problème Trojan.Win32.BHO.aboRésolu/Fermé

Question

Bonjour,

Suite a un problème sérieux detecté lors d'une analyse AV de kaspersky et une recommandation d'un membre, j'ouvre mon propre sujet concernant un problème insolvable avec le virus Trojan.Win32.BHO.abo que je ne peut supprimer

Je suis sur la corde raide merci de bien vouloir m'aider, je post ci-joint le rapport HijackThis :


Logfile of HijackThis v1.99.1
Scan saved at 18:28:22, on 03/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\apps\ABoard\ABoard.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Geffray\LOCALS~1\Temp\Rar$EX00.875\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {1182A964-F338-4150-B053-32772BC321E8} - C:\WINDOWS\system32\atkctr.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [UniqueDisplay] C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: 54M Wireless USB Adapter.lnk = C:\Program Files\USB\54M Wireless USB Adapter\Mrv8000x.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/default/TriJinx.1.0.0.87.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/default/mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/bingame/popcaploader_v10.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxcg_device -   - C:\WINDOWS\system32\lxcgcoms.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

merci de bien vouloir m'aider

g!rly · Answer

salut aero-D

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4
* Double-clique VundoFix.exe afin de le lancer
* Clique sur le bouton Scan for Vundo
* Lorsque le scan est complété, clique sur le bouton Remove Vundo
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

@+

FillPCA · Answer

Re,

    *  Télécharge combofix.exe (par sUBs) sur ton Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    * Double clique combofix.exe et suis les invites.
    * Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

Edite aussi un nouveau rapport Hijackthis.

FillPCA

Edite : Bonjour, à toi l'honneur !

Aero-D · Answer

Pour g!rly le rapport VundoFix (aucun fichier trouvé donc pas de redemarrage)

VundoFix V6.7.0

Checking Java version...

Java version is 1.4.2.5
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.11

Scan started at 18:41:34 03/12/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...


Pour FillPCA le rapport de Combofix n'as pas marché car il plante a chaque demarrage ><

Je met le nouveau log de HJT

Logfile of HijackThis v1.99.1
Scan saved at 19:41, on 2007-12-03
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\apps\ABoard\ABoard.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Geffray\LOCALS~1\Temp\Rar$EX00.031\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {1182A964-F338-4150-B053-32772BC321E8} - C:\WINDOWS\system32\atkctr.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [UniqueDisplay] C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: 54M Wireless USB Adapter.lnk = C:\Program Files\USB\54M Wireless USB Adapter\Mrv8000x.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/default/TriJinx.1.0.0.87.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/default/mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/bingame/popcaploader_v10.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxcg_device -   - C:\WINDOWS\system32\lxcgcoms.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

Aero-D · Answer

A en déduire par le rapport de HJT, l'erreur est 02 BHO et sa viendrais du fichier atkctr.dll dans le system32 mais si je me souvient bien on peut pas suppr un .dll ... arf on avance au moins

g!rly · Answer

re,

salut a toi fillpca ;-)

aero-D

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe      

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Aero-D · Answer

J'ai dis dans mon dernier post que combofix plantais a chaque fois sa tourne dans le vide il est dis que sa fesais 10 min d'analyse voir le double pour les pc gravement infecté ... je veux bien que mon pc sois pas super clean mais bon de la a ce que combofix tourne 1h je pense qu'il y a un prob ...

J'ai isolé le prob j'ai la clé de registre sous les yeux mais que je veux la suppr c'est impossible meme avec regcleaner et regseeker biensur manuellement aussi si je la vire je vire le virus merci de bien vouloir m'éclairer sur ce sujet

g!rly · Answer

re,

desolé je dois avoir du mal a lire ce qui est ecrit en gras, j´avais pas vu...

Télécharge OAD http://sosvirus.changelog.fr/OAD.exe
- Enregistre le sur ton bureau

Double clique sur le OAD pour le lancer

- nom de fichier à rechercher tape ou fais un copier coller de :

{1182A964-F338-4150-B053-32772BC321E8}

- Type de recherche : sélectionne l'option 6 puis valide


OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ait terminé.
Le rapport de recherche s'affichera automatiquement à l’écran dès qu'il aura terminé.

- Fais un copier / coller de ce rapport dans ton prochain post.

Note importante : Suivant la taille des disques durs cette recherche peut prendre plusieurs minutes. Sois patient

@+

Aero-D · Answer

voila le rapport de OAD : 

 2007-12-03 ---- 21:57:10.17  

----------------------------------
§§§§§§ [{1182A964-F338-4150-B053-32772BC321E8}] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

g!rly · Answer

re,

peux tu faire la meme chose avec ceci :

C:\WINDOWS\system32\atkctr.dll

Aero-D · Answer

voila pour la derniere recherche :

 2007-12-03 ---- 22:09:29.73  

----------------------------------
§§§§§§ [C:\WINDOWS\system32\atkctr.dll] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

g!rly · Answer

tu dis dans le post 6 que tu voie la cle de la dll dans ton registre
supprime la car comme tu voie moi je la voie pas
recherche en suite le fichier C:\WINDOWS\system32\atkctr.dll et supprime le aussi 
si tu n´y a arrive pas fais le en mode sans echec
si tu ne le voie pas affiche les fichiers et dossiers cachés et applique
dis moi quoi
@+

Aero-D · Answer

déja essayé de suppr la clé en mode sans echec et impossible manuellement, avec regcleaner et regseeker c'est pour sa que je seche si je la suppr le prob est réglé

g!rly · Answer

on va essayer avec avenger :

Sélectionne ceci :
  
Registry keys to delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1182A964-F338-4150-B053-32772BC321E8}

Registry keys to replace with dummy:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{1182A964-F338-4150-B053-32772BC321E8}=-

Files to Delete:
C:\WINDOWS\system32\atkctr.dll

--> Clic droit copier

- Ouvre le Bloc-Note et clic sur le menu Edition/Coller afin de coller le contenu qui est dans le cadre ci-dessus
- Enregistre le fichier sur ton bureau sous le nom remove.txt

- Télécharge The Avenger http://www.geekstogo.com/forum/files/file/393-the-avenger-by-swandog46/
- Dézip le contenu de l'archive sur ton bureau et double-clic sur avenger.exe
- Clique sur "Ok"
- Sélectionne "Load Script from File" et clique sur l'icône en forme de dossier.
- Sélectionne le fichier remove.txt qui est sur ton bureau
- Clique sur le feu vert pour lancer le script
- Clique sur "Oui"
- Accepte de redémarrer ton pc.

Quand le PC a redémarre ouvre le fichier C:\avenger.txt et copie/colle le contenu ici.

Aero-D · Answer

log d'avenger :

//////////////////////////////////////////
  Avenger Pre-Processor log
//////////////////////////////////////////

Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: {1182A964-F338-4150-B053-32772BC321E8}=-


//////////////////////////////////////////


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\icrfganw

*******************

Script file located at: \??\C:\WINDOWS\oikoynpo.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open file C:\WINDOWS\system32\atkctr.dll for deletion
Deletion of file C:\WINDOWS\system32\atkctr.dll failed!

Could not process line:
C:\WINDOWS\system32\atkctr.dll
Status: 0xc0000022



Could not open registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1182A964-F338-4150-B053-32772BC321E8} for deletion
Deletion of registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1182A964-F338-4150-B053-32772BC321E8} failed!
Status: 0xc0000022


Could not open registry key \Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1182A964-F338-4150-B053-32772BC321E8} for replacement

Could not replace values under subkey of: \Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects  .  Status: 0xc0000022
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects replaced with dummy successfully.

Completed script processing.

*******************

Finished!  Terminate.

g!rly · Answer

aie aie aie
tu peux faire analyser le fichier : 
C:\WINDOWS\system32\atkctr.dll
ici :
http://virusscan.jotti.org/de/

Aero-D · Answer

assez violent comme virus rien n'y fais on peut pas supprimer la clé ni le fichier pollueur j'espere qu'on va trouver car il est assez chiant quand meme (il provoque des erreur au lancement des programmes et donc faut le relancer par ex 4 fois pour lancer avenger xD)

g!rly · Answer

oui pas cool en effet
post le rapport d´analyse de jottis une fois que tu l´as

Aero-D · Answer

The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

grrrrr

g!rly · Answer

et ici :

http://www.virustotal.com/sobre.html

Aero-D · Answer

0 bytes size received / Se ha recibido un archivo vacio

sa soule il est pas detecté nul part

g!rly · Answer

re,

essaie ceci :

Téléchargez ceci (de gchris) : http://komun.chez-alice.fr/Repertoire/Utilitaires.Desinfection.html
Dézippez-le sur votre bureau (clic droit -> extraire tout).
Vérifiez que vous êtes bien connecté à internet.
Dans le dossier créé, double-cliquez sur le fichier "Ad-Fix.bat" ou "Ad-fix"
Choisissez l'option 1.
Si vous avez un message de votre pare-feu qui vous demande si vous voulez autoriser le fichier URL2FILE.EXE à
se connecter à Internet, Autorisez, c'est nécessaire à ad-fix pour vérifier la version.
Quand c'est finit (cela peut prendre plusieurs minutes), un rapport s'ouvre avec le bloc-notes.
Merci de faire un copier/coller ici du contenu du rapport (Ad-Fix.txt)

@+

Aero-D · Answer

voila le rapport de Ad-Fix :


         Ad-Fix v0.101e
         by gchris
 
 
OPTION 1 (Scan) :
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                  Démarré à : 

19:26:30.59 2007-12-04  


                  Executé depuis : 

C:\Documents and Settings\Geffray\Bureau\Ad-Fix


                  Os : 

Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
            Recherche de fichier manquant
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
           Recherche de fichiers cachés (pas forcément mauvais)
 
 
    Fichiers cachés à la racine du disque système :
 
BOOT.BAK
BOOT.INI
Bootfont.bin
cmldr
hiberfil.sys
IO.SYS
IPH.PH
MSDOS.SYS
pagefile.sys
sqmdata00.sqm
sqmdata01.sqm
sqmdata02.sqm
sqmdata03.sqm
sqmdata04.sqm
sqmdata05.sqm
sqmdata06.sqm
sqmdata07.sqm
sqmdata08.sqm
sqmdata09.sqm
sqmdata10.sqm
sqmdata11.sqm
sqmdata12.sqm
sqmdata13.sqm
sqmdata14.sqm
sqmdata15.sqm
sqmdata16.sqm
sqmdata17.sqm
sqmdata18.sqm
sqmdata19.sqm
sqmnoopt00.sqm
sqmnoopt01.sqm
sqmnoopt02.sqm
sqmnoopt03.sqm
sqmnoopt04.sqm
sqmnoopt05.sqm
sqmnoopt06.sqm
sqmnoopt07.sqm
sqmnoopt08.sqm
sqmnoopt09.sqm
sqmnoopt10.sqm
sqmnoopt11.sqm
sqmnoopt12.sqm
sqmnoopt13.sqm
sqmnoopt14.sqm
sqmnoopt15.sqm
sqmnoopt16.sqm
sqmnoopt17.sqm
sqmnoopt18.sqm
sqmnoopt19.sqm
 
    Fichiers cachés dans le répertoire Windows :
 
QTFont.qfn
WindowsShell.Manifest
winnt.bmp
winnt256.bmp
 
    Fichiers cachés dans le répertoire System32 :
 
cdplayer.exe.manifest
logonui.exe.manifest
ncpa.cpl.manifest
nwc.cpl.manifest
sapi.cpl.manifest
WindowsLogon.manifest
wuaucpl.cpl.manifest
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
           Analyse du registre
 

---------- USER AGENT -- POST PLATFORM

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

----------

----------  AppInit_DLLs

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll"

----------
HKCR\Interface\{48E59292-9880-11CF-9754-00AA00C00908}     Détecté !
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\media-motor.net     Détecté !
HKLM\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}     Détecté !
 
 
   Complete!
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
           Recherche de fichiers et dossiers
 
 
C:\WINDOWS\unvise32qt.exe     Détecté !
 
 
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Terminé à 19:36:44.37

Aero-D · Answer

maisj e peux affirmer que ce qu'il a trouvé c'est pas le virus car le fichier infecté est : atkctr.dll dans system32 mais impossible de le suppr manuellement, avec un prog en mode sans echec et meme dans la base de registre ... donc je sais plus trop quoi faire

g!rly · Answer

re,

fais deja ka suite de ad fix

¤Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter.
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).  

Lancez de nouveau Ad-fix
Choisissez l'option 2
Le bureau ou les icônes vont disparaître, c'est normal.
Quand c'est terminé, pressez la touche "entrée" pour redémarrer l'ordinateur.

Aero-D · Answer

voila le rapport en mode sans echec :


         Ad-Fix v0.101e
         by gchris
 
 
OPTION 2 (Fix) :
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                  Démarré à : 

20:45:35.96 2007-12-04  
en mode sans échec


                  Executé depuis : 

C:\Documents and Settings\Geffray\Bureau\Ad-Fix


                  Os : 

Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
            Recherche de fichier manquant
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
             Nettoyage du registre
 
HKCR\Interface\{48E59292-9880-11CF-9754-00AA00C00908}    Supprimé !
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\media-motor.net    Supprimé !
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
             Suppression des fichiers
 
C:\WINDOWS\unvise32qt.exe    Supprimé !
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Terminé à 20:54:54.79 


Redémarrage effectué

g!rly · Answer

re,

on va essayer ca maintenant:

Une partie de la procédure se déroulera sans avoir accès à internet, prière d'imprimer ces instructions, ou de les coller dans un fichier texte, pour lecture durant cette désinfection.

Les manipulations sont à faire sans interruption et dans l'ordre.

Si tu ne comprends pas quelque chose, demande des explications avant de commencer.

1/Télécharge Brute Force Uninstaller (de Merijn)
http://www.merijn.org/files/bfu.zip

Créé un nouveau dossier directement sur le C:\ et nomme-le BFU. Décompresse le fichier téléchargé dans ce nouveau dossier (C:\BFU)

2/FAIS UN CLIC-DROIT sur le lien suivant

http://perso.orange.fr/Chercheur-perso/scripts/toolbar.bfu

et choisis "Enregistrer la cible sous..." afin de télécharger Toolbar.bfu de Chercheur

Sauvegarde dans le dossier créé (C:\BFU). **Note : si tu utilises Internet Explorer; lors de la sauvegarde, assure-toi que le champs "Type :" affiche "Tous les fichiers".
Tu dois maintenant avoir deux fichiers dans le dossier C:\BFU : Toolbar.bfu et BFU.exe (très important).

3/ Redémarre en mode Sans Échec :
au redémarrage, tapote immédiatement la touche F8 ou F5;
tu verras un écran avec choix de démarrages apparaitre.
Utilisant les flèches du clavier, choisis "Mode Sans Échec" et valide avec "Entrée".
Choisis ton compte usuel, et non Administrateur.

4/ Démarre le "Brute Force Uninstaller" en double-cliquant BFU.exe (du dossier C:\BFU)

Clique sur le petit dossier jaune, à la droite de la boîte scrïptline to execute, et
double-clique sur :
Toolbar.bfu
Dans la boîte "scrïptline to execute", tu devrais maintenant voir ceci :
C:\BFU\Toolbar.bfu
Clique sur Execute et laisse-le faire son travail.
Attendre que Complete scrïpt execution apparaisse et clique sur OK.
Clique Exit pour fermer le programme BFU.

5/Redémarre normalement et repost un hijack this stp

@+

g!rly · Answer

salut Aero-D,

Ca n´as pas l´air de donner grand chose ?, je me trompe ?

Quelle est le probleme, lorsque tu passe combofix, as tu un message d´erreur ?

Peux tu passer cet outil stp :

 * Télécharge SREng (de Smallfrogs) : http://www.kztechs.com/eng/download.html
* Dézippe tout son contenu sur ton bureau (clic droit >Extraire ici).
* Ouvre le dossier SReng2 et double-clique sur SREng.exe.
* Clique sur "smart scan".
* Clique sur le bouton "scan".
* Quand l'analyse est terminée, clique sur le bouton "save reports".
* Sauvegarde alors le rapport sur ton bureau.
* Copie/colle le contenu du rapport SREnglLOG.log dans ta prochaine réponse. 

@+

Aero-D · Answer

sa ne donne rien et pour BFU j'ai bien essayé de lancer le mode sans echec qui au début se lancais bien mais impossible l'ordi reboot a chaque fois que je le lance donc ... faut faire quelque chose :'(

j'essaie SREng et je te redis g!rly

Aero-D · Answer

voila le rapport de SREng [CODE] 2007-12-05,13:27:23 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Home Edition Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed Follow item(s) have been choosed: All Boot Items (Including Registry, Startup Folders, Services and so on) Browser Add-ons Runing Processes (Including process model information) File Associations Winsock Provider Autorun.Inf HOSTS File Process Privileges Scan Boot Items Registry [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <"C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"> [Panicware, Inc.] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher] [(Verified)Microsoft Windows Publisher] [(Verified)Microsoft Windows Publisher] [NVIDIA Corporation] [] <"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"> [(Verified)"Sun Microsystems, Inc."] [NEC Computers International] [N/A] <"C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"> [(Verified)Logitech Inc] <"C:\Program Files\Logitech\G-series Software\LCDMon.exe"> [Logitech Inc.] [N/A] <"C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start> [InstallShield Software Corporation] [] [NVIDIA Corporation] <"C:\Program Files\Spyware Doctor\SDTrayApp.exe"> [(Verified)PC Tools] <"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"> [(Verified)Kaspersky Lab] [(Verified)Simply Super Software] <"C:\Program Files\Unlocker\UnlockerAssistant.exe"> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] [(Verified)Kaspersky Lab] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] [(Verified)Kaspersky Lab] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs> [N/A] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; C:\Program Files\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe> [Echovoice] <; "C:\Program Files\Lexmark 2300 Series\ezprint.exe"> [N/A] <; "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s> [N/A] <; "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE> [Logitech Inc.] <; "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide> [(Verified)Logitech Inc] <; "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"> [N/A] <; "C:\Program Files\Spyware Doctor\SDTrayApp.exe"> [(Verified)PC Tools] <; "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions> [Sony Ericsson Mobile Communications AB] <; SOUNDMAN.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <; "C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" -osboot> [RealNetworks, Inc.] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; C:\Program Files\Winamp\winampa.exe> [] ================================== Startup Folders [54M Wireless USB Adapter] C:\Program Files\USB\54M Wireless USB Adapter\Mrv8000x.exe [N/A]> [BHODemon 2.0] C:\PROGRA~1\BHODEM~1\BHODemon.exe [Definitive Solutions, Inc.]> ================================== Services [Ad-Aware 2007 Service / aawservice][Running/Auto Start] <"C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"> [Adobe LM Service / Adobe LM Service][Stopped/Disabled] <"C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe"> [AOL Connectivity Service / AOL ACS][Stopped/Disabled] [Gestion d'applications / AppMgmt][Stopped/Manual Start] %SystemRoot%\System32\appmgmts.dll> [Kaspersky Internet Security 7.0 / AVP][Running/Auto Start] <"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r> [##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## / Bonjour Service][Running/Auto Start] <"C:\Program Files\Bonjour\mDNSResponder.exe"> [CyberLink Background Capture Service (CBCS) / CLCapSvc][Running/Auto Start] <"c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe"><> [CyberLink Task Scheduler (CTS) / CLSched][Running/Auto Start] <"c:\APPS\Powercinema\Kernel\TV\CLSched.exe"><> [CyberLink Media Library Service / CyberLink Media Library Service][Running/Auto Start] <"C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe"> [FLEXnet Licensing Service / FLEXnet Licensing Service][Stopped/Manual Start] <"C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"> [Generic Service for HID Keyboard Input Collections / GenericHidService][Running/Auto Start] [InstallDriver Table Manager / IDriverT][Stopped/Manual Start] <"C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe"> [Process Monitor / LVPrcSrv][Running/Auto Start] [LVSrvLauncher / LVSrvLauncher][Stopped/Auto Start] [lxcg_device / lxcg_device][Stopped/Manual Start] <> [MSSQL$SONY_MEDIAMGR / MSSQL$SONY_MEDIAMGR][Stopped/Manual Start] [MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start] [MysqlInventime / MysqlInventime][Stopped/Manual Start] [NVIDIA Display Driver Service / NVSvc][Running/Auto Start] [PC Tools Auxiliary Service / sdAuxService][Running/Auto Start] [PC Tools Security Service / sdCoreService][Running/Auto Start] [SmartLinkService / SLService][Running/Auto Start] <> [SQLAgent$SONY_MEDIAMGR / SQLAgent$SONY_MEDIAMGR][Stopped/Manual Start] ================================== Drivers [3xHybrid service / 3xHybrid][Stopped/Manual Start] [abp480n5 / abp480n5][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ABP480N5.SYS> [adpu160m / adpu160m][Running/Boot Start] <\SystemRoot\system32\DRIVERS\adpu160m.sys> [Aha154x / Aha154x][Running/Boot Start] <\SystemRoot\system32\DRIVERS\aha154x.sys> [aic78u2 / aic78u2][Running/Boot Start] <\SystemRoot\system32\DRIVERS\aic78u2.sys> [aic78xx / aic78xx][Running/Boot Start] <\SystemRoot\system32\DRIVERS\aic78xx.sys> [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] [AliIde / AliIde][Running/Boot Start] <\SystemRoot\system32\DRIVERS\aliide.sys> [Pilote de filtre du bus AMD AGP / amdagp][Running/Boot Start] <\SystemRoot\system32\DRIVERS\amdagp.sys> [Pilote de processeur AMD / AmdK8][Running/System Start] [asc / asc][Running/Boot Start] <\SystemRoot\system32\DRIVERS\asc.sys> [asc3350p / asc3350p][Running/Boot Start] <\SystemRoot\system32\DRIVERS\asc3350p.sys> [asc3550 / asc3550][Running/Boot Start] <\SystemRoot\system32\DRIVERS\asc3550.sys> [cd20xrnt / cd20xrnt][Running/Boot Start] <\SystemRoot\system32\DRIVERS\cd20xrnt.sys> [CmdIde / CmdIde][Running/Boot Start] <\SystemRoot\system32\DRIVERS\cmdide.sys> [dac2w2k / dac2w2k][Running/Boot Start] <\SystemRoot\system32\DRIVERS\dac2w2k.sys> [dpti2o / dpti2o][Running/Boot Start] <\SystemRoot\system32\DRIVERS\dpti2o.sys> [flnqvxin / flnqvxin][Running/Boot Start] <\SystemRoot\system32\drivers\dhawtanq.dat> [File Security Driver / IKFileSec][Running/Boot Start] <\SystemRoot\system32\drivers\ikfilesec.sys> [System Filter Driver / IKSysFlt][Running/System Start] [System Security Driver / IKSysSec][Running/System Start] [ini910u / ini910u][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ini910u.sys> [Sony Ericsson 750 driver (WDM) / k750bus][Stopped/Manual Start] [Sony Ericsson 750 USB WMC Modem Filter / k750mdfl][Stopped/Manual Start] [Sony Ericsson 750 USB WMC Modem Drivers / k750mdm][Stopped/Manual Start] [Sony Ericsson 750 USB WMC Device Management Drivers / k750mgmt][Stopped/Manual Start] [Sony Ericsson 750 USB WMC OBEX Interface Drivers / k750obex][Stopped/Manual Start] [kl1 / kl1][Running/Boot Start] <\SystemRoot\system32\drivers\kl1.sys> [klif / klif][Running/System Start] <\??\C:\WINDOWS\system32\drivers\klif.sys> [Kaspersky Anti-Virus NDIS Filter / klim5][Running/Manual Start] [Logitech SetPoint USB Receiver device driver / LHidUsbK][Stopped/Manual Start] [Logitech SetPoint Mouse Filter Driver / LMouKE][Stopped/Manual Start] [Logitech AEC Driver / LVcKap][Stopped/Manual Start] <> [Logitech Machine Vision Engine Loader / LVMVDrv][Stopped/Manual Start] [Logitech LVPr2Mon Driver / LVPr2Mon][Running/Manual Start] <> [Logitech USB Monitor Filter / LVUSBSta][Running/Manual Start] [mraid35x / mraid35x][Running/Boot Start] <\SystemRoot\system32\DRIVERS\mraid35x.sys> [Vista 32-bits Native WiFi Driver - USB / MRV6X32U][Stopped/Manual Start] <> [54M Wireless USB Adapter Dirver for Windows XP / MRVW225][Running/Manual Start] <> [Mtlmnt5 / Mtlmnt5][Running/Manual Start] <> [Mtlstrm / Mtlstrm][Stopped/Manual Start] <> [NtMtlFax / NtMtlFax][Stopped/Manual Start] <> [nv / nv][Running/Manual Start] [Volume Adapter / pepifilter][Running/Manual Start] [Logitech QuickCam IM(PID_PEPI) / PID_PEPI][Running/Manual Start] [Pilote de liaison parallèle directe / Ptilink][Running/Manual Start] [PxHelp20 / PxHelp20][Running/Boot Start] <\SystemRoot\System32\Drivers\PxHelp20.sys> [ql1080 / ql1080][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ql1080.sys> [Ql10wnt / Ql10wnt][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ql10wnt.sys> [ql12160 / ql12160][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ql12160.sys> [ql1280 / ql1280][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ql1280.sys> [RecAgent / RecAgent][Stopped/Manual Start] <\??\C:\WINDOWS\system32\DRIVERS\RecAgent.sys> [Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver / RTL8023xp][Stopped/Manual Start] [Secdrv / Secdrv][Running/Auto Start] [StarForce Protection Environment Driver (version 1.x) / sfdrv01][Running/Boot Start] <\SystemRoot\System32\drivers\sfdrv01.sys> [StarForce Protection Helper Driver (version 2.x) / sfhlp02][Running/Boot Start] <\SystemRoot\System32\drivers\sfhlp02.sys> [StarForce Protection VFS Driver (version 2.x) / sfvfs02][Running/Boot Start] <\SystemRoot\System32\drivers\sfvfs02.sys> [Filtre de bus AGP SIS / sisagp][Running/Boot Start] <\SystemRoot\system32\DRIVERS\sisagp.sys> [SmartLink AMR_PCI Driver / Slntamr][Running/Manual Start] <> [SlNtHal / SlNtHal][Stopped/Manual Start] <> [SlWdmSup / SlWdmSup][Running/Manual Start] [Sparrow / Sparrow][Running/Boot Start] <\SystemRoot\system32\DRIVERS\sparrow.sys> [sptd / sptd][Running/Boot Start] <\SystemRoot\System32\Drivers\sptd.sys> [symc810 / symc810][Running/Boot Start] <\SystemRoot\system32\DRIVERS\symc810.sys> [symc8xx / symc8xx][Running/Boot Start] <\SystemRoot\system32\DRIVERS\symc8xx.sys> [sym_hi / sym_hi][Running/Boot Start] <\SystemRoot\system32\DRIVERS\sym_hi.sys> [sym_u3 / sym_u3][Running/Boot Start] <\SystemRoot\system32\DRIVERS\sym_u3.sys> [TosIde / TosIde][Running/Boot Start] <\SystemRoot\system32\DRIVERS oside.sys> [ultra / ultra][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ultra.sys> [ViaIde / ViaIde][Running/Boot Start] <\SystemRoot\system32\DRIVERS\viaide.sys> [WAN Miniport (ATW) / wanatw][Running/Manual Start] [Codec Teletext standard / WSTCODEC][Stopped/Manual Start] ================================== Browser Add-ons [] {1182A964-F338-4150-B053-32772BC321E8} [Java Plug-in 1.6.0_03] {08B0E5C0-4FCB-11CF-AAA5-00401C608501} [Statistiques d’Anti-Virus Internet] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} [Skype add-on (button)] {77BF5300-1474-4EC7-9980-D32B190E9B07} [&Rechercher] {92780B25-18CC-41C8-B9BE-3C9C571A8263} [] {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A> [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} [Checkers Class] {20A60F0D-9AFA-4515-A0FD-83BD84642501} [CPlayFirstTriJinxControl Object] {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} [EARTPatchX Class] {54B52E52-8000-4413-BD67-FC7FE24B59F2} [Solitaire Showdown Class] {5C051655-FCD5-4969-9182-770EA5AA5565} [UnoCtrl Class] {5D6F45B3-9043-443D-A792-115447494D24} [MJLauncherCtrl Class] {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} [Java Plug-in 1.6.0_03] {8AD9C840-044E-11D1-B3E9-00805F499D93} [MSN Games - Installer] {B8BE5E93-A60C-4D26-A2DC-220313175592} [MessengerStatsClient Class] {C3F79A2B-B9B4-4A66-B012-3EE46475B072} [Java Plug-in 1.4.2_05] {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} [Java Plug-in 1.5.0_03] {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} [Java Plug-in 1.5.0_11] {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} [Java Plug-in 1.6.0_01] {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} [Java Plug-in 1.6.0_02] {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} [Java Plug-in 1.6.0_03] {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [Java Plug-in 1.6.0_03] {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [PopCapLoader Object] {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} [Minesweeper Flags Class] {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} [QuickTime Object] {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [DataCtl Class] {0468C085-CA5B-11D0-AF08-00609797F0E0} [Adobe PDF Reader Link Helper] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [] {1182A964-F338-4150-B053-32772BC321E8} [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} [Microsoft Visio Document] {279D6C9A-652E-4833-BEFC-312CA8887857} [EARTPatchX Class] {54B52E52-8000-4413-BD67-FC7FE24B59F2} [InstallShield Update Service Agent] {5B7524C8-2446-40E9-9474-94A779DBA224} [DivXBrowserPlugin Object] {67DABFBF-D0AB-41FA-9C46-CC0F21721616} [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} [Active Desktop Mover] {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A> [Skype add-on (button)] {77BF5300-1474-4EC7-9980-D32B190E9B07} [Microsoft Web Browser] {8856F961-340A-11D0-A96B-00C04FD705A2} [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [MSN Games - Installer] {B8BE5E93-A60C-4D26-A2DC-220313175592} [VIDEO__AVI Moniker Class] {CD3AFA88-B84F-48F0-9393-7EDC34128127} [VIDEO__MPEG Moniker Class] {CD3AFA89-B84F-48F0-9393-7EDC34128127} [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [QuickTimeCheck Class] {DE4AF3B0-F4D4-11D3-B41A-0050DA2E6C21} [XML DOM Document 3.0] {F5078F32-C551-11D3-89B9-0000F81FE221} [XML HTTP] {F6D90F16-9C73-11D3-B32E-00C04F990BB4} [Ajouter à Kaspersky Anti-Bannière] [E&xporter vers Microsoft Excel] ================================== Running Processes [PID: 640 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1040 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1064 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1112 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1124 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1292 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1352 / SERVICE RÉSEAU][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [PID: 1396 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [PID: 1456 / SERVICE RÉSEAU][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [PID: 1596 / SERVICE LOCAL][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1840 / SYSTEM][C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe] [Lavasoft AB, 7, 0, 2, 5] [C:\Program Files\Lavasoft\Ad-Aware 2007\CEAPI.dll] [Lavasoft AB, 7, 0, 2, 3] [C:\Program Files\Lavasoft\Ad-Aware 2007\PKArchive84cb.dll] [PKWARE, Inc., 8.4.219.0] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Lavasoft\Ad-Aware 2007\Update.dll] [, 7, 0, 1, 3] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1924 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\lxcglmpm.DLL] [ , 1.154.19.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.2175.0] [PID: 1968 / SYSTEM][c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 520 / SYSTEM][C:\Program Files\Bonjour\mDNSResponder.exe] [Apple Computer, Inc., 1,0,3,1] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 552 / SYSTEM][c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe] [, 4.00.1214] [c:\Apps\Powercinema\Kernel\TV\CLCapSvcps.dll] [N/A, ] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [c:\Apps\Powercinema\Kernel\TV\CLCapEngine.dll] [, 4.00.1214] [c:\Apps\Powercinema\Kernel\TV\PCMRRec4.dll] [CyberLink Corp., 4.00.1304] [C:\WINDOWS\system32\msdmo.dll] [, ] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 476 / SYSTEM][c:\APPS\Powercinema\Kernel\TV\CLSched.exe] [, 4.00.1214] [c:\Apps\Powercinema\Kernel\TV\CLCapSvcps.dll] [N/A, ] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [c:\Apps\Powercinema\Kernel\TV\CLSchMgr.dll] [, 4.00.1214] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 736 / SYSTEM][C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe] [Cyberlink, 1, 1, 0, 1101] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 752 / SYSTEM][C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe] [Cyberlink, 1, 1, 0, 1101] [c:\Apps\Powercinema\Kernel\HomeNetWorking\CLNetMedia.dll] [, 1, 0, 0, 1012] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 780 / SYSTEM][c:\APPS\HIDSERVICE\HIDSERVICE.exe] [N/A, ] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 896 / SYSTEM][C:\WINDOWS\system32 vsvc32.exe] [NVIDIA Corporation, 6.14.11.6909] [C:\WINDOWS\system32 vapi.dll] [NVIDIA Corporation, 6.14.11.6909] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 964 / SYSTEM][C:\Program Files\Spyware Doctor\svcntaux.exe] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor tl100.bpl] [Borland Software Corporation, 10.0.2288.42451] [C:\Program Files\Spyware Doctor\vcl100.bpl] [Borland Software Corporation, 10.0.2288.42451] [C:\Program Files\Spyware Doctor\SysAccess.dll] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\ikdll.dll] [PCTools Research Pty Ltd., 5.0.2.1036] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1472 / SYSTEM][C:\Program Files\Spyware Doctor\swdsvc.exe] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\SysAccess.dll] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor tl100.bpl] [Borland Software Corporation, 10.0.2288.42451] [C:\Program Files\Spyware Doctor\ikdll.dll] [PCTools Research Pty Ltd., 5.0.2.1036] [C:\Program Files\Spyware Doctor\CommOM.dll] [PC Tools, 5.0.5.5] [C:\Program Files\Spyware Doctor\vcl100.bpl] [Borland Software Corporation, 10.0.2288.42451] [C:\Program Files\Spyware Doctor\CommLib.dll] [PC Tools, 5.0.5.2] [C:\Program Files\Spyware Doctor\commhlpr.dll] [PC Tools, 5.0.5.0] [C:\Program Files\Spyware Doctor\RegHelper.dll] [PC Tools, 5.0.5.2] [C:\Program Files\Spyware Doctor\inethlpr.dll] [PC Tools, 5.0.5.2] [C:\Program Files\Spyware Doctor\filehlpr.dll] [PC Tools, 5.0.5.22] [C:\Program Files\Spyware Doctor\sdcore.dll] [PC Tools, 5.0.5.25] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\FileStorage.sdp] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\Settings.sdp] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\IDBLib.sdp] [PC Tools, 5.0.5.2] [C:\Program Files\Spyware Doctor\SDInfo.sdp] [PC Tools, 5.0.5.9] [C:\Program Files\Spyware Doctor\SDExtra.sdp] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\PCTWSC.dll] [PC Tools, 1, 0, 0, 7] [C:\Program Files\Spyware Doctor\Immunizer.sdp] [PC Tools, 5.0.5.5] [C:\Program Files\Spyware Doctor\Localizer.sdp] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\NfyMan.sdp] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\quarantine.sdp] [PC Tools, 5.0.5.2] [C:\Program Files\Spyware Doctor\BH.dll] [PC Tools, 5.0.5.2] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Spyware Doctor\RebootManager.sdp] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\scaneng.sdp] [PC Tools, 5.0.5.6] [C:\Program Files\Spyware Doctor\stasks.sdp] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\SystemMonitor.sdp] [PC Tools, 5.0.5.45] [C:\Program Files\Spyware Doctor\whitelist.sdp] [PC Tools, 5.0.5.2] [C:\Program Files\Spyware Doctor\plugins\Browsers.SDP] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\plugins\cookie.sdp] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\plugins\grfiles.SDP] [PC Tools, 5.0.5.28] [C:\Program Files\Spyware Doctor\plugins\grregistry.SDP] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\PCToolsComponents.bpl] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\SH.dll] [PC Tools, 5.0.5.4] [C:\Program Files\Spyware Doctor\plugins\KLGuard.SDP] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\plugins\Network.SDP] [PC Tools, 5.0.5.13] [C:\Program Files\Spyware Doctor\plugins\Process.SDP] [PC Tools, 5.0.5.5] [C:\Program Files\Spyware Doctor\plugins\ScriptEngine.SDP] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\plugins\SDNET.SDP] [PC Tools, 5.0.5.23] [C:\Program Files\Spyware Doctor\plugins\StartUp.SDP] [PC Tools, 5.0.5.3] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll] [Kaspersky Lab, 7.0.0.125] [PID: 1848 / SYSTEM][C:\WINDOWS\system32\slserv.exe] [ , 2.80.00(24Apr2000)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 2004 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 3112 / SERVICE LOCAL][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 3952 / Geffray][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\SmartFTP Client\sfShellTools.dll] [SmartSoft Ltd, 1.0.1.0] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll] [Kaspersky Lab, 7.0.0.125] [C:\PROGRA~1\WINDOW~2\wmpband.dll] [Microsoft Corporation, 11.0.5721.5145 (WMP_11.061018-2006)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\SmartFTP Client\sfShellTools.dll] [SmartSoft Ltd, 1.0.1.0] [PID: 2552 / Geffray][C:\Documents and Settings\Geffray\Bureau\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\Documents and Settings\Geffray\Bureau\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\PROGRA~1\PANICW~1\POP-UP~1\XAHook.dll] [Panicware, Inc., 1, 0, 0, 1008] ================================== File Associations .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock Provider N/A ================================== Autorun.Inf N/A ================================== HOSTS File 127.0.0.1 localhost ================================== Process Privileges Scan Special Privilege Enabled: SeLoadDriverPrivilege [PID = 520, C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 520, C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 552, C:\APPS\POWERCINEMA\KERNEL\TV\CLCAPSVC.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 552, C:\APPS\POWERCINEMA\KERNEL\TV\CLCAPSVC.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 476, C:\APPS\POWERCINEMA\KERNEL\TV\CLSCHED.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 476, C:\APPS\POWERCINEMA\KERNEL\TV\CLSCHED.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 736, C:\PROGRAM FILES\CYBERLINK\SHARED FILES\CLML_NTSERVICE\CLMLSERVER.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 736, C:\PROGRAM FILES\CYBERLINK\SHARED FILES\CLML_NTSERVICE\CLMLSERVER.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 752, C:\PROGRAM FILES\CYBERLINK\SHARED FILES\CLML_NTSERVICE\CLMLSERVICE.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 752, C:\PROGRAM FILES\CYBERLINK\SHARED FILES\CLML_NTSERVICE\CLMLSERVICE.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 780, C:\APPS\HIDSERVICE\HIDSERVICE.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 780, C:\APPS\HIDSERVICE\HIDSERVICE.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 896, C:\WINDOWS\SYSTEM32\NVSVC32.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 896, C:\WINDOWS\SYSTEM32\NVSVC32.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 3952, C:\WINDOWS\EXPLORER.EXE] Special Privilege Enabled: SeDebugPrivilege [PID = 3952, C:\WINDOWS\EXPLORER.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3952, C:\WINDOWS\EXPLORER.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 3472, C:\APPS\ABOARD\ABOARD.EXE] Special Privilege Enabled: SeDebugPrivilege [PID = 3472, C:\APPS\ABOARD\ABOARD.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3472, C:\APPS\ABOARD\ABOARD.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 3504, C:\APPS\ABOARD\AOSD.EXE] Special Privilege Enabled: SeDebugPrivilege [PID = 3504, C:\APPS\ABOARD\AOSD.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3504, C:\APPS\ABOARD\AOSD.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 3564, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LCDMON.EXE] Special Privilege Enabled: SeDebugPrivilege [PID = 3564, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LCDMON.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3564, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LCDMON.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 3668, C:\PROGRAM FILES\FICHIERS COMMUNS\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE] Special Privilege Enabled: SeDebugPrivilege [PID = 3668, C:\PROGRAM FILES\FICHIERS COMMUNS\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3668, C:\PROGRAM FILES\FICHIERS COMMUNS\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 2052, C:\DOCUMENTS AND SETTINGS\GISELE.PCHOME\BUREAU\UNIQUEDISPLAY.EXE] Special Privilege Enabled: SeDebugPrivilege [PID = 2052, C:\DOCUMENTS AND SETTINGS\GISELE.PCHOME\BUREAU\UNIQUEDISPLAY.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 2052, C:\DOCUMENTS AND SETTINGS\GISELE.PCHOME\BUREAU\UNIQUEDISPLAY.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 3884, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCLOCK.EXE] Special Privilege Enabled: SeDebugPrivilege [PID = 3884, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCLOCK.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3884, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCLOCK.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 800, C:\PROGRAM FILES\UNLOCKER\UNLOCKERASSISTANT.EXE] Special Privilege Enabled: SeDebugPrivilege [PID = 800, C:\PROGRAM FILES\UNLOCKER\UNLOCKERASSISTANT.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 800, C:\PROGRAM FILES\UNLOCKER\UNLOCKERASSISTANT.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 1240, C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE] Special Privilege Enabled: SeDebugPrivilege [PID = 1240, C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1240, C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 828, C:\PROGRAM FILES\BHODEMON 2\BHODEMON.EXE] Special Privilege Enabled: SeDebugPrivilege [PID = 828, C:\PROGRAM FILES\BHODEMON 2\BHODEMON.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 828, C:\PROGRAM FILES\BHODEMON 2\BHODEMON.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3040, C:\WINDOWS\SYSTEM32\WUAUCLT.EXE] Special Privilege Enabled: SeSystemtimePrivilege [PID = 3040, C:\WINDOWS\SYSTEM32\WUAUCLT.EXE] ================================== API HOOK RVA Error: LoadLibraryA (Dangerous Level: High, Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA Error: LoadLibraryExA (Dangerous Level: High, Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA Error: LoadLibraryExW (Dangerous Level: High, Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA Error: LoadLibraryW (Dangerous Level: High, Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys) Entrypoint Error: FreeLibrary (Dangerous Level: High, Hooked by Module: 0x7170002D) RVA Error: GetProcAddress (Dangerous Level: High, Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys) ================================== Hidden Process N/A ================================== [/CODE]

Aero-D · Answer

l'erreur (le fichier infecté) est dans browser add-on :

Browser Add-ons
[]
{1182A964-F338-4150-B053-32772BC321E8} <C:\WINDOWS\system32\atkctr.dll, N/A>

g!rly · Answer

re,

Sélectionne cette liste ci dessous :

Drivers to unload:
flnqvxin

Files to delete:
C:\system32\drivers\dhawtanq.dat
C:\WINDOWS\system32\atkctr.dll

registry keys to delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1182A964-F338-4150-B053-32772BC321E8}

--> Clic droit copier

- Ouvre le Bloc-Note et clic sur le menu Edition/Coller afin de coller le contenu qui est dans le cadre ci-dessus
- Enregistre le fichier sur ton bureau sous le nom remove.txt

ouvre the avenger 
- Sélectionne "Load Script from File" et clique sur l'icône en forme de dossier.
- Sélectionne le fichier remove.txt qui est sur ton bureau
- Clique sur le feu vert pour lancer le script
- Clique sur "Oui"
- Accepte de redémarrer ton pc.

ps : le pc va redemarrer deux fois.

Quand le PC a redémarre ouvre le fichier C:\avenger.txt et copie/colle le contenu ici.

@+

Aero-D · Answer

Rapport d'avenger

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\oiheouac

*******************

Script file located at: \??\C:\WINDOWS\system32
vhlqjhr.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open registry key \Registry\Machine\System\CurrentControlSet\Services\flnqvxin for deletion
Unload of driver flnqvxin failed!

Could not process line:
flnqvxin
Status: 0xc0000022



Could not open file C:\system32\drivers\dhawtanq.dat for deletion
Deletion of file C:\system32\drivers\dhawtanq.dat failed!

Could not process line:
C:\system32\drivers\dhawtanq.dat
Status: 0xc0000022



Could not open file C:\WINDOWS\system32\atkctr.dll for deletion
Deletion of file C:\WINDOWS\system32\atkctr.dll failed!

Could not process line:
C:\WINDOWS\system32\atkctr.dll
Status: 0xc0000022



Could not open registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1182A964-F338-4150-B053-32772BC321E8} for deletion
Deletion of registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1182A964-F338-4150-B053-32772BC321E8} failed!
Status: 0xc0000022


Completed script processing.

*******************

Finished!  Terminate.

g!rly · Answer

re,

ca n´as toujours pas fonctionné :-(

* Télécharge delfkill32 (de Marckie) sur le bureau : http://users.telenet.be/marcvn/tools/win32delfkil.exe
* Double clique sur win32delfkil.exe et accepte les instructions. Ne t'inquiète pas si les icones disparaissent.
Si le PC ne redémarre pas tout seul, fais-le.
Poste le contenu du bloc-note qui s'ouvre.

@+

Aero-D · Answer

voila le rapport de defkill32 sans grand sucès qui ne detecte meme pas le fichier

WIN32DELFKIL LOGFILE - by Marckie
 
 
version 3.131 
2007-12-05  18:32:09.83 
running from: "C:\Documents and Settings\Geffray\Bureau"
 
 
--- File(s) found in Windows directory ---
 
--- File(s) found in system32 folder ---
 
--- Services ---
 
--- Export SharedTaskScheduler key ---
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

 
--- Notify key ---
 
 
--- rebooting the computer --- 
 
 
--- File(s) found in Windows directory ---
 
--- File(s) found in system32 folder ---
 
--- Services ---
 
--- Export SharedTaskSchedulerkey ---
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"


 
--- Notify key --- 
 
Finished!

g!rly · Answer

aero-D

oui c´est un peu déséspérant...

un autre helper va me donner un coup de main un peut plus tards;  des qu´il revient je te fais signe (il va diner)...

@+

g!rly · Answer

edit :

-> Télécharge DiagHelp.zip sur ton bureau.
   Tuto : http://www.malekal.com/DiagHelp/DiagHelp.php
-> Ne double-clic pas dessus !! Fais un clic droit sur le fichier et extraire tout
-> Un nouveau dossier chercher va être créé DiagHelp
-> Ouvre le et double-clic sur go.cmd (le .cmd peut ne pas apparaître)
-> Une fenêtre va s'ouvrir, choisis l'option 1
-> L'analyse va commencer, ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand on te le demande.

ATTENTION : pendant l'analyse, après le rapport catchme, il te sera demandé d'appuyer sur une touche afin de poursuivre le scan, suis bien les instructions à l'écran !

-> A la fin de l'analyse, il peut-être (pas obligatoire) demandé de redemanderl'ordinateur... Une fois l'ordinateur redémarré le rapport va apparaître sur le bloc-note.. Ce dernier se trouve sur C:\resultat.txt
-> Copie/colle le contenu du bloc-note qui s'ouvre, pour cela :
-> Dans le bloc-note, cliquez sur le menu Edition / Selectionner tout
-> A nouveau menu Edition / copier
-> Dans un nouveau message ici, faire un clic droit / coller

@ toute

Aero-D · Answer

voila le rapport sans grand succès lui non plus ... DiagHelp version v1.4 - http://www.malekal.com excute le 2007-12-05 à 19:53:06.85 Liste des derniers fichies modifies/crees dans windir\system32 et prefetch C:\WINDOWS\prefetch\CHCP.COM-17EDBDC9.pf -->2007-12-05 19:53:05 C:\WINDOWS\prefetch\S104..EXE-38CD3BDF.pf -->2007-12-05 19:52:31 C:\WINDOWS\prefetch\FIREFOX.EXE-06188867.pf -->2007-12-05 19:52:08 C:\WINDOWS\prefetch\BHODEMON.EXE-00DF676E.pf -->2007-12-05 19:51:56 C:\WINDOWS\prefetch\NOTEPAD.EXE-2F2D61E1.pf -->2007-12-05 19:51:54 C:\WINDOWS\prefetch\UNIQUEDISPLAY.EXE-173B7D3A.pf -->2007-12-05 19:51:44 C:\WINDOWS\prefetch\RUNDLL32.EXE-3CAE7316.pf -->2007-12-05 19:51:44 C:\WINDOWS\prefetch\LCDMON.EXE-13FBDAC6.pf -->2007-12-05 19:51:44 C:\WINDOWS\prefetch\ISSCH.EXE-2EFA1349.pf -->2007-12-05 19:51:43 C:\WINDOWS\prefetch\COMMUNICATIONS_HELPER.EXE-081C76F0.pf -->2007-12-05 19:51:42 C:\WINDOWS\System32\drivers\fidbox2.dat -->2007-12-05 19:51:11 C:\WINDOWS\System32\drivers\fidbox.dat -->2007-12-05 19:49:08 C:\WINDOWS\System32\drivers\fidbox2.idx -->2007-12-05 19:46:10 C:\WINDOWS\System32\drivers\fidbox.idx -->2007-12-05 19:46:10 C:\WINDOWS\System32\drivers\sixac^sr.sys -->2007-12-05 17:20:45 C:\WINDOWS\System32\drivers\klin.dat -->2007-12-02 13:54:01 C:\WINDOWS\System32\drivers\klick.dat -->2007-12-02 13:54:01 C:\WINDOWS\System32\adssite_sidebar_uninstall.exe -->2007-12-05 19:52:31 C:\WINDOWS\System32\swsc.exe -->2007-12-05 18:30:06 C:\WINDOWS\System32\swreg.exe -->2007-12-05 18:30:06 C:\WINDOWS\System32 estart.exe -->2007-12-05 18:30:06 C:\WINDOWS\System32 egdacl.exe -->2007-12-05 18:30:06 C:\WINDOWS\System32 eboot.exe -->2007-12-05 18:30:06 C:\WINDOWS\System32\process.exe -->2007-12-05 18:30:06 C:\WINDOWS\System32\VundoFixSVC.exe -->2007-12-04 18:22:18 C:\WINDOWS\System32\adssite_sidebar.dll -->2007-12-03 18:12:02 C:\WINDOWS\System32\atkctr.dll -->2007-12-03 09:43:44 C:\WINDOWS\System32\CONFIG.NT -->2007-12-02 13:40:32 C:\WINDOWS\System32\wpa.dbl -->2007-12-02 13:31:21 C:\WINDOWS\System32\PerfStringBackup.INI -->2007-12-02 13:15:34 C:\WINDOWS\System32\perfh00C.dat -->2007-12-02 13:15:34 C:\WINDOWS\System32\perfh009.dat -->2007-12-02 13:15:34 C:\WINDOWS\System32\perfc00C.dat -->2007-12-02 13:15:34 C:\WINDOWS\System32\perfc009.dat -->2007-12-02 13:15:34 C:\WINDOWS\System32 vapps.xml -->2007-12-01 15:46:17 C:\WINDOWS\System32\FNTCACHE.DAT -->2007-12-01 15:45:56 C:\WINDOWS\System32 sh5.dll -->2007-11-30 16:57:56 C:\WINDOWS\System32\lvcoinst.log -->2007-11-29 15:40:51 C:\WINDOWS\System32\jupdate-1.6.0_03-b05.log -->2007-11-20 10:12:33 C:\WINDOWS\System32\NVUNINST.EXE -->2007-11-12 08:03:34 C:\WINDOWS\System32 wiz.exe -->2007-11-12 06:51:00 C:\WINDOWS\System32 vwssr.dll -->2007-11-12 06:51:00 C:\WINDOWS\0.log -->2007-12-05 19:48:53 C:\WINDOWS\wiadebug.log -->2007-12-05 19:48:04 C:\WINDOWS\wiaservc.log -->2007-12-05 19:48:03 C:\WINDOWS\bootstat.dat -->2007-12-05 19:47:52 C:\WINDOWS\SchedLgU.Txt -->2007-12-05 19:45:51 C:\WINDOWS\WindowsUpdate.log -->2007-12-05 19:45:08 C:\WINDOWS\setupapi.log -->2007-12-05 19:26:41 C:\WINDOWS\QTFont.qfn -->2007-12-04 21:01:41 C:\WINDOWS\setupact.log -->2007-12-04 20:48:40 C:\WINDOWS tbtlog.txt -->2007-12-04 20:44:11 C:\WINDOWS\SpywareDoctor505Uninstall.log -->2007-12-02 13:09:16 C:\WINDOWS\SpywareDoctor505Installation.log -->2007-12-02 12:15:08 C:\WINDOWS\win.ini -->2007-12-01 20:41:54 C:\WINDOWS\DirectX.log -->2007-12-01 15:24:08 C:\WINDOWS soc.log -->2007-11-29 22:08:48 winlogon.exe Verified: Signed svchost.exe Verified: Signed ws2_32.dll Verified: Signed user32.dll Verified: Signed tcpip.sys Verified: Signed ndis.sys Verified: Signed null.sys Verified: Signed ListDLLs v2.25 - DLL lister for Win9x/NT Copyright (C) 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ explorer.exe pid: 3044 Command line: C:\WINDOWS\Explorer.EXE Base Size Version Path *** Loaded C:\WINDOWS\system32\kernel32.dll differs from file image: *** File timestamp: Mon Apr 16 17:53:11 2007 *** Loaded image timestamp: Mon Apr 16 17:53:12 2007 *** Loaded C:\WINDOWS\system32\USER32.dll differs from file image: *** File timestamp: Thu Mar 08 16:37:50 2007 *** Loaded image timestamp: Thu Mar 08 16:50:02 2007 *** Loaded C:\WINDOWS\system32\SHDOCVW.dll differs from file image: *** File timestamp: Wed Aug 22 14:57:28 2007 *** Loaded image timestamp: Wed Aug 22 14:59:42 2007 0x44080000 0xcf000 7.00.6000.16544 C:\WINDOWS\system32\WININET.dll 0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll 0x43e00000 0x45000 7.00.6000.16544 C:\WINDOWS\system32\iertutil.dll *** Loaded C:\WINDOWS\system32\SHELL32.dll differs from file image: *** File timestamp: Thu Oct 25 18:43:25 2007 *** Loaded image timestamp: Thu Oct 25 18:56:00 2007 0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll 0x636e0000 0x29000 5.00.0005.0024 C:\Program Files\Spyware Doctor\smumhook.dll 0x5a000000 0x1f000 5.00.0005.0002 C:\Program Files\Spyware Doctor\klg.dat 0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll 0x00fd0000 0x17000 10.05.0001.2027 C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll 0x10000000 0x64000 1.00.0001.0000 C:\Program Files\SmartFTP Client\sfShellTools.dll 0x01120000 0x17000 7.00.0000.0125 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll 0x01440000 0x28000 7.00.0000.0125 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll 0x13420000 0x1a000 11.00.5721.5145 C:\PROGRA~1\WINDOW~2\wmpband.dll 0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL 0x017b0000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll 0x44360000 0x5cb000 7.00.6000.16544 C:\WINDOWS\system32\ieframe.dll 0x44160000 0x124000 7.00.6000.16544 C:\WINDOWS\system32\urlmon.dll 0x442b0000 0x3c000 7.00.6000.16544 C:\WINDOWS\system32\webcheck.dll 0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\WPDShServiceObj.dll 0x01ad0000 0x26000 1.00.0002.0002 C:\Program Files\SmartFTP Client\smarthook.dll 0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceTypes.dll 0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll 0x01160000 0x4000 C:\Program Files\Unlocker\UnlockerHook.dll 0x01ab0000 0xf000 1.00.0000.1008 C:\PROGRA~1\PANICW~1\POP-UP~1\XAHook.dll 0x02ea0000 0x1c000 7.00.0000.0000 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll 0x6bd10000 0x10000 12.00.4518.1014 C:\Program Files\Microsoft Office\Office12\msohevi.dll 0x78130000 0x9b000 8.00.50727.0163 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\MSVCR80.dll 0x60980000 0x7000 3.01.4000.1823 C:\WINDOWS\system32\MSISIP.DLL 0x74e10000 0x10000 5.06.0000.8820 C:\WINDOWS\system32\wshext.dll 0x73d20000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL 0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL 0x59000000 0xe000 5.06.0000.6626 C:\WINDOWS\system32\wshFR.DLL ListDLLs v2.25 - DLL lister for Win9x/NT Copyright (C) 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ winlogon.exe pid: 1060 Command line: winlogon.exe Base Size Version Path 0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe *** Loaded C:\WINDOWS\system32\kernel32.dll differs from file image: *** File timestamp: Mon Apr 16 17:53:11 2007 *** Loaded image timestamp: Mon Apr 16 17:53:12 2007 *** Loaded C:\WINDOWS\system32\USER32.dll differs from file image: *** File timestamp: Thu Mar 08 16:37:50 2007 *** Loaded image timestamp: Thu Mar 08 16:50:02 2007 *** Loaded C:\WINDOWS\system32\SHELL32.dll differs from file image: *** File timestamp: Thu Oct 25 18:43:25 2007 *** Loaded image timestamp: Thu Oct 25 18:56:00 2007 0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll 0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll 0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll 0x10000000 0x17000 7.00.0000.0125 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll 0x012b0000 0x33000 7.00.0000.0125 C:\WINDOWS\system32\klogon.dll 0x636e0000 0x29000 5.00.0005.0024 C:\Program Files\Spyware Doctor\smumhook.dll 0x5a000000 0x1f000 5.00.0005.0002 C:\Program Files\Spyware Doctor\klg.dat *** Loaded C:\WINDOWS\system32\RASAPI32.dll differs from file image: *** File timestamp: Wed Aug 04 09:53:42 2004 *** Loaded image timestamp: Wed Aug 04 09:58:24 2004 0x014b0000 0x17000 7.00.0000.0125 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll 0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll 0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL Le volume dans le lecteur C s'appelle HDD Le numéro de série du volume est 0861-D979 Répertoire de C:\WINDOWS\system32 2004-08-05 13:00 6,144 csrss.exe 1 fichier(s) 6,144 octets 0 Rép(s) 109,386,919,936 octets libres Contenu de Downloaded Program Files Le volume dans le lecteur C s'appelle HDD Le numéro de série du volume est 0861-D979 Répertoire de C:\WINDOWS\Downloaded Program Files 2007-08-30 18:37 . 2007-08-30 18:37 .. 2004-08-16 17:08 65 desktop.ini 2002-07-25 16:13 24,576 dwusplay.dll 2002-07-25 16:13 196,608 dwusplay.exe 2003-10-26 14:25 133,712 EARTPX.dll 2003-10-26 14:13 321 EARTPX.inf 2007-04-13 01:14 382,344 GAME_UNO1.dll 2007-01-17 14:44 316 GAME_UNO1.INF 2005-02-16 15:15 401,408 isusweb.dll 2007-02-22 23:41 304,544 MessengerStatsPAClient.dll 2007-02-28 14:21 130,472 MineSweeper.dll 2005-11-09 08:28 126,976 mjolauncher.dll 2005-11-09 08:26 230 mjolauncher.inf 2007-02-28 14:21 131,472 msgrchkr.dll 2005-04-21 09:59 131,072 popcaploader.dll 2005-04-18 13:45 242 popcaploader.inf 2007-02-28 13:21 142,248 SolitaireShowdown.dll 2006-11-09 14:36 5,019 swflash.inf 2006-12-18 17:17 1,652,320 TriJinx.1.0.0.87.dll 2006-12-18 17:16 248 TriJinx.1.0.0.87.inf 2003-08-29 14:55 2,136 WMAVAX.inf 2003-06-30 21:41 1,689 WMV9VCM.inf 2007-02-19 11:26 159,128 ZIntro.ocx 22 fichier(s) 3,927,146 octets Total des fichiers listés : 22 fichier(s) 3,927,146 octets 2 Rép(s) 109,386,919,936 octets libres Recherche de rootkit! (Merci S!Ri) Recherche d'infections connues Export des clefs sensibles.. Liste des fichiers en exception sur le pare-feu XP SP2 "%ProgramFiles%\AOL 9.0\aol.exe"="%ProgramFiles%\AOL 9.0\aol.exe:*:Enabled:AOL" "%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe"="%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA" "%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe"="%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe:*:Enabled:PANDORA" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\APPS\Inventime\my.exe"="C:\APPS\Inventime\my.exe:*:Enabled:INVENTIME" "C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire" "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe"="C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe:*:Enabled:Assistance à distance - Windows Messenger et voix" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\Program Files\SmartFTP Client\SmartFTP.exe"="C:\Program Files\SmartFTP Client\SmartFTP.exe:*:Enabled:SmartFTP Client 2.5" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Export de la clef SharedTaskScheduler [SharedTaskScheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant" exports des policies REGEDIT4 [system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 Export des clefs sensibles.. Rechercher adresses sensibles dans le fichier HOSTS... catchme 0.3.1319 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-05 19:54:16 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:3a,52,47,b9,e1,d1,98,fc,8b,d8,59,0d,ff,c4,07,24,1f,94,62,5f,87,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,83,a9,ae,73,08,58,07,9c,ff,7f,2f,db,75,41,98,1c,25,.. "khjeh"=hex:1f,c8,5f,e8,0d,9a,7a,77,e2,77,6e,61,ed,80,54,f6,93,91,f0,f2,c3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:ab,13,1b,8a,7a,b1,2f,ec,06,9d,82,3b,05,e5,4f,7d,e2,f5,fc,1b,6a,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:3a,52,47,b9,e1,d1,98,fc,8b,d8,59,0d,ff,c4,07,24,1f,94,62,5f,87,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,83,a9,ae,73,08,58,07,9c,ff,7f,2f,db,75,41,98,1c,25,.. "khjeh"=hex:1f,c8,5f,e8,0d,9a,7a,77,e2,77,6e,61,ed,80,54,f6,93,91,f0,f2,c3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:ab,13,1b,8a,7a,b1,2f,ec,06,9d,82,3b,05,e5,4f,7d,e2,f5,fc,1b,6a,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:3a,52,47,b9,e1,d1,98,fc,8b,d8,59,0d,ff,c4,07,24,1f,94,62,5f,87,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,83,a9,ae,73,08,58,07,9c,ff,7f,2f,db,75,41,98,1c,25,.. "khjeh"=hex:1f,c8,5f,e8,0d,9a,7a,77,e2,77,6e,61,ed,80,54,f6,93,91,f0,f2,c3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:ab,13,1b,8a,7a,b1,2f,ec,06,9d,82,3b,05,e5,4f,7d,e2,f5,fc,1b,6a,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:3a,52,47,b9,e1,d1,98,fc,8b,d8,59,0d,ff,c4,07,24,1f,94,62,5f,87,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,83,a9,ae,73,08,58,07,9c,ff,7f,2f,db,75,41,98,1c,25,.. "khjeh"=hex:1f,c8,5f,e8,0d,9a,7a,77,e2,77,6e,61,ed,80,54,f6,93,91,f0,f2,c3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:ab,13,1b,8a,7a,b1,2f,ec,06,9d,82,3b,05,e5,4f,7d,e2,f5,fc,1b,6a,.. IPC error: 2 Le fichier spécifié est introuvable. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:22910da0 "s2"=dword:069374f3 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:3a,52,47,b9,e1,d1,98,fc,8b,d8,59,0d,ff,c4,07,24,1f,94,62,5f,87,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,83,a9,ae,73,08,58,07,9c,ff,7f,2f,db,75,41,98,1c,25,.. "khjeh"=hex:1f,c8,5f,e8,0d,9a,7a,77,e2,77,6e,61,ed,80,54,f6,93,91,f0,f2,c3,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:20,d0,24,17,4d,20,95,e4,77,d6,3b,7e,11,43,81,e6,f6,2b,6e,fa,7a,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:3a,52,47,b9,e1,d1,98,fc,8b,d8,59,0d,ff,c4,07,24,1f,94,62,5f,87,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,83,a9,ae,73,08,58,07,9c,ff,7f,2f,db,75,41,98,1c,25,.. "khjeh"=hex:1f,c8,5f,e8,0d,9a,7a,77,e2,77,6e,61,ed,80,54,f6,93,91,f0,f2,c3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:20,d0,24,17,4d,20,95,e4,77,d6,3b,7e,11,43,81,e6,f6,2b,6e,fa,7a,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\xd8\x2022\x20ac|\xff\xff\xff\xff\22\x2022\x20ac|\xf9\x20229~\2] "5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\Software\Adobe\FeatureSubscriptions\DVAAdobeDocMeta\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\Registered" scanning hidden files ... scan completed successfully hidden services: 0 hidden files: 0 KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Process list by traversal of KiWaitListHead 4 - System 204 - mDNSResponder.e 240 - CLSched.exe 256 - svcntaux.exe 376 - CLMLService.exe 404 - HidService.exe 580 - nvsvc32.exe 812 - BHODemon.exe 908 - swdsvc.exe 1000 - AOSD.EXE 1028 - firefox.exe 1036 - csrss.exe 1060 - winlogon.exe 1108 - services.exe 1120 - lsass.exe 1284 - svchost.exe 1340 - svchost.exe 1384 - svchost.exe 1448 - svchost.exe 1492 - slserv.exe 1592 - svchost.exe 1692 - LCDClock.exe 1836 - aawservice.exe 1916 - spoolsv.exe 1960 - LVPrcSrv.exe 2036 - avp.exe 2752 - LCDMon.exe 3044 - explorer.exe 3052 - alg.exe 3152 - avp.exe 3168 - SDTrayApp.exe 3712 - PSFree.exe 3752 - ctfmon.exe 3988 - cmd.exe 5944 - KProcCheck.exe -1304204150 - x --[Hidden]-- Total number of processes = 36 NOTE: Under WinXP, this will not show all processes. KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Driver/Module list by traversal of PsLoadedModuleList 804D7000 - \WINDOWS\system32 toskrnl.exe 806EC000 - \WINDOWS\system32\hal.dll F7AAF000 - \WINDOWS\system32\KDCOM.DLL F79BF000 - \WINDOWS\system32\BOOTVID.dll F74A4000 - sptd.sys F7AB1000 - \WINDOWS\System32\Drivers\WMILIB.SYS F748C000 - \WINDOWS\System32\Drivers\SCSIPORT.SYS F745D000 - ACPI.sys F744C000 - pci.sys F75AF000 - isapnp.sys F782F000 - dhawtanq.dat F7B77000 - pciide.sys F7837000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS F7AB3000 - aliide.sys F7AB5000 - cmdide.sys F7AB7000 - toside.sys F7AB9000 - viaide.sys F7ABB000 - intelide.sys F75BF000 - MountMgr.sys F742D000 - ftdisk.sys F783F000 - PartMgr.sys F75CF000 - VolSnap.sys F79C3000 - cpqarray.sys F7415000 - atapi.sys F79C7000 - aha154x.sys F7847000 - sparrow.sys F79CB000 - symc810.sys F75DF000 - aic78xx.sys F79CF000 - dac960nt.sys F75EF000 - ql10wnt.sys F79D3000 - amsint.sys F784F000 - asc.sys F79D7000 - asc3550.sys F7857000 - mraid35x.sys F785F000 - i2omp.sys F79DB000 - ini910u.sys F75FF000 - ql1240.sys F760F000 - aic78u2.sys F7867000 - symc8xx.sys F786F000 - sym_hi.sys F7877000 - sym_u3.sys F787F000 - ABP480N5.SYS F7887000 - asc3350p.sys F7ABD000 - cd20xrnt.sys F761F000 - ultra.sys F73FC000 - adpu160m.sys F788F000 - dpti2o.sys F762F000 - ql1080.sys F763F000 - ql1280.sys F764F000 - ql12160.sys F7897000 - perc2.sys F7ABF000 - perc2hib.sys F789F000 - hpn.sys F79DF000 - cbidf2k.sys F73D0000 - dac2w2k.sys F765F000 - disk.sys F766F000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS F73B0000 - fltMgr.sys F739E000 - sr.sys F767F000 - ikfilesec.sys F768F000 - PxHelp20.sys F7387000 - KSecDD.sys F72FA000 - Ntfs.sys F72CD000 - NDIS.sys F769F000 - sisagp.sys F76AF000 - viaagp.sys F72BA000 - sfvfs02.sys F78A7000 - sfhlp02.sys F72A8000 - sfdrv01.sys F76BF000 - ohci1394.sys F76CF000 - \WINDOWS\system32\DRIVERS\1394BUS.SYS F728D000 - Mup.sys F7271000 - kl1.sys F78AF000 - \WINDOWS\system32\drivers\TDI.SYS F76DF000 - alim1541.sys F76EF000 - amdagp.sys F76FF000 - agp440.sys F770F000 - agpCPQ.sys F773F000 - \SystemRoot\system32\DRIVERS ic1394.sys F653C000 - \SystemRoot\system32\DRIVERS v4_mini.sys F6528000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS F7967000 - \SystemRoot\system32\DRIVERS\usbohci.sys F6505000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS F796F000 - \SystemRoot\system32\DRIVERS\usbehci.sys F7211000 - \SystemRoot\system32\DRIVERS\imapi.sys F7201000 - \SystemRoot\system32\DRIVERS\cdrom.sys F71F1000 - \SystemRoot\system32\DRIVERS edbook.sys F64E2000 - \SystemRoot\system32\DRIVERS\ks.sys F64D1000 - \SystemRoot\system32\DRIVERS\serial.sys F7171000 - \SystemRoot\system32\DRIVERS\serenum.sys F7977000 - \SystemRoot\system32\DRIVERS\fdc.sys F6495000 - \SystemRoot\system32\DRIVERS\parport.sys F6441000 - \SystemRoot\system32\DRIVERS\slntamr.sys F797F000 - \SystemRoot\system32\DRIVERS\SlWdmSup.sys F6412000 - \SystemRoot\system32\DRIVERS\Mtlmnt5.sys F7987000 - \SystemRoot\System32\Drivers\Modem.SYS F61DB000 - \SystemRoot\system32\drivers\ALCXWDM.SYS F61B7000 - \SystemRoot\system32\drivers\portcls.sys F774F000 - \SystemRoot\system32\drivers\drmk.sys F6CE3000 - \SystemRoot\system32\DRIVERS\AmdK8.sys F798F000 - \SystemRoot\system32\DRIVERS\klim5.sys F7D05000 - \SystemRoot\system32\DRIVERS\audstub.sys F6C73000 - \SystemRoot\system32\DRIVERS asl2tp.sys F7161000 - \SystemRoot\system32\DRIVERS distapi.sys F5E6A000 - \SystemRoot\system32\DRIVERS diswan.sys F6C63000 - \SystemRoot\system32\DRIVERS aspppoe.sys F6C53000 - \SystemRoot\system32\DRIVERS aspptp.sys F5E59000 - \SystemRoot\system32\DRIVERS\psched.sys F775F000 - \SystemRoot\system32\DRIVERS\msgpc.sys F79A7000 - \SystemRoot\system32\DRIVERS\ptilink.sys F79AF000 - \SystemRoot\system32\DRIVERS aspti.sys F79B7000 - \SystemRoot\system32\DRIVERS\wanatw4.sys F776F000 - \SystemRoot\system32\DRIVERS ermdd.sys F78E7000 - \SystemRoot\system32\DRIVERS\kbdclass.sys F78EF000 - \SystemRoot\system32\DRIVERS\mouclass.sys F7AF5000 - \SystemRoot\system32\DRIVERS\swenum.sys F5E25000 - \SystemRoot\system32\DRIVERS\update.sys F715D000 - \SystemRoot\system32\DRIVERS\mssmbios.sys F778F000 - \SystemRoot\System32\Drivers\NDProxy.SYS F779F000 - \SystemRoot\system32\DRIVERS\usbhub.sys F7AF9000 - \SystemRoot\system32\DRIVERS\USBD.SYS F78FF000 - \SystemRoot\system32\DRIVERS\flpydisk.sys F37A9000 - \SystemRoot\system32\drivers\iksysflt.sys F77BF000 - \SystemRoot\system32\drivers\KCOM.SYS F3792000 - \SystemRoot\system32\drivers\iksyssec.sys F7AFB000 - \SystemRoot\System32\Drivers\i2omgmt.SYS F7AFD000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS F7BE7000 - \SystemRoot\System32\Drivers\Null.SYS F7AFF000 - \SystemRoot\System32\Drivers\Beep.SYS F7917000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS F791F000 - \SystemRoot\System32\drivers\vga.sys F7B03000 - \SystemRoot\System32\Drivers\mnmdd.SYS F7B05000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys F7927000 - \SystemRoot\System32\Drivers\Msfs.SYS F792F000 - \SystemRoot\System32\Drivers\Npfs.SYS F71A5000 - \SystemRoot\system32\DRIVERS asacd.sys F36E7000 - \SystemRoot\system32\DRIVERS\ipsec.sys F368F000 - \SystemRoot\system32\DRIVERS cpip.sys F3667000 - \SystemRoot\system32\DRIVERS etbt.sys F3645000 - \SystemRoot\System32\drivers\afd.sys F77DF000 - \SystemRoot\system32\DRIVERS etbios.sys F361A000 - \SystemRoot\system32\DRIVERS dbss.sys F35AB000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys F356D000 - \??\C:\WINDOWS\system32\drivers\klif.sys F77FF000 - \SystemRoot\System32\Drivers\Fips.SYS F354C000 - \SystemRoot\system32\DRIVERS\ipnat.sys F781F000 - \SystemRoot\system32\DRIVERS\wanarp.sys F7261000 - \SystemRoot\system32\DRIVERS\arp1394.sys F7947000 - \SystemRoot\system32\DRIVERS\usbccgp.sys F794F000 - \SystemRoot\system32\DRIVERS\USBSTOR.SYS F2F56000 - \SystemRoot\system32\DRIVERS\MRVW225.sys F3881000 - \SystemRoot\system32\DRIVERS\hidusb.sys F7221000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS F71E1000 - \SystemRoot\system32\drivers\LVUSBSta.sys F2C94000 - \SystemRoot\system32\DRIVERS\LV302V32.SYS F7B2B000 - \SystemRoot\system32\DRIVERS\lv302af.sys F71D1000 - \SystemRoot\system32\drivers\usbaudio.sys F6C83000 - \SystemRoot\System32\Drivers\Cdfs.SYS F370E000 - \SystemRoot\system32\DRIVERS\mouhid.sys F370A000 - \SystemRoot\system32\DRIVERS\kbdhid.sys F2C7C000 - \SystemRoot\System32\Drivers\dump_atapi.sys F7B65000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS BF800000 - \SystemRoot\System32\win32k.sys F3534000 - \SystemRoot\System32\drivers\Dxapi.sys F5E81000 - \SystemRoot\System32\watchdog.sys BF9C3000 - \SystemRoot\System32\drivers\dxg.sys F7B89000 - \SystemRoot\System32\drivers\dxgthk.sys BF9D5000 - \SystemRoot\System32 v4_disp.dll BFFA0000 - \SystemRoot\System32\ATMFD.DLL BAF10000 - \SystemRoot\system32\DRIVERS disuio.sys BAC8B000 - \SystemRoot\system32\DRIVERS\mrxdav.sys BAABE000 - \SystemRoot\system32\drivers\wdmaud.sys BAC33000 - \SystemRoot\system32\drivers\sysaudio.sys BA97E000 - \SystemRoot\system32\DRIVERS\srv.sys BA74E000 - \SystemRoot\system32\DRIVERS\secdrv.sys F7C6B000 - \??\C:\WINDOWS\system32\Drivers\mchInjDrv.sys F376A000 - \SystemRoot\system32\DRIVERS\LVPr2Mon.sys BA33B000 - \SystemRoot\system32\drivers\kmixer.sys B9CCE000 - \SystemRoot\System32\Drivers\HTTP.sys F7BD9000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys Total number of drivers = 180 Liste des programmes installes 54M Wireless USB Adapter Ad-Aware 2007 Adobe Acrobat 5.0 Adobe After Effects CS3 Adobe After Effects CS3 Adobe After Effects CS3 Presets Adobe Anchor Service CS3 Adobe Asset Services CS3 Adobe Audition 2.0 Adobe Audition 2.0 Adobe Bridge CS3 Adobe Bridge Start Meeting Adobe Camera Raw 4.0 Adobe CMaps Adobe Color - Photoshop Specific Adobe Color Common Settings Adobe Color EU Recommended Settings Adobe Color JA Extra Settings Adobe Color NA Extra Settings Adobe Default Language CS3 Adobe Device Central CS3 Adobe ExtendScript Toolkit 2 Adobe Fonts All Adobe Help Center 2.0 Adobe Help Viewer CS3 Adobe Linguistics CS3 Adobe MotionPicture Color Files Adobe PDF Library Files Adobe Photoshop CS3 Adobe Photoshop CS3 Adobe Reader 7.0.9 - Français Adobe Setup Adobe Setup Adobe Shockwave Player Adobe Stock Photos 1.0 Adobe Stock Photos CS3 Adobe Type Support Adobe Update Manager CS3 Adobe Version Cue CS3 Client Adobe Video Profiles Adobe WinSoft Linguistics Plugin Adobe XMP DVA Panels CS3 Adobe XMP Panels CS3 aMSN 0.97RC1 Archiveur WinRAR AutoUpdate AV Voice Changer Software DIAMOND 5.0 BHODemon 2.0.0.23 Bink and Smacker Condition Zero Correctif pour Lecteur Windows Media 11 (KB939683) Correctif pour Windows XP (KB914440) Correctif Windows XP - KB873333 Correctif Windows XP - KB873339 Correctif Windows XP - KB885250 Correctif Windows XP - KB885835 Correctif Windows XP - KB885836 Correctif Windows XP - KB886185 Correctif Windows XP - KB887472 Correctif Windows XP - KB888113 Correctif Windows XP - KB888302 Correctif Windows XP - KB890047 Correctif Windows XP - KB890175 Correctif Windows XP - KB890859 Correctif Windows XP - KB890923 Correctif Windows XP - KB891781 Correctif Windows XP - KB893066 Correctif Windows XP - KB893086 Counter-Strike: Source Dark Messiah Might and Magic Single Player Dawn Of War Dawn Of War - Winter Assault Disc2Phone DivX Codec DivX Web Player DVD Decoder Pak for Windows XP Dynomite EVEREST Ultimate Edition v2.50 GameSpy Comrade Gif Movie Gear 4 Google Earth HijackThis 1.99.1 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB926239) J2SE Runtime Environment 5.0 Update 11 J2SE Runtime Environment 5.0 Update 3 Java 2 Runtime Environment, SE v1.4.2_05 Java(TM) 6 Update 2 Java(TM) 6 Update 3 Java(TM) SE Runtime Environment 6 Update 1 Jigsaw Gallery Kaspersky Internet Security 7.0 Kaspersky Internet Security 7.0 Lecteur Windows Media 11 LimeWire PRO 4.12.11 Logitech Audio Echo Cancellation Component Logitech G-series Keyboard Software Logitech QuickCam Logitech Video Enumerator Macromedia Extension Manager Macromedia Flash Player 8 Macromedia Flash Player 8 Macromedia Flash Player 8 Plugin Macromedia Shockwave Player Messenger Plus! Live MessengerDiscovery Live 1.3.0322 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 French Language Pack Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Microsoft .NET Framework 2.0 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office Access MUI (French) 2007 Microsoft Office Excel MUI (French) 2007 Microsoft Office InfoPath MUI (French) 2007 Microsoft Office Outlook MUI (French) 2007 Microsoft Office PowerPoint MUI (French) 2007 Microsoft Office Professional Plus 2007 Microsoft Office Professional Plus 2007 Microsoft Office Proof (Arabic) 2007 Microsoft Office Proof (Dutch) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (German) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (French) 2007 Microsoft Office Publisher MUI (French) 2007 Microsoft Office Shared MUI (French) 2007 Microsoft Office Word MUI (French) 2007 Microsoft Software Update for Web Folders (French) 12 Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR) Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable Microsoft Works Mise à jour de sécurité pour Lecteur Windows Media (KB911564) Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734) Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782) Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398) Mise à jour de sécurité pour Step by Step Interactive Training (KB923723) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653) Mise à jour de sécurité pour Windows XP (KB893756) Mise à jour de sécurité pour Windows XP (KB896358) Mise à jour de sécurité pour Windows XP (KB896423) Mise à jour de sécurité pour Windows XP (KB896424) Mise à jour de sécurité pour Windows XP (KB896428) Mise à jour de sécurité pour Windows XP (KB899587) Mise à jour de sécurité pour Windows XP (KB899591) Mise à jour de sécurité pour Windows XP (KB900725) Mise à jour de sécurité pour Windows XP (KB901017) Mise à jour de sécurité pour Windows XP (KB901190) Mise à jour de sécurité pour Windows XP (KB901214) Mise à jour de sécurité pour Windows XP (KB902400) Mise à jour de sécurité pour Windows XP (KB904706) Mise à jour de sécurité pour Windows XP (KB905414) Mise à jour de sécurité pour Windows XP (KB905749) Mise à jour de sécurité pour Windows XP (KB908519) Mise à jour de sécurité pour Windows XP (KB911562) Mise à jour de sécurité pour Windows XP (KB911927) Mise à jour de sécurité pour Windows XP (KB912919) Mise à jour de sécurité pour Windows XP (KB913580) Mise à jour de sécurité pour Windows XP (KB914388) Mise à jour de sécurité pour Windows XP (KB914389) Mise à jour de sécurité pour Windows XP (KB917344) Mise à jour de sécurité pour Windows XP (KB917422) Mise à jour de sécurité pour Windows XP (KB917953) Mise à jour de sécurité pour Windows XP (KB918118) Mise à jour de sécurité pour Windows XP (KB918439) Mise à jour de sécurité pour Windows XP (KB919007) Mise à jour de sécurité pour Windows XP (KB920213) Mise à jour de sécurité pour Windows XP (KB920670) Mise à jour de sécurité pour Windows XP (KB920683) Mise à jour de sécurité pour Windows XP (KB920685) Mise à jour de sécurité pour Windows XP (KB921503) Mise à jour de sécurité pour Windows XP (KB922819) Mise à jour de sécurité pour Windows XP (KB923191) Mise à jour de sécurité pour Windows XP (KB923414) Mise à jour de sécurité pour Windows XP (KB923689) Mise à jour de sécurité pour Windows XP (KB923694) Mise à jour de sécurité pour Windows XP (KB923980) Mise à jour de sécurité pour Windows XP (KB924191) Mise à jour de sécurité pour Windows XP (KB924270) Mise à jour de sécurité pour Windows XP (KB924496) Mise à jour de sécurité pour Windows XP (KB924667) Mise à jour de sécurité pour Windows XP (KB925902) Mise à jour de sécurité pour Windows XP (KB926255) Mise à jour de sécurité pour Windows XP (KB926436) Mise à jour de sécurité pour Windows XP (KB927779) Mise à jour de sécurité pour Windows XP (KB927802) Mise à jour de sécurité pour Windows XP (KB928090) Mise à jour de sécurité pour Windows XP (KB928255) Mise à jour de sécurité pour Windows XP (KB928843) Mise à jour de sécurité pour Windows XP (KB929123) Mise à jour de sécurité pour Windows XP (KB929969) Mise à jour de sécurité pour Windows XP (KB930178) Mise à jour de sécurité pour Windows XP (KB931261) Mise à jour de sécurité pour Windows XP (KB931768) Mise à jour de sécurité pour Windows XP (KB931784) Mise à jour de sécurité pour Windows XP (KB932168) Mise à jour de sécurité pour Windows XP (KB933566) Mise à jour de sécurité pour Windows XP (KB933729) Mise à jour de sécurité pour Windows XP (KB935839) Mise à jour de sécurité pour Windows XP (KB935840) Mise à jour de sécurité pour Windows XP (KB936021) Mise à jour de sécurité pour Windows XP (KB937143) Mise à jour de sécurité pour Windows XP (KB938127) Mise à jour de sécurité pour Windows XP (KB938829) Mise à jour de sécurité pour Windows XP (KB939653) Mise à jour de sécurité pour Windows XP (KB941202) Mise à jour de sécurité pour Windows XP (KB943460) Mise à jour pour Windows XP (KB894391) Mise à jour pour Windows XP (KB898461) Mise à jour pour Windows XP (KB900485) Mise à jour pour Windows XP (KB904942) Mise à jour pour Windows XP (KB908531) Mise à jour pour Windows XP (KB910437) Mise à jour pour Windows XP (KB911280) Mise à jour pour Windows XP (KB916595) Mise à jour pour Windows XP (KB920872) Mise à jour pour Windows XP (KB922582) Mise à jour pour Windows XP (KB927891) Mise à jour pour Windows XP (KB929338) Mise à jour pour Windows XP (KB930916) Mise à jour pour Windows XP (KB931836) Mise à jour pour Windows XP (KB933360) Mise à jour pour Windows XP (KB938828) Mozilla Firefox (2.0.0.11) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 Parser and SDK mTC (remove only) MVision MyPhoneExplorer Neuf - Kit de connexion NI Service Center NVIDIA Drivers Pack Vista Inspirat 2 1.0 particleIllusion 3.0 demo PDF Settings Pop-Up Stopper Free Edition PremiumSoft Navicat 8.0 for MySQL PremiumSoft Navicat MySQL 7.2 Programme de gestion Camera de Logitech® Realtek AC'97 Audio Search Assistant Adssite Security Update for CAPICOM (KB931906) Security Update for CAPICOM (KB931906) Security Update for Excel 2007 (KB936509) Security Update for Office 2007 (KB934062) Security Update for Office 2007 (KB936514) Security Update for Publisher 2007 (KB936646) Security Update for the 2007 Microsoft Office System (KB936960) Security Update pour Microsoft .NET Framework 2.0 (KB928365) Skype™ 3.5 SLD Codec Pack SmartFTP Client Sonic RecordNow! Sony Ericsson PC Suite 1.20.173 Sony Ericsson Themes Creator 3.18 Sony Media Manager 2.2 Sony Sound Forge 8.0d Sony Vegas 7.0 Spybot - Search & Destroy 1.4 Spyware Doctor 5.1 Steam TeamSpeak 2 RC2 TimeShift TrackMania Nations ESWC 1.7.9 Trojan Remover 6.5.9 Ulead GIF Animator 5 Evaluation Unlocker 1.8.5 Update for Office 2007 (KB932080) Update for Office 2007 (KB934391) Update for Office 2007 (KB934393) Update for Outlook 2007 (KB937608) Update for Outlook 2007 Junk Email Filter (kb943559) Update for Word 2007 (KB934173) VideoLAN VLC media player 0.8.6b VideoMach 4.0.4 WebAnimé v6.05 (Enterprise Version) WebFldrs XP Winamp (remove only) Windows Installer 3.1 (KB893803) Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Live installer Windows Live Messenger Windows Media Encoder 9 Series Windows Media Encoder 9 Series Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 WinHTTrack Website Copier 3.41-3 World of Warcraft Xfire (remove only) Le volume dans le lecteur C s'appelle HDD Le numéro de série du volume est 0861-D979 Répertoire de C:\Program Files 2007-12-04 19:16 . 2007-12-04 19:16 .. 2007-11-27 17:13 Adobe 2007-07-01 16:02 Alwil Software 2007-03-11 01:29 AMD 2007-07-26 12:55 aMSN 2007-10-04 18:37 AV Vcs 5.0 DIAMOND 2007-03-10 17:55 Avast 2007-12-04 19:18 BHODemon 2 2007-08-31 13:30 Bonjour 2007-11-27 17:09 Common Files 2007-11-27 17:09 Cosmi 2007-03-11 01:29 CyberLink 2007-05-16 12:50 Disc2Phone 2007-11-03 19:09 DivX 2007-09-07 20:22 Echovoice 2007-08-22 13:13 Everest Ultimate Edition 2007 2007-12-03 17:30 Fichiers communs 2007-12-01 15:32 GameSpy 2007-09-12 12:06 Google 2007-11-29 22:08 Internet Explorer 2007-11-20 10:12 Java 2007-12-02 13:45 Kaspersky Lab 2007-11-24 09:51 Lavasoft 2007-11-28 19:30 LimeWire 2007-03-28 10:57 Logitech 2007-08-18 09:55 Lx_cats 2007-11-03 19:17 Macromedia 2007-03-14 01:51 Messenger 2007-06-19 18:00 Messenger Plus! Live 2007-11-15 19:35 MessengerDiscovery 2007-06-20 20:07 Microsoft CAPICOM 2.1.0.2 2007-03-11 01:29 microsoft frontpage 2007-08-18 14:35 Microsoft Office 2007-08-18 14:35 Microsoft Visual Studio 2007-08-18 14:29 Microsoft Visual Studio 8 2007-08-18 14:35 Microsoft Works 2007-08-18 14:33 Microsoft.NET 2007-08-30 19:36 Movie Maker 2007-12-05 19:52 Mozilla Firefox 2007-08-21 19:53 MSBuild 2007-03-11 01:29 MSN 2007-11-29 11:16 MSN Games 2007-03-11 01:29 MSN Gaming Zone 2007-11-15 19:35 MSN Messenger 2007-09-02 12:32 MSXML 4.0 2007-09-19 12:44 mTC 2007-09-21 18:25 MyPhoneExplorer 2007-04-23 13:08 MySQL 2007-06-19 19:17 NetMeeting 2007-03-12 18:41 Neuf 2007-08-30 19:36 Outlook Express 2007-05-05 10:29 Panicware 2007-11-24 17:57 particleIllusion_3_demo 2007-09-19 17:46 photofiltre 2007-11-05 21:13 PremiumSoft 2007-03-14 01:52 QuickTime 2007-06-27 19:02 RADVideo 2007-03-11 01:29 Real 2007-08-19 00:19 RegCleaner 2007-12-01 15:24 Sierra Entertainment 2007-05-23 11:24 Skype 2007-04-11 20:21 SLD Codec Pack 2007-10-21 12:20 SmartFTP Client 2007-06-03 21:19 Sony 2007-09-19 12:48 Sony Ericsson 2007-06-03 21:18 Sony Setup 2007-12-03 18:13 Spybot - Search & Destroy 2007-12-02 14:38 Spyware Doctor 2007-12-02 11:34 Steam 2007-03-11 19:45 Teamspeak 2007-04-26 12:50 THQ 2007-11-24 21:27 TrackMania Nations ESWC 2007-12-05 19:51 Trojan Remover 2007-11-03 19:10 tsG15 2007-12-04 18:58 Unlocker 2007-08-09 11:28 USB 2007-08-19 00:55 VideoLAN 2007-11-24 16:38 VideoMach-4.0.4 2007-03-11 01:29 Viewpoint 2007-11-03 13:03 Visicom Media 2007-09-30 11:53 WebAnimé 2007-09-08 19:38 Winamp 2007-06-19 21:00 Windows Live 2007-06-30 19:37 Windows Media Components 2007-03-28 10:40 Windows Media Connect 2 2007-03-28 10:40 Windows Media Player 2007-03-14 01:53 Windows NT 2007-08-18 15:37 WinRAR 2007-11-05 22:02 world of warcraft 2007-08-12 13:41 world of warcraft 2.0.12 2007-03-11 01:29 xerox 0 fichier(s) 0 octets 92 Rép(s) 109,192,118,272 octets libres Le volume dans le lecteur C s'appelle HDD Le numéro de série du volume est 0861-D979 Répertoire de C:\Program Files\fichiers communs 2007-12-03 17:30 . 2007-12-03 17:30 .. 2007-11-27 17:13 Adobe 2007-04-30 13:07 Adobe Systems Shared 2007-03-14 01:50 AOL 2007-03-14 01:50 aolshare 2007-04-23 11:05 Blizzard Entertainment 2007-11-27 17:09 Cosmi 2007-08-18 15:17 DESIGNER 2007-03-24 10:02 DirectX 2007-04-13 18:00 GTK 2007-08-30 18:37 InstallShield 2007-03-11 01:29 Java 2007-03-14 18:07 LogiShrd 2007-11-03 19:17 Macromedia 2007-08-18 15:48 Macromedia Shared 2007-08-31 13:19 Macrovision Shared 2007-08-18 15:17 Microsoft Shared 2007-03-11 01:29 MSSoap 2007-11-09 22:33 NSV 2007-03-11 01:29 Nullsoft 2007-03-11 01:29 ODBC 2007-03-11 01:29 Real 2007-03-14 01:51 Services 2007-09-09 14:07 Skype 2007-03-14 01:51 Sonic Shared 2007-03-11 01:29 SpeechEngines 2007-03-14 01:51 SureThing Shared 2007-03-14 13:35 Symantec Shared 2007-08-18 14:41 System 2007-05-16 11:22 Teleca Shared 2007-04-25 18:13 Vbox 2007-11-24 09:49 Wise Installation Wizard 2007-03-11 01:29 xing shared 0 fichier(s) 0 octets 34 Rép(s) 109,192,114,176 octets libres Le volume dans le lecteur C s'appelle HDD Le numéro de série du volume est 0861-D979 Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders 2007-08-18 14:41 . 2007-08-18 14:41 .. 2007-03-14 01:50 1033 2007-08-18 14:42 1036 2006-10-26 18:49 970,528 MSONSEXT.DLL 2006-10-26 19:12 40,256 MSOSV.DLL 1999-06-03 11:09 122,937 MSOWS409.DLL 2001-03-07 06:00 127,033 MSOWS40c.DLL 2003-07-11 01:25 80,448 PKMWS.DLL 5 fichier(s) 1,341,202 octets 4 Rép(s) 109,192,114,176 octets libres Le volume dans le lecteur C s'appelle HDD Le numéro de série du volume est 0861-D979 Répertoire de C:\Program Files\common files 2007-11-27 17:09 . 2007-11-27 17:09 .. 2007-11-27 17:09 Borland Shared 0 fichier(s) 0 octets 3 Rép(s) 109,192,114,176 octets libres Le volume dans le lecteur C s'appelle HDD Le numéro de série du volume est 0861-D979 Répertoire de C:\ 2007-12-05 18:30 280,286 win32delfkil.exe 1 fichier(s) 280,286 octets 0 Rép(s) 109,192,114,176 octets libres c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.0.125\French\setup.exe c:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\E12C95FCBD1240FEAE314D89676CA6F8\LieDetector.exe c:\Documents and Settings\Geffray\.limewire\.NetworkShare\LimeWireWin4.14.10.exe c:\Documents and Settings\Geffray\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_fr_FR.exe c:\Documents and Settings\Geffray\Application Data\Macromedia\Flash Player\#SharedObjects\6KTRWYBF\localhost\Program Files\FLV Player\FLVPlayer.exe c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{83F12F73-D52E-40C0-93B1-463C311C4E17}\Icon8255BBAC1.exe c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{83F12F73-D52E-40C0-93B1-463C311C4E17}\Icon83F12F734.exe c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{83F12F73-D52E-40C0-93B1-463C311C4E17}\Icon83F12F738.exe c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{885A63EA-382B-4DD4-A755-14809B8557D6}\ARPPRODUCTICON.exe c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{91057632-CA70-413C-B628-2D3CDBBB906B}\ARPPRODUCTICON.exe c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{DD8408E9-9421-484F-979D-DB6361E3E828}\IconDD8408E910.exe c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{DD8408E9-9421-484F-979D-DB6361E3E828}\IconDD8408E96.exe c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC.exe c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC1.exe c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B.exe c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B1.exe c:\Documents and Settings\Geffray\Application Data\Simply Super Software\Trojan Remover\fplB.exe c:\Documents and Settings\Geffray\Application Data\Simply Super Software\Trojan Remover\xaq9.exe c:\Documents and Settings\Geffray\Bureau\UniqueDisplay.exe c:\Documents and Settings\Geffray\Bureau\BFU\BFU.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\catchme.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\diff.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\dumphive.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\FilesInfoCmd.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\find2.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\Fport.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\grep.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\gzip.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\KProcCheck.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\LFiles.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\LISTDLLS.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\md5sums.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\pslist.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\sigcheck.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\streams.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp\swreg.exe c:\Documents and Settings\Geffray\Bureau\DiagHelp ar.exe c:\Documents and Settings\Geffray\Local Settings\Application Data\Adobe\Updater5\Install\aftereffects8\after_effects_8.0.1_update.exe c:\Documents and Settings\Geffray\Local Settings\Application Data\GameSpy\Comrade\updates\ComradeFull160.exe~ c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer2996\Setup.exe c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer2996 edist\WindowsInstaller-KB893803-v2-x86.exe c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer2996 edist\WindowsServer2003-KB898715-ia64-enu.exe c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer2996 edist\WindowsServer2003-KB898715-x64-enu.exe c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer2996 edist\WindowsServer2003-KB898715-x86-enu.exe c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer2996 edist\WindowsXP-KB898715-x64-enu.exe c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer3748\Setup.exe c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer3748 edist\WindowsInstaller-KB893803-v2-x86.exe c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer3748 edist\WindowsServer2003-KB898715-ia64-enu.exe c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer3748 edist\WindowsServer2003-KB898715-x64-enu.exe c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer3748 edist\WindowsServer2003-KB898715-x86-enu.exe c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer3748 edist\WindowsXP-KB898715-x64-enu.exe c:\Documents and Settings\Geffray\Local Settings\Temp\s104..exe c:\Documents and Settings\Geffray\Local Settings\Temp\s2q0.8.exe c:\Documents and Settings\Geffray\Local Settings\Temp\Rar$EX00.391\avenger.exe c:\Documents and Settings\Geffray\Mes documents\internet\codecs\DivXPlay.exe c:\Documents and Settings\Geffray\Mes documents\internet\codecs\quick time.exe c:\Documents and Settings\Geffray\Mes documents\internet\codecs\WM9Codecs.exe c:\Documents and Settings\Geffray\Mes documents\internet\graphisme et montage\audition 2.0\Audition 2.0 Setup.exe c:\Documents and Settings\Geffray\Mes documents\internet\graphisme et montage\audition 2.0\keygen.exe c:\Documents and Settings\Geffray\Mes documents\internet\graphisme et montage\sony\SF8_Retail.exe c:\Documents and Settings\Geffray\Mes documents\internet\graphisme et montage\sony\SF8_Trial.exe c:\Documents and Settings\Geffray\Mes documents\internet\installation\avast.exe c:\Documents and Settings\Geffray\Mes documents\internet\installation\live messenger +.exe c:\Documents and Settings\Geffray\Mes documents\internet\installation\live messenger.exe c:\Documents and Settings\Geffray\Mes documents\internet\installation\mozilla firefox.exe c:\Documents and Settings\Geffray\Mes documents\internet\installation\Nvidia 7300 series.exe c:\Documents and Settings\Geffray\Mes documents\internet\installation\Skype.exe c:\Documents and Settings\Geffray\Mes documents\internet\installation\SteamInstall_Full.exe c:\Documents and Settings\Geffray\Mes documents\internet\jeux\counter\HUD conter\INpact_CSS_Hud_tweaker_1.19.exe c:\Documents and Settings\Geffray\Mes documents\internet\jeux\counter\HUD conter\data\vtf_tools\jpg2tga.exe c:\Documents and Settings\Geffray\Mes documents\internet\jeux\counter\HUD conter\data\vtf_tools\vtex.exe c:\Documents and Settings\Geffray\Mes documents\internet\jeux\game boy\gameboy advance\VisualBoyAdvance.exe c:\Documents and Settings\Geffray\Mes documents\internet\jeux\kotor 2\KSE\kse_333.exe c:\Documents and Settings\Geffray\Mes documents\internet\jeux\mini jeux\ConquerAntarctica.exe c:\Documents and Settings\Geffray\Mes documents\internet\jeux\mini jeux\DirtBike.exe c:\Documents and Settings\Geffray\Mes documents\internet\jeux\WoW\BurningCrusade installer\Installer.exe c:\Documents and Settings\Geffray\Mes documents\internet\jeux\WoW\WoW Installer\Installer.exe c:\Documents and Settings\Geffray\Mes documents\internet\jeux\WoW\WoW Installer\DirectX\dxsetup.exe c:\Documents and Settings\Geffray\Mes documents\internet\jeux\WoW\WoW-2.0.0-frFR-Installer\Installer.exe c:\Documents and Settings\Geffray\Mes documents\internet\jeux\WoW\WoW-2.0.0-frFR-Installer\DirectX\dxsetup.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\dossier installation\caméra.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\dossier installation\DivXInstaller.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\dossier installation\GoogleEarth.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\dossier installation\wmp11-windowsxp-x86-fr-fr.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\dossier installation\plugin firefox\WGAPluginInstall.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\msn\BlackWizzer.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\msn\stuffplug_stuffplug_3.0.387_beta_anglais_38488.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\RAD Video Tools.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\AMV convert tool\MP3set3_68\InstMsiA.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\AMV convert tool\MP3set3_68\InstMsiW.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\AMV convert tool\MP3set3_68\setup.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\AMV convert tool\MP3set3_68\vcredist.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\sound forge\soundforge80d-trial.exe c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\sound forge\keygen\keygen.exe c:\Documents and Settings\Geffray\Mes documents\internet\protection\a2 free\a2freesetup.exe c:\Documents and Settings\Geffray\Mes documents\internet\protection\avast home\setupfre.exe c:\Documents and Settings\Geffray\Mes documents\internet\protection\pop up stopper\PopUpStopper.exe c:\Documents and Settings\Geffray\Mes documents\internet\protection egcleaner\RegCleaner.exe c:\Documents and Settings\Geffray\Mes documents\internet\protection\spybot\spybotsd14.exe c:\Documents and Settings\Gisele.PCHOME\Application Data\MEGAUPLOADTOOLBAR\megauper.exe c:\Documents and Settings\Gisele.PCHOME\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe c:\Documents and Settings\Gisele.PCHOME\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe c:\Documents and Settings\Gisele.PCHOME\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe c:\Documents and Settings\Gisele.PCHOME\Bureau\PREVXCSIFREE.EXE c:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe c:\Documents and Settings\All Users\Application Data\Logishrd\LQCVFX\Filters\MMSEF.dll c:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\bejeweled2\Bejeweled2.dll c:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\Zuma.dll c:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\E12C95FCBD1240FEAE314D89676CA6F8\dbghelp.dll c:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\E12C95FCBD1240FEAE314D89676CA6F8\GdiPlus.dll c:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\E12C95FCBD1240FEAE314D89676CA6F8\zlib.dll c:\Documents and Settings\Geffray\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll c:\Documents and Settings\Gisele.PCHOME\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll c:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{18AA4E21-D540-4a3a-9F9F-E6DE33D6F253}\MSExcel.dll c:\Documents and Settings

FillPCA · Answer

Salut,

Diaghelp est un programme de diagnostic et non un programme de nettoyage.


1/ Clique sur démarrer>Exécuter>cmd puis valide par "entrée".
Tape sc stop flnqvxin
et
sc delete flnqvxin

Continue même si un message d'erruer apparait.

2/ Ouvre le dossier DiagHelp.
Double-clique sur catchme.exe (le .exe peut ne pas apparaître).

Une fenêtre va s'ouvrir, va dans l'onglet Script.
Copie/colle ceci :

files to kill:
C:\system32\drivers\dhawtanq.dat
C:\WINDOWS\system32\atkctr.dll

Clique sur Run.

3/ Ouvre le Bloc-note
et copie-colle les lignes entre --- ci-dessous (y compris la ligne vide à la fin)

-----------------------------------------------------------------------------------
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1182A964-F338-4150-B053-32772BC321E8}]

--------------------------------------------------------------------------------------------------------------

Enregistre ce fichier sur ton bureau (Nom du fichier : "Fixme.reg " -sans inclure les guillemets- ; Type : Tous les fichiers).

Double-clique sur Fixme.reg et clique sur Oui lorsqu'on te demande confirmation pour Fusionner.
Lorsque tu reçois un message du bon déroulement, supprime le fichier Fixme.reg.

Edite un nouveau rapport Hijackthis.

FillPCA

Aero-D · Answer

Logfile of HijackThis v1.99.1
Scan saved at 21:24, on 2007-12-05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Geffray\LOCALS~1\Temp\Rar$EX00.281\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {1182A964-F338-4150-B053-32772BC321E8} - C:\WINDOWS\system32\atkctr.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [UniqueDisplay] C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [BootSkin Startup Jobs] ; "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [Echovoice Gamer Statistics] ; C:\Program Files\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
O4 - HKLM\..\Run: [EzPrint] ; "C:\Program Files\Lexmark 2300 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] ; "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Launch LGDCore] ; "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] ; "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [lxcgmon.exe] ; "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"
O4 - HKLM\..\Run: [PCMService] ; "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] ; "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] ; "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] ; C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] ; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [updateMgr] ; C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: 54M Wireless USB Adapter.lnk = C:\Program Files\USB\54M Wireless USB Adapter\Mrv8000x.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/default/TriJinx.1.0.0.87.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/default/mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/bingame/popcaploader_v10.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxcg_device -   - C:\WINDOWS\system32\lxcgcoms.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

FillPCA · Answer

Re,

    *  Télécharge gmer sur le bureau et dézippe-le (clic droit et extraire ici) : http://www2.gmer.net/gmer.zip
    * Double-clique sur gmer.exe sur le bureau. Si ton antivirus réagit, ne t'inquiète et ignore l'alerte.
    * Clique sur l'onglet "rootkit",
    * A droite, coche "Files" et "Services" puis clique sur scan.
    * A la fin du scan, clique sur le bouton copy.
    * Dans démarrer>programmes>accessoires : ouvre le bloc-note et clique sur CTRL+V afin de copier le rapport dans ce même bloc-note.
    * Edite ce rapport dans ta prochaine réponse.

Aero-D · Answer

voila le rapport de gmer

GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-12-05 21:45:01
Windows 5.1.2600 Service Pack 2


---- Files - GMER 1.0.13 ----

ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\01\54-{D79EA704-4C80-BAA6-44BA-F16B65B605C6}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v54-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\22\225-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v222-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v225-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\23\231-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v223-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v231-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\24\232-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v224-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v232-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\26\246-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v226-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v246-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\27\248-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v227-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v248-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\28\247-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v228-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v247-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\29\237-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v229-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v237-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\30\238-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v230-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v238-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\33\249-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v233-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v249-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\35\250-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v235-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v250-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\36\245-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v236-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v245-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\39\256-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v239-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v256-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\40\251-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v240-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v251-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\41\252-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v241-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v252-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\42\253-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v242-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v253-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\43\254-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v243-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v254-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\alamir_resarn@msn.com\DFSR\Staging\CS{D79EA704-4C80-BAA6-44BA-F16B65B605C6}\44\255-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v244-{AFC8E6F2-6180-4E81-AA05-7C913A478BF7}-v255-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\aurel83190@hotmail.fr\DFSR\Staging\CS{5513A8DD-1F8E-8174-C258-92CC206625EE}\01\51-{5513A8DD-1F8E-8174-C258-92CC206625EE}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v51-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\big_bowser@hotmail.fr\DFSR\Staging\CS{31135659-E1C6-E6A0-3CB2-3ADE69DA3C1E}\01\360-{31135659-E1C6-E6A0-3CB2-3ADE69DA3C1E}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v360-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS           
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\big_bowser@hotmail.fr\DFSR\Staging\CS{31135659-E1C6-E6A0-3CB2-3ADE69DA3C1E}\59\500-{E68DB935-3248-4456-9EC8-9550B1C17C74}-v159-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v500-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1          
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\big_bowser@hotmail.fr\DFSR\Staging\CS{31135659-E1C6-E6A0-3CB2-3ADE69DA3C1E}\59\500-{E68DB935-3248-4456-9EC8-9550B1C17C74}-v159-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v500-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\boudin999@hotmail.fr\DFSR\Staging\CS{15F8ADA2-D597-328E-3CBC-03A8230E59BB}\01\34-{15F8ADA2-D597-328E-3CBC-03A8230E59BB}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v34-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\boudinator@hotmail.fr\DFSR\Staging\CS{047AFA97-2F0D-50C4-33E6-5A0AD84F02A5}\01\363-{047AFA97-2F0D-50C4-33E6-5A0AD84F02A5}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v363-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS           
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\01\383-{B323547C-EE22-8F78-0919-4308AB0140BE}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v383-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS               
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\01\407-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v401-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v407-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\01\407-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v401-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v407-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\02\408-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v402-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v408-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\02\408-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v402-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v408-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\03\409-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v403-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v409-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\03\409-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v403-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v409-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\05\406-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v405-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v406-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\05\406-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v405-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v406-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\84\387-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v384-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v387-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\84\387-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v384-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v387-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\84\387-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v384-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v387-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.3              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\84\387-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v384-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v387-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\85\398-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v385-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v398-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\85\398-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v385-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v398-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\88\399-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v388-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v399-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\88\399-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v388-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v399-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\89\400-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v389-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v400-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\89\400-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v389-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v400-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\90\396-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v390-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v396-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\90\396-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v390-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v396-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\92\392-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v392-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v392-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\92\392-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v392-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v392-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\93\397-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v393-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v397-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\93\397-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v393-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v397-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\94\395-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v394-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v395-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\digit-all@live.fr\DFSR\Staging\CS{B323547C-EE22-8F78-0919-4308AB0140BE}\94\395-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v394-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v395-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\elojeni2_3@hotmail.fr\DFSR\Staging\CS{8A3CFBDA-8842-048D-9496-34FA16185118}\01\26-{8A3CFBDA-8842-048D-9496-34FA16185118}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v26-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\h.ffej@caramail.com\DFSR\Staging\CS{7A76B68A-24AB-26FF-AE40-356983A59DEF}\01\19-{7A76B68A-24AB-26FF-AE40-356983A59DEF}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v19-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS               
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\h.ffej@caramail.com\DFSR\Staging\CS{7A76B68A-24AB-26FF-AE40-356983A59DEF}\17\420-{532246A8-E4D3-4A33-AA6D-368CEE9BAB12}-v17-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v420-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1             
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\h.ffej@caramail.com\DFSR\Staging\CS{7A76B68A-24AB-26FF-AE40-356983A59DEF}\17\420-{532246A8-E4D3-4A33-AA6D-368CEE9BAB12}-v17-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v420-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS            
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\h.ffej@caramail.com\DFSR\Staging\CS{7A76B68A-24AB-26FF-AE40-356983A59DEF}\18\45-{532246A8-E4D3-4A33-AA6D-368CEE9BAB12}-v18-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v45-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1               
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\h.ffej@caramail.com\DFSR\Staging\CS{7A76B68A-24AB-26FF-AE40-356983A59DEF}\18\45-{532246A8-E4D3-4A33-AA6D-368CEE9BAB12}-v18-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v45-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\h.ffej@caramail.com\DFSR\Staging\CS{7A76B68A-24AB-26FF-AE40-356983A59DEF}\19\43-{532246A8-E4D3-4A33-AA6D-368CEE9BAB12}-v19-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v43-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1               
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\h.ffej@caramail.com\DFSR\Staging\CS{7A76B68A-24AB-26FF-AE40-356983A59DEF}\19\43-{532246A8-E4D3-4A33-AA6D-368CEE9BAB12}-v19-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v43-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\h.ffej@caramail.com\DFSR\Staging\CS{7A76B68A-24AB-26FF-AE40-356983A59DEF}\26\46-{532246A8-E4D3-4A33-AA6D-368CEE9BAB12}-v26-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v46-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1               
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\h.ffej@caramail.com\DFSR\Staging\CS{7A76B68A-24AB-26FF-AE40-356983A59DEF}\26\46-{532246A8-E4D3-4A33-AA6D-368CEE9BAB12}-v26-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v46-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\hasi76@hotmail.fr\DFSR\Staging\CS{44F1F83B-0BC1-57DE-6A94-D5B3653ABB8E}\01\24-{44F1F83B-0BC1-57DE-6A94-D5B3653ABB8E}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v24-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS                 
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\hasi76@hotmail.fr\DFSR\Staging\CS{44F1F83B-0BC1-57DE-6A94-D5B3653ABB8E}\27\30-{FD420BDA-DACF-4694-A851-9FAD52F812A6}-v27-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v30-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1                 
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\hasi76@hotmail.fr\DFSR\Staging\CS{44F1F83B-0BC1-57DE-6A94-D5B3653ABB8E}\27\30-{FD420BDA-DACF-4694-A851-9FAD52F812A6}-v27-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v30-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS                
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\hasi76@hotmail.fr\DFSR\Staging\CS{44F1F83B-0BC1-57DE-6A94-D5B3653ABB8E}\73\73-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v73-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v73-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS                
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\hasi76@hotmail.fr\DFSR\Staging\CS{44F1F83B-0BC1-57DE-6A94-D5B3653ABB8E}\84\370-{3459EF81-ED32-4002-A29C-73F4B559BC38}-v84-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v370-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1               
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\hasi76@hotmail.fr\DFSR\Staging\CS{44F1F83B-0BC1-57DE-6A94-D5B3653ABB8E}\84\370-{3459EF81-ED32-4002-A29C-73F4B559BC38}-v84-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v370-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2               
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\hasi76@hotmail.fr\DFSR\Staging\CS{44F1F83B-0BC1-57DE-6A94-D5B3653ABB8E}\84\370-{3459EF81-ED32-4002-A29C-73F4B559BC38}-v84-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v370-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\ingat75@hotmail.fr\DFSR\Staging\CS{AE27921B-B0C2-171F-5B95-245D7214B588}\01\39-{AE27921B-B0C2-171F-5B95-245D7214B588}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v39-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS                
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\ingat75@hotmail.fr\DFSR\Staging\CS{AE27921B-B0C2-171F-5B95-245D7214B588}\42\41-{3E6ADC18-140C-4F42-B7C7-AFCE1A599078}-v742-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v41-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1               
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\ingat75@hotmail.fr\DFSR\Staging\CS{AE27921B-B0C2-171F-5B95-245D7214B588}\42\41-{3E6ADC18-140C-4F42-B7C7-AFCE1A599078}-v742-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v41-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\ingat75@hotmail.fr\DFSR\Staging\CS{AE27921B-B0C2-171F-5B95-245D7214B588}\43\42-{3E6ADC18-140C-4F42-B7C7-AFCE1A599078}-v743-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v42-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1               
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\ingat75@hotmail.fr\DFSR\Staging\CS{AE27921B-B0C2-171F-5B95-245D7214B588}\43\42-{3E6ADC18-140C-4F42-B7C7-AFCE1A599078}-v743-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v42-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\ingat75@hotmail.fr\DFSR\Staging\CS{AE27921B-B0C2-171F-5B95-245D7214B588}\44\40-{3E6ADC18-140C-4F42-B7C7-AFCE1A599078}-v744-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v40-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1               
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\ingat75@hotmail.fr\DFSR\Staging\CS{AE27921B-B0C2-171F-5B95-245D7214B588}\44\40-{3E6ADC18-140C-4F42-B7C7-AFCE1A599078}-v744-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v40-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\julienreviron@hotmail.fr\DFSR\Staging\CS{EE1BE4CB-5FC0-A726-332B-94D1E057A6DF}\01\14-{EE1BE4CB-5FC0-A726-332B-94D1E057A6DF}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v14-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS          
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\latitadelinedu76@hotmail.fr\DFSR\Staging\CS{94B7DA77-C904-7125-9A02-D493865577D9}\01\15-{94B7DA77-C904-7125-9A02-D493865577D9}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v15-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\micka_noob_pgm@hotmail.fr\DFSR\Staging\CS{A39622D4-20E0-E038-F511-65A1DEB40A69}\01\16-{A39622D4-20E0-E038-F511-65A1DEB40A69}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v16-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\micka_noob_pgm@hotmail.fr\DFSR\Staging\CS{A39622D4-20E0-E038-F511-65A1DEB40A69}\14\47-{2963BF7F-C154-4BBF-999C-1EA81793142B}-v14-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v47-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\micka_noob_pgm@hotmail.fr\DFSR\Staging\CS{A39622D4-20E0-E038-F511-65A1DEB40A69}\14\47-{2963BF7F-C154-4BBF-999C-1EA81793142B}-v14-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v47-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\micka_noob_pgm@hotmail.fr\DFSR\Staging\CS{A39622D4-20E0-E038-F511-65A1DEB40A69}\14\47-{2963BF7F-C154-4BBF-999C-1EA81793142B}-v14-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v47-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.3         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\micka_noob_pgm@hotmail.fr\DFSR\Staging\CS{A39622D4-20E0-E038-F511-65A1DEB40A69}\14\47-{2963BF7F-C154-4BBF-999C-1EA81793142B}-v14-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v47-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS        
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\micka_noob_pgm@hotmail.fr\DFSR\Staging\CS{A39622D4-20E0-E038-F511-65A1DEB40A69}\76\76-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v76-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v76-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS        
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\00\126-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v100-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v126-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\00\126-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v100-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v126-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\01\127-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v101-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v127-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\01\127-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v101-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v127-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\01\17-{EBE7A08F-85D2-4386-3727-C7C81CADDF96}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v17-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\02\128-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v102-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v128-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\02\128-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v102-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v128-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\03\129-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v103-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v129-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\03\129-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v103-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v129-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\04\130-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v104-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v130-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\04\130-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v104-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v130-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\05\134-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v105-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v134-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\05\134-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v105-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v134-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\06\131-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v106-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v131-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\06\131-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v106-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v131-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\07\132-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v107-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v132-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\07\132-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v107-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v132-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\08\133-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v108-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v133-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\08\133-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v108-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v133-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\35\135-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v135-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v135-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\36\176-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v136-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v176-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\36\176-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v136-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v176-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\37\177-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v137-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v177-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\37\177-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v137-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v177-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\38\178-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v138-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v178-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\38\178-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v138-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v178-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\40\180-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v140-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v180-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\40\180-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v140-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v180-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\41\181-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v141-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v181-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\41\181-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v141-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v181-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\42\182-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v142-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v182-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\42\182-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v142-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v182-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\43\183-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v143-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v183-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\43\183-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v143-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v183-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\44\184-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v144-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v184-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\44\184-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v144-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v184-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\45\185-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v145-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v185-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\45\185-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v145-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v185-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\46\186-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v146-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v186-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\46\186-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v146-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v186-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\47\187-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v147-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v187-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\47\187-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v147-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v187-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\48\188-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v148-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v188-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\48\188-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v148-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v188-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\49\189-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v149-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v189-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\49\189-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v149-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v189-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\50\190-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v150-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v190-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\50\190-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v150-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v190-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\51\191-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v151-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v191-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\51\191-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v151-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v191-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\52\192-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v152-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v192-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\52\192-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v152-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v192-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\53\193-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v153-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v193-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\53\193-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v153-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v193-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\54\194-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v154-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v194-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\54\194-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v154-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v194-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\55\195-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v155-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v195-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\55\195-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v155-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v195-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\56\196-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v156-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v196-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\56\196-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v156-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v196-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\57\197-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v157-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v197-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\57\197-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v157-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v197-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\58\198-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v158-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v198-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\58\198-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v158-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v198-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\59\199-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v159-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v199-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\59\199-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v159-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v199-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\60\200-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v160-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v200-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\60\200-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v160-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v200-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\61\201-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v161-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v201-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\61\201-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v161-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v201-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\62\202-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v162-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v202-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\62\202-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v162-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v202-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\63\203-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v163-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v203-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\63\203-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v163-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v203-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\64\204-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v164-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v204-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\64\204-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v164-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v204-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\65\205-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v165-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v205-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\65\205-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v165-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v205-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\66\206-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v166-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v206-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\66\206-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v166-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v206-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\67\207-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v167-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v207-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\67\207-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v167-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v207-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\68\208-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v168-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v208-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\68\208-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v168-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v208-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\69\209-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v169-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v209-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\69\209-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v169-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v209-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\70\210-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v170-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v210-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\70\210-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v170-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v210-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\71\211-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v171-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v211-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\71\211-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v171-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v211-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\L

FillPCA · Answer

Re,

Ton rapport n'est pas entier. Poste-le en plusieurs fois si nécessaire.

FillPCA

Aero-D · Answer

oups autant pour moi j'edit de suite

ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\72\212-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v172-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v212-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\72\212-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v172-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v212-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\72\378-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v372-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v378-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\72\378-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v372-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v378-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\73\213-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v173-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v213-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\73\213-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v173-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v213-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\74\214-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v174-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v214-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\74\214-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v174-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v214-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\74\379-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v374-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v379-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\74\379-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v374-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v379-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\75\216-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v175-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v216-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\75\216-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v175-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v216-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\75\380-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v375-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v380-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\75\380-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v375-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v380-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\76\381-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v376-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v381-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\76\381-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v376-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v381-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\77\382-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v377-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v382-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\77\382-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v377-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v382-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS     
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\83\83-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v83-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v83-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS        
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\84\110-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v84-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v110-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\84\110-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v84-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v110-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\85\111-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v85-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v111-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\85\111-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v85-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v111-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\86\112-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v86-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v112-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\86\112-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v86-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v112-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\87\113-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v87-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v113-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\87\113-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v87-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v113-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\88\114-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v88-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v114-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\88\114-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v88-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v114-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\89\115-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v89-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v115-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\89\115-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v89-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v115-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\90\116-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v90-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v116-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\90\116-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v90-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v116-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\91\117-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v91-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v117-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\91\117-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v91-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v117-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\92\118-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v92-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v118-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\92\118-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v92-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v118-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\93\119-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v93-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v119-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\93\119-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v93-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v119-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\94\120-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v94-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v120-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\94\120-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v94-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v120-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\95\121-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v95-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v121-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\95\121-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v95-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v121-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\96\122-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v96-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v122-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\96\122-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v96-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v122-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\97\123-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v97-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v123-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\97\123-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v97-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v123-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\98\124-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v98-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v124-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\98\124-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v98-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v124-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\99\125-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v99-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v125-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{EBE7A08F-85D2-4386-3727-C7C81CADDF96}\99\125-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v99-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v125-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS      
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata	hethirdman3@hotmail.fr\DFSR\Staging\CS{CB3A678D-6F8B-A066-666C-8074954B1275}\01\48-{CB3A678D-6F8B-A066-666C-8074954B1275}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v48-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS           
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata	hethirdman3@hotmail.fr\DFSR\Staging\CS{CB3A678D-6F8B-A066-666C-8074954B1275}\97\483-{08C1F92E-E732-4ACE-96AD-2363067A73D2}-v397-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v483-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1        
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata	hethirdman3@hotmail.fr\DFSR\Staging\CS{CB3A678D-6F8B-A066-666C-8074954B1275}\97\483-{08C1F92E-E732-4ACE-96AD-2363067A73D2}-v397-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v483-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS       
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata	homas91280@hotmail.fr\DFSR\Staging\CS{68BCA219-6899-9C91-9BE9-A2CEE27E0333}\01\49-{68BCA219-6899-9C91-9BE9-A2CEE27E0333}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v49-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS            
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata	homas91280@hotmail.fr\DFSR\Staging\CS{68BCA219-6899-9C91-9BE9-A2CEE27E0333}\13\13-{10A76D37-674B-4D69-A411-8A1F9AD3786D}-v13-{10A76D37-674B-4D69-A411-8A1F9AD3786D}-v13-Partial.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS              
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata	homas91280@hotmail.fr\DFSR\Staging\CS{68BCA219-6899-9C91-9BE9-A2CEE27E0333}\23\23-{10A76D37-674B-4D69-A411-8A1F9AD3786D}-v23-{10A76D37-674B-4D69-A411-8A1F9AD3786D}-v23-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS           
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata	opless-gril27@hotmail.fr\DFSR\Staging\CS{4755839C-EE26-0BA9-9BA6-833CEEE7F48E}\01\50-{4755839C-EE26-0BA9-9BA6-833CEEE7F48E}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v50-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS         
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\warlocky@hotmail.fr\DFSR\Staging\CS{C56F1605-7D25-50DB-F21C-B37D14E7B31D}\01\79-{C56F1605-7D25-50DB-F21C-B37D14E7B31D}-v1-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v79-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS               
ADS  C:\Documents and Settings\Geffray\Local Settings\Application Data\Microsoft\Messenger\faux.reveur@cegetel.net\SharingMetadata\warlocky@hotmail.fr\DFSR\Staging\CS{C56F1605-7D25-50DB-F21C-B37D14E7B31D}\80\80-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v80-{A035F0A5-2C7A-4DB4-B7DC-1320191D13CC}-v80-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS              
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\00\548-{086225C2-4448-4685-8E51-DA7C58994C3E}-v500-{086225C2-4448-4685-8E51-DA7C58994C3E}-v548-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\00\548-{086225C2-4448-4685-8E51-DA7C58994C3E}-v500-{086225C2-4448-4685-8E51-DA7C58994C3E}-v548-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\01\454-{2DF3B1D3-07F4-1C53-9073-B416659DE632}-v1-{086225C2-4448-4685-8E51-DA7C58994C3E}-v454-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS    
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\01\549-{086225C2-4448-4685-8E51-DA7C58994C3E}-v501-{086225C2-4448-4685-8E51-DA7C58994C3E}-v549-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\01\549-{086225C2-4448-4685-8E51-DA7C58994C3E}-v501-{086225C2-4448-4685-8E51-DA7C58994C3E}-v549-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\02\550-{086225C2-4448-4685-8E51-DA7C58994C3E}-v502-{086225C2-4448-4685-8E51-DA7C58994C3E}-v550-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\02\550-{086225C2-4448-4685-8E51-DA7C58994C3E}-v502-{086225C2-4448-4685-8E51-DA7C58994C3E}-v550-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\03\551-{086225C2-4448-4685-8E51-DA7C58994C3E}-v503-{086225C2-4448-4685-8E51-DA7C58994C3E}-v551-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\03\551-{086225C2-4448-4685-8E51-DA7C58994C3E}-v503-{086225C2-4448-4685-8E51-DA7C58994C3E}-v551-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\55\455-{086225C2-4448-4685-8E51-DA7C58994C3E}-v455-{086225C2-4448-4685-8E51-DA7C58994C3E}-v455-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\56\504-{086225C2-4448-4685-8E51-DA7C58994C3E}-v456-{086225C2-4448-4685-8E51-DA7C58994C3E}-v504-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\56\504-{086225C2-4448-4685-8E51-DA7C58994C3E}-v456-{086225C2-4448-4685-8E51-DA7C58994C3E}-v504-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\57\505-{086225C2-4448-4685-8E51-DA7C58994C3E}-v457-{086225C2-4448-4685-8E51-DA7C58994C3E}-v505-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\57\505-{086225C2-4448-4685-8E51-DA7C58994C3E}-v457-{086225C2-4448-4685-8E51-DA7C58994C3E}-v505-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\58\506-{086225C2-4448-4685-8E51-DA7C58994C3E}-v458-{086225C2-4448-4685-8E51-DA7C58994C3E}-v506-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\58\506-{086225C2-4448-4685-8E51-DA7C58994C3E}-v458-{086225C2-4448-4685-8E51-DA7C58994C3E}-v506-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\59\507-{086225C2-4448-4685-8E51-DA7C58994C3E}-v459-{086225C2-4448-4685-8E51-DA7C58994C3E}-v507-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\59\507-{086225C2-4448-4685-8E51-DA7C58994C3E}-v459-{086225C2-4448-4685-8E51-DA7C58994C3E}-v507-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\60\508-{086225C2-4448-4685-8E51-DA7C58994C3E}-v460-{086225C2-4448-4685-8E51-DA7C58994C3E}-v508-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\60\508-{086225C2-4448-4685-8E51-DA7C58994C3E}-v460-{086225C2-4448-4685-8E51-DA7C58994C3E}-v508-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\61\509-{086225C2-4448-4685-8E51-DA7C58994C3E}-v461-{086225C2-4448-4685-8E51-DA7C58994C3E}-v509-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\61\509-{086225C2-4448-4685-8E51-DA7C58994C3E}-v461-{086225C2-4448-4685-8E51-DA7C58994C3E}-v509-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\62\510-{086225C2-4448-4685-8E51-DA7C58994C3E}-v462-{086225C2-4448-4685-8E51-DA7C58994C3E}-v510-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\62\510-{086225C2-4448-4685-8E51-DA7C58994C3E}-v462-{086225C2-4448-4685-8E51-DA7C58994C3E}-v510-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\63\511-{086225C2-4448-4685-8E51-DA7C58994C3E}-v463-{086225C2-4448-4685-8E51-DA7C58994C3E}-v511-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\63\511-{086225C2-4448-4685-8E51-DA7C58994C3E}-v463-{086225C2-4448-4685-8E51-DA7C58994C3E}-v511-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\64\512-{086225C2-4448-4685-8E51-DA7C58994C3E}-v464-{086225C2-4448-4685-8E51-DA7C58994C3E}-v512-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\64\512-{086225C2-4448-4685-8E51-DA7C58994C3E}-v464-{086225C2-4448-4685-8E51-DA7C58994C3E}-v512-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\65\513-{086225C2-4448-4685-8E51-DA7C58994C3E}-v465-{086225C2-4448-4685-8E51-DA7C58994C3E}-v513-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\65\513-{086225C2-4448-4685-8E51-DA7C58994C3E}-v465-{086225C2-4448-4685-8E51-DA7C58994C3E}-v513-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\66\514-{086225C2-4448-4685-8E51-DA7C58994C3E}-v466-{086225C2-4448-4685-8E51-DA7C58994C3E}-v514-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\66\514-{086225C2-4448-4685-8E51-DA7C58994C3E}-v466-{086225C2-4448-4685-8E51-DA7C58994C3E}-v514-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\67\515-{086225C2-4448-4685-8E51-DA7C58994C3E}-v467-{086225C2-4448-4685-8E51-DA7C58994C3E}-v515-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\67\515-{086225C2-4448-4685-8E51-DA7C58994C3E}-v467-{086225C2-4448-4685-8E51-DA7C58994C3E}-v515-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\68\516-{086225C2-4448-4685-8E51-DA7C58994C3E}-v468-{086225C2-4448-4685-8E51-DA7C58994C3E}-v516-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\68\516-{086225C2-4448-4685-8E51-DA7C58994C3E}-v468-{086225C2-4448-4685-8E51-DA7C58994C3E}-v516-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\69\517-{086225C2-4448-4685-8E51-DA7C58994C3E}-v469-{086225C2-4448-4685-8E51-DA7C58994C3E}-v517-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\69\517-{086225C2-4448-4685-8E51-DA7C58994C3E}-v469-{086225C2-4448-4685-8E51-DA7C58994C3E}-v517-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\70\518-{086225C2-4448-4685-8E51-DA7C58994C3E}-v470-{086225C2-4448-4685-8E51-DA7C58994C3E}-v518-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\70\518-{086225C2-4448-4685-8E51-DA7C58994C3E}-v470-{086225C2-4448-4685-8E51-DA7C58994C3E}-v518-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\71\519-{086225C2-4448-4685-8E51-DA7C58994C3E}-v471-{086225C2-4448-4685-8E51-DA7C58994C3E}-v519-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\71\519-{086225C2-4448-4685-8E51-DA7C58994C3E}-v471-{086225C2-4448-4685-8E51-DA7C58994C3E}-v519-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\72\520-{086225C2-4448-4685-8E51-DA7C58994C3E}-v472-{086225C2-4448-4685-8E51-DA7C58994C3E}-v520-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\72\520-{086225C2-4448-4685-8E51-DA7C58994C3E}-v472-{086225C2-4448-4685-8E51-DA7C58994C3E}-v520-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\73\521-{086225C2-4448-4685-8E51-DA7C58994C3E}-v473-{086225C2-4448-4685-8E51-DA7C58994C3E}-v521-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\73\521-{086225C2-4448-4685-8E51-DA7C58994C3E}-v473-{086225C2-4448-4685-8E51-DA7C58994C3E}-v521-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\74\522-{086225C2-4448-4685-8E51-DA7C58994C3E}-v474-{086225C2-4448-4685-8E51-DA7C58994C3E}-v522-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\74\522-{086225C2-4448-4685-8E51-DA7C58994C3E}-v474-{086225C2-4448-4685-8E51-DA7C58994C3E}-v522-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\75\523-{086225C2-4448-4685-8E51-DA7C58994C3E}-v475-{086225C2-4448-4685-8E51-DA7C58994C3E}-v523-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\75\523-{086225C2-4448-4685-8E51-DA7C58994C3E}-v475-{086225C2-4448-4685-8E51-DA7C58994C3E}-v523-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\76\524-{086225C2-4448-4685-8E51-DA7C58994C3E}-v476-{086225C2-4448-4685-8E51-DA7C58994C3E}-v524-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\76\524-{086225C2-4448-4685-8E51-DA7C58994C3E}-v476-{086225C2-4448-4685-8E51-DA7C58994C3E}-v524-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\77\525-{086225C2-4448-4685-8E51-DA7C58994C3E}-v477-{086225C2-4448-4685-8E51-DA7C58994C3E}-v525-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\77\525-{086225C2-4448-4685-8E51-DA7C58994C3E}-v477-{086225C2-4448-4685-8E51-DA7C58994C3E}-v525-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\78\526-{086225C2-4448-4685-8E51-DA7C58994C3E}-v478-{086225C2-4448-4685-8E51-DA7C58994C3E}-v526-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\78\526-{086225C2-4448-4685-8E51-DA7C58994C3E}-v478-{086225C2-4448-4685-8E51-DA7C58994C3E}-v526-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\79\527-{086225C2-4448-4685-8E51-DA7C58994C3E}-v479-{086225C2-4448-4685-8E51-DA7C58994C3E}-v527-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\79\527-{086225C2-4448-4685-8E51-DA7C58994C3E}-v479-{086225C2-4448-4685-8E51-DA7C58994C3E}-v527-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\80\528-{086225C2-4448-4685-8E51-DA7C58994C3E}-v480-{086225C2-4448-4685-8E51-DA7C58994C3E}-v528-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\80\528-{086225C2-4448-4685-8E51-DA7C58994C3E}-v480-{086225C2-4448-4685-8E51-DA7C58994C3E}-v528-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\81\529-{086225C2-4448-4685-8E51-DA7C58994C3E}-v481-{086225C2-4448-4685-8E51-DA7C58994C3E}-v529-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\81\529-{086225C2-4448-4685-8E51-DA7C58994C3E}-v481-{086225C2-4448-4685-8E51-DA7C58994C3E}-v529-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\82\530-{086225C2-4448-4685-8E51-DA7C58994C3E}-v482-{086225C2-4448-4685-8E51-DA7C58994C3E}-v530-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\82\530-{086225C2-4448-4685-8E51-DA7C58994C3E}-v482-{086225C2-4448-4685-8E51-DA7C58994C3E}-v530-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\83\531-{086225C2-4448-4685-8E51-DA7C58994C3E}-v483-{086225C2-4448-4685-8E51-DA7C58994C3E}-v531-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\83\531-{086225C2-4448-4685-8E51-DA7C58994C3E}-v483-{086225C2-4448-4685-8E51-DA7C58994C3E}-v531-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\84\532-{086225C2-4448-4685-8E51-DA7C58994C3E}-v484-{086225C2-4448-4685-8E51-DA7C58994C3E}-v532-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\84\532-{086225C2-4448-4685-8E51-DA7C58994C3E}-v484-{086225C2-4448-4685-8E51-DA7C58994C3E}-v532-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\85\533-{086225C2-4448-4685-8E51-DA7C58994C3E}-v485-{086225C2-4448-4685-8E51-DA7C58994C3E}-v533-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\85\533-{086225C2-4448-4685-8E51-DA7C58994C3E}-v485-{086225C2-4448-4685-8E51-DA7C58994C3E}-v533-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\86\534-{086225C2-4448-4685-8E51-DA7C58994C3E}-v486-{086225C2-4448-4685-8E51-DA7C58994C3E}-v534-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\86\534-{086225C2-4448-4685-8E51-DA7C58994C3E}-v486-{086225C2-4448-4685-8E51-DA7C58994C3E}-v534-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\87\535-{086225C2-4448-4685-8E51-DA7C58994C3E}-v487-{086225C2-4448-4685-8E51-DA7C58994C3E}-v535-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\87\535-{086225C2-4448-4685-8E51-DA7C58994C3E}-v487-{086225C2-4448-4685-8E51-DA7C58994C3E}-v535-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\88\536-{086225C2-4448-4685-8E51-DA7C58994C3E}-v488-{086225C2-4448-4685-8E51-DA7C58994C3E}-v536-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\88\536-{086225C2-4448-4685-8E51-DA7C58994C3E}-v488-{086225C2-4448-4685-8E51-DA7C58994C3E}-v536-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\89\537-{086225C2-4448-4685-8E51-DA7C58994C3E}-v489-{086225C2-4448-4685-8E51-DA7C58994C3E}-v537-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\89\537-{086225C2-4448-4685-8E51-DA7C58994C3E}-v489-{086225C2-4448-4685-8E51-DA7C58994C3E}-v537-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\90\538-{086225C2-4448-4685-8E51-DA7C58994C3E}-v490-{086225C2-4448-4685-8E51-DA7C58994C3E}-v538-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\90\538-{086225C2-4448-4685-8E51-DA7C58994C3E}-v490-{086225C2-4448-4685-8E51-DA7C58994C3E}-v538-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\91\539-{086225C2-4448-4685-8E51-DA7C58994C3E}-v491-{086225C2-4448-4685-8E51-DA7C58994C3E}-v539-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\91\539-{086225C2-4448-4685-8E51-DA7C58994C3E}-v491-{086225C2-4448-4685-8E51-DA7C58994C3E}-v539-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\92\540-{086225C2-4448-4685-8E51-DA7C58994C3E}-v492-{086225C2-4448-4685-8E51-DA7C58994C3E}-v540-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\92\540-{086225C2-4448-4685-8E51-DA7C58994C3E}-v492-{086225C2-4448-4685-8E51-DA7C58994C3E}-v540-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\93\541-{086225C2-4448-4685-8E51-DA7C58994C3E}-v493-{086225C2-4448-4685-8E51-DA7C58994C3E}-v541-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\93\541-{086225C2-4448-4685-8E51-DA7C58994C3E}-v493-{086225C2-4448-4685-8E51-DA7C58994C3E}-v541-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\94\542-{086225C2-4448-4685-8E51-DA7C58994C3E}-v494-{086225C2-4448-4685-8E51-DA7C58994C3E}-v542-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\94\542-{086225C2-4448-4685-8E51-DA7C58994C3E}-v494-{086225C2-4448-4685-8E51-DA7C58994C3E}-v542-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\95\543-{086225C2-4448-4685-8E51-DA7C58994C3E}-v495-{086225C2-4448-4685-8E51-DA7C58994C3E}-v543-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\95\543-{086225C2-4448-4685-8E51-DA7C58994C3E}-v495-{086225C2-4448-4685-8E51-DA7C58994C3E}-v543-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\96\544-{086225C2-4448-4685-8E51-DA7C58994C3E}-v496-{086225C2-4448-4685-8E51-DA7C58994C3E}-v544-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\96\544-{086225C2-4448-4685-8E51-DA7C58994C3E}-v496-{086225C2-4448-4685-8E51-DA7C58994C3E}-v544-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\97\545-{086225C2-4448-4685-8E51-DA7C58994C3E}-v497-{086225C2-4448-4685-8E51-DA7C58994C3E}-v545-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\97\545-{086225C2-4448-4685-8E51-DA7C58994C3E}-v497-{086225C2-4448-4685-8E51-DA7C58994C3E}-v545-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\98\546-{086225C2-4448-4685-8E51-DA7C58994C3E}-v498-{086225C2-4448-4685-8E51-DA7C58994C3E}-v546-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\98\546-{086225C2-4448-4685-8E51-DA7C58994C3E}-v498-{086225C2-4448-4685-8E51-DA7C58994C3E}-v546-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\99\547-{086225C2-4448-4685-8E51-DA7C58994C3E}-v499-{086225C2-4448-4685-8E51-DA7C58994C3E}-v547-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\99\547-{086225C2-4448-4685-8E51-DA7C58994C3E}-v499-{086225C2-4448-4685-8E51-DA7C58994C3E}-v547-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\99\555-{7D8E8286-592E-4EB7-972F-C86F71B0F529}-v899-{086225C2-4448-4685-8E51-DA7C58994C3E}-v555-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1   
ADS  C:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\Microsoft\Messenger\mc_addam@cegetel.net\SharingMetadata
otargiacomo.eric@neuf.fr\DFSR\Staging\CS{2DF3B1D3-07F4-1C53-9073-B416659DE632}\99\555-{7D8E8286-592E-4EB7-972F-C86F71B0F529}-v899-{086225C2-4448-4685-8E51-DA7C58994C3E}-v555-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS  

---- EOF - GMER 1.0.13 ----

FillPCA · Answer

Re,

1/ Clique sur démarrer>Exécuter>cmd 
Tape chaque commande en appuyant sur entrée pour les valider:

sc stop flnqvxin
sc delete flnqvxin
gmer -killall
gmer -del reg "HKLM\SYSTEM\CurrentControlSet\Services\flnqvxin"
gmer -del reg "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1182A964-F338-4150-B053-32772BC321E8}"
gmer -del file "C:\system32\drivers\dhawtanq.dat"
gmer -del file "C:\WINDOWS\system32\atkctr.dll"
gmer -reboot

2/ Edite un nouveau rapport Hijackthis.
3/ Edite aussi un rapport SREng.

FillPCA

Aero-D · Answer

Logfile of HijackThis v1.99.1
Scan saved at 16:20, on 2007-12-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Trojan Remover\Trjscan.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\DOCUME~1\Geffray\LOCALS~1\Temp\Rar$EX03.312\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {1182A964-F338-4150-B053-32772BC321E8} - C:\WINDOWS\system32\atkctr.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [UniqueDisplay] C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [BootSkin Startup Jobs] ; "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [Echovoice Gamer Statistics] ; C:\Program Files\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
O4 - HKLM\..\Run: [EzPrint] ; "C:\Program Files\Lexmark 2300 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] ; "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Launch LGDCore] ; "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] ; "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [lxcgmon.exe] ; "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"
O4 - HKLM\..\Run: [PCMService] ; "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] ; "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] ; "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] ; C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] ; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [updateMgr] ; C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: 54M Wireless USB Adapter.lnk = C:\Program Files\USB\54M Wireless USB Adapter\Mrv8000x.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/default/TriJinx.1.0.0.87.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/default/mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/bingame/popcaploader_v10.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxcg_device -   - C:\WINDOWS\system32\lxcgcoms.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

g!rly · Answer

salut Aero-D

elle resiste a tous, c´est pas croyable...

j´ai trouvé ceci qui pourrais bien etre util pour la supprimer 

http://www.incodesolutions.com/threats/System32Rootatkctrdll.php

il y a un scan fee trail proposé quand tu click sur remove it pro

dis moi quoi

@+

Aero-D · Answer

impeccable ce log le detecte ... mais il faut payer pour le suppr :'(

g!rly · Answer

grrrr

peux etre as tu des infos supplementaires qui seraient visible dans remove it genre les cles de registre lié a la dll ou autre ?

tu peux aussi essayer avec celui ci dans le meme style mais gratuit...

https://www.superantispyware.com/

sinon on va voire si fillpca a trouvé quelque chose...

@+

FillPCA · Answer

Salut,

Je reviens du boulot. J'ai encore un atout. Après le diner.

FillPCA

Aero-D · Answer

que dalle pour antispyware

FillPCA · Answer

Bonjour,

Icesword est un outil dangereux et ne doit pas être utilisé par quelqu'un d'autre. Ces consignes sont destinées au cas présent et à personne d'autre.

Suis très exactement ceci :

1/ Télécharge Icesword ici : https://www.majorgeeks.com/downloadget.php?id=5199&file=9&evp=0d36c3ec48c6373fd5daac78f0c6a417
Extrais l'archive Icesword sur ton bureau, puis, dans ce dossier, double-clique sur icesword.exe

Choisis la fonction "file" en bas à gauche. Par l'arboressence fournie, choisis ce fichier :
C:\Windows\system32\drivers\dhawtanq.dat
Fais un clic droit dessus et choisis "delete".

Fais la même chose avec ce fichier :
C:\WINDOWS\system32\atkctr.dll

À gauche, vers le haut maintenant, clique sur le bouton Registry (juste sous Functions) ;

- Par l'arborescence fournie, retrouve cette clé :

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\flnqvxin
- Dans la fenêtre de gauche, fais un clic droit sur le petit dossier nommé flnqvxin et clique Delete

Choisis le bouton "function" puis le bouton BHO. Fais un clic droit sur cette BHO et choisis delete :
{1182A964-F338-4150-B053-32772BC321E8}

2/    Désactive temporairement ton antivirus.

3/ *  Télécharge KillAFile (par Marckie) sur ton Bureau : http://users.telenet.be/marcvn/tools/KillAFile.exe
    * Double clique sur KillAFile.exe afin de le lancer. Une fenêtre DOS au fond rouge apparaîtra.
    * Tape le chiffre 1 puis valide avec la touche Entrée pour choisir "Delete a file on reboot
    * Tu verras maintenant une nouvelle invite : "Insert full path and filename to delete. and then press enter:"
    * Tu dois taper ceci, au complet et très exactement :

C:\WINDOWS\system32\atkctr.dll

    * Appuie sur la touche Entrée.
    * À l'invite qui suit, appuie sur n'importe quelle touche pour valider (Entrée par exemple).
    * Ton PC va maintenant redémarrer.
    * Edite le rapport généré par killafile. Il se trouve aussi ici : C:\kaflog.txt

3/ Edite les rapports suivants :
Killafile, Hijackthis et un rapport SREng.

FillPCA

Aero-D · Answer

euh j'ai pas de dossier system32 directement dans C:\

j'ai chercher dans system32 de windows mais pas dhawtanq.dat dans le dossier driver

Aero-D · Answer

edit :

non c'est bon finalement j'ai double clic a la place d'un clic simple et pour la suppression bonne nouvelle sa a marché je te tiens au courant sur la suite

FillPCA · Answer

Re,

Bon sang ! Tu as raison. J'avais pourtant relu. J'ai corrigé. Continue la manip.

FillPCA

Aero-D · Answer

et paf voici le log d'hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 22:01, on 2007-12-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\InCode Solutions\RemoveIT Pro v4-Trialemoveit.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\DOCUME~1\Geffray\LOCALS~1\Temp\Rar$EX01.609\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [UniqueDisplay] C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [BootSkin Startup Jobs] ; "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [Echovoice Gamer Statistics] ; C:\Program Files\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
O4 - HKLM\..\Run: [EzPrint] ; "C:\Program Files\Lexmark 2300 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] ; "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Launch LGDCore] ; "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] ; "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [lxcgmon.exe] ; "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"
O4 - HKLM\..\Run: [PCMService] ; "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] ; "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] ; "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] ; C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] ; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [updateMgr] ; C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [RemoveIT Pro XT] C:\Program Files\InCode Solutions\RemoveIT Pro v4-Trialemoveit.exe
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: 54M Wireless USB Adapter.lnk = C:\Program Files\USB\54M Wireless USB Adapter\Mrv8000x.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/default/TriJinx.1.0.0.87.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/default/mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/bingame/popcaploader_v10.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxcg_device -   - C:\WINDOWS\system32\lxcgcoms.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

FillPCA · Answer

Ouf ! Elle semble avoir dégagée. Tu peux confirmer avec le rapport SREng ?

FillPCA

Aero-D · Answer

le rapport de killafile :

KILLAFILE - logfile


Running from: "C:\Documents and Settings\Geffray\Bureau"

Aero-D · Answer

voila le rapport de SReng (part 1) [CODE] 2007-12-06,22:07:45 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Home Edition Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed Follow item(s) have been choosed: All Boot Items (Including Registry, Startup Folders, Services and so on) Browser Add-ons Runing Processes (Including process model information) File Associations Winsock Provider Autorun.Inf HOSTS File Process Privileges Scan Boot Items Registry [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <"C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"> [Panicware, Inc.] [(Verified)Microsoft Windows Publisher] <; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [N/A] <; C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9> [N/A] [SUPERAntiSpyware.com] [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher] [(Verified)Microsoft Windows Publisher] [(Verified)Microsoft Windows Publisher] [NVIDIA Corporation] [] <"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"> [(Verified)"Sun Microsystems, Inc."] [NEC Computers International] [N/A] <"C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"> [(Verified)Logitech Inc] <"C:\Program Files\Logitech\G-series Software\LCDMon.exe"> [Logitech Inc.] [N/A] <"C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start> [InstallShield Software Corporation] [] [NVIDIA Corporation] <"C:\Program Files\Spyware Doctor\SDTrayApp.exe"> [(Verified)PC Tools] <"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"> [(Verified)Kaspersky Lab] [(Verified)Simply Super Software] <"C:\Program Files\Unlocker\UnlockerAssistant.exe"> [] <; "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs> [N/A] <; C:\Program Files\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe> [Echovoice] <; "C:\Program Files\Lexmark 2300 Series\ezprint.exe"> [N/A] <; "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s> [N/A] <; "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE> [Logitech Inc.] <; "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide> [(Verified)Logitech Inc] <; "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"> [N/A] <; "c:\Apps\Powercinema\PCMService.exe"> [CyberLink Corp.] <; "C:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.] <; "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions> [Sony Ericsson Mobile Communications AB] <; SOUNDMAN.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <; "C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" -osboot> [RealNetworks, Inc.] <; C:\Program Files\Winamp\winampa.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] [(Verified)Kaspersky Lab] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}> [SuperAdBlocker.com] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon] [SUPERAntiSpyware.com] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] [(Verified)Kaspersky Lab] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [Microsoft Corporation] ================================== Startup Folders [54M Wireless USB Adapter] C:\Program Files\USB\54M Wireless USB Adapter\Mrv8000x.exe [N/A]> [BHODemon 2.0] C:\PROGRA~1\BHODEM~1\BHODemon.exe [Definitive Solutions, Inc.]> ================================== Services [Ad-Aware 2007 Service / aawservice][Running/Auto Start] <"C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"> [Adobe LM Service / Adobe LM Service][Stopped/Disabled] <"C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe"> [AOL Connectivity Service / AOL ACS][Stopped/Disabled] [Gestion d'applications / AppMgmt][Stopped/Manual Start] %SystemRoot%\System32\appmgmts.dll> [Kaspersky Internet Security 7.0 / AVP][Running/Auto Start] <"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r> [##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## / Bonjour Service][Running/Auto Start] <"C:\Program Files\Bonjour\mDNSResponder.exe"> [CyberLink Background Capture Service (CBCS) / CLCapSvc][Running/Auto Start] <"c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe"><> [CyberLink Task Scheduler (CTS) / CLSched][Running/Auto Start] <"c:\APPS\Powercinema\Kernel\TV\CLSched.exe"><> [CyberLink Media Library Service / CyberLink Media Library Service][Running/Auto Start] <"C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe"> [FLEXnet Licensing Service / FLEXnet Licensing Service][Stopped/Manual Start] <"C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"> [Generic Service for HID Keyboard Input Collections / GenericHidService][Running/Auto Start] [InstallDriver Table Manager / IDriverT][Stopped/Manual Start] <"C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe"> [Process Monitor / LVPrcSrv][Running/Auto Start] [LVSrvLauncher / LVSrvLauncher][Stopped/Auto Start] [lxcg_device / lxcg_device][Stopped/Manual Start] <> [MSSQL$SONY_MEDIAMGR / MSSQL$SONY_MEDIAMGR][Stopped/Manual Start] [MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start] [MysqlInventime / MysqlInventime][Stopped/Manual Start] [NVIDIA Display Driver Service / NVSvc][Running/Auto Start] [PC Tools Auxiliary Service / sdAuxService][Running/Auto Start] [PC Tools Security Service / sdCoreService][Running/Auto Start] [SmartLinkService / SLService][Running/Auto Start] <> [SQLAgent$SONY_MEDIAMGR / SQLAgent$SONY_MEDIAMGR][Stopped/Manual Start] [Windows Live Setup Service / WLSetupSvc][Stopped/Manual Start] <"C:\Program Files\Windows Live\installer\WLSetupSvc.exe"><> ================================== Drivers [3xHybrid service / 3xHybrid][Stopped/Manual Start] [abp480n5 / abp480n5][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ABP480N5.SYS> [adpu160m / adpu160m][Running/Boot Start] <\SystemRoot\system32\DRIVERS\adpu160m.sys> [Aha154x / Aha154x][Running/Boot Start] <\SystemRoot\system32\DRIVERS\aha154x.sys> [aic78u2 / aic78u2][Running/Boot Start] <\SystemRoot\system32\DRIVERS\aic78u2.sys> [aic78xx / aic78xx][Running/Boot Start] <\SystemRoot\system32\DRIVERS\aic78xx.sys> [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] [AliIde / AliIde][Running/Boot Start] <\SystemRoot\system32\DRIVERS\aliide.sys> [Pilote de filtre du bus AMD AGP / amdagp][Running/Boot Start] <\SystemRoot\system32\DRIVERS\amdagp.sys> [Pilote de processeur AMD / AmdK8][Running/System Start] [asc / asc][Running/Boot Start] <\SystemRoot\system32\DRIVERS\asc.sys> [asc3350p / asc3350p][Running/Boot Start] <\SystemRoot\system32\DRIVERS\asc3350p.sys> [asc3550 / asc3550][Running/Boot Start] <\SystemRoot\system32\DRIVERS\asc3550.sys> [catchme / catchme][Stopped/Manual Start] <\??\C:\DOCUME~1\Geffray\LOCALS~1\Temp\catchme.sys> [cd20xrnt / cd20xrnt][Running/Boot Start] <\SystemRoot\system32\DRIVERS\cd20xrnt.sys> [CmdIde / CmdIde][Running/Boot Start] <\SystemRoot\system32\DRIVERS\cmdide.sys> [dac2w2k / dac2w2k][Running/Boot Start] <\SystemRoot\system32\DRIVERS\dac2w2k.sys> [dpti2o / dpti2o][Running/Boot Start] <\SystemRoot\system32\DRIVERS\dpti2o.sys> [gmer / gmer][Stopped/Manual Start] [File Security Driver / IKFileSec][Running/Boot Start] <\SystemRoot\system32\drivers\ikfilesec.sys> [System Filter Driver / IKSysFlt][Running/System Start] [System Security Driver / IKSysSec][Running/System Start] [ini910u / ini910u][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ini910u.sys> [Sony Ericsson 750 driver (WDM) / k750bus][Stopped/Manual Start] [Sony Ericsson 750 USB WMC Modem Filter / k750mdfl][Stopped/Manual Start] [Sony Ericsson 750 USB WMC Modem Drivers / k750mdm][Stopped/Manual Start] [Sony Ericsson 750 USB WMC Device Management Drivers / k750mgmt][Stopped/Manual Start] [Sony Ericsson 750 USB WMC OBEX Interface Drivers / k750obex][Stopped/Manual Start] [kl1 / kl1][Running/Boot Start] <\SystemRoot\system32\drivers\kl1.sys> [klif / klif][Running/System Start] <\??\C:\WINDOWS\system32\drivers\klif.sys> [Kaspersky Anti-Virus NDIS Filter / klim5][Running/Manual Start] [Logitech SetPoint USB Receiver device driver / LHidUsbK][Stopped/Manual Start] [Logitech SetPoint Mouse Filter Driver / LMouKE][Stopped/Manual Start] [Logitech AEC Driver / LVcKap][Stopped/Manual Start] <> [Logitech Machine Vision Engine Loader / LVMVDrv][Stopped/Manual Start] [Logitech LVPr2Mon Driver / LVPr2Mon][Running/Manual Start] <> [Logitech USB Monitor Filter / LVUSBSta][Running/Manual Start] [mraid35x / mraid35x][Running/Boot Start] <\SystemRoot\system32\DRIVERS\mraid35x.sys> [Vista 32-bits Native WiFi Driver - USB / MRV6X32U][Stopped/Manual Start] <> [54M Wireless USB Adapter Dirver for Windows XP / MRVW225][Running/Manual Start] <> [Mtlmnt5 / Mtlmnt5][Running/Manual Start] <> [Mtlstrm / Mtlstrm][Stopped/Manual Start] <> [NtMtlFax / NtMtlFax][Stopped/Manual Start] <> [nv / nv][Running/Manual Start] [Volume Adapter / pepifilter][Running/Manual Start] [Logitech QuickCam IM(PID_PEPI) / PID_PEPI][Running/Manual Start] [Pilote de liaison parallèle directe / Ptilink][Running/Manual Start] [PxHelp20 / PxHelp20][Running/Boot Start] <\SystemRoot\System32\Drivers\PxHelp20.sys> [ql1080 / ql1080][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ql1080.sys> [Ql10wnt / Ql10wnt][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ql10wnt.sys> [ql12160 / ql12160][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ql12160.sys> [ql1280 / ql1280][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ql1280.sys> [RecAgent / RecAgent][Stopped/Manual Start] <\??\C:\WINDOWS\system32\DRIVERS\RecAgent.sys> [Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver / RTL8023xp][Stopped/Manual Start] [SASDIFSV / SASDIFSV][Running/System Start] <\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS><> [SASENUM / SASENUM][Running/Manual Start] <\??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS> [SASKUTIL / SASKUTIL][Running/System Start] <\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys><> [Secdrv / Secdrv][Running/Auto Start] [StarForce Protection Environment Driver (version 1.x) / sfdrv01][Running/Boot Start] <\SystemRoot\System32\drivers\sfdrv01.sys> [StarForce Protection Helper Driver (version 2.x) / sfhlp02][Running/Boot Start] <\SystemRoot\System32\drivers\sfhlp02.sys> [StarForce Protection VFS Driver (version 2.x) / sfvfs02][Running/Boot Start] <\SystemRoot\System32\drivers\sfvfs02.sys> [Filtre de bus AGP SIS / sisagp][Running/Boot Start] <\SystemRoot\system32\DRIVERS\sisagp.sys> [SmartLink AMR_PCI Driver / Slntamr][Running/Manual Start] <> [SlNtHal / SlNtHal][Stopped/Manual Start] <> [SlWdmSup / SlWdmSup][Running/Manual Start] [Sparrow / Sparrow][Running/Boot Start] <\SystemRoot\system32\DRIVERS\sparrow.sys> [sptd / sptd][Running/Boot Start] <\SystemRoot\System32\Drivers\sptd.sys> [symc810 / symc810][Running/Boot Start] <\SystemRoot\system32\DRIVERS\symc810.sys> [symc8xx / symc8xx][Running/Boot Start] <\SystemRoot\system32\DRIVERS\symc8xx.sys> [sym_hi / sym_hi][Running/Boot Start] <\SystemRoot\system32\DRIVERS\sym_hi.sys> [sym_u3 / sym_u3][Running/Boot Start] <\SystemRoot\system32\DRIVERS\sym_u3.sys> [TosIde / TosIde][Running/Boot Start] <\SystemRoot\system32\DRIVERS oside.sys> [ultra / ultra][Running/Boot Start] <\SystemRoot\system32\DRIVERS\ultra.sys> [ViaIde / ViaIde][Running/Boot Start] <\SystemRoot\system32\DRIVERS\viaide.sys> [WAN Miniport (ATW) / wanatw][Running/Manual Start] [Codec Teletext standard / WSTCODEC][Stopped/Manual Start] ================================== Browser Add-ons [Java Plug-in 1.6.0_03] {08B0E5C0-4FCB-11CF-AAA5-00401C608501} [Statistiques d’Anti-Virus Internet] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} [Skype add-on (button)] {77BF5300-1474-4EC7-9980-D32B190E9B07} [&Rechercher] {92780B25-18CC-41C8-B9BE-3C9C571A8263} [] {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A> [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} [Checkers Class] {20A60F0D-9AFA-4515-A0FD-83BD84642501} [CPlayFirstTriJinxControl Object] {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} [EARTPatchX Class] {54B52E52-8000-4413-BD67-FC7FE24B59F2} [Solitaire Showdown Class] {5C051655-FCD5-4969-9182-770EA5AA5565} [UnoCtrl Class] {5D6F45B3-9043-443D-A792-115447494D24} [MJLauncherCtrl Class] {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} [Java Plug-in 1.6.0_03] {8AD9C840-044E-11D1-B3E9-00805F499D93} [MSN Games - Installer] {B8BE5E93-A60C-4D26-A2DC-220313175592} [MessengerStatsClient Class] {C3F79A2B-B9B4-4A66-B012-3EE46475B072} [Java Plug-in 1.4.2_05] {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} [Java Plug-in 1.5.0_03] {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} [Java Plug-in 1.5.0_11] {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} [Java Plug-in 1.6.0_01] {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} [Java Plug-in 1.6.0_02] {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} [Java Plug-in 1.6.0_03] {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [Java Plug-in 1.6.0_03] {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [PopCapLoader Object] {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} [Minesweeper Flags Class] {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} [QuickTime Object] {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [DataCtl Class] {0468C085-CA5B-11D0-AF08-00609797F0E0} [Adobe PDF Reader Link Helper] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} [Microsoft Visio Document] {279D6C9A-652E-4833-BEFC-312CA8887857} [EARTPatchX Class] {54B52E52-8000-4413-BD67-FC7FE24B59F2} [InstallShield Update Service Agent] {5B7524C8-2446-40E9-9474-94A779DBA224} [DivXBrowserPlugin Object] {67DABFBF-D0AB-41FA-9C46-CC0F21721616} [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} [Active Desktop Mover] {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A> [Skype add-on (button)] {77BF5300-1474-4EC7-9980-D32B190E9B07} [Microsoft Web Browser] {8856F961-340A-11D0-A96B-00C04FD705A2} [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [MSN Games - Installer] {B8BE5E93-A60C-4D26-A2DC-220313175592} [VIDEO__AVI Moniker Class] {CD3AFA88-B84F-48F0-9393-7EDC34128127} [VIDEO__MPEG Moniker Class] {CD3AFA89-B84F-48F0-9393-7EDC34128127} [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [QuickTimeCheck Class] {DE4AF3B0-F4D4-11D3-B41A-0050DA2E6C21} [XML DOM Document 3.0] {F5078F32-C551-11D3-89B9-0000F81FE221} [XML HTTP] {F6D90F16-9C73-11D3-B32E-00C04F990BB4} [Ajouter à Kaspersky Anti-Bannière] [E&xporter vers Microsoft Excel] ================================== Running Processes [PID: 612 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1040 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1064 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\SUPERAntiSpyware\SASWINLO.dll] [SUPERAntiSpyware.com, 1, 0, 0, 1046] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1112 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1124 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1284 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1344 / SERVICE RÉSEAU][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [PID: 1388 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [PID: 1448 / SERVICE RÉSEAU][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [PID: 1592 / SERVICE LOCAL][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1852 / SYSTEM][C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe] [Lavasoft AB, 7, 0, 2, 5] [C:\Program Files\Lavasoft\Ad-Aware 2007\CEAPI.dll] [Lavasoft AB, 7, 0, 2, 3] [C:\Program Files\Lavasoft\Ad-Aware 2007\PKArchive84cb.dll] [PKWARE, Inc., 8.4.219.0] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Lavasoft\Ad-Aware 2007\Update.dll] [, 7, 0, 1, 3] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1932 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\lxcglmpm.DLL] [ , 1.154.19.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.2175.0] [PID: 1976 / SYSTEM][c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 248 / SYSTEM][C:\Program Files\Bonjour\mDNSResponder.exe] [Apple Computer, Inc., 1,0,3,1] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 272 / SYSTEM][c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe] [, 4.00.1214] [c:\Apps\Powercinema\Kernel\TV\CLCapSvcps.dll] [N/A, ] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [c:\Apps\Powercinema\Kernel\TV\CLCapEngine.dll] [, 4.00.1214] [c:\Apps\Powercinema\Kernel\TV\PCMRRec4.dll] [CyberLink Corp., 4.00.1304] [C:\WINDOWS\system32\msdmo.dll] [, ] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 316 / SYSTEM][c:\APPS\Powercinema\Kernel\TV\CLSched.exe] [, 4.00.1214] [c:\Apps\Powercinema\Kernel\TV\CLCapSvcps.dll] [N/A, ] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [c:\Apps\Powercinema\Kernel\TV\CLSchMgr.dll] [, 4.00.1214] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 368 / SYSTEM][C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe] [Cyberlink, 1, 1, 0, 1101] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 384 / SYSTEM][C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe] [Cyberlink, 1, 1, 0, 1101] [c:\Apps\Powercinema\Kernel\HomeNetWorking\CLNetMedia.dll] [, 1, 0, 0, 1012] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 412 / SYSTEM][c:\APPS\HIDSERVICE\HIDSERVICE.exe] [N/A, ] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 564 / SYSTEM][C:\WINDOWS\system32 vsvc32.exe] [NVIDIA Corporation, 6.14.11.6909] [C:\WINDOWS\system32 vapi.dll] [NVIDIA Corporation, 6.14.11.6909] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 720 / SYSTEM][C:\Program Files\Spyware Doctor\svcntaux.exe] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor tl100.bpl] [Borland Software Corporation, 10.0.2288.42451] [C:\Program Files\Spyware Doctor\vcl100.bpl] [Borland Software Corporation, 10.0.2288.42451] [C:\Program Files\Spyware Doctor\SysAccess.dll] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\ikdll.dll] [PCTools Research Pty Ltd., 5.0.2.1036] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1016 / SYSTEM][C:\Program Files\Spyware Doctor\swdsvc.exe] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\SysAccess.dll] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor tl100.bpl] [Borland Software Corporation, 10.0.2288.42451] [C:\Program Files\Spyware Doctor\ikdll.dll] [PCTools Research Pty Ltd., 5.0.2.1036] [C:\Program Files\Spyware Doctor\CommOM.dll] [PC Tools, 5.0.5.5] [C:\Program Files\Spyware Doctor\vcl100.bpl] [Borland Software Corporation, 10.0.2288.42451] [C:\Program Files\Spyware Doctor\CommLib.dll] [PC Tools, 5.0.5.2] [C:\Program Files\Spyware Doctor\commhlpr.dll] [PC Tools, 5.0.5.0] [C:\Program Files\Spyware Doctor\RegHelper.dll] [PC Tools, 5.0.5.2] [C:\Program Files\Spyware Doctor\inethlpr.dll] [PC Tools, 5.0.5.2] [C:\Program Files\Spyware Doctor\filehlpr.dll] [PC Tools, 5.0.5.22] [C:\Program Files\Spyware Doctor\sdcore.dll] [PC Tools, 5.0.5.25] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\FileStorage.sdp] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\Settings.sdp] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\IDBLib.sdp] [PC Tools, 5.0.5.2] [C:\Program Files\Spyware Doctor\SDInfo.sdp] [PC Tools, 5.0.5.9] [C:\Program Files\Spyware Doctor\SDExtra.sdp] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\PCTWSC.dll] [PC Tools, 1, 0, 0, 7] [C:\Program Files\Spyware Doctor\Immunizer.sdp] [PC Tools, 5.0.5.5] [C:\Program Files\Spyware Doctor\Localizer.sdp] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\NfyMan.sdp] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\quarantine.sdp] [PC Tools, 5.0.5.2] [C:\Program Files\Spyware Doctor\BH.dll] [PC Tools, 5.0.5.2] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Spyware Doctor\RebootManager.sdp] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\scaneng.sdp] [PC Tools, 5.0.5.6] [C:\Program Files\Spyware Doctor\stasks.sdp] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\SystemMonitor.sdp] [PC Tools, 5.0.5.45] [C:\Program Files\Spyware Doctor\whitelist.sdp] [PC Tools, 5.0.5.2] [C:\Program Files\Spyware Doctor\plugins\Browsers.SDP] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\plugins\cookie.sdp] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\plugins\grfiles.SDP] [PC Tools, 5.0.5.28] [C:\Program Files\Spyware Doctor\plugins\grregistry.SDP] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\PCToolsComponents.bpl] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\SH.dll] [PC Tools, 5.0.5.4] [C:\Program Files\Spyware Doctor\plugins\KLGuard.SDP] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\plugins\Network.SDP] [PC Tools, 5.0.5.13] [C:\Program Files\Spyware Doctor\plugins\Process.SDP] [PC Tools, 5.0.5.5] [C:\Program Files\Spyware Doctor\plugins\ScriptEngine.SDP] [PC Tools, 5.0.5.1] [C:\Program Files\Spyware Doctor\plugins\SDNET.SDP] [PC Tools, 5.0.5.23] [C:\Program Files\Spyware Doctor\plugins\StartUp.SDP] [PC Tools, 5.0.5.3] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll] [Kaspersky Lab, 7.0.0.125] [PID: 1580 / SYSTEM][C:\WINDOWS\system32\slserv.exe] [ , 2.80.00(24Apr2000)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 1648 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 792 / Geffray][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\SmartFTP Client\sfShellTools.dll] [SmartSoft Ltd, 1.0.1.0] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll] [Kaspersky Lab, 7.0.0.125] [C:\PROGRA~1\WINDOW~2\wmpband.dll] [Microsoft Corporation, 11.0.5721.5145 (WMP_11.061018-2006)] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\WINDOWS\system32\WPDShServiceObj.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\Program Files\SUPERAntiSpyware\SASSEH.DLL] [SuperAdBlocker.com, 1, 0, 0, 1008] [C:\Program Files\SmartFTP Client\smarthook.dll] [SmartSoft Ltd., 1.0.2.2] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\PortableDeviceTypes.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\PROGRA~1\PANICW~1\POP-UP~1\XAHook.dll] [Panicware, Inc., 1, 0, 0, 1008] [C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ] [PID: 2528 / SERVICE LOCAL][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 3088 / Geffray][C:\Program Files\Spyware Doctor\SDTrayApp.exe] [PC Tools, 5.0.5.33] [C:\Program Files\Spyware Doctor tl100.bpl] [Borland Software Corporation, 10.0.2288.42451] [C:\Program Files\Spyware Doctor\vcl100.bpl] [Borland Software Corporation, 10.0.2288.42451] [C:\Program Files\Spyware Doctor\SysAccess.dll] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\ikdll.dll] [PCTools Research Pty Ltd., 5.0.2.1036] [C:\Program Files\Spyware Doctor\CommOM.dll] [PC Tools, 5.0.5.5] [C:\Program Files\Spyware Doctor\CommLib.dll] [PC Tools, 5.0.5.2] [C:\Program Files\Spyware Doctor\PCToolsComponents.bpl] [PC Tools, 5.0.5.3] [C:\Program Files\Spyware Doctor\cdialogs.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\pwindow.dll] [PC Tools, 5.0.5.2] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 3872 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 4092 / Geffray][C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe] [Sun Microsystems, Inc., 6.0.30.5] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [PID: 452 / Geffray][C:\apps\ABoard\ABoard.exe] [NEC Computers International, 1, 2, 0, 0] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\apps\ABoard\AHook.dll] [NEC Computers International, 1, 1, 3, 0] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [PID: 572 / Geffray][C:\apps\ABoard\AOSD.exe] [NEC Computers International, 1, 2, 0, 0] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [PID: 628 / Geffray][C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe] [Logitech Inc., 1.4.7.2031] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [PID: 660 / Geffray][C:\Program Files\Logitech\G-series Software\LCDMon.exe] [Logitech Inc., 1.01.112] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [PID: 688 / Geffray][C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe] [InstallShield Software Corporation, 4, 10, 100, 25539] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [PID: 828 / Geffray][C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe] [N/A, ] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [PID: 840 / Geffray][C:\WINDOWS\system32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\WINDOWS\system32\NvMcTray.dll] [NVIDIA Corporation, 6.14.11.6909] [C:\WINDOWS\system32 vapi.dll] [NVIDIA Corporation, 6.14.11.6909] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\WINDOWS\system32\NVRSFR.DLL] [NVIDIA Corporation, 6.14.11.6909] [PID: 1172 / Geffray][C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe] [Logitech Inc., 1.01.112] [C:\WINDOWS\system32\odbcbcp.dll] [Microsoft Corporation, 2000.085.1117.00 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ] [C:\Program Files\Logitech\G-series Software\LgLcdApi.dll] [Logitech Inc., 1.01.112] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [PID: 2076 / Geffray][C:\Program Files\Unlocker\UnlockerAssistant.exe] [N/A, ] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [PID: 2196 / Geffray][C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe] [Panicware, Inc., 3, 1, 0, 1014] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\PROGRA~1\PANICW~1\POP-UP~1\XAHook.dll] [Panicware, Inc., 1, 0, 0, 1008] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ] [C:\PROGRA~1\PANICW~1\POP-UP~1\XA\psie6.dll] [Panicware, 1, 0, 0, 1002] [C:\PROGRA~1\PANICW~1\POP-UP~1\XA\pswmsg.dll] [Panicware, 1, 0, 0, 1003] [C:\PROGRA~1\PANICW~1\POP-UP~1\XA\psgain3.dll] [Panicware, 1, 0, 0, 1003] [C:\PROGRA~1\PANICW~1\POP-UP~1\XA\psns7.dll] [Panicware, 1, 0, 0, 1004] [C:\PROGRA~1\PANICW~1\POP-UP~1\XA\psns4.dll] [Panicware, 1, 0, 0, 1004] [PID: 2212 / Geffray][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ] [PID: 556 / Geffray][C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe] [SUPERAntiSpyware.com, 3, 9, 0, 1008] [C:\Program Files\SUPERAntiSpyware\deupx.dll] [SuperAntiSpyware.com, 1, 0, 0, 2] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\klscav.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\SUPERAntiSpyware\SASSEH.DLL] [SuperAdBlocker.com, 1, 0, 0, 1008] [C:\PROGRA~1\PANICW~1\POP-UP~1\XAHook.dll] [Panicware, Inc., 1, 0, 0, 1008] [PID: 2408 / Geffray][C:\Program Files\InCode Solutions\RemoveIT Pro v4-Trial emoveit.exe] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll] [Kaspersky Lab, 7.0.0.125] [C:\PROGRA~1\PANICW~1\POP-UP~1\XAHook.dll] [Panicware, Inc., 1, 0, 0, 1008] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [PID: 3708 / Geffray][C:\Program Files\BHODemon 2\BHODemon.exe] [Definitive Solutions, Inc., 2.0.0.23] [C:\Program Files\BHODemon 2\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\BHODemon 2\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\BHODemon 2\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\MFC71FRA.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ] [PID: 2244 / Geffray][C:\Program Files\Mozilla Firefox\firefox.exe] [Mozilla Corporation, 1.8.1.11: 2007112718] [C:\Program Files\Mozilla Firefox\js3250.dll] [Netscape Communications Corporation, 4.0] [C:\Program Files\Mozilla Firefox spr4.dll] [Netscape Communications Corporation, 4.6.7] [C:\Program Files\Mozilla Firefox\xpcom_core.dll] [Mozilla Foundation, 1.8.1.11: 2007112718] [C:\Program Files\Mozilla Firefox\plc4.dll] [Netscape Communications Corporation, 4.6.7] [C:\Program Files\Mozilla Firefox\plds4.dll] [Netscape Communications Corporation, 4.6.7] [C:\Program Files\Mozilla Firefox\smime3.dll] [Mozilla Foundation, 3.11.5 Basic ECC] [C:\Program Files\Mozilla Firefox ss3.dll] [Mozilla Foundation, 3.11.5 Basic ECC] [C:\Program Files\Mozilla Firefox\softokn3.dll] [Mozilla Foundation, 3.11.4 Basic ECC] [C:\Program Files\Mozilla Firefox\ssl3.dll] [Mozilla Foundation, 3.11.5 Basic ECC] [C:\Program Files\Mozilla Firefox\xpcom_compat.dll] [Mozilla Foundation, 1.8.1.11: 2007112718] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ] [C:\Program Files\Mozilla Firefox\components\myspell.dll] [Mozilla Foundation, 1.8.1.11: 2007112718] [C:\Program Files\Mozilla Firefox\components sBrowserOpt.dll] [ , 4, 0, 0, 0] [C:\Program Files\Mozilla Firefox\xpcom.dll] [Mozilla Foundation, 1.8.1.11: 2007112718] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\Program Files\Mozilla Firefox\components\jar50.dll] [Mozilla Foundation, 1.8.1.11: 2007112718] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\PROGRA~1\PANICW~1\POP-UP~1\XAHook.dll] [Panicware, Inc., 1, 0, 0, 1008] [C:\Program Files\Mozilla Firefox\freebl3.dll] [Mozilla Foundation, 3.11.4 Basic ECC] [C:\Program Files\Mozilla Firefox ssckbi.dll] [Mozilla Foundation, 1.64] [C:\Program Files\Mozilla Firefox\components\spellchk.dll] [Mozilla Foundation, 1.8.1.11: 2007112718] [C:\Program Files\Mozilla Firefox\plugins pnul32.dll] [mozilla.org, 1, 0, 0, 15] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1788 / Geffray][C:\Program Files\WinRAR\WinRAR.exe] [N/A, ] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\SmartFTP Client\sfShellTools.dll] [SmartSoft Ltd, 1.0.1.0] [C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll] [Microsoft Corporation, 8.1.0178.00] [C:\WINDOWS\system32\wpdshext.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\PROGRA~1\PANICW~1\POP-UP~1\XAHook.dll] [Panicware, Inc., 1, 0, 0, 1008] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [PID: 776 / Geffray][C:\DOCUME~1\Geffray\LOCALS~1\Temp\Rar$EX00.922\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24] [C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2] [C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027] [C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ] [C:\PROGRA~1\PANICW~1\POP-UP~1\XAHook.dll] [Panicware, Inc., 1, 0, 0, 1008] [C:\DOCUME~1\Geffray\LOCALS~1\Temp\Rar$EX00.922\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] ================================== File Associations .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock Provider N/A ================================== Autorun.Inf N/A ================================== HOSTS File 127.0.0.1 localhost ================================== Process Privileges Scan Special Privilege Enabled: SeLoadDriverPrivilege [PID = 248, C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE] Special Privilege

Aero-D · Answer

et voila la suite :

Special Privilege Enabled: SeSystemtimePrivilege [PID = 248, C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 272, C:\APPS\POWERCINEMA\KERNEL\TV\CLCAPSVC.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 272, C:\APPS\POWERCINEMA\KERNEL\TV\CLCAPSVC.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 316, C:\APPS\POWERCINEMA\KERNEL\TV\CLSCHED.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 316, C:\APPS\POWERCINEMA\KERNEL\TV\CLSCHED.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 368, C:\PROGRAM FILES\CYBERLINK\SHARED FILES\CLML_NTSERVICE\CLMLSERVER.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 368, C:\PROGRAM FILES\CYBERLINK\SHARED FILES\CLML_NTSERVICE\CLMLSERVER.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 384, C:\PROGRAM FILES\CYBERLINK\SHARED FILES\CLML_NTSERVICE\CLMLSERVICE.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 384, C:\PROGRAM FILES\CYBERLINK\SHARED FILES\CLML_NTSERVICE\CLMLSERVICE.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 412, C:\APPS\HIDSERVICE\HIDSERVICE.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 412, C:\APPS\HIDSERVICE\HIDSERVICE.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 564, C:\WINDOWS\SYSTEM32\NVSVC32.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 564, C:\WINDOWS\SYSTEM32\NVSVC32.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 792, C:\WINDOWS\EXPLORER.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 792, C:\WINDOWS\EXPLORER.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 792, C:\WINDOWS\EXPLORER.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 452, C:\APPS\ABOARD\ABOARD.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 452, C:\APPS\ABOARD\ABOARD.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 452, C:\APPS\ABOARD\ABOARD.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 572, C:\APPS\ABOARD\AOSD.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 572, C:\APPS\ABOARD\AOSD.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 572, C:\APPS\ABOARD\AOSD.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 660, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LCDMON.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 660, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LCDMON.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 660, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LCDMON.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 688, C:\PROGRAM FILES\FICHIERS COMMUNS\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 688, C:\PROGRAM FILES\FICHIERS COMMUNS\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 688, C:\PROGRAM FILES\FICHIERS COMMUNS\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 828, C:\DOCUMENTS AND SETTINGS\GISELE.PCHOME\BUREAU\UNIQUEDISPLAY.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 828, C:\DOCUMENTS AND SETTINGS\GISELE.PCHOME\BUREAU\UNIQUEDISPLAY.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 828, C:\DOCUMENTS AND SETTINGS\GISELE.PCHOME\BUREAU\UNIQUEDISPLAY.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 1172, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCLOCK.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 1172, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCLOCK.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1172, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCLOCK.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 2076, C:\PROGRAM FILES\UNLOCKER\UNLOCKERASSISTANT.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 2076, C:\PROGRAM FILES\UNLOCKER\UNLOCKERASSISTANT.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 2076, C:\PROGRAM FILES\UNLOCKER\UNLOCKERASSISTANT.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 2196, C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 2196, C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 2196, C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 556, C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 556, C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 556, C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 2408, C:\PROGRAM FILES\INCODE SOLUTIONS\REMOVEIT PRO V4-TRIAL\REMOVEIT.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 2408, C:\PROGRAM FILES\INCODE SOLUTIONS\REMOVEIT PRO V4-TRIAL\REMOVEIT.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 2408, C:\PROGRAM FILES\INCODE SOLUTIONS\REMOVEIT PRO V4-TRIAL\REMOVEIT.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 3708, C:\PROGRAM FILES\BHODEMON 2\BHODEMON.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 3708, C:\PROGRAM FILES\BHODEMON 2\BHODEMON.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3708, C:\PROGRAM FILES\BHODEMON 2\BHODEMON.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 1788, C:\PROGRAM FILES\WINRAR\WINRAR.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 1788, C:\PROGRAM FILES\WINRAR\WINRAR.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1788, C:\PROGRAM FILES\WINRAR\WINRAR.EXE]

==================================
API HOOK
RVA Error:  LoadLibraryA (Dangerous Level: High,  Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA Error:  LoadLibraryExA (Dangerous Level: High,  Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA Error:  LoadLibraryExW (Dangerous Level: High,  Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA Error:  LoadLibraryW (Dangerous Level: High,  Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys)
Entrypoint Error: FreeLibrary (Dangerous Level: High,  Hooked by Module: 0x7170002D)
RVA Error:  GetProcAddress (Dangerous Level: High,  Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys)

==================================
Hidden Process
N/A

==================================


[/CODE]

il semblerais que sa sois partie mon pc s'affole plus kaspersky est calme ^^

Aero-D · Answer

il reste un prob ... quand je veux ouvrir notepad sa rencontre aussitot une erreur et sa ferme ... comme avec le trojan et sa viens d'une application qui déconne (l'icone c'est un docteur qui osculte c'est dans windows) vous avez pas une idée ?

FillPCA · Answer

Re,

On fait les dernières vérifications d'usages, mais peux-tu me dire auparavant comment le pc se porte ?

FillPCA

Aero-D · Answer

bah le pc sa va kaspersky se déclenche pas mais dès que je lance quelque chose genre gestionnaire de tache ou bloc note (j'ai pas essayé d'autre truc) sa rencontre un problème et sa ferme ...

FillPCA · Answer

Re,

On s'est croisé. On essaiera de régler cela tout à la fin. On fait le ménage et les dernières applications d'usage.

1/
    *  Télécharge OTMoveIt  (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe
    * Lance OTmoveIT.
    * Clique sur CleanUp! (le programme va télécharger un fichier texte qui servira a nettoyer les programmes que l'on a téléchargés).

NOTE : Normalement, ton firewall (parefeu) devrait te demander si OTmoveIT peut accéder à internet, Autorise le.

    * Une liste apparaît dans la partie gauche d'OTmoveIT.
    * Un message apparaît pour confirmer le nettoyage. Confirme.
    * Les fichiers infectés qui se trouvent dans les quarantaines seront supprimés aussi.

2/ Télécharge Ccleaner Basic https://www.ccleaner.com/ccleaner/download

Ouvre Ccleaner, clique sur "lancer le nettoyage".

3/ Télécharge AVGantispyware : https://www.avg.com/en-ww/free-antivirus-download
Tu l'installes.
Lance AVG Anti-Spyware et clique sur le bouton Mise à jour. Patiente.

Clique sur le bouton Analyse (de la barre d'outils)
Puis sur l'onglets Comment réagir, clique sur Actions recommandées. Sélectionne Quarantaine.
Reviens à l'onglet Analyse. Clique sur Analyse complète du système.
A la fin du scan, choisis l'option " Appliquer toutes les actions " en bas. Ensuite.
Clique sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware. 

4/     *  Fais un scan en ligne en cliquant ici : https://www.bitdefender.com/toolbox/
    * Tu dois réaliser le scan en utilisant Internet explorer. Une information apparait en haut, près de la barre d'état. Tu dois accepter et installer l'activeX proposé. La mise à jour de l'antivirus se lance.
    * Réalise un scan complet du système.
    * Sauvegarde le rapport en mode texte à l'issue du scan.

5/ Edite le rapport AVGantispyware et le rapport bit defender.

FillPCA

g!rly · Answer

chapeau FillPCA ;-)
grand vainqueur icesword !!! et killAfile!!!
je connais aussi (icesword) mais n´ai pas penssé a l´utiliser;  m´en etant servie que quelques fois sous vista...
en tous cas j´aurais appris pas mal de tucs avec ta collaboration, merci ;-)
je te laisse continuer, on est d´accord...
bonne fetes si on se recroise pas avant...
de meme pour toi aero-D
@+

Aero-D · Answer

mon pc va avoir du mal a regler sa a la fin car la moveit rencontre un prob et ferme tout seul

FillPCA · Answer

Re,

Clique sur démarrer>Exécuter>cmd

Tape sfc /scannow

Cela peut durer 1/4 h ou 1/2 h. Ton CD peut t'être demandé.

Redémarre ensuite le pc et dis-moi comment les choses ont évolué.

FillPCA

FillPCA · Answer

Hello G!rly,

Je n'avais pas vu ton post. Ca ne s'est pas fait sans mal. Ouf !

Pour Aero-D :

Il est tard et je décroche. Si l'opération précédente n'est pas concluante, tu peux tenter une réparation de XP à partir du CD et de ce lien : 
https://forums.cnetfrance.fr

Si ça va mieux, peux-tu effectuer les étapes réclamées à mon post 63 de 22 h 18 et notamment les rapports ?

A demain.

FillPCA

Aero-D · Answer

c'est bon problème résolu mon frere a appellé une de ses connaissances en informatique et le pc marche impec (je sais pas se qui a été fais mais bidouillage de registre et tout) mais tout marche impec merci pour toute l'aide apporté le temps et l'energie investi

merci encore et @+ tout le monde

FillPCA · Answer

Salut,

J'aurais pourtant aimé qu'on procède aux derniers scan pour être certain qu'il ne reste rien. Ce n'est pas parce qu'il marche bien en apparence qu'il ne reste rien.

FillPCA

latruff · Answer

bonsoir,

voila maintenant 3 jours que j'essais de m'en debarasser et rien y fait, je viens de trouver ce "Post" et je m'apercoi que j'ai exactement la meme chose.

dois-je faire exactement tout pareil que (AERO-D, http://www.commentcamarche.net/forum/affich 4215132 probleme trojan win32 bho abo) ?  ou je dois vous afficher le rapport HijackThis et tous reprendre depuis le debut ?

pouvez-vous m'aider? si quequ'un veux bien s'occuper de mon cas, ce serai extra.

merci.

FillPCA · Answer

Salut,

Non, ne fais pas ce qui précède. Chaque cas est spécifique. Il faut que tu ouvres ton propre sujet en éditant un rapport Hijackthis.

FillPCA

Problème Trojan.Win32.BHO.abo

71 réponses

Discussions similaires

Newsletters