.1	CashUnlim.com
127.0.0.1	www.CashUnlim.com
127.0.0.1	casino.com.free.game.pogo.gratisdownloads.nl
127.0.0.1	casino2win.net
127.0.0.1	casino-gambling-1.net
127.0.0.1	casino-gambling-2.net
127.0.0.1	casinomidas.net
127.0.0.1	casinonline.net
127.0.0.1	casino-onlines.net
127.0.0.1	castingsamateur.com
127.0.0.1	www.castingsamateur.com
127.0.0.1	catallogue.com
127.0.0.1	catch-dc.info
127.0.0.1	www.catch-dc.info
127.0.0.1	categories.mygeek.com
127.0.0.1	catsss.da.ru
127.0.0.1	caxa.ru
127.0.0.1	cc.panet.org
127.0.0.1	ccecaedbebfcaf.com
127.0.0.1	www.ccecaedbebfcaf.com
127.0.0.1	cclebali.org
127.0.0.1	ccorriere.it
127.0.0.1	www.ccorriere.it
127.0.0.1	cdegate.com
127.0.0.1	www.cdegate.com
127.0.0.1	cdn.drivecleaner.com
127.0.0.1	cdn.errorsafe.com
127.0.0.1	cdn.movies-etc.com
127.0.0.1	cdn.winsoftware.com
127.0.0.1	cdn2.movies-etc.com
127.0.0.1	cdorriere.it
127.0.0.1	www.cdorriere.it
127.0.0.1	ceewawires.org
127.0.0.1	centralmedia.ws
127.0.0.1	certumgroup.com
127.0.0.1	cforriere.it
127.0.0.1	www.cforriere.it
127.0.0.1	check.jupitersatellites.biz
127.0.0.1	www.check.jupitersatellites.biz
127.0.0.1	checkin100.com
127.0.0.1	www.checkin100.com
127.0.0.1	checkssecurity.com
127.0.0.1	www.checkssecurity.com
127.0.0.1	chelancatering.com
127.0.0.1	chenshijituan.com
127.0.0.1	www.chenshijituan.com
127.0.0.1	childrenvilla.com
127.0.0.1	chips-4-free.com
127.0.0.1	chrisswasey.com
127.0.0.1	chriswallace.net
127.0.0.1	cia-trjn.myvnc.com
127.0.0.1	www.cia-trjn.myvnc.com
127.0.0.1	ciorriere.it
127.0.0.1	www.ciorriere.it
127.0.0.1	cirriere.it
127.0.0.1	www.cirriere.it
127.0.0.1	ckick4thumbs.com
127.0.0.1	cl55.biz
127.0.0.1	clackamasliteraryreview.com
127.0.0.1	cleansoftwares.com
127.0.0.1	www.cleansoftwares.com
127.0.0.1	clearsearch.cc
127.0.0.1	clearsearch.net
127.0.0.1	clickaire.com
127.0.0.1	click-codec.com
127.0.0.1	www.click-codec.com
127.0.0.1	clickhere4search.com
127.0.0.1	www.clickhere4search.com
127.0.0.1	click-now.net
127.0.0.1	clickspring.net
127.0.0.1	www.clickspring.net
127.0.0.1	click-to-download.com
127.0.0.1	www.click-to-download.com
127.0.0.1	clicktomakeasearch.com
127.0.0.1	www.clicktomakeasearch.com
127.0.0.1	clickyestoenter.net
127.0.0.1	client.exeupdate.com
127.0.0.1	client.myadultexplorer.com
127.0.0.1	cliks.org
127.0.0.1	www.cliks.org
127.0.0.1	clorriere.it
127.0.0.1	www.clorriere.it
127.0.0.1	clrsch.com
127.0.0.1	clubxxxvideo.com
127.0.0.1	www.clubxxxvideo.com
127.0.0.1	clusif.free.fr
127.0.0.1	cmtapestry.com
127.0.0.1	cnetadd.com
127.0.0.1	www.cnetadd.com
127.0.0.1	cnzz.com
127.0.0.1	www.cnzz.com
127.0.0.1	code.ignphrases.com
127.0.0.1	codec.ninoa.com
127.0.0.1	codecdvd.net
127.0.0.1	www.codecdvd.net
127.0.0.1	codec-fun.com
127.0.0.1	www.codec-fun.com
127.0.0.1	codecsoft.net
127.0.0.1	www.codecsoft.net
127.0.0.1	codrriere.it
127.0.0.1	www.codrriere.it
127.0.0.1	coeriere.it
127.0.0.1	www.coeriere.it
127.0.0.1	coerriere.it
127.0.0.1	www.coerriere.it
127.0.0.1	cofrriere.it
127.0.0.1	www.cofrriere.it
127.0.0.1	cogrriere.it
127.0.0.1	www.cogrriere.it
127.0.0.1	coirriere.it
127.0.0.1	www.coirriere.it
127.0.0.1	command.adservs.com
127.0.0.1	www.commonname.com
127.0.0.1	computerpcgames.net
127.0.0.1	www.computerpcgames.net
127.0.0.1	computerrecover.com
127.0.0.1	www.computerrecover.com
127.0.0.1	config.180solutions.com
127.0.0.1	content.dollarrevenue.com
127.0.0.1	www.content.dollarrevenue.com
127.0.0.1	content.ireit.com
127.0.0.1	www.content.ireit.com
127.0.0.1	content.onerateld.com
127.0.0.1	contentmatch.net
127.0.0.1	www.contentmatch.net
127.0.0.1	contra-virus.com
127.0.0.1	www.contra-virus.com
127.0.0.1	controlmeh.com
127.0.0.1	www.controlmeh.com
127.0.0.1	cooldeskalert.com
127.0.0.1	www.cooldeskalert.com
127.0.0.1	coolfetishsite.com
127.0.0.1	coolfreehost.com
127.0.0.1	coolfreepage.com
127.0.0.1	coolfreepages.com
127.0.0.1	cool-homepage.co
127.0.0.1	cool-homepage.com
127.0.0.1	coolmoneysearch.com
127.0.0.1	coolpornsearch.com
127.0.0.1	cool-search.net
127.0.0.1	cool-search.netfartpost.com
127.0.0.1	coolsearcher.info
127.0.0.1	coolservecorp.net
127.0.0.1	www.coolservecorp.net
127.0.0.1	coolwebsearch.com
127.0.0.1	www.coolwebsearch.com
127.0.0.1	cool-web-search.com
127.0.0.1	coolwebsearsh.com
127.0.0.1	coolwwwsearch.com
127.0.0.1	www.coolwwwsearch.com
127.0.0.1	cool-xxx.net
127.0.0.1	coorriere.it
127.0.0.1	www.coorriere.it
127.0.0.1	copmtraine.com
127.0.0.1	coprriere.it
127.0.0.1	www.coprriere.it
127.0.0.1	core.psyche-evolution.com
127.0.0.1	www.core.psyche-evolution.com
127.0.0.1	coreiere.it
127.0.0.1	www.coreiere.it
127.0.0.1	coreriere.it
127.0.0.1	www.coreriere.it
127.0.0.1	corrdiere.it
127.0.0.1	www.corrdiere.it
127.0.0.1	correiere.it
127.0.0.1	www.correiere.it
127.0.0.1	corrfiere.it
127.0.0.1	www.corrfiere.it
127.0.0.1	corrgiere.it
127.0.0.1	www.corrgiere.it
127.0.0.1	corridere.it
127.0.0.1	www.corridere.it
127.0.0.1	corriedre.it
127.0.0.1	www.corriedre.it
127.0.0.1	corriee.it
127.0.0.1	www.corriee.it
127.0.0.1	corrieere.it
127.0.0.1	www.corrieere.it
127.0.0.1	corriefre.it
127.0.0.1	www.corriefre.it
127.0.0.1	corriegre.it
127.0.0.1	www.corriegre.it
127.0.0.1	corrierde.it
127.0.0.1	www.corrierde.it
127.0.0.1	corriered.it
127.0.0.1	www.corriered.it
127.0.0.1	corrieree.it
127.0.0.1	www.corrieree.it
127.0.0.1	corrieref.it
127.0.0.1	www.corrieref.it
127.0.0.1	corrierer.it
127.0.0.1	www.corrierer.it
127.0.0.1	corrieres.it
127.0.0.1	www.corrieres.it
127.0.0.1	corrierew.it
127.0.0.1	www.corrierew.it
127.0.0.1	corrierfe.it
127.0.0.1	www.corrierfe.it
127.0.0.1	corrierge.it
127.0.0.1	www.corrierge.it
127.0.0.1	corrierr.it
127.0.0.1	www.corrierr.it
127.0.0.1	corrierre.it
127.0.0.1	www.corrierre.it
127.0.0.1	corrierse.it
127.0.0.1	www.corrierse.it
127.0.0.1	corrierte.it
127.0.0.1	www.corrierte.it
127.0.0.1	corrierw.it
127.0.0.1	www.corrierw.it
127.0.0.1	corrierwe.it
127.0.0.1	www.corrierwe.it
127.0.0.1	corriesre.it
127.0.0.1	www.corriesre.it
127.0.0.1	corriete.it
127.0.0.1	www.corriete.it
127.0.0.1	corrietre.it
127.0.0.1	www.corrietre.it
127.0.0.1	corriewre.it
127.0.0.1	www.corriewre.it
127.0.0.1	corrifere.it
127.0.0.1	www.corrifere.it
127.0.0.1	corriiere.it
127.0.0.1	www.corriiere.it
127.0.0.1	corrilere.it
127.0.0.1	www.corrilere.it
127.0.0.1	corrioere.it
127.0.0.1	www.corrioere.it
127.0.0.1	corrire.it
127.0.0.1	www.corrire.it
127.0.0.1	corrirere.it
127.0.0.1	www.corrirere.it
127.0.0.1	corrirre.it
127.0.0.1	www.corrirre.it
127.0.0.1	corrisere.it
127.0.0.1	www.corrisere.it
127.0.0.1	corriuere.it
127.0.0.1	www.corriuere.it
127.0.0.1	corriwere.it
127.0.0.1	www.corriwere.it
127.0.0.1	corriwre.it
127.0.0.1	www.corriwre.it
127.0.0.1	corrliere.it
127.0.0.1	www.corrliere.it
127.0.0.1	corroere.it
127.0.0.1	www.corroere.it
127.0.0.1	corroiere.it
127.0.0.1	www.corroiere.it
127.0.0.1	corrriere.it
127.0.0.1	www.corrriere.it
127.0.0.1	corrtiere.it
127.0.0.1	www.corrtiere.it
127.0.0.1	corruere.it
127.0.0.1	www.corruere.it
127.0.0.1	corruiere.it
127.0.0.1	www.corruiere.it
127.0.0.1	cortiere.it
127.0.0.1	www.cortiere.it
127.0.0.1	cortriere.it
127.0.0.1	www.cortriere.it
127.0.0.1	costrike.com
127.0.0.1	www.costrike.com
127.0.0.1	cotriere.it
127.0.0.1	www.cotriere.it
127.0.0.1	cotrriere.it
127.0.0.1	www.cotrriere.it
127.0.0.1	couldnotfind.com
127.0.0.1	count.cc
127.0.0.1	count.hitscount.net
127.0.0.1	count-all.com
127.0.0.1	countdutycall.info
127.0.0.1	www.countdutycall.info
127.0.0.1	counter.sexmaniack.com
127.0.0.1	cporriere.it
127.0.0.1	www.cporriere.it
127.0.0.1	cprriere.it
127.0.0.1	www.cprriere.it
127.0.0.1	cpvfeed.com
127.0.0.1	cracks.me.uk
127.0.0.1	cracks4all.com
127.0.0.1	www.cracks4all.com
127.0.0.1	crapsgold.info
127.0.0.1	www.crapsgold.info
127.0.0.1	Crazygirls-world.com
127.0.0.1	crazywinnings.com
127.0.0.1	www.crazywinnings.com
127.0.0.1	creamedcutties.com
127.0.0.1	createaccesskey.com
127.0.0.1	www.createaccesskey.com
127.0.0.1	creditsearchonline.com
127.0.0.1	crestring.com
127.0.0.1	crooder.com
127.0.0.1	crriere.it
127.0.0.1	www.crriere.it
127.0.0.1	crystalysmedia.com
127.0.0.1	www.crystalysmedia.com
127.0.0.1	csx.adservs.com
127.0.0.1	www.csx.adservs.com
127.0.0.1	cts.180solutions.com
127.0.0.1	cuisinartoven.com
127.0.0.1	www.cuisinartoven.com
127.0.0.1	curedc.info
127.0.0.1	www.curedc.info
127.0.0.1	curepcsolutions.com
127.0.0.1	www.curepcsolutions.com
127.0.0.1	curvedspaces.com
127.0.0.1	cutadult.com
127.0.0.1	www.cutadult.com
127.0.0.1	cvirgilio.it
127.0.0.1	www.cvirgilio.it
127.0.0.1	cvorriere.it
127.0.0.1	www.cvorriere.it
127.0.0.1	cvs.jps.ru
127.0.0.1	cvsymphony.com
127.0.0.1	cxorriere.it
127.0.0.1	www.cxorriere.it
127.0.0.1	cyberrape.com
127.0.0.1	www.cyberrape.com
127.0.0.1	cydom.com
127.0.0.1	cydoor.com
127.0.0.1	www.cydoor.com
127.0.0.1	daily-gals.com
127.0.0.1	dailypornmag.com
127.0.0.1	www.dailypornmag.com
127.0.0.1	dailyteenspic.com
127.0.0.1	dailytoolbar.com
127.0.0.1	www.dailytoolbar.com
127.0.0.1	dancingbabycd.com
127.0.0.1	data-hoster.com
127.0.0.1	www.data-hoster.com
127.0.0.1	datanotary.com
127.0.0.1	datareco.com
127.0.0.1	dating-galaxy.info
127.0.0.1	www.dating-galaxy.info
127.0.0.1	dating-search.net
127.0.0.1	davemarshall.org
127.0.0.1	db105.com
127.0.0.1	dbdecicated.com
127.0.0.1	www.dbdecicated.com
127.0.0.1	dbxcompany.com
127.0.0.1	www.dbxcompany.com
127.0.0.1	dcdl.dmcast.com
127.0.0.1	dcfitusa.com
127.0.0.1	dcorriere.it
127.0.0.1	www.dcorriere.it
127.0.0.1	dcurtis.com
127.0.0.1	www.dcurtis.com
127.0.0.1	dcww.dmcast.com
127.0.0.1	de.ag
127.0.0.1	de.drivecleaner.com
127.0.0.1	de.errorsafe.com
127.0.0.1	de.winantivirus.com
127.0.0.1	de98.remsys.org
127.0.0.1	debay.it
127.0.0.1	www.debay.it
127.0.0.1	dedmazay.3322.org
127.0.0.1	dedsearch.com
127.0.0.1	www.dedsearch.com
127.0.0.1	defaultsearch.net
127.0.0.1	Defensaantimalware.com
127.0.0.1	www.Defensaantimalware.com
127.0.0.1	deja-rue.com
127.0.0.1	www.deja-rue.com
127.0.0.1	derklaif.biz
127.0.0.1	www.derklaif.biz
127.0.0.1	derrari.it
127.0.0.1	www.derrari.it
127.0.0.1	desarrollocreativo.com
127.0.0.1	deskbar.worldtostart.com
127.0.0.1	www.deskbar.worldtostart.com
127.0.0.1	deskwizz.com
127.0.0.1	www.deskwizz.com
127.0.0.1	dev.ntcor.com
127.0.0.1	develip.com
127.0.0.1	dewis.spb.ru
127.0.0.1	dewis.us
127.0.0.1	df809jow4wj2304lfd0sf9fsd0a2t4ldf809jow4wj2304lfd0sf9fsd0a2t4ld.biz
127.0.0.1	dgbusiness.com
127.0.0.1	www.dgbusiness.com
127.0.0.1	dialer2004.com
127.0.0.1	dialerclub.com
127.0.0.1	www.dialerclub.com
127.0.0.1	dialer-shop.com
127.0.0.1	www.dialer-shop.com
127.0.0.1	dialoff.com
127.0.0.1	www.dialoff.com
127.0.0.1	did.i-used.cc
127.0.0.1	www.did.i-used.cc
127.0.0.1	dietpills4free.com
127.0.0.1	dietpussy.com
127.0.0.1	digikeygen.com
127.0.0.1	www.digikeygen.com
127.0.0.1	digistreamsa.com
127.0.0.1	digitalcoders.net
127.0.0.1	www.digitalcoders.net
127.0.0.1	www.digitalfan.com
127.0.0.1	digital-pornography.com
127.0.0.1	dionforvalleycouncil.org
127.0.0.1	directdvdpro.com
127.0.0.1	www.directdvdpro.com
127.0.0.1	directporta.info
127.0.0.1	www.directporta.info
127.0.0.1	directsearchzone.com
127.0.0.1	www.directsearchzone.com
127.0.0.1	dist.checkin100.com
127.0.0.1	dl.ad-ware.cc
127.0.0.1	dl.malwarewipe.com
127.0.0.1	dl.targetsaver.com
127.0.0.1	www.dl.targetsaver.com
127.0.0.1	dl.web-nexus.net
127.0.0.1	dl1.antivermins.com
127.0.0.1	dl1.antivirgear.com
127.0.0.1	dl1.spydawn.com
127.0.0.1	dl1.virusprotectpro.com
127.0.0.1	dl10.spyfalcon.com
127.0.0.1	dl16.spyfalcon.com
127.0.0.1	dl2.spyfalcon.com
127.0.0.1	dl2.spyheal.com
127.0.0.1	dl2.spywarestrike.com
127.0.0.1	dl3.spyfalcon.com
127.0.0.1	dl3.spyheal.com
127.0.0.1	dl3.spywarestrike.com
127.0.0.1	dl4.spyfalcon.com
127.0.0.1	dl4.spywarestrike.com
127.0.0.1	dl5.spyfalcon.com
127.0.0.1	dl5.spywarestrike.com
127.0.0.1	dl6.spywarestrike.com
127.0.0.1	dl7.spywarestrike.com
127.0.0.1	dl8.spyheal.com
127.0.0.1	dl8.spywarestrike.com
127.0.0.1	dl9.spyfalcon.com
127.0.0.1	dmcast.com
127.0.0.1	www.dmcast.com
127.0.0.1	dnaads.com
127.0.0.1	www.dnaads.com
127.0.0.1	dnl.mabou.org
127.0.0.1	dns-look-up.com
127.0.0.1	www.dns-look-up.com
127.0.0.1	doctorwaldron.com
127.0.0.1	document-not-found.pornpic.org
127.0.0.1	doggyaction.com
127.0.0.1	dogproblemswebsite.com
127.0.0.1	www.dogproblemswebsite.com
127.0.0.1	doktorxxx.com
127.0.0.1	dollarrevenue.com
127.0.0.1	domaincar.com
127.0.0.1	www.domaincar.com
127.0.0.1	domains2003.net
127.0.0.1	domains-for-you-online.com
127.0.0.1	domain-your-registration.com
127.0.0.1	domkrat.com
127.0.0.1	dotcomtoolbar.com
127.0.0.1	www.dotcomtoolbar.com
127.0.0.1	down.136136.net
127.0.0.1	download.abetterinternet.com
127.0.0.1	download.antispywarebot.com
127.0.0.1	www.download.antispywarebot.com
127.0.0.1	download.bardownload.com
127.0.0.1	www.download.bardownload.com
127.0.0.1	download.bravesentry.com
127.0.0.1	www.download.bravesentry.com
127.0.0.1	download.cdn.drivecleaner.com
127.0.0.1	download.cdn.errorsafe.com
127.0.0.1	download.cdn.winsoftware.com
127.0.0.1	download.errorsafe.com
127.0.0.1	download.jupitersatellites.biz
127.0.0.1	www.download.jupitersatellites.biz
127.0.0.1	download.searchtabs.net
127.0.0.1	download.secureyournet.biz
127.0.0.1	www.download.secureyournet.biz
127.0.0.1	download.spyonthis.net
127.0.0.1	download.spy-shredder.com
127.0.0.1	download.systemdoctor.com
127.0.0.1	download.winantispyware.com
127.0.0.1	download.winantivirus.com
127.0.0.1	download.windrivecleaner.com
127.0.0.1	download.winfixer.com
127.0.0.1	download10.spywarequake.com
127.0.0.1	download11.spywarequake.com
127.0.0.1	download12.spywarequake.com
127.0.0.1	download13.spywarequake.com
127.0.0.1	download15.spywarequake.com
127.0.0.1	download2.spywarequake.com
127.0.0.1	download-2007.com
127.0.0.1	www.download-2007.com
127.0.0.1	download3.spyaxe.com
127.0.0.1	download3.spywarequake.com
127.0.0.1	download4.spyaxe.com
127.0.0.1	download4.spywarequake.com
127.0.0.1	download5.spyaxe.com
127.0.0.1	download5.spywarequake.com
127.0.0.1	download6.spyaxe.com
127.0.0.1	download7.spywarequake.com
127.0.0.1	download8.spywarequake.com
127.0.0.1	download9.spywarequake.com
127.0.0.1	download-ad-aware.com
127.0.0.1	www.download-ad-aware.com
127.0.0.1	download-all-4-free.com
127.0.0.1	www.download-all-4-free.com
127.0.0.1	download-all-area.com
127.0.0.1	www.download-all-area.com
127.0.0.1	download-antivir.com
127.0.0.1	www.download-antivir.com
127.0.0.1	downloadanysong.com
127.0.0.1	www.downloadanysong.com
127.0.0.1	download-avast.com
127.0.0.1	www.download-avast.com
127.0.0.1	downloadcorporation.com
127.0.0.1	www.downloadcorporation.com
127.0.0.1	download-dvdshrink.com
127.0.0.1	www.download-dvdshrink.com
127.0.0.1	download-for-free.net
127.0.0.1	www.download-for-free.net
127.0.0.1	downloadfreesoft.com
127.0.0.1	www.downloadfreesoft.com
127.0.0.1	downloadfreeway.com
127.0.0.1	www.downloadfreeway.com
127.0.0.1	downloadimesh.com
127.0.0.1	www.downloadimesh.com
127.0.0.1	download-itunes-now.com
127.0.0.1	www.download-itunes-now.com
127.0.0.1	download-limewire.org
127.0.0.1	www.download-limewire.org
127.0.0.1	downloadlost.tv
127.0.0.1	www.downloadlost.tv
127.0.0.1	downloadmax.net
127.0.0.1	www.downloadmax.net
127.0.0.1	download-mcafee.com
127.0.0.1	www.download-mcafee.com
127.0.0.1	download-me.info
127.0.0.1	downloadmediaax.com
127.0.0.1	www.downloadmediaax.com
127.0.0.1	downloadpics.net
127.0.0.1	www.downloadpics.net
127.0.0.1	download-real-player.com
127.0.0.1	www.download-real-player.com
127.0.0.1	downloads.180solutions.com
127.0.0.1	downloads.adaware.cc
127.0.0.1	downloadservicearea.com
127.0.0.1	www.downloadservicearea.com
127.0.0.1	downloads-free.org
127.0.0.1	www.downloads-free.org
127.0.0.1	downloadsglobe.com
127.0.0.1	www.downloadsglobe.com
127.0.0.1	download-this.us
127.0.0.1	www.download-this.us
127.0.0.1	download-trillian.com
127.0.0.1	www.download-trillian.com
127.0.0.1	downloadv3.com
127.0.0.1	www.downloadv3.com
127.0.0.1	downloadvax.com
127.0.0.1	www.downloadvax.com
127.0.0.1	download-windvd.com
127.0.0.1	www.download-windvd.com
127.0.0.1	download-winrar.com
127.0.0.1	www.download-winrar.com
127.0.0.1	downloadwizard.com
127.0.0.1	downloadzcenter.com
127.0.0.1	downloadzcentral.com
127.0.0.1	downloadzfree.com
127.0.0.1	www.downloadzfree.com
127.0.0.1	downloadznow.net
127.0.0.1	download-zone-free.com
127.0.0.1	www.download-zone-free.com
127.0.0.1	download-zone-free.net
127.0.0.1	www.download-zone-free.net
127.0.0.1	dp-host.com
127.0.0.1	dr.mcboo.com
127.0.0.1	dr.webhancer.com
127.0.0.1	www.dr.webhancer.com
127.0.0.1	dr2.webhancer.com
127.0.0.1	www.dr2.webhancer.com
127.0.0.1	dr38.mcboo.com
127.0.0.1	dr47.mcboo.com
127.0.0.1	dragqueen.gay-clan.com
127.0.0.1	drepubblica.it
127.0.0.1	www.drepubblica.it
127.0.0.1	drivecleaner.com
127.0.0.1	www.drivecleaner.com
127.0.0.1	drivecleanr.com
127.0.0.1	www.drivecleanr.com
127.0.0.1	drocherway.com
127.0.0.1	dropspam.com
127.0.0.1	www.dropspam.com
127.0.0.1	drug-sources-exposed.com
127.0.0.1	drvvv.com
127.0.0.1	dsupereva.it
127.0.0.1	www.dsupereva.it
127.0.0.1	dtlproduct.com
127.0.0.1	www.dtlproduct.com
127.0.0.1	dudu.com
127.0.0.1	www.dudu.com
127.0.0.1	dulcineasystems.net
127.0.0.1	dumpserv.com
127.0.0.1	duolaimi.net
127.0.0.1	dutch-sex.com
127.0.0.1	dvdaccess.net
127.0.0.1	www.dvdaccess.net
127.0.0.1	dvdbank.org
127.0.0.1	dvdcodec.net
127.0.0.1	www.dvdcodec.net
127.0.0.1	dvdsmovies.net
127.0.0.1	www.dvdsmovies.net
127.0.0.1	dvdsvideos.net
127.0.0.1	www.dvdsvideos.net
127.0.0.1	dvdtocdsite.com
127.0.0.1	www.dvdtocdsite.com
127.0.0.1	dynamique.drivecleaner.com
127.0.0.1	e3bay.it
127.0.0.1	www.e3bay.it
127.0.0.1	e4bay.it
127.0.0.1	www.e4bay.it
127.0.0.1	eager-sex.com
127.0.0.1	earthllnk.net
127.0.0.1	www.earthllnk.net
127.0.0.1	eases.net
127.0.0.1	easyantispy.com
127.0.0.1	easybestdeals.com
127.0.0.1	www.easybestdeals.com
127.0.0.1	easycategories.com
127.0.0.1	easymp3musicnow.com
127.0.0.1	www.easymp3musicnow.com
127.0.0.1	easy-pharmacy.info
127.0.0.1	www.easy-pharmacy.info
127.0.0.1	easy-search.net
127.0.0.1	easysearch4you.com
127.0.0.1	www.easysearch4you.com
127.0.0.1	easysearchingtips.com
127.0.0.1	easyspyware.com
127.0.0.1	www.easyspyware.com
127.0.0.1	easywww.info
127.0.0.1	www.easywww.info
127.0.0.1	eba6y.it
127.0.0.1	www.eba6y.it
127.0.0.1	eba7y.it
127.0.0.1	www.eba7y.it
127.0.0.1	ebaay.it
127.0.0.1	www.ebaay.it
127.0.0.1	ebagy.it
127.0.0.1	www.ebagy.it
127.0.0.1	ebahy.it
127.0.0.1	www.ebahy.it
127.0.0.1	ebajy.it
127.0.0.1	www.ebajy.it
127.0.0.1	ebaqy.it
127.0.0.1	www.ebaqy.it
127.0.0.1	ebasy.it
127.0.0.1	www.ebasy.it
127.0.0.1	ebaty.it
127.0.0.1	www.ebaty.it
127.0.0.1	ebauy.it
127.0.0.1	www.ebauy.it
127.0.0.1	ebav.com
127.0.0.1	ebaw.com
127.0.0.1	ebawy.it
127.0.0.1	www.ebawy.it
127.0.0.1	ebaxy.it
127.0.0.1	www.ebaxy.it
127.0.0.1	ebay6.it
127.0.0.1	www.ebay6.it
127.0.0.1	ebay7.it
127.0.0.1	www.ebay7.it
127.0.0.1	ebayg.it
127.0.0.1	www.ebayg.it
127.0.0.1	ebayh.it
127.0.0.1	www.ebayh.it
127.0.0.1	ebayj.it
127.0.0.1	www.ebayj.it
127.0.0.1	ebayt.it
127.0.0.1	www.ebayt.it
127.0.0.1	ebayu.it
127.0.0.1	www.ebayu.it
127.0.0.1	ebazy.it
127.0.0.1	www.ebazy.it
127.0.0.1	ebch.com
127.0.0.1	ebdv.com
127.0.0.1	ebdw.com
127.0.0.1	ebestfind.org
127.0.0.1	www.ebestfind.org
127.0.0.1	ebgay.it
127.0.0.1	www.ebgay.it
127.0.0.1	ebgo.com
127.0.0.1	ebhay.it
127.0.0.1	www.ebhay.it
127.0.0.1	ebjp.com
127.0.0.1	ebkb.com
127.0.0.1	ebkn.com
127.0.0.1	ebky.com
127.0.0.1	eblv.com
127.0.0.1	ebmu.com
127.0.0.1	ebnay.it
127.0.0.1	www.ebnay.it
127.0.0.1	ebony-pornmag.com
127.0.0.1	www.ebony-pornmag.com
127.0.0.1	ebonypornmag.com
127.0.0.1	www.ebonypornmag.com
127.0.0.1	ebqay.it
127.0.0.1	www.ebqay.it
127.0.0.1	ebsay.it
127.0.0.1	www.ebsay.it
127.0.0.1	ebsy.it
127.0.0.1	www.ebsy.it
127.0.0.1	ebvay.it
127.0.0.1	www.ebvay.it
127.0.0.1	ebvr.com
127.0.0.1	ebway.it
127.0.0.1	www.ebway.it
127.0.0.1	ebxay.it
127.0.0.1	www.ebxay.it
127.0.0.1	ebzay.it
127.0.0.1	www.ebzay.it
127.0.0.1	ecmh.com
127.0.0.1	ecmp.com
127.0.0.1	ecosrioplatenses.org
127.0.0.1	ecpm.com
127.0.0.1	ecstasyporn.net
127.0.0.1	ecwz.com
127.0.0.1	ecyb.com
127.0.0.1	edbay.it
127.0.0.1	www.edbay.it
127.0.0.1	edhq.com
127.0.0.1	edietprogram.com
127.0.0.1	www.edietprogram.com
127.0.0.1	edty.com
127.0.0.1	eduy.com
127.0.0.1	eebay.it
127.0.0.1	www.eebay.it
127.0.0.1	eeev.com
127.0.0.1	eepubblica.it
127.0.0.1	www.eepubblica.it
127.0.0.1	efbay.it
127.0.0.1	www.efbay.it
127.0.0.1	egbay.it
127.0.0.1	www.egbay.it
127.0.0.1	ehbay.it
127.0.0.1	www.ehbay.it
127.0.0.1	eikokoike.com
127.0.0.1	elitecodec.com
127.0.0.1	www.elitecodec.com
127.0.0.1	elitemediagroup.net
127.0.0.1	www.elitemediagroup.net
127.0.0.1	e-localad.com
127.0.0.1	emailicon.org
127.0.0.1	www.emailicon.org
127.0.0.1	emch.com
127.0.0.1	emcodec.com
127.0.0.1	www.emcodec.com
127.0.0.1	emediacodec.com
127.0.0.1	www.emediacodec.com
127.0.0.1	emule.mp3-muzic.com
127.0.0.1	www.emule.mp3-muzic.com
127.0.0.1	emuledownloadhome.com
127.0.0.1	www.emuledownloadhome.com
127.0.0.1	emule-freebie.com
127.0.0.1	www.emule-freebie.com
127.0.0.1	enay.it
127.0.0.1	www.enay.it
127.0.0.1	enbay.it
127.0.0.1	www.enbay.it
127.0.0.1	energy-factor.com
127.0.0.1	www.energy-factor.com
127.0.0.1	engineplay.com
127.0.0.1	www.engineplay.com
127.0.0.1	engine-ticket.com
127.0.0.1	www.engine-ticket.com
127.0.0.1	enhance.com
127.0.0.1	www.enhance.com
127.0.0.1	enhancevideos.com
127.0.0.1	www.enhancevideos.com
127.0.0.1	enitinvest.net
127.0.0.1	enjoywebsurf.com
127.0.0.1	entertainsite.net
127.0.0.1	www.entertainsite.net
127.0.0.1	enterthesearch.com
127.0.0.1	www.enterthesearch.com
127.0.0.1	e-plus.cc
127.0.0.1	epornsex.com
127.0.0.1	eprotectionline.com
127.0.0.1	www.eprotectionline.com
127.0.0.1	eprotectpage.com
127.0.0.1	www.eprotectpage.com
127.0.0.1	erbay.it
127.0.0.1	www.erbay.it
127.0.0.1	erepubblica.it
127.0.0.1	www.erepubblica.it
127.0.0.1	ergosites.com
127.0.0.1	erossoalice.it
127.0.0.1	www.erossoalice.it
127.0.0.1	errari.it
127.0.0.1	www.errari.it
127.0.0.1	error404site.com
127.0.0.1	www.error404site.com
127.0.0.1	error404site.net
127.0.0.1	www.error404site.net
127.0.0.1	errorkiller.com
127.0.0.1	www.errorkiller.com
127.0.0.1	errorprotector.com
127.0.0.1	www.errorprotector.com
127.0.0.1	errorsafe.com
127.0.0.1	www.errorsafe.com
127.0.0.1	errorsdns.com
127.0.0.1	www.errorsdns.com
127.0.0.1	ert0003.e76.163ns.com
127.0.0.1	ertikadeswiokinganfujas.com
127.0.0.1	www.ertikadeswiokinganfujas.com
127.0.0.1	es.winantivirus.com
127.0.0.1	es0-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es1-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es2-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es3-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es4-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es5-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es6-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es7-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es8-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es9-www.5zgmu7o20kt5d8yq.com
127.0.0.1	esafetylist.com
127.0.0.1	www.esafetylist.com
127.0.0.1	esafetypage.com
127.0.0.1	www.esafetypage.com
127.0.0.1	esbay.it
127.0.0.1	www.esbay.it
127.0.0.1	esearch2005.com
127.0.0.1	www.esearch2005.com
127.0.0.1	esecuritynote.com
127.0.0.1	www.esecuritynote.com
127.0.0.1	esecuritypage.com
127.0.0.1	www.esecuritypage.com
127.0.0.1	esupereva.it
127.0.0.1	www.esupereva.it
127.0.0.1	etomi.all-downloads-now.com
127.0.0.1	www.etomi.all-downloads-now.com
127.0.0.1	eupdatepage.com
127.0.0.1	www.eupdatepage.com
127.0.0.1	euuu.com
127.0.0.1	evbay.it
127.0.0.1	www.evbay.it
127.0.0.1	evidence-detector.biz
127.0.0.1	evilspidercomics.com
127.0.0.1	evko.biz
127.0.0.1	www.evko.biz
127.0.0.1	ewbay.it
127.0.0.1	www.ewbay.it
127.0.0.1	ewebsearch.net
127.0.0.1	e-websitesolutions.com
127.0.0.1	ewizard.cc
127.0.0.1	exaccess.ru
127.0.0.1	www.exaccess.ru
127.0.0.1	excellentsckin.com
127.0.0.1	exeupdate.com
127.0.0.1	www.exeupdate.com
127.0.0.1	exflow.org
127.0.0.1	www.exflow.org
127.0.0.1	exit.megago.com
127.0.0.1	expandvideo.com
127.0.0.1	www.expandvideo.com
127.0.0.1	exportplay.com
127.0.0.1	www.exportplay.com
127.0.0.1	extremepaidsurveys.com
127.0.0.1	www.extremepaidsurveys.com
127.0.0.1	extremeseek.net
127.0.0.1	eza1netsearch.com
127.0.0.1	www.eza1netsearch.com
127.0.0.1	ezcybersearch.com
127.0.0.1	www.ezcybersearch.com
127.0.0.1	ez-searching.com
127.0.0.1	ezwebsearching.com
127.0.0.1	www.ezwebsearching.com
127.0.0.1	f1.bestmanage.org
127.0.0.1	f1.truth-is-out-there.org
127.0.0.1	f1organizer.com
127.0.0.1	www.f1organizer.com
127.0.0.1	f2.bestmanage.org
127.0.0.1	f2.truth-is-out-there.org
127.0.0.1	f3.bestmanage.org
127.0.0.1	f3.truth-is-out-there.org
127.0.0.1	f4.bestmanage.org
127.0.0.1	f4.truth-is-out-there.org
127.0.0.1	f5.bestmanage.org
127.0.0.1	f5.truth-is-out-there.org
127.0.0.1	f6.bestmanage.org
127.0.0.1	f7.bestmanage.org
127.0.0.1	f7.truth-is-out-there.org
127.0.0.1	f8.bestmanage.org
127.0.0.1	f8.truth-is-out-there.org
127.0.0.1	f9.bestmanage.org
127.0.0.1	f9.truth-is-out-there.org
127.0.0.1	fairsearcher.com
127.0.0.1	www.fairsearcher.com
127.0.0.1	faithstevens.com
127.0.0.1	fantasiewelten.com
127.0.0.1	farmacept32.phpnet.us
127.0.0.1	farmsteadbandb.com
127.0.0.1	farse.com
127.0.0.1	fartpost.com
127.0.0.1	fastfreedownload.com
127.0.0.1	fastmetasearch.com
127.0.0.1	www.fastmetasearch.com
127.0.0.1	fastssearch.com
127.0.0.1	www.fastssearch.com
127.0.0.1	fastwebfinder.com
127.0.0.1	faxporn.com
127.0.0.1	fazzetta.it
127.0.0.1	www.fazzetta.it
127.0.0.1	fcorriere.it
127.0.0.1	www.fcorriere.it
127.0.0.1	featured-results.com
127.0.0.1	febay.it
127.0.0.1	www.febay.it
127.0.0.1	feed.dedsearch.com
127.0.0.1	feeds.2search.com
127.0.0.1	www.feeds.2search.com
127.0.0.1	feeds2.2search.org
127.0.0.1	www.feeds2.2search.org
127.0.0.1	ferraeri.it
127.0.0.1	www.ferraeri.it
127.0.0.1	ferrai.it
127.0.0.1	www.ferrai.it
127.0.0.1	ferrarei.it
127.0.0.1	www.ferrarei.it
127.0.0.1	ferrarti.it
127.0.0.1	www.ferrarti.it
127.0.0.1	ferrasri.it
127.0.0.1	www.ferrasri.it
127.0.0.1	ferratri.it
127.0.0.1	www.ferratri.it
127.0.0.1	ferreari.it
127.0.0.1	www.ferreari.it
127.0.0.1	ferrri.it
127.0.0.1	www.ferrri.it
127.0.0.1	ferrsari.it
127.0.0.1	www.ferrsari.it
127.0.0.1	ferrtari.it
127.0.0.1	www.ferrtari.it
127.0.0.1	fetrrari.it
127.0.0.1	www.fetrrari.it
127.0.0.1	fgazzetta.it
127.0.0.1	www.fgazzetta.it
127.0.0.1	fgoogle.it
127.0.0.1	www.fgoogle.it
127.0.0.1	fhg.panet.org
127.0.0.1	fhgate.com
127.0.0.1	www.fhgate.com
127.0.0.1	fickenisgeil.de
127.0.0.1	file.unionsms.net
127.0.0.1	filestore.com
127.0.0.1	www.filestore.com
127.0.0.1	filetretporn.com
127.0.0.1	www.filetretporn.com
127.0.0.1	Filtrodetrojan.com
127.0.0.1	www.Filtrodetrojan.com
127.0.0.1	finalfantasyactionfigures.com
127.0.0.1	www.finalfantasyactionfigures.com
127.0.0.1	finance-loans.com
127.0.0.1	find4u.net
127.0.0.1	find-52.com
127.0.0.1	www.find-52.com
127.0.0.1	findanyshow.org
127.0.0.1	www.findanyshow.org
127.0.0.1	find-find-777.net
127.0.0.1	www.find-find-777.net
127.0.0.1	find-itnow.com
127.0.0.1	findit-now.com
127.0.0.1	findloss.com
127.0.0.1	findthesite.com
127.0.0.1	findthewebsiteyouneed.com
127.0.0.1	www.findthewebsiteyouneed.com
127.0.0.1	find-uk-health.co.uk
127.0.0.1	findwapsite.org
127.0.0.1	www.findwapsite.org
127.0.0.1	findwhatevernow.com
127.0.0.1	www.findwhatevernow.com
127.0.0.1	fined.biz
127.0.0.1	fine-search.net
127.0.0.1	fionasteel.com
127.0.0.1	firefoxdownload-now.com
127.0.0.1	www.firefoxdownload-now.com
127.0.0.1	firehunt.com
127.0.0.1	www.firehunt.com
127.0.0.1	firgilio.it
127.0.0.1	www.firgilio.it
127.0.0.1	firstbookmark.net
127.0.0.1	firstgoodsearch.com
127.0.0.1	www.firstgoodsearch.com
127.0.0.1	fitness-free.com
127.0.0.1	fixerantispy.com
127.0.0.1	www.fixerantispy.com
127.0.0.1	fjsynebcod.com
127.0.0.1	www.fjsynebcod.com
127.0.0.1	flashdollars.com
127.0.0.1	www.flashdollars.com
127.0.0.1	flashflashmx.3322.org
127.0.0.1	floorsovertexas.com
127.0.0.1	www.floorsovertexas.com
127.0.0.1	floproject.com
127.0.0.1	www.floproject.com
127.0.0.1	flrxtools.greatnuke.com
127.0.0.1	flrx-tools.net
127.0.0.1	www.flrx-tools.net
127.0.0.1	fn777.greatbahamas.com
127.0.0.1	www.fn777.greatbahamas.com
127.0.0.1	foodvacations.net
127.0.0.1	forex.jps.ru
127.0.0.1	forexcredit.com
127.0.0.1	forexcredit.ru
127.0.0.1	formingfusions.com
127.0.0.1	forsythfire.net
127.0.0.1	forthline.com
127.0.0.1	foxmin.com
127.0.0.1	www.foxmin.com
127.0.0.1	fp.gad-network.com
127.0.0.1	fr.drivecleaner.com
127.0.0.1	www.fr.drivecleaner.com
127.0.0.1	fr.winantivirus.com
127.0.0.1	fr.winfixer.com
127.0.0.1	frame.crazywinnings.com
127.0.0.1	free4porno.net
127.0.0.1	free64all.com
127.0.0.1	free-adobe-download-support.com
127.0.0.1	www.free-adobe-download-support.com
127.0.0.1	free-avg.org
127.0.0.1	www.free-avg.org
127.0.0.1	free-avg-download.com
127.0.0.1	www.free-avg-download.com
127.0.0.1	free-bearshares.com
127.0.0.1	www.free-bearshares.com
127.0.0.1	freebookmark.net
127.0.0.1	freebookmarks.net
127.0.0.1	freecat.biz
127.0.0.1	www.freecat.biz
127.0.0.1	freecategories.com
127.0.0.1	free-chipes.com
127.0.0.1	freecj.com
127.0.0.1	freecoolhost.com
127.0.0.1	freedownloadhq.com
127.0.0.1	www.freedownloadhq.com
127.0.0.1	freedownloadpage.com
127.0.0.1	www.freedownloadpage.com
127.0.0.1	free-download-place.co

Utilisateur anonyme · Answer

tu as fait la manip ?
que je propose ici ?
https://leblogdeclaude.blogspot.com/2007/04/informatique-diter-son-fichier-host.html
c'est bien ton fichier host qui s'affiche avec le raccourcis que tu as crée sur le bureau ?
-----------------------------

cath69 · Answer

Oui, au lieu du fichier vide montré en exemple sur ton site, j'ai eu toute cette longue liste !

Utilisateur anonyme · Answer

Bon,
télécharges ceci:
http://siri.urz.free.fr/Softs/RHosts.exe
Exécute-le.
recolle-moi ton fichier hosts.

cath69 · Answer

# Copyright (c) 1993-1999 Microsoft Corp.
#
# Ceci est un exemple de fichier HOSTS utilisé par Microsoft TCP/IP
# pour Windows.
#
# Ce fichier contient les correspondances des adresses IP aux noms d'hôtes.
# Chaque entrée doit être sur une ligne propre. L'adresse IP doit être placée
# dans la première colonne, suivie par le nom d'hôte correspondant. L'adresse
# IP et le nom d'hôte doivent être séparés par au moins un espace.
#
# De plus, des commentaires (tels que celui-ci) peuvent être insérés sur des
# lignes propres ou après le nom d'ordinateur. Ils sont indiqué par le
# symbole '#'.
#
# Par exemple :
#
#      102.54.94.97     rhino.acme.com          # serveur source
#       38.25.63.10     x.acme.com              # hôte client x

127.0.0.1       localhost

Utilisateur anonyme · Answer

Bon au moins j'ai une certitude, il est remis à neuf....
refais un Smitfraud option 1
https://leblogdeclaude.blogspot.com/2007/04/informatique-procdure-smitfraud.html

cath69 · Answer

SmitFraudFix v2.252

Rapport fait à  5:24:36,78, 15/11/2007
Executé à partir de C:\Documents and Settings\Catherine Theiller\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Catherine Theiller


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Catherine Theiller\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CATHER~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte VIA PCI 10/100Mo Fast Ethernet - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.2.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{6DF7D03D-7185-4610-9D87-88A30506C4C7}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6DF7D03D-7185-4610-9D87-88A30506C4C7}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{6DF7D03D-7185-4610-9D87-88A30506C4C7}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

ouvres notepad:

copie/coller
-------------------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=-

------------------------------------------------
enregistre-le sous fix.reg
sur le bureau.
Double clic dessus.
Acceptes fusionner
-----------------------------------------------------------
reposte un log Hijackthis

cath69 · Answer

Logfile of HijackThis v1.99.1
Scan saved at 10:56:43, on 15/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A4069847-C342-48E2-9257-01A24E5C78EA} (F-Secure Online Scanner 3.2) - https://www.f-secure.com/en/home/support
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

Bien, tout ceci me semble correct.
Comment va ton PC ?
--------------------
démarrer/panneau de configuration/Système/onglet mise à jour/décoche mise à jour automatique.

cath69 · Answer

Tout va bien, comme avant l'infection

Utilisateur anonyme · Answer

ok, fonces vers la restauration système.
désactive la restauration système.
reboot la machine.
Recoche alors la restauration système et fais une sauvegarde d'un point de restauration....ouffff !
-------------------------------------------------------------------------------------------------------------------------------
https://leblogdeclaude.blogspot.com/2007/07/restauration-de-son-ordi-une-date.html

cath69 · Answer

Hello Philo !
Voilà, j'ai terminé la restauration du système. Tout s'est bien passé. Mon ordi fonctionne comme s'il était neuf ! merci pour ta patience et tes explications très claires.

Utilisateur anonyme · Answer

Content d'avoir mené à bien la désinfection.
;-)
lis ceci avec attention:
https://leblogdeclaude.blogspot.com/2007/05/derniers-conseils.html
cordialement

cath69 · Answer

Bien vu pour AFT cleaner et les autres derniers conseils. merci encore pour ton aide.

Utilisateur anonyme · Answer

ok, n'oublies pas...le mieux est de quitter le gratuit et aller vers du costaud en protection...f-secure par exemple.
;-)

Fly · Answer

Bonsoir Philou, je viens de lire une bonne partie de ce topic parce qu'il se trouve que j'ai le même problème que Cathy. Les bannières de pub sur  les sites sont  remplacées par le message " Your computer may be infected for spyware" . Je me demandais si je pouvais m'en debarasser en suivant toute la procédure expliquée à Cathy ?

Merci d'avance pour ta réponse !

meastikmetal · Answer

j ai un probleme avec la page de google voila ce qu elle me fait sortir  

You may be experincing unusual behaviour of your browser for your search engine and e-mail. You may be using un-licenced software which may cause the disturbance. Please install the bug fixer.
Click here to download.  
je suis sous win xp merci

Win32 + "your computer may be infected...&quo

138 réponses

Discussions similaires

Newsletters