Win32.Banker.FS Trojan.SpyAgent.DA Fermé

Question

Bonjour,

j'ai reçu un virus de msn, il y avait 2 chevaux de troie
depuis, plusieurs autres virus ont été détectés et mis en quarantaine par avast sauf un:
Win32.Banker.FS Trojan.SpyAgent.DA
je ne sais pas quoi faire, j'ai beau installer avg cela n'a rien fait
pouvez vous m'aider svp?

afideg · Accepted Answer

Bonjour Beau boulot. Comment se comporte le PC ? A)- Le log Malwarebytes' Anti-Malware me paraît incomplet. Ce n'est pas grave. Recommence, SVP; et ne me poste que le rapport final montrant la liste des éléments supprimés. ( au lieu de -> No action taken. ) B)- Il faudra faire analyser des fichiers ( en gras ) chez VirusTotal, comme ceci: Voici un tuto en cas de nécessité http://bibou0007.com/tutos-f45/tutorial-sur-virustotal-t190.htm 1°- Assure toi d'avoir accès aux dossiers/fichiers cachés : Soit en faisant : Ouvrir un dossier, n'importe lequel. Aller dans "Outils" >"Options des dossiers" > "Affichage" Soit en faisant « Démarrer »/ »PanneauConfiguration/OptionsDossiers /onglet « Affichage » et là : cocher la case devant les lignes: - afficher les fichiers et dossier cachés - afficher contenu dossier système décocher la case devant les lignes: - masquer les extensions des fichiers dont le type est connu - masquer les fichiers protégés du système d'exploitation Tu vas recevoir un message qui te dit que cela peut endommager le système, n'en tiens pas compte. Puis cliquer APPLIQUER à TOUS les Dossiers > [OK] Si tu n'es pas à l'aise dans la navigation des dossiers, je t'invite à suivre ce tutorial : < http://www.malekal.com/rechercher_fichiers.php > 2°- Vas là :< https://www.virustotal.com/gui/ > •- sur la page qui s'affiche tu cliques sur [Parcourir] •- ensuite sur la nouvelle page qui s'affiche, tu suis le chemin du fichier abobkzqz.exe c'est-à-dire via "Poste de travail" > C:\WINDOWS\ •- Tu ouvres le dossier "WINDOWS\", et quand tu y as trouvé le fichier abobkzqz.exe, tu cliques sur "Ouvrir" ( sur cette dernière page affichée) •- le fichier abobkzqz.exe se retrouve alors ainsi dans la fenêtre de VirusTotal, pour l'analyse •- là, tu cliques sur "send file" = « Envoyer » ( de la page de VirusTotal ) •- et tu attends le résultat (il faut parfois patienter) •- Dans l'encadré: "Situation actuelle: terminé" ==> cliquer sur "Formaté" •- Une nouvelle fenêtre de votre navigateur apparaîtra... •- Dans la nouvelle fenêtre, cliquer sur cette image : < http://img215.imageshack.us/img215/6039/virustotalpourcopierip3.jpg > •- Faire un clic-droit sur la page, choisir => "Sélectionner tout" > puis encore clic-droit => Copier... Enfin , clic-droit => Coller le(s) résultat(s) dans le WordPad ou Bloc-Notes ==> et le poster sur forum ici. 3°- Fais la même chose pour ceux-ci (en gras) ==> attention, ce n'est pas le même chemin: •- C:\Program Files\Citrus Alarm Clock\Citrus Alarm Clock.exe Connais-tu ce Citrus Alarm Clock, et à quoi te sert-il ? •- C:\Program Files gurrd\SetSmart.dll Connais-tu ce ngurrd, et à quoi te sert-il ? C)- Cette ligne O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file), c'est la machine à pubs EoRezo (apparemment inactive) EoEngine.exe vient de eorezo qui propose la méteo en temps réel : EO weather. Apparemment il charge aussi des publicités régulièrement . ==> mais on va vérifier s'il l'on peut le supprimer. a- Vas dans "Poste de travail", et suis ce chemin C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing), pour suppimer eoRezo et EoAdv ( eorezo = "Régie de Pub" ) b- Sinon, clic sur "démarrer/exécuter", et colle la ligne suivantes et valider [OK] à chaque saisie : regsvr32 /u "C:\PROGRAM FILES\eoRezo\EoAdv\EoRezoBHO.dll" ==> [OK] regsvr32 /u "C:\PROGRAM FILES\eoRezo\EoAdv ==> [OK] regsvr32 /u "C:\PROGRAM FILES\eoRezo ==> [OK] Valide , peu importe le message que tu obtiendras. Ensuite essaye de supprimer à nouveau ce fichier. Si ça ne marche pas, supprime directement le dossier C:\PROGRAM FILES\eoRezo en mode sans échec. D)- Dans le "Panneau de configuration", as-tu bien supprimé l'ancienne version JAVA; parce que je vois encore ce processus au démarrage C:\Program Files\Java\jre1.6.0_05 E)- Je constate que Avast ne te sert pas à grand-chose (sinon à t'avertir qu'il a laissé infecter ton PC !!). Alors, fais-moi plaisir; applique ceci: 1)- Télécharger à partir de ce lien et tuto http://www.libellules.ch/tuto_antivir.php Autres TUTORIELS : < https://www.astucesinternet.com/modules/news/article.php?storyid=253 > ==> enregistre-le sur ton bureau pour y accéder facilement. - ou < http://www.malekal.com/tutorial_antivir.html > 2)- Désinstaller AVAST: < https://www.avast.com/fr-fr/uninstall-utility > 3)- Attention, après le téléchargement, il faut se déconnecter du Net ( débrancher éventuellement le modem ) avant de lancer l'installation. - Attention : Sers-toi du tutoriel pour installer ANTIVIR, http://www.vista-xp.fr/forum/topic227.html Active bien l'anti-rootkits ! 4)- Procédure d'utilisation: Après l'installation du programme et avant de lancer l'analyse, ... ...il faut redémarrer le PC en mode sans échec, comme ceci: < http://www.coupdepoucepc.com/modules/news/article.php?storyid=253 > L'analyse: - Lancer Antivir en Scan complet (analyse avancée) en faisant un click-droit sur l’icône d’Antivir dans la « barre des taches » en bas à droite (= Systray, à côté de l’horloge) puis clic sur « start Antivir » - Cliquer sur l’onglet « scanner » - Vérifier pour « RootKit search » et « Manuelle détection » (en développant avec la petite croix devant chacun d'eux) que tous les disques durs soient bien cochés, puis cliquer sur la loupe (en dessous de statut) - Une fenêtre va s’ouvrir « Luke Filewalker » - Le scan va démarrer. - Mettre tout ce qu il trouve en "quarantine" Le rapport: Une fois le scan achevé, fermer les deux fenêtres d'Antivir et sauvegarder sur le bureau le rapport qui vient d'apparaître. Redémarrer en mode normal puis poster le rapport d'Antivir (qui est sur le bureau). Voici un lien pour ne plus avoir de popup intempestif pour acheter la version payante lors des mises à jour https://forum.malekal.com/viewtopic.php?p=45326#p45326 Si problème de mise à jour, télécharger les Maj d'antivir ici : https://www.bytesin.com/software/Download-Avira-Antivir-Virus-Definition-File-Update/ Installer F)- Un dernier log HJT, SVP. Merci EDIT: • ComboFix me donne ceci: [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e122ec9-4a9e-11dd-8a58-001a92b25956}] \Shell\AutoRun\command - 1dg.exe \Shell\explore\Command - 1dg.exe \Shell\open\Command - 1dg.exe • Or, au post # 18 tu signales: « je n'ai pas de disque dur externe branché » • Mais possèdes-tu une clé USB ? • Par anticipation, télécharge l'outil Flash_Disinfector de sUBs: http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe Enregistre Flash_Disinfector.exe sur ton bureau. Double clique sur Flash_Disinfector.exe pour l'exécuter. Quand le message : [Plug in yours flash drive & clic Ok to begin disinfection] apparaitra : Connecte au pc, clé USB, DD externes, susceptibles d'avoir été infectés. Puis clic sur [Ok] Les icônes sur le bureau vont disparaître jusqu'à l'apparition du message: [Done!!] Appuies ensuite sur OK, pour faire réapparaître le bureau. Bonne chance Al.

jlpjlp · Answer

slt,




Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. 
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici : 
• Redémarre ton ordinateur 
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde). 
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître. 
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée". 
• Choisis ton compte. 
Déroule la liste des instructions ci-dessous : 
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
• Appuie sur Y pour commencer le processus de nettoyage. 
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
• Appuie sur une touche pour redémarrer le PC. 
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum



_________________

colle un rapport hijackthis 
 
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :

https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html


Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo. 

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste 

Ensuite avec Explorer créer un dossier c:\hijackthis 
Décompresser Hijackthis dans ce dossier. 
C'est important pour les sauvegardes."

lolocks · Answer

Alors voici mon rapport Hijack, merci à tous par avance de vous pencher sur mon (mes?) problèmes

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:17:58, on 23/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\WINDOWS\vsnpstd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\VMSnap23.exe
C:\WINDOWS\Domino.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\abobkzqz.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SPYWAREfighter\spftray.exe
C:\Documents and Settings\mortier\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\mortier\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\abobkzqz.exe
C:\WINDOWS\svzip.exe
C:\WINDOWS\svhoster.exe
C:\WINDOWSunsql.exe
C:\WINDOWS\sv.exe
C:\WINDOWS\winlogon.exe
C:\WINDOWS\abobkzqz.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fdivertissement%2fcelebrites%2fgalery%2fwentworth02.jpg%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: IE to GetRight Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BigDogPath323VMSnap] C:\WINDOWS\VMSnap23.exe
O4 - HKLM\..\Run: [BigDogPath323Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [lphceblj0el4r] C:\WINDOWS\system32\lphceblj0el4r.exe
O4 - HKLM\..\Run: [SMrhcablj0el4r] C:\Program Fileshcablj0el4rhcablj0el4r.exe
O4 - HKLM\..\Run: [HlpAplDsc] C:\WINDOWS\abobkzqz.exe
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\system32\3076b.exe
O4 - HKLM\..\Run: [WinLogon] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [runsql] C:\WINDOWSunsql.exe
O4 - HKLM\..\Run: [netsv32] C:\WINDOWS\sv.exe
O4 - HKLM\..\Run: [netzip] C:\WINDOWS\svzip.exe
O4 - HKLM\..\Run: [net64] C:\WINDOWS\svhoster.exe
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\system32\3076b.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\mortier\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Burn bleh] C:\DOCUME~1\mortier\APPLIC~1\IDOLVI~1\Mix wait.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\system32\3076b.exe
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\system32\3076b.exe
O4 - HKLM\..\Policies\Explorer\Run: [t8FKk1gbQQ] C:\Documents and Settings\All Users\Application Data\czcferof\yjshohcb.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Startup: YouTube Uploader.lnk = C:\Documents and Settings\mortier\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
O4 - Global Startup: Citrus Alarm Clock.lnk = C:\Program Files\Citrus Alarm Clock\Citrus Alarm Clock.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZN
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5CA8D349-C6E7-11D4-8166-009027DF3BB2} (France Telecom MDDK ActiveX Control) - http://accueil.ava.serveur-ava.com/stkid_data/ocx/mDKid.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DF1C8E21-4045-4D67-B528-335F1A4F0DE9} - http://scripts.dlv4.com/binaries/egaccess4/egaccess4_1073_em_XP.cab
O21 - SSODL: SetSmart - {6643B857-DF80-9FFB-CB0D-0082ED053567} - C:\Program Files
gurrd\SetSmart.dll
O22 - SharedTaskScheduler: USB Ware - {E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D} - (no file)
O22 - SharedTaskScheduler: IPC Configuration Utility - IPC Configuration Utility - (no file)
O22 - SharedTaskScheduler: Windows Installer Class - {020487CC-FC04-4B1E-863F-D9801796230B} - C:\DOCUME~1\mortier\LOCALS~1\Temp\wndutl32.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe (file missing)
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe
O23 - Service: Windows Log - Unknown owner - C:\WINDOWS\system32
vsvcd.exe (file missing)

afideg · Answer

Re,
Bonjour jlpjlp

Il fallait que l'internaute (lolocks, le squatteur) commence par SDFix !
Zut alors; encore commencé par la queue !

En plus, j'aime quand on me dit "Bonjour" !


Bonjour lolocks le squatteur,
Commence par ceci: Clic-droit sur ce lien :
< http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe >
et enregistre-le sur ton bureau.

Ensuite double clique sur l’icône "Navilog1.exe " pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.

(Si ce n'est pas le cas, vas dans le poste de travail, en double-cliquant sur le fichier « navilog1.bat » se trouvant dans %program files%Navilog1).

Laisse-toi guider. 
Au menu principal, choisis 1 et valide.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le bloc-notes va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le bloc-notes.

Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)


Merci
Al.

jlpjlp · Answer

slt afideg,

je te laisse faire  avec tout ce qu'il a tu ne vas pas t'ennuyer

a plus

afideg · Answer

Re,
C'est charmant.
Merci.
C'est démarré sur les chapeaux de roues !
Amicalement  ;)
Al.

lolocks · Answer

Désolé de ne pas avoir dit bonjour tout à l'heure ce n'est pas mon habitude mais il y a une légère dose de stress par rapport à la perte de mes donées qui m'empeche d'avoir l'esprit tout à fait clair. Encore une fois désolé et Bonjour.

Je vous colle le rapport et merci par avance du temps consacré

Search Navipromo version 3.6.5 commencé le 23/08/2008 à 11:51:03,01

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "mortier" 

Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***

C:\WINDOWS\mslagent trouvé !
C:\WINDOWS\msskinner trouvé !

*** Recherche dossiers dans "C:\Program Files" ***

...\MailSkinner trouvé !

*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\mortier\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\mortier\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\mortier\menudm~1\progra~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" *** 


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\mortier\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 



*** Recherche fichiers *** 


C:\WINDOWS\Downloaded Program Files\IaLdr32.inf trouvé !
C:\WINDOWS\pack.epk trouvé !
C:\WINDOWS\system32
vs2.inf trouvé !

*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé ! 

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :

esscyrj.dat trouvé !
esscyrj_nav.dat trouvé !
esscyrj_navps.dat trouvé !

* Dans "C:\Documents and Settings\mortier\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 23/08/2008 à 11:59:45,81 ***

afideg · Answer

OK,
Merci

Poursuis comme ceci:

Double clique sur le raccourci Navilog1.exe présent sur le bureau et laisse-toi guider. 
Au menu principal, choisis 2 et valide. 

Le fix va t'informer qu'il va alors redémarrer ton PC 
Ferme toutes les fenêtres ouvertes 
Appuie sur une touche comme demandé.
(si ton Pc ne redémarre pas automatiquement, fais-le toi-même)
Au redémarrage de ton PC, choisis ta session habituelle.

Patiente jusqu'au message : 
*** Nettoyage Termine le ..... *** 
Le bloc-notes va s'ouvrir. 
Sauvegarde le rapport sur le bureau de manière à le retrouver 
Referme le bloc-notes. Ton bureau va réapparaitre 

PS:Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches. 
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter" 
Tape explorer et valide. Cela te fera apparaitre ton bureau.

Poste le rapport

Ajoute un nouveau rapport HijackThis à ta réponse


Merci
Al.


Note: Je ne suis pas collé à mon PC.
J'aurai des absences

lolocks · Answer

D'une part merci infiniment, car je n'ai plus le msg d'erreur, votre ordinateur est infecté bien qu'à mon avis il doit rester des saloperies à l'interieur, en tout cas le gros du problème à peut etre bien été résolu, donc merci je vous poste le rapport de désinfection et un rapport Hijack en attendant la suite des manipulations.

Clean Navipromo version 3.6.5 commencé le 23/08/2008 à 12:23:04,20

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "mortier" 

Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
Système de fichiers : NTFS

Mode suppression automatique 
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur

 
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
 

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\mortier\locals~1\applic~1" * 


* Suppression dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 


*** Suppression dossiers dans "C:\WINDOWS" ***

C:\WINDOWS\mslagent ...suppression... 
C:\WINDOWS\mslagent supprimé ! 

C:\WINDOWS\msskinner ...suppression... 
C:\WINDOWS\msskinner supprimé ! 


*** Suppression dossiers dans "C:\Program Files" ***

...\Mailskinner ...suppression... 
...\Mailskinner supprimé ! 


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\mortier\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\mortier\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\mortier\menudm~1\progra~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" *** 



*** Suppression fichiers ***

C:\WINDOWS\Downloaded Program Files\IaLdr32.inf supprimé !
C:\WINDOWS\pack.epk supprimé !
C:\WINDOWS\system32
vs2.inf supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\mortier\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


esscyrj.dat trouvé ! 
Copie esscyrj.dat réalisée avec succès !
esscyrj.dat supprimé !

esscyrj_nav.dat trouvé ! 
Copie esscyrj_nav.dat réalisée avec succès !
esscyrj_nav.dat supprimé !

esscyrj_navps.dat trouvé ! 
Copie esscyrj_navps.dat réalisée avec succès !
esscyrj_navps.dat supprimé !


* Dans "C:\Documents and Settings\mortier\locals~1\applic~1" * 


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Nettoyage terminé le 23/08/2008 à 12:26:21,06 ***




et le rapport hijack : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:33:05, on 23/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\vsnpstd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\VMSnap23.exe
C:\WINDOWS\Domino.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\abobkzqz.exe
C:\WINDOWS\winlogon.exe
C:\WINDOWSunsql.exe
C:\WINDOWS\sv.exe
C:\WINDOWS\svzip.exe
C:\WINDOWS\svhoster.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SPYWAREfighter\spftray.exe
C:\Documents and Settings\mortier\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Documents and Settings\mortier\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fdivertissement%2fcelebrites%2fgalery%2fwentworth02.jpg%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: IE to GetRight Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BigDogPath323VMSnap] C:\WINDOWS\VMSnap23.exe
O4 - HKLM\..\Run: [BigDogPath323Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [lphceblj0el4r] C:\WINDOWS\system32\lphceblj0el4r.exe
O4 - HKLM\..\Run: [SMrhcablj0el4r] C:\Program Fileshcablj0el4rhcablj0el4r.exe
O4 - HKLM\..\Run: [HlpAplDsc] C:\WINDOWS\abobkzqz.exe
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\system32\3076b.exe
O4 - HKLM\..\Run: [WinLogon] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [runsql] C:\WINDOWSunsql.exe
O4 - HKLM\..\Run: [netsv32] C:\WINDOWS\sv.exe
O4 - HKLM\..\Run: [netzip] C:\WINDOWS\svzip.exe
O4 - HKLM\..\Run: [net64] C:\WINDOWS\svhoster.exe
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\system32\3076b.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\mortier\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Burn bleh] C:\DOCUME~1\mortier\APPLIC~1\IDOLVI~1\Mix wait.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\system32\3076b.exe
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\system32\3076b.exe
O4 - HKLM\..\Policies\Explorer\Run: [t8FKk1gbQQ] C:\Documents and Settings\All Users\Application Data\czcferof\yjshohcb.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Startup: YouTube Uploader.lnk = C:\Documents and Settings\mortier\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
O4 - Global Startup: Citrus Alarm Clock.lnk = C:\Program Files\Citrus Alarm Clock\Citrus Alarm Clock.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZN
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5CA8D349-C6E7-11D4-8166-009027DF3BB2} (France Telecom MDDK ActiveX Control) - http://accueil.ava.serveur-ava.com/stkid_data/ocx/mDKid.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O21 - SSODL: SetSmart - {6643B857-DF80-9FFB-CB0D-0082ED053567} - C:\Program Files
gurrd\SetSmart.dll
O22 - SharedTaskScheduler: USB Ware - {E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D} - (no file)
O22 - SharedTaskScheduler: IPC Configuration Utility - IPC Configuration Utility - (no file)
O22 - SharedTaskScheduler: Windows Installer Class - {020487CC-FC04-4B1E-863F-D9801796230B} - C:\DOCUME~1\mortier\LOCALS~1\Temp\wndutl32.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe (file missing)
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe
O23 - Service: Windows Log - Unknown owner - C:\WINDOWS\system32
vsvcd.exe (file missing)

afideg · Answer

Re, Merci C'est effectivement loin d'être terminé. Jusqu'à présent, ça avance dans le bon sens. On continue comme ceci: A)- Supprime Navilog1. B)- Télécharge Lop S&D.exe (Eric 71 & Angeldark) https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2 sur ton bureau. (et ne t'en sers pas tout de suite) Télécharge SmitfraudFix En image : http://siri.urz.free.fr/Fix/SmitfraudFix.php Tu le décompresses, tu double-cliques sur smitfraudfix.cmd, et tu choisis l'option 1 •- Dans ta prochaine réponse, fais un copier/coller du rapport qui s'ouvre. Renomme-le « Rapport1.txt», c’est très important pour la suite. Le rapport se trouve à la racine du disque système C:\rapport1.txt •- Si tu vois des lignes avec PRESENT!; continue la manip qui suit. Redémarre le PC en mode sans échec ; comme ceci: < http://www.coupdepoucepc.com/modules/news/article.php?storyid=253 > Quand tu as le curseur qui clignote, tu peux avoir un temps d'ouverture du mode sans échec qui va jusqu'à 15 minutes. Il faut donc être patient. Il faut laisser aller le PC à son rythme, pour que s'installe le bureau; après quoi, tu réutilises ta souris. Choisir sa session habituelle, (pas le compte "Administrateur" ou une autre). Les icônes du bureau peuvent également avoir changé d'emplacement en raison de cette basse résolution. •- Ouvre le dossier "SmitfraudFix" et double clic sur "Smitfraudfix.cmd", choisis l’option 2 et tu réponds "oui" à tout. Le rapport se trouve à la racine du disque système C:\rapport.txt ; avec celui renommé en "Rapport1.txt" qui se trouve à la racine du disque système C:\rapport1.txt. Tu les posteras quand tu auras rédémarré en mode normal, plus tard. C)- Double-clique sur Lop S&D.exe du bureau, pour lancer l'installation de Lop S&D.exe (Eric 71 & Angeldark), puis sur [Exécuter], ensuite sélectionne la langue souhaitée, puis choisis l'Option 2 - Suppression +HOSTS - et patiente jusqu'à ce qu'il ait terminé. Tutorial Lop S&D : Supprimer les infections lop.com / Swizzor / Adware.Lop http://www.malekal.com/tutorial_Lop_SD.php D)- Redémarre normalement et poste, dans la même réponse, le contenu du rapport C:\lopR.txt Ainsi que C:\rapport.txt ; avec celui renommé en "Rapport1.txt" qui se trouve à la racine du disque système C:\rapport1.txt. de SmitFraudFix. E)- Relance un nouveau rapport HijackThis après avoir fixé ces lignes seulement: R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0 O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O8 - Extra context menu item: &Search - Aide en images pour fixer ligne avec HJT http://dcangeldark.blogspot.com/2008/02/hijackthis-202-corriger-des-lignes.html Courage Merci Al.

jfkpresident · Answer

bonjour a tous ; salut Al )

pour suivre ..

afideg · Answer

Bonjour JFK
Merci
Je suis en bonne compagnie.
Je vais devoir quitter le PC un moment (famille)

Je dois poursuivre comme ceci:
1)- Supprimer SmitfraudFix et LopS&D
2)- Lancer Malwarebyte's Anti-Malware suivi de ComboFix
3)- CFSript suivi de KasperskyOnline.
4)- Fixer en HJT, et re-CFSript éventuel.

Je m'amuse quoi !
Remplacer AVAST par ANTIVIR et rapport + HJT.

Bon appétit.
Al.

lolocks · Answer

Bonjour merci de prendre le relais, donc je vais poster rapport1, rapport, le rapport lopSD (meme si c'est pas demandé il servira peut etre) + un rapport Hijack

Je voulais signaler que lors du redemaragge en mode normal j'avais perdu mon fond d'ecran sur mon bureau, et j'ai essayer de le remettre tout seul, mais je ne peux pas selectionner d'image (zone de selection grisé, si tu veux un impr ecran, si jamais je ne m'exprime pas bien demande lors de ton prochain message)
Merci d'avance pour la suite

Rapport1.txt :

SmitFraudFix v2.339

Rapport fait à 13:16:49,01, 23/08/2008
Executé à partir de C:\Documents and Settings\mortier\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\vsnpstd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\VMSnap23.exe
C:\WINDOWS\Domino.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\abobkzqz.exe
C:\WINDOWS\winlogon.exe
C:\WINDOWSunsql.exe
C:\WINDOWS\sv.exe
C:\WINDOWS\svzip.exe
C:\WINDOWS\svhoster.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SPYWAREfighter\spftray.exe
C:\Documents and Settings\mortier\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Documents and Settings\mortier\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\mortier\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\abobkzqz.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1	www.legal-at-spybot.info
127.0.0.1	legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ot.ico PRESENT !
C:\WINDOWS\system32	s.ico PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\mortier


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\mortier\Application Data

C:\Documents and Settings\mortier\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Antivirus XP 2008 PRESENT !
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Antivirus XP 2008.lnk PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\mortier\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 

C:\Program Files\akl\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}"="USB Ware"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"IPC Configuration Utility"="IPC Configuration Utility"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{020487CC-FC04-4B1E-863F-D9801796230B}"="Windows Installer Class"

[HKEY_CLASSES_ROOT\CLSID\{020487CC-FC04-4B1E-863F-D9801796230B}\InProcServer32]
@="C:\DOCUME~1\mortier\LOCALS~1\Temp\wndutl32.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{020487CC-FC04-4B1E-863F-D9801796230B}\InProcServer32]
@="C:\DOCUME~1\mortier\LOCALS~1\Temp\wndutl32.dll"



»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte Fast Ethernet compatible VIA - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1CF3D093-6617-4ADA-951E-2FDCF915DEA5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{94DE5A7D-3A0F-4837-894A-11F0F94D2982}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{1CF3D093-6617-4ADA-951E-2FDCF915DEA5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1CF3D093-6617-4ADA-951E-2FDCF915DEA5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin



 rapport.txt :

SmitFraudFix v2.339

Rapport fait à 13:28:51,87, 23/08/2008
Executé à partir de C:\Documents and Settings\mortier\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}"="USB Ware"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"IPC Configuration Utility"="IPC Configuration Utility"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{020487CC-FC04-4B1E-863F-D9801796230B}"="Windows Installer Class"

[HKEY_CLASSES_ROOT\CLSID\{020487CC-FC04-4B1E-863F-D9801796230B}\InProcServer32]
@="C:\DOCUME~1\mortier\LOCALS~1\Temp\wndutl32.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{020487CC-FC04-4B1E-863F-D9801796230B}\InProcServer32]
@="C:\DOCUME~1\mortier\LOCALS~1\Temp\wndutl32.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.1001-search.info
127.0.0.1	1001-search.info
127.0.0.1	www.100888290cs.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	www.10sek.com
127.0.0.1	10sek.com
127.0.0.1	www.123topsearch.com
127.0.0.1	123topsearch.com
127.0.0.1	www.132.com
127.0.0.1	132.com
127.0.0.1	www.136136.net
127.0.0.1	136136.net
127.0.0.1	www.139mm.com
127.0.0.1	139mm.com
127.0.0.1	www.163ns.com
127.0.0.1	163ns.com
127.0.0.1	171203.com
127.0.0.1	17-plus.com
127.0.0.1	www.1800searchonline.com
127.0.0.1	1800searchonline.com
127.0.0.1	www.180searchassistant.com
127.0.0.1	180searchassistant.com
127.0.0.1	www.180solutions.com
127.0.0.1	180solutions.com
127.0.0.1	www.181.365soft.info
127.0.0.1	181.365soft.info
127.0.0.1	www.1987324.com
127.0.0.1	1987324.com
127.0.0.1	www.1-domains-registrations.com
127.0.0.1	1-domains-registrations.com
127.0.0.1	www.1-extreme.biz
127.0.0.1	1-extreme.biz
127.0.0.1	www.1sexparty.com
127.0.0.1	1sexparty.com
127.0.0.1	www.1stantivirus.com
127.0.0.1	1stantivirus.com
127.0.0.1	www.1stpagehere.com
127.0.0.1	1stpagehere.com
127.0.0.1	www.1stsearchportal.com
127.0.0.1	1stsearchportal.com
127.0.0.1	2.82211.net
127.0.0.1	www.2006ooo.com
127.0.0.1	2006ooo.com
127.0.0.1	www.2007-download.com
127.0.0.1	2007-download.com
127.0.0.1	www.2020search.com
127.0.0.1	2020search.com
127.0.0.1	20x2p.com
127.0.0.1	www.24.365soft.info
127.0.0.1	24.365soft.info
127.0.0.1	www.24-7pharmacy.info
127.0.0.1	24-7pharmacy.info
127.0.0.1	www.24-7searching-and-more.com
127.0.0.1	24-7searching-and-more.com
127.0.0.1	www.24teen.com
127.0.0.1	24teen.com
127.0.0.1	www.2every.net
127.0.0.1	2every.net
127.0.0.1	2ndpower.com
127.0.0.1	www.2search.com
127.0.0.1	2search.com
127.0.0.1	www.2search.org
127.0.0.1	2search.org
127.0.0.1	www.2squared.com
127.0.0.1	2squared.com
127.0.0.1	www.3322.org
127.0.0.1	3322.org
127.0.0.1	365soft.info
127.0.0.1	www.36site.com
127.0.0.1	36site.com
127.0.0.1	3721.com
127.0.0.1	39-93.com
127.0.0.1	www.3abetterinternet.com
127.0.0.1	3abetterinternet.com
127.0.0.1	www.3bay.it
127.0.0.1	3bay.it
127.0.0.1	www.3ebay.it
127.0.0.1	3ebay.it
127.0.0.1	www.3xclipsonline.com
127.0.0.1	3xclipsonline.com
127.0.0.1	www.3xcurves.com
127.0.0.1	3xcurves.com
127.0.0.1	www.3xfestival.com
127.0.0.1	3xfestival.com
127.0.0.1	www.3x-festival.com
127.0.0.1	3x-festival.com
127.0.0.1	www.3x-galls.com
127.0.0.1	3x-galls.com
127.0.0.1	www.3xmiracle.com
127.0.0.1	3xmiracle.com
127.0.0.1	www.3xmoviesblog.com
127.0.0.1	3xmoviesblog.com
127.0.0.1	www.404dns.com
127.0.0.1	404dns.com
127.0.0.1	www.4199.com
127.0.0.1	4199.com
127.0.0.1	www.4corn.net
127.0.0.1	4corn.net
127.0.0.1	www.4ebay.it
127.0.0.1	4ebay.it
127.0.0.1	4klm.com
127.0.0.1	www.4mpg.com
127.0.0.1	4mpg.com
127.0.0.1	www.4repubblica.it
127.0.0.1	4repubblica.it
127.0.0.1	www.4softget.com
127.0.0.1	4softget.com
127.0.0.1	www.59cn.cn
127.0.0.1	59cn.cn
127.0.0.1	www.5iscali.it
127.0.0.1	5iscali.it
127.0.0.1	www.5repubblica.it
127.0.0.1	5repubblica.it
127.0.0.1	www.5starvideos.com
127.0.0.1	5starvideos.com
127.0.0.1	www.5tiscali.it
127.0.0.1	5tiscali.it
127.0.0.1	www.5zgmu7o20kt5d8yq.com
127.0.0.1	5zgmu7o20kt5d8yq.com
127.0.0.1	www.680180.net
127.0.0.1	680180.net
127.0.0.1	www.6iscali.it
127.0.0.1	6iscali.it
127.0.0.1	www.6njaga.com
127.0.0.1	6njaga.com
127.0.0.1	www.6sek.com
127.0.0.1	6sek.com
127.0.0.1	www.6tiscali.it
127.0.0.1	6tiscali.it
127.0.0.1	www.70-music.com
127.0.0.1	70-music.com
127.0.0.1	www.7322.com
127.0.0.1	7322.com
127.0.0.1	www.745970.com
127.0.0.1	745970.com
127.0.0.1	75tz.com
127.0.0.1	www.777search.com
127.0.0.1	777search.com
127.0.0.1	www.777top.com
127.0.0.1	777top.com
127.0.0.1	www.7939.com
127.0.0.1	7939.com
127.0.0.1	www.7search.com
127.0.0.1	7search.com
127.0.0.1	80gw6ry3i3x3qbrkwhxhw.032439.com
127.0.0.1	www.80-music.com
127.0.0.1	80-music.com
127.0.0.1	82211.net
127.0.0.1	8866.org
127.0.0.1	www.88vcd.com
127.0.0.1	88vcd.com
127.0.0.1	www.8ad.com
127.0.0.1	8ad.com
127.0.0.1	www.90-music.com
127.0.0.1	90-music.com
127.0.0.1	www.9505.com
127.0.0.1	9505.com
127.0.0.1	www.971searchbox.com
127.0.0.1	971searchbox.com
127.0.0.1	9mmporn.com
127.0.0.1	a.bestmanage.org
127.0.0.1	www.aaabesthomepage.com
127.0.0.1	aaabesthomepage.com
127.0.0.1	aaasexypics.com
127.0.0.1	www.aaawebfinder.com
127.0.0.1	aaawebfinder.com
127.0.0.1	www.aaqadarsztriv.com
127.0.0.1	aaqadarsztriv.com
127.0.0.1	www.aaqada-rsztriv.com
127.0.0.1	aaqada-rsztriv.com
127.0.0.1	www.aaqadaueorn.com
127.0.0.1	aaqadaueorn.com
127.0.0.1	www.aaqada-ueorn.com
127.0.0.1	aaqada-ueorn.com
127.0.0.1	www.aaqada-ygco.com
127.0.0.1	aaqada-ygco.com
127.0.0.1	www.aaqada-ymct.com
127.0.0.1	aaqada-ymct.com
127.0.0.1	www.aav2008.com
127.0.0.1	aav2008.com
127.0.0.1	www.abccodec.com
127.0.0.1	abccodec.com
127.0.0.1	www.abcdperformance.com
127.0.0.1	abcdperformance.com
127.0.0.1	www.abc-find.info
127.0.0.1	abc-find.info
127.0.0.1	www.abcsearch.com
127.0.0.1	abcsearch.com
127.0.0.1	www.abetterinternet.com
127.0.0.1	abetterinternet.com
127.0.0.1	www.abnetsoft.info
127.0.0.1	abnetsoft.info
127.0.0.1	www.about-adult.net
127.0.0.1	about-adult.net
127.0.0.1	www.aboutclicker.com
127.0.0.1	aboutclicker.com
127.0.0.1	www.abrp.net
127.0.0.1	abrp.net
127.0.0.1	www.absolutee.com
127.0.0.1	absolutee.com
127.0.0.1	www.abyssmedia.com
127.0.0.1	abyssmedia.com
127.0.0.1	www.ac66.cn
127.0.0.1	ac66.cn
127.0.0.1	access.navinetwork.com
127.0.0.1	access.rapid-pass.net
127.0.0.1	www.accessactivexvideo.com
127.0.0.1	accessactivexvideo.com
127.0.0.1	www.accessclips.com
127.0.0.1	accessclips.com
127.0.0.1	www.access-dvd.com
127.0.0.1	access-dvd.com
127.0.0.1	www.accesskeygenerator.com
127.0.0.1	accesskeygenerator.com
127.0.0.1	www.accessthefuture.net
127.0.0.1	accessthefuture.net
127.0.0.1	www.accessvid.net
127.0.0.1	accessvid.net
127.0.0.1	www.acemedic.com
127.0.0.1	acemedic.com
127.0.0.1	www.ace-webmaster.com
127.0.0.1	ace-webmaster.com
127.0.0.1	www.acrobat-2007.com
127.0.0.1	acrobat-2007.com
127.0.0.1	www.acrobat-8.com
127.0.0.1	acrobat-8.com
127.0.0.1	www.acrobat-center.com
127.0.0.1	acrobat-center.com
127.0.0.1	www.acrobat-hq.com
127.0.0.1	acrobat-hq.com
127.0.0.1	www.acrobatreader-8.com
127.0.0.1	acrobatreader-8.com
127.0.0.1	www.acrobat-reader-8.de
127.0.0.1	acrobat-reader-8.de
127.0.0.1	www.acrobat-stop.com
127.0.0.1	acrobat-stop.com
127.0.0.1	www.actionbreastcancer.org
127.0.0.1	actionbreastcancer.org
127.0.0.1	www.activesearcher.info
127.0.0.1	activesearcher.info
127.0.0.1	www.activexaccessobject.com
127.0.0.1	activexaccessobject.com
127.0.0.1	www.activexaccessvideo.com
127.0.0.1	activexaccessvideo.com
127.0.0.1	www.activexemedia.com
127.0.0.1	activexemedia.com
127.0.0.1	www.activexmediaobject.com
127.0.0.1	activexmediaobject.com
127.0.0.1	www.activexmediapro.com
127.0.0.1	activexmediapro.com
127.0.0.1	www.activexmediasite.com
127.0.0.1	activexmediasite.com
127.0.0.1	www.activexmediasoftware.com
127.0.0.1	activexmediasoftware.com
127.0.0.1	www.activexmediasource.com
127.0.0.1	activexmediasource.com
127.0.0.1	www.activexmediatool.com
127.0.0.1	activexmediatool.com
127.0.0.1	www.activexmediatour.com
127.0.0.1	activexmediatour.com
127.0.0.1	www.activexsoftwares.com
127.0.0.1	activexsoftwares.com
127.0.0.1	www.activexsource.com
127.0.0.1	activexsource.com
127.0.0.1	www.activexupdate.com
127.0.0.1	activexupdate.com
127.0.0.1	www.activexvideo.com
127.0.0.1	activexvideo.com
127.0.0.1	www.activexvideotool.com
127.0.0.1	activexvideotool.com
127.0.0.1	www.ad.marketingsector.com
127.0.0.1	ad.marketingsector.com
127.0.0.1	www.ad.mokead.com
127.0.0.1	ad.mokead.com
127.0.0.1	ad.oinadserver.com
127.0.0.1	ad.outerinfoads.com
127.0.0.1	www.ad25.com
127.0.0.1	ad25.com
127.0.0.1	www.ad45.com
127.0.0.1	ad45.com
127.0.0.1	www.ad77.com
127.0.0.1	ad77.com
127.0.0.1	www.ad86.com
127.0.0.1	ad86.com
127.0.0.1	www.adamsupportgroup.org
127.0.0.1	adamsupportgroup.org
127.0.0.1	www.adarmor.com
127.0.0.1	adarmor.com
127.0.0.1	www.adasearch.com
127.0.0.1	adasearch.com
127.0.0.1	adaware.cc
127.0.0.1	www.adawarenow.com
127.0.0.1	adawarenow.com
127.0.0.1	adchannel.contextplus.net
127.0.0.1	www.addetect.com
127.0.0.1	addetect.com
127.0.0.1	www.add-hhh.info
127.0.0.1	add-hhh.info
127.0.0.1	www.addictivetechnologies.com
127.0.0.1	addictivetechnologies.com
127.0.0.1	www.addictivetechnologies.net
127.0.0.1	addictivetechnologies.net
127.0.0.1	www.addioerrori.com
127.0.0.1	addioerrori.com
127.0.0.1	www.add-manager.com
127.0.0.1	add-manager.com
127.0.0.1	www.adgate.info
127.0.0.1	adgate.info
127.0.0.1	www.adioserrores.com
127.0.0.1	adioserrores.com
127.0.0.1	www.adipics.com
127.0.0.1	adipics.com
127.0.0.1	www.adlogix.com
127.0.0.1	adlogix.com
127.0.0.1	www.admin2cash.biz
127.0.0.1	admin2cash.biz
127.0.0.1	adnet-plus.com
127.0.0.1	www.adnetserver.com
127.0.0.1	adnetserver.com
127.0.0.1	adobe-download-now.com
127.0.0.1	www.adobe-downloads.com
127.0.0.1	adobe-downloads.com
127.0.0.1	www.adobe-reader-8.fr
127.0.0.1	adobe-reader-8.fr
127.0.0.1	www.adprotect.com
127.0.0.1	adprotect.com
127.0.0.1	ads.centralmedia.ws
127.0.0.1	ads.k8l.info
127.0.0.1	ads.kmpads.com
127.0.0.1	ads.marketingsector.com
127.0.0.1	ads.searchingbooth.com
127.0.0.1	ads.z-quest.com
127.0.0.1	www.ads183.com
127.0.0.1	ads183.com
127.0.0.1	www.adscontex.com
127.0.0.1	adscontex.com
127.0.0.1	www.adservices1.enhance.com
127.0.0.1	adservices1.enhance.com
127.0.0.1	adservs.com
127.0.0.1	www.adsextend.net
127.0.0.1	adsextend.net
127.0.0.1	www.adshttp.com
127.0.0.1	adshttp.com
127.0.0.1	www.adsniffer.com
127.0.0.1	adsniffer.com
127.0.0.1	www.adsonwww.com
127.0.0.1	adsonwww.com
127.0.0.1	www.adspics.com
127.0.0.1	adspics.com
127.0.0.1	www.adtrak.net
127.0.0.1	adtrak.net
127.0.0.1	adtrgt.com
127.0.0.1	www.adult18codec.com
127.0.0.1	adult18codec.com
127.0.0.1	www.adult777search.info
127.0.0.1	adult777search.info
127.0.0.1	www.adultan.com
127.0.0.1	adultan.com
127.0.0.1	www.adultcodec-2008.com
127.0.0.1	adultcodec-2008.com
127.0.0.1	www.adultcodecstars.com
127.0.0.1	adultcodecstars.com
127.0.0.1	www.adult-engine-search.com
127.0.0.1	adult-engine-search.com
127.0.0.1	www.adult-erotic-guide.net
127.0.0.1	adult-erotic-guide.net
127.0.0.1	www.adultfilmsite.com
127.0.0.1	adultfilmsite.com
127.0.0.1	www.adult-friends-finder.net
127.0.0.1	adult-friends-finder.net
127.0.0.1	adultgambling.org
127.0.0.1	adult-host.org
127.0.0.1	www.adulthyperlinks.com
127.0.0.1	adulthyperlinks.com
127.0.0.1	www.adultmovieplus.com
127.0.0.1	adultmovieplus.com
127.0.0.1	www.adult-mpg.net
127.0.0.1	adult-mpg.net
127.0.0.1	adult-personal.us
127.0.0.1	adultsgames.net
127.0.0.1	www.adultsonlyvids.com
127.0.0.1	adultsonlyvids.com
127.0.0.1	www.adultsper.com
127.0.0.1	adultsper.com
127.0.0.1	www.adulttds.com
127.0.0.1	adulttds.com
127.0.0.1	www.adultzoneworld.com
127.0.0.1	adultzoneworld.com
127.0.0.1	www.advancedcleaner.com
127.0.0.1	advancedcleaner.com
127.0.0.1	www.advcash.biz
127.0.0.1	advcash.biz
127.0.0.1	advert.exaccess.ru
127.0.0.1	www.advertisemoney.info
127.0.0.1	advertisemoney.info
127.0.0.1	advertising.paltalk.com
127.0.0.1	www.advertising-money.info
127.0.0.1	advertising-money.info
127.0.0.1	ad-ware.cc
127.0.0.1	www.ad-w-a-r-e.com
127.0.0.1	ad-w-a-r-e.com
127.0.0.1	www.a-d-w-a-r-e.com
127.0.0.1	a-d-w-a-r-e.com
127.0.0.1	www.adware.pro
127.0.0.1	adware.pro
127.0.0.1	www.adwarealert.com
127.0.0.1	adwarealert.com
127.0.0.1	www.ad-warealert.com
127.0.0.1	ad-warealert.com
127.0.0.1	www.adwarearrest.com
127.0.0.1	adwarearrest.com
127.0.0.1	www.adwarebazooka.com
127.0.0.1	adwarebazooka.com
127.0.0.1	www.adwarecommander.com
127.0.0.1	adwarecommander.com
127.0.0.1	www.adwarefinder.com
127.0.0.1	adwarefinder.com
127.0.0.1	www.adwaregold.com
127.0.0.1	adwaregold.com
127.0.0.1	www.adwarepatrol.com
127.0.0.1	adwarepatrol.com
127.0.0.1	www.adwareplatinum.com
127.0.0.1	adwareplatinum.com
127.0.0.1	www.adwareprotectionsite.com
127.0.0.1	adwareprotectionsite.com
127.0.0.1	www.adwarepunisher.com
127.0.0.1	adwarepunisher.com
127.0.0.1	www.adwareremover.ws
127.0.0.1	adwareremover.ws
127.0.0.1	www.adwaresafety.com
127.0.0.1	adwaresafety.com
127.0.0.1	www.adwarexp.com
127.0.0.1	adwarexp.com
127.0.0.1	affiliate.idownload.com
127.0.0.1	www.aflgate.com
127.0.0.1	aflgate.com
127.0.0.1	africaspromise.org
127.0.0.1	agava.com
127.0.0.1	agava.ru
127.0.0.1	agentstudio.com
127.0.0.1	www.ageofconans.net
127.0.0.1	ageofconans.net
127.0.0.1	www.aginegialle.it
127.0.0.1	aginegialle.it
127.0.0.1	www.ahnenforschung.de
127.0.0.1	ahnenforschung.de
127.0.0.1	www.aifind.info
127.0.0.1	aifind.info
127.0.0.1	www.airtleworld.com
127.0.0.1	airtleworld.com
127.0.0.1	www.aitalia.it
127.0.0.1	aitalia.it
127.0.0.1	akamai.downloadv3.com
127.0.0.1	www.aklitalia.it
127.0.0.1	aklitalia.it
127.0.0.1	akril.com
127.0.0.1	alcatel.ws
127.0.0.1	www.alertspy.com
127.0.0.1	alertspy.com
127.0.0.1	www.alfacleaner.com
127.0.0.1	alfacleaner.com
127.0.0.1	alfa-search.com
127.0.0.1	www.alialia.it
127.0.0.1	alialia.it
127.0.0.1	www.aliotalia.it
127.0.0.1	aliotalia.it
127.0.0.1	www.alirtalia.it
127.0.0.1	alirtalia.it
127.0.0.1	www.alitaia.it
127.0.0.1	alitaia.it
127.0.0.1	www.alitaklia.it
127.0.0.1	alitaklia.it
127.0.0.1	www.alitala.it
127.0.0.1	alitala.it
127.0.0.1	www.alitali.it
127.0.0.1	alitali.it
127.0.0.1	www.alitaliaq.it
127.0.0.1	alitaliaq.it
127.0.0.1	www.alitalias.it
127.0.0.1	alitalias.it
127.0.0.1	www.alitaliaz.it
127.0.0.1	alitaliaz.it
127.0.0.1	www.alitalioa.it
127.0.0.1	alitalioa.it
127.0.0.1	www.alitalisa.it
127.0.0.1	alitalisa.it
127.0.0.1	www.alitaliua.it
127.0.0.1	alitaliua.it
127.0.0.1	www.alitalkia.it
127.0.0.1	alitalkia.it
127.0.0.1	www.alitaloia.it
127.0.0.1	alitaloia.it
127.0.0.1	www.alitaluia.it
127.0.0.1	alitaluia.it
127.0.0.1	www.alitaslia.it
127.0.0.1	alitaslia.it
127.0.0.1	www.alitlia.it
127.0.0.1	alitlia.it
127.0.0.1	www.alitralia.it
127.0.0.1	alitralia.it
127.0.0.1	www.alitsalia.it
127.0.0.1	alitsalia.it
127.0.0.1	www.aliutalia.it
127.0.0.1	aliutalia.it
127.0.0.1	www.all1count.net
127.0.0.1	all1count.net
127.0.0.1	www.all4internet.com
127.0.0.1	all4internet.com
127.0.0.1	allabtcars.com
127.0.0.1	allabtjeeps.com
127.0.0.1	www.all-bittorrent.com
127.0.0.1	all-bittorrent.com
127.0.0.1	www.allcollisions.com
127.0.0.1	allcollisions.com
127.0.0.1	www.allcybersearch.com
127.0.0.1	allcybersearch.com
127.0.0.1	www.alldnserrors.com
127.0.0.1	alldnserrors.com
127.0.0.1	www.all-downloads-now.com
127.0.0.1	all-downloads-now.com
127.0.0.1	www.all-edonkey.com
127.0.0.1	all-edonkey.com
127.0.0.1	www.allertaminacce.com
127.0.0.1	allertaminacce.com
127.0.0.1	allforadult.com
127.0.0.1	allhyperlinks.com
127.0.0.1	www.alliesecurity.com
127.0.0.1	alliesecurity.com
127.0.0.1	all-inet.com
127.0.0.1	allinternetbusiness.com
127.0.0.1	www.all-limewire.com
127.0.0.1	all-limewire.com
127.0.0.1	www.allmegabucks.com
127.0.0.1	allmegabucks.com
127.0.0.1	www.allprotections.com
127.0.0.1	allprotections.com
127.0.0.1	www.allresultz.net
127.0.0.1	allresultz.net
127.0.0.1	www.allsearch.us
127.0.0.1	allsearch.us
127.0.0.1	www.allsecuritynotes.com
127.0.0.1	allsecuritynotes.com
127.0.0.1	www.allsecuritysite.com
127.0.0.1	allsecuritysite.com
127.0.0.1	www.allstarsvideos.net
127.0.0.1	allstarsvideos.net
127.0.0.1	www.alltiettantivirus.com
127.0.0.1	alltiettantivirus.com
127.0.0.1	www.alltruesoftware.com
127.0.0.1	alltruesoftware.com
127.0.0.1	www.allvideoactivex.com
127.0.0.1	allvideoactivex.com
127.0.0.1	www.almanah.biz
127.0.0.1	almanah.biz
127.0.0.1	almarvideos.com
127.0.0.1	www.aloitalia.it
127.0.0.1	aloitalia.it
127.0.0.1	www.aluitalia.it
127.0.0.1	aluitalia.it
127.0.0.1	www.amaena.com
127.0.0.1	amaena.com
127.0.0.1	amandamountains.com
127.0.0.1	www.amateurliveshow.com
127.0.0.1	amateurliveshow.com
127.0.0.1	www.amediasoftware.com
127.0.0.1	amediasoftware.com
127.0.0.1	www.amediasource.com
127.0.0.1	amediasource.com
127.0.0.1	www.americanautobargains.com
127.0.0.1	americanautobargains.com
127.0.0.1	www.americancarbargains.com
127.0.0.1	americancarbargains.com
127.0.0.1	american-teens.net
127.0.0.1	amigeek.com
127.0.0.1	www.amigobore.com
127.0.0.1	amigobore.com
127.0.0.1	amisbusiness.com
127.0.0.1	www.ampmsearch.com
127.0.0.1	ampmsearch.com
127.0.0.1	www.analcord.com
127.0.0.1	analcord.com
127.0.0.1	analmovi.com
127.0.0.1	www.anarchylolita.com
127.0.0.1	anarchylolita.com
127.0.0.1	anarchyporn.com
127.0.0.1	www.andromedical.com
127.0.0.1	andromedical.com
127.0.0.1	www.animepornmag.com
127.0.0.1	animepornmag.com
127.0.0.1	anin.org
127.0.0.1	www.anjpn-avxiz.biz
127.0.0.1	anjpn-avxiz.biz
127.0.0.1	www.anjpnzqav.biz
127.0.0.1	anjpnzqav.biz
127.0.0.1	www.anjpn-zqav.biz
127.0.0.1	anjpn-zqav.biz
127.0.0.1	annaromeo.com
127.0.0.1	www.antiddos.us
127.0.0.1	antiddos.us
127.0.0.1	www.antiespiadorado.com
127.0.0.1	antiespiadorado.com
127.0.0.1	www.antiespionspack.com
127.0.0.1	antiespionspack.com
127.0.0.1	www.antigusanos2008.com
127.0.0.1	antigusanos2008.com
127.0.0.1	www.antispamassistant.com
127.0.0.1	antispamassistant.com
127.0.0.1	www.antispamdeluxe.com
127.0.0.1	antispamdeluxe.com
127.0.0.1	www.antispionage.com
127.0.0.1	antispionage.com
127.0.0.1	www.antispionagepro.com
127.0.0.1	antispionagepro.com
127.0.0.1	www.antispyadvanced.com
127.0.0.1	antispyadvanced.com
127.0.0.1	www.antispycheck.com
127.0.0.1	antispycheck.com
127.0.0.1	www.antispydns.biz
127.0.0.1	antispydns.biz
127.0.0.1	www.antispykit.com
127.0.0.1	antispykit.com
127.0.0.1	www.antispylab.com
127.0.0.1	antispylab.com
127.0.0.1	www.antispyshield.com
127.0.0.1	antispyshield.com
127.0.0.1	www.antispysolutions.com
127.0.0.1	antispysolutions.com
127.0.0.1	www.antispyware.com
127.0.0.1	antispyware.com
127.0.0.1	www.antispyware-2008.info
127.0.0.1	antispyware-2008.info
127.0.0.1	www.antispyware2008.name
127.0.0.1	antispyware2008.name
127.0.0.1	www.antispyware-2008.name
127.0.0.1	antispyware-2008.name
127.0.0.1	www.antispyware2008.org
127.0.0.1	antispyware2008.org
127.0.0.1	www.antispyware-2008.org
127.0.0.1	antispyware-2008.org
127.0.0.1	www.antispyware2008-download.com
127.0.0.1	antispyware2008-download.com
127.0.0.1	www.antispyware-2008-download.com
127.0.0.1	antispyware-2008-download.com
127.0.0.1	www.antispyware2008-download.name
127.0.0.1	antispyware2008-download.name
127.0.0.1	www.antispyware2008-download.org
127.0.0.1	antispyware2008-download.org
127.0.0.1	www.antispyware-2008-download.org
127.0.0.1	antispyware-2008-download.org
127.0.0.1	www.antispywareboot.com
127.0.0.1	antispywareboot.com
127.0.0.1	www.antispywarebot.com
127.0.0.1	antispywarebot.com
127.0.0.1	www.antispywarebox.com
127.0.0.1	antispywarebox.com
127.0.0.1	www.antispywaredownloads.com
127.0.0.1	antispywaredownloads.com
127.0.0.1	www.antispywaresuite.com
127.0.0.1	antispywaresuite.com
127.0.0.1	www.antispywareupdates.net
127.0.0.1	antispywareupdates.net
127.0.0.1	www.antispywarexp.com
127.0.0.1	antispywarexp.com
127.0.0.1	www.antispyweb.net
127.0.0.1	antispyweb.net
127.0.0.1	www.antiver2008.com
127.0.0.1	antiver2008.com
127.0.0.1	www.antivermins.com
127.0.0.1	antivermins.com
127.0.0.1	www.anti-vermins.com
127.0.0.1	anti-vermins.com
127.0.0.1	www.antivir2007.com
127.0.0.1	antivir2007.com
127.0.0.1	www.antivirgear.com
127.0.0.1	antivirgear.com
127.0.0.1	www.antivirprotect.com
127.0.0.1	antivirprotect.com
127.0.0.1	www.antivirus.fastfreedownload.com
127.0.0.1	antivirus.fastfreedownload.com
127.0.0.1	www.antivirus2008pro.com
127.0.0.1	antivirus2008pro.com
127.0.0.1	www.antivirus-2008pro.com
127.0.0.1	antivirus-2008pro.com
127.0.0.1	www.antivirus-2008-pro.com
127.0.0.1	antivirus-2008-pro.com
127.0.0.1	www.antivirus2008pro.info
127.0.0.1	antivirus2008pro.info
127.0.0.1	www.antivirus-2008pro.info
127.0.0.1	antivirus-2008pro.info
127.0.0.1	www.antivirus-2008-pro.info
127.0.0.1	antivirus-2008-pro.info
127.0.0.1	www.antivirus2008pro.net
127.0.0.1	antivirus2008pro.net
127.0.0.1	www.antivirus-2008pro.net
127.0.0.1	antivirus-2008pro.net
127.0.0.1	www.antivirus-2008-pro.net
127.0.0.1	antivirus-2008-pro.net
127.0.0.1	www.antivirus2008pro.org
127.0.0.1	antivirus2008pro.org
127.0.0.1	www.antivirus-2008pro.org
127.0.0.1	antivirus-2008pro.org
127.0.0.1	www.antivirus-2008-pro.org
127.0.0.1	antivirus-2008-pro.org
127.0.0.1	www.antivirus2008x.com
127.0.0.1	antivirus2008x.com
127.0.0.1	www.antivirusadvance.com
127.0.0.1	antivirusadvance.com
127.0.0.1	www.antivirusaskeladd.com
127.0.0.1	antivirusaskeladd.com
127.0.0.1	www.antivirus-database.com
127.0.0.1	antivirus-database.com
127.0.0.1	www.antivirusgereedschap.com
127.0.0.1	antivirusgereedschap.com
127.0.0.1	www.antivirusgolden.com
127.0.0.1	antivirusgolden.com
127.0.0.1	www.antivirus-hq.net
127.0.0.1	antivirus-hq.net
127.0.0.1	www.antiviruspcsuite.com
127.0.0.1	antiviruspcsuite.com
127.0.0.1	www.antiviruspremium.com
127.0.0.1	antiviruspremium.com
127.0.0.1	www.anti-virus-pro.com
127.0.0.1	anti-virus-pro.com
127.0.0.1	www.antivirusprotector.com
127.0.0.1	antivirusprotector.com
127.0.0.1	www.antivirus-scanner.com
127.0.0.1	antivirus-scanner.com
127.0.0.1	www.antivirusscherm.com
127.0.0.1	antivirusscherm.com
127.0.0.1	www.antivirussecuritypro.com
127.0.0.1	antivirussecuritypro.com
127.0.0.1	www.antivirus-stop.com
127.0.0.1	antivirus-stop.com
127.0.0.1	www.antivirussuite.com
127.0.0.1	antivirussuite.com
127.0.0.1	www.antiworm2008.com
127.0.0.1	antiworm2008.com
127.0.0.1	www.antiwurm2008.com
127.0.0.1	antiwurm2008.com
127.0.0.1	antrocity.com
127.0.0.1	www.anyofus.com
127.0.0.1	anyofus.com
127.0.0.1	www.anysafereviews.com
127.0.0.1	anysafereviews.com
127.0.0.1	www.anysn.seproger.com
127.0.0.1	anysn.seproger.com
127.0.0.1	anything4health.com
127.0.0.1	www.apicpreview.com
127.0.0.1	apicpreview.com
127.0.0.1	www.appealcircuit.com
127.0.0.1	appealcircuit.com
127.0.0.1	www.approvedlinks.com
127.0.0.1	approvedlinks.com
127.0.0.1	apps.deskwizz.com
127.0.0.1	apps.webservicehost.com
127.0.0.1	www.aprotectedpage.com
127.0.0.1	aprotectedpage.com
127.0.0.1	apsua.com
127.0.0.1	www.archivioadulti.com
127.0.0.1	archivioadulti.com
127.0.0.1	www.archiviosex.net
127.0.0.1	archiviosex.net
127.0.0.1	aregay.com
127.0.0.1	www.ares.click-new-download.com
127.0.0.1	ares.click-new-download.com
127.0.0.1	www.ares-freebie.com
127.0.0.1	ares-freebie.com
127.0.0.1	www.arespro2007.com
127.0.0.1	arespro2007.com
127.0.0.1	www.aresultra.com
127.0.0.1	aresultra.com
127.0.0.1	www.ares-usa.com
127.0.0.1	ares-usa.com
127.0.0.1	arheo.com
127.0.0.1	arizonaweb.org
127.0.0.1	armitageinn.com
127.0.0.1	www.arquivojpgs.smtp.ru
127.0.0.1	arquivojpgs.smtp.ru
127.0.0.1	artachnid.com
127.0.0.1	art-func.com
127.0.0.1	art-xxx.com
127.0.0.1	www.asafebrowser.com
127.0.0.1	asafebrowser.com
127.0.0.1	www.asafetyalways.com
127.0.0.1	asafetyalways.com
127.0.0.1	www.asafetynote.com
127.0.0.1	asafetynote.com
127.0.0.1	www.asafetynotice.com
127.0.0.1	asafetynotice.com
127.0.0.1	www.asafetypage.com
127.0.0.1	asafetypage.com
127.0.0.1	www.asdbiz.biz
127.0.0.1	asdbiz.biz
127.0.0.1	www.asdeykuddq.com
127.0.0.1	asdeykuddq.com
127.0.0.1	www.asecurebar.com
127.0.0.1	asecurebar.com
127.0.0.1	www.asecureboard.com
127.0.0.1	asecureboard.com
127.0.0.1	www.asecurevalue.com
127.0.0.1	asecurevalue.com
127.0.0.1	www.asecurityissue.com
127.0.0.1	asecurityissue.com
127.0.0.1	www.asecuritynotice.com
127.0.0.1	asecuritynotice.com
127.0.0.1	www.asecuritypaper.com
127.0.0.1	asecuritypaper.com
127.0.0.1	www.asecuritystuff.com
127.0.0.1	asecuritystuff.com
127.0.0.1	www.asfadaptation.com
127.0.0.1	asfadaptation.com
127.0.0.1	asiankingkong.com
127.0.0.1	www.asianpornmag.com
127.0.0.1	asianpornmag.com
127.0.0.1	www.asiantoolbar.com
127.0.0.1	asiantoolbar.com
127.0.0.1	www.asidseiupc.com
127.0.0.1	asidseiupc.com
127.0.0.1	www.aslitalia.it
127.0.0.1	aslitalia.it
127.0.0.1	ass-gals.com
127.0.0.1	www.assureprotection.com
127.0.0.1	assureprotection.com
127.0.0.1	asta-killer.com
127.0.0.1	www.astrologie-server.com
127.0.0.1	astrologie-server.com
127.0.0.1	www.asupereva.it
127.0.0.1	asupereva.it
127.0.0.1	www.ataprogram.com
127.0.0.1	ataprogram.com
127.0.0.1	athenrye.com
127.0.0.1	www.atotalsafety.com
127.0.0.1	atotalsafety.com
127.0.0.1	www.atrueprotection.com
127.0.0.1	atrueprotection.com
127.0.0.1	www.atruesecurity.com
127.0.0.1	atruesecurity.com
127.0.0.1	www.attackware.com
127.0.0.1	attackware.com
127.0.0.1	www.attrezzi.biz
127.0.0.1	attrezzi.biz
127.0.0.1	www.aucunsvirus.com
127.0.0.1	aucunsvirus.com
127.0.0.1	www.aulde.net
127.0.0.1	aulde.net
127.0.0.1	www.aupereva.it
127.0.0.1	aupereva.it
127.0.0.1	www.autobargains.org
127.0.0.1	autobargains.org
127.0.0.1	www.autobargainsnetwork.com
127.0.0.1	autobargainsnetwork.com
127.0.0.1	www.autocontext.begun.ru
127.0.0.1	autocontext.begun.ru
127.0.0.1	autoescrowpay.com
127.0.0.1	www.avadvance.com
127.0.0.1	avadvance.com
127.0.0.1	www.avast.free-software-center.com
127.0.0.1	avast.free-software-center.com
127.0.0.1	www.avast-2007.com
127.0.0.1	avast-2007.com
127.0.0.1	www.avast-downloads.com
127.0.0.1	avast-downloads.com
127.0.0.1	www.avast-hq.com
127.0.0.1	avast-hq.com
127.0.0.1	www.avforce.com
127.0.0.1	avforce.com
127.0.0.1	www.avg.grab-it-today.net
127.0.0.1	avg.grab-it-today.net
127.0.0.1	www.avg.softwarecenterz.com
127.0.0.1	avg.softwarecenterz.com
127.0.0.1	www.avg-secure.com
127.0.0.1	avg-secure.com
127.0.0.1	www.aviadaptation.com
127.0.0.1	aviadaptation.com
127.0.0.1	avian-ads.com
127.0.0.1	www.avicoupler.com
127.0.0.1	avicoupler.com
127.0.0.1	www.avideoaxaccess.com
127.0.0.1	avideoaxaccess.com
127.0.0.1	www.avideosurfer.com
127.0.0.1	avideosurfer.com
127.0.0.1	www.avidirection.com
127.0.0.1	avidirection.com
127.0.0.1	www.aviewersoft.com
127.0.0.1	aviewersoft.com
127.0.0.1	www.aviexecution.com
127.0.0.1	aviexecution.com
127.0.0.1	www.avihelper.com
127.0.0.1	avihelper.com
127.0.0.1	www.aviinstrument.com
127.0.0.1	aviinstrument.com
127.0.0.1	www.avitool.com
127.0.0.1	avitool.com
127.0.0.1	www.aviutility.com
127.0.0.1	aviutility.com
127.0.0.1	www.avpcheckupdate.com
127.0.0.1	avpcheckupdate.com
127.0.0.1	www.avsmanufacture.com
127.0.0.1	avsmanufacture.com
127.0.0.1	www.avsystemcare.com
127.0.0.1	avsystemcare.com
127.0.0.1	www.avxizaaqada.biz
127.0.0.1	avxizaaqada.biz
127.0.0.1	www.avxiz-anjpn.biz
127.0.0.1	avxiz-anjpn.biz
127.0.0.1	www.avxizueorn.biz
127.0.0.1	avxizueorn.biz
127.0.0.1	www.avxiz-ueorn.biz
127.0.0.1	avxiz-ueorn.biz
127.0.0.1	www.avxiz-vtvcp.biz
127.0.0.1	avxiz-vtvcp.biz
127.0.0.1	www.avxiz-ygco.biz
127.0.0.1	avxiz-ygco.biz
127.0.0.1	www.avxiz-zqav.biz
127.0.0.1	avxiz-zqav.biz
127.0.0.1	www.awarenesstech.com
127.0.0.1	awarenesstech.com
127.0.0.1	www.awarninglist.com
127.0.0.1	awarninglist.com
127.0.0.1	awbeta.net-nucleus.com
127.0.0.1	www.awesomehomepage.com
127.0.0.1	awesomehomepage.com
127.0.0.1	awmcash.biz
127.0.0.1	awmdabest.com
127.0.0.1	www.axemediasoftware.com
127.0.0.1	axemediasoftware.com
127.0.0.1	www.aximageobject.com
127.0.0.1	aximageobject.com
127.0.0.1	www.axmediaproject.com
127.0.0.1	axmediaproject.com
127.0.0.1	www.axmediasoftware.com
127.0.0.1	axmediasoftware.com
127.0.0.1	www.axmediasolutions.com
127.0.0.1	axmediasolutions.com
127.0.0.1	www.axobjectpage.com
127.0.0.1	axobjectpage.com
127.0.0.1	www.axobjectsource.com
127.0.0.1	axobjectsource.com
127.0.0.1	www.axsoftwaretool.com
127.0.0.1	axsoftwaretool.com
127.0.0.1	www.axvideoproject.com
127.0.0.1	axvideoproject.com
127.0.0.1	www.axvideosetup.com
127.0.0.1	axvideosetup.com
127.0.0.1	ayakawamura.com
127.0.0.1	ayumitaniguchi.com
127.0.0.1	azebar.com
127.0.0.1	www.azureusclub.com
127.0.0.1	azureusclub.com
127.0.0.1	www.azureus-freebie.com
127.0.0.1	azureus-freebie.com
127.0.0.1	www.azzetta.it
127.0.0.1	azzetta.it
127.0.0.1	b.casalemedia.com
127.0.0.1	b122.mcboo.com
127.0.0.1	www.babe.k-lined.com
127.0.0.1	babe.k-lined.com
127.0.0.1	www.babe.the-killer.bz
127.0.0.1	babe.the-killer.bz
127.0.0.1	www.babenet.com
127.0.0.1	babenet.com
127.0.0.1	www.babespornmag.com
127.0.0.1	babespornmag.com
127.0.0.1	www.babeweb.de
127.0.0.1	babeweb.de
127.0.0.1	www.baccarat-other.info
127.0.0.1	baccarat-other.info
127.0.0.1	www.backstripgirls.com
127.0.0.1	backstripgirls.com
127.0.0.1	backup.mabou.org
127.0.0.1	www.baiduqqsina.cn
127.0.0.1	baiduqqsina.cn
127.0.0.1	www.balotierra.com
127.0.0.1	balotierra.com
127.0.0.1	bannedhost.net
127.0.0.1	barbudafarms.com
127.0.0.1	www.bardownload.com
127.0.0.1	bardownload.com
127.0.0.1	barnandfence.com
127.0.0.1	batsearch.com
127.0.0.1	baygraphicsllc.com
127.0.0.1	bb.wudiliuliang.com
127.0.0.1	bbbsearch.com
127.0.0.1	bb-search.com
127.0.0.1	www.bcnproduction.com
127.0.0.1	bcnproduction.com
127.0.0.1	bdsmlibrary.net
127.0.0.1	www.bdsmpornmag.com
127.0.0.1	bdsmpornmag.com
127.0.0.1	www.bealent.com
127.0.0.1	bealent.com
127.0.0.1	www.bearshare.click-new-download.com
127.0.0.1	bearshare.click-new-download.com
127.0.0.1	www.bearshare.download-me.info
127.0.0.1	bearshare.download-me.info
127.0.0.1	www.bearshare.mp3-muzic.com
127.0.0.1	bearshare.mp3-muzic.com
127.0.0.1	www.bearshare-download.org
127.0.0.1	bearshare-download.org
127.0.0.1	www.bearshare-downloads.net
127.0.0.1	bearshare-downloads.net
127.0.0.1	www.bearsharelive.co.uk
127.0.0.1	bearsharelive.co.uk
127.0.0.1	www.bearshare-music-downloads.com
127.0.0.1	bearshare-music-downloads.com
127.0.0.1	www.bearsharepro2007.com
127.0.0.1	bearsharepro2007.com
127.0.0.1	www.bearshare-usa.com
127.0.0.1	bearshare-usa.com
127.0.0.1	bedhome.com
127.0.0.1	bediadance.com
127.0.0.1	www.beebappyy.biz
127.0.0.1	beebappyy.biz
127.0.0.1	www.begin2search.com
127.0.0.1	begin2search.com
127.0.0.1	bellabasketsfl.com
127.0.0.1	bernaolatwin.com
127.0.0.1	www.berufe-jobs.de
127.0.0.1	berufe-jobs.de
127.0.0.1	www.berufe-server.de
127.0.0.1	berufe-server.de
127.0.0.1	www.berufe-welt.de
127.0.0.1	berufe-welt.de
127.0.0.1	www.berufs-wahl.de
127.0.0.1	berufs-wahl.de
127.0.0.1	www.beruijindegunhadesun.com
127.0.0.1	beruijindegunhadesun.com
127.0.0.1	www.best3xclips.com
127.0.0.1	best3xclips.com
127.0.0.1	www.bestadults.com
127.0.0.1	bestadults.com
127.0.0.1	www.best-codec.com
127.0.0.1	best-codec.com
127.0.0.1	best-counter.com
127.0.0.1	bestcrawler.com
127.0.0.1	www.bestdailyvids.com
127.0.0.1	bestdailyvids.com
127.0.0.1	bestfor.ru
127.0.0.1	www.bestfuckvids.com
127.0.0.1	bestfuckvids.com
127.0.0.1	best-hardpics.com
127.0.0.1	www.bestmanage.org
127.0.0.1	bestmanage.org
127.0.0.1	www.bestmanage0.org
127.0.0.1	bestmanage0.org
127.0.0.1	www.bestmanage1.org
127.0.0.1	bestmanage1.org
127.0.0.1	www.bestmanage2.org
127.0.0.1	bestmanage2.org
127.0.0.1	www.bestmanage3.org
127.0.0.1	bestmanage3.org
127.0.0.1	www.bestmanage4.org
127.0.0.1	bestmanage4.org
127.0.0.1	www.bestmanage5.org
127.0.0.1	bestmanage5.org
127.0.0.1	www.bestmanage6.org
127.0.0.1	bestmanage6.org
127.0.0.1	www.bestmanage7.org
127.0.0.1	bestmanage7.org
127.0.0.1	www.bestmanage8.org
127.0.0.1	bestmanage8.org
127.0.0.1	www.bestmanage9.org
127.0.0.1	bestmanage9.org
127.0.0.1	www.bestmovszone.com
127.0.0.1	bestmovszone.com
127.0.0.1	www.bestoffersnetworks.com
127.0.0.1	bestoffersnetworks.com
127.0.0.1	www.best-porncollection.com
127.0.0.1	best-porncollection.com
127.0.0.1	bestporngate.com
127.0.0.1	www.bestsafetyguide.net
127.0.0.1	bestsafetyguide.net
127.0.0.1	www.bestsearch.cc
127.0.0.1	bestsearch.cc
127.0.0.1	www.bestsearchworld.info
127.0.0.1	bestsearchworld.info
127.0.0.1	www.best-spyware.info
127.0.0.1	best-spyware.info
127.0.0.1	www.best-targeted-traffic.com
127.0.0.1	best-targeted-traffic.com
127.0.0.1	www.best-voyeur.info
127.0.0.1	best-voyeur.info
127.0.0.1	bestweblinks.com
127.0.0.1	best-winning-casino.com
127.0.0.1	www.bestworldgirls-for-u.net
127.0.0.1	bestworldgirls-for-u.net
127.0.0.1	www.bestxclips.com
127.0.0.1	bestxclips.com
127.0.0.1	bestxporno.com
127.0.0.1	www.bestxxxmpegs.com
127.0.0.1	bestxxxmpegs.com
127.0.0.1	www.bettersearch.biz
127.0.0.1	bettersearch.biz
127.0.0.1	www.bgazzetta.it
127.0.0.1	bgazzetta.it
127.0.0.1	www.bgoogle.it
127.0.0.1	bgoogle.it
127.0.0.1	www.bigcodecadult.com
127.0.0.1	bigcodecadult.com
127.0.0.1	www.bigcodecadult2008.com
127.0.0.1	bigcodecadult2008.com
127.0.0.1	www.bigcodecadult2008-17.com
127.0.0.1	bigcodecadult2008-17.com
127.0.0.1	www.bighot18adult2008.com
127.0.0.1	bighot18adult2008.com
127.0.0.1	www.bighot18-adult2008.com
127.0.0.1	bighot18-adult2008.com
127.0.0.1	www.bighot18codec2008.com
127.0.0.1	bighot18codec2008.com
127.0.0.1	www.bighot18-codec2008.com
127.0.0.1	bighot18-codec2008.com
127.0.0.1	www.bigtrafficnetwork.com
127.0.0.1	bigtrafficnetwork.com
127.0.0.1	www.bigwww.com
127.0.0.1	bigwww.com
127.0.0.1	www.bill.de
127.0.0.1	bill.de
127.0.0.1	bin.errorprotector.com
127.0.0.1	bins.media-motor.net
127.0.0.1	bins2.media-motor.net
127.0.0.1	bis.180solutions.com
127.0.0.1	bitchesonline.net
127.0.0.1	www.bitcomet-freebie.com
127.0.0.1	bitcomet-freebie.com
127.0.0.1	www.bittorrent.click-new-download.com
127.0.0.1	bittorrent.click-new-download.com
127.0.0.1	biz.biz
127.0.0.1	www.bkvcompany.com
127.0.0.1	bkvcompany.com
127.0.0.1	www.blackblues00.com
127.0.0.1	blackblues00.com
127.0.0.1	www.blackcodec.com
127.0.0.1	blackcodec.com
127.0.0.1	www.black-codec.com
127.0.0.1	black-codec.com
127.0.0.1	www.blackcodec.net
127.0.0.1	blackcodec.net
127.0.0.1	www.blackhats.tc
127.0.0.1	blackhats.tc
127.0.0.1	www.blackhawksoftware.com
127.0.0.1	blackhawksoftware.com
127.0.0.1	blackjack-free.net
127.0.0.1	www.blacklegion.info
127.0.0.1	blacklegion.info
127.0.0.1	blazefind.com
127.0.0.1	blender.xu.pl
127.0.0.1	www.blockcheckercontrol.com
127.0.0.1	blockcheckercontrol.com
127.0.0.1	blondetgp.com
127.0.0.1	www.blue-elefant.com
127.0.0.1	blue-elefant.com
127.0.0.1	www.bm.theaimonline.com
127.0.0.1	bm.theaimonline.com
127.0.0.1	www.bnmgate.com
127.0.0.1	bnmgate.com
127.0.0.1	bodaciousbabette.com
127.0.0.1	www.bonzi.com
127.0.0.1	bonzi.com
127.0.0.1	boobdoll.com
127.0.0.1	boobsandtits.com
127.0.0.1	boobsclub.com
127.0.0.1	www.bookedspace.com
127.0.0.1	bookedspace.com
127.0.0.1	www.boom.com.vn
127.0.0.1	boom.com.vn
127.0.0.1	www.boomgirltv.com
127.0.0.1	boomgirltv.com
127.0.0.1	boredlife.com
127.0.0.1	bowlofogumbo.com
127.0.0.1	www.bpfq02.com
127.0.0.1	bpfq02.com
127.0.0.1	www.bqgate.com
127.0.0.1	bqgate.com
127.0.0.1	br.errorsafe.com
127.0.0.1	br.winantivirus.com
127.0.0.1	br.winfixer.com
127.0.0.1	bradcoem.org
127.0.0.1	www.braincodec.com
127.0.0.1	braincodec.com
127.0.0.1	www.brakecodec.com
127.0.0.1	brakecodec.com
127.0.0.1	brandiyoung.com
127.0.0.1	www.bravesentry.com
127.0.0.1	bravesentry.com
127.0.0.1	www.breenten.biz
127.0.0.1	breenten.biz
127.0.0.1	www.brodbfm.net
127.0.0.1	brodbfm.net
127.0.0.1	brookeburn.com
127.0.0.1	www.browserwise.com
127.0.0.1	browserwise.com
127.0.0.1	bsa.safetydownload.com
127.0.0.1	www.bsplaycodec.com
127.0.0.1	bsplaycodec.com
127.0.0.1	bucps.com
127.0.0.1	buhartes.info
127.0.0.1	buldog-stats.com
127.0.0.1	www.bullseye-network.com
127.0.0.1	bullseye-network.com
127.0.0.1	burgerkingbigscreen.com
127.0.0.1	www.burningsite.com
127.0.0.1	burningsite.com
127.0.0.1	www.burnsrecyclinginc.com
127.0.0.1	burnsrecyclinginc.com
127.0.0.1	buscards.net
127.0.0.1	bustyrussell.com
127.0.0.1	www.busysearch.net
127.0.0.1	busysearch.net
127.0.0.1	buttejazz.org
127.0.0.1	www.buy-find.info
127.0.0.1	buy-find.info
127.0.0.1	buyselldomain.net
127.0.0.1	www.buytraff.biz
127.0.0.1	buytraff.biz
127.0.0.1	buz.ru
127.0.0.1	www.bvdtechinque.com
127.0.0.1	bvdtechinque.com
127.0.0.1	www.bvirgilio.it
127.0.0.1	bvirgilio.it
127.0.0.1	www.bye-spyware.com
127.0.0.1	bye-spyware.com
127.0.0.1	c.centralmedia.ws
127.0.0.1	www.c.enhance.com
127.0.0.1	c.enhance.com
127.0.0.1	c.goclick.com
127.0.0.1	www.c4tdownload.com
127.0.0.1	c4tdownload.com
127.0.0.1	www.c5.www4free.info
127.0.0.1	c5.www4free.info
127.0.0.1	www.cache.surfaccuracy.com
127.0.0.1	cache.surfaccuracy.com
127.0.0.1	cache.ysbweb.com
127.0.0.1	www.cadesfinjeriokas.com
127.0.0.1	cadesfinjeriokas.com
127.0.0.1	calcioturris.com
127.0.0.1	www.calendaralerts.net
127.0.0.1	calendaralerts.net
127.0.0.1	www.callinghome.biz
127.0.0.1	callinghome.biz
127.0.0.1	www.cameouk.co.uk
127.0.0.1	cameouk.co.uk
127.0.0.1	cameup.com
127.0.0.1	www.camouflageclothingonline.net
127.0.0.1	camouflageclothingonline.net
127.0.0.1	campaigns.outerinfo.net
127.0.0.1	camup.net
127.0.0.1	canberracricketcoaching.com
127.0.0.1	candycantaloupes.com
127.0.0.1	www.canidetect.org
127.0.0.1	canidetect.org
127.0.0.1	www.cantfind.com
127.0.0.1	cantfind.com
127.0.0.1	careers.dulcineasystems.net
127.0.0.1	carsands.com
127.0.0.1	carsrentals.net
127.0.0.1	cartoes.uol.com.br
127.0.0.1	www.casalemedia.com
127.0.0.1	casalemedia.com
127.0.0.1	www.cashdeluxe.net
127.0.0.1	cashdeluxe.net
127.0.0.1	www.cashengines.com
127.0.0.1	cashengines.com
127.0.0.1	cashsearch.biz
127.0.0.1	www.cashsurfers.com
127.0.0.1	cashsurfers.com
127.0.0.1	www.cashunlim.com
127.0.0.1	cashunlim.com
127.0.0.1	casino.com.free.game.pogo.gratisdownloads.nl
127.0.0.1	casino2win.net
127.0.0.1	casino-gambling-1.net
127.0.0.1	casino-gambling-2.net
127.0.0.1	casinomidas.net
127.0.0.1	casinonline.net
127.0.0.1	casino-onlines.net
127.0.0.1	www.castingsamateur.com
127.0.0.1	castingsamateur.com
127.0.0.1	catallogue.com
127.0.0.1	www.catch-dc.info
127.0.0.1	catch-dc.info
127.0.0.1	categories.mygeek.com
127.0.0.1	catsss.da.ru
127.0.0.1	caxa.ru
127.0.0.1	cazygirls-world.com
127.0.0.1	cc.panet.org
127.0.0.1	www.ccecaedbebfcaf.com
127.0.0.1	ccecaedbebfcaf.com
127.0.0.1	cclebali.org
127.0.0.1	www.ccorriere.it
127.0.0.1	ccorriere.it
127.0.0.1	www.cdcopysite.com
127.0.0.1	cdcopysite.com
127.0.0.1	www.cdegate.com
127.0.0.1	cdegate.com
127.0.0.1	cdn.drivecleaner.com
127.0.0.1	cdn.errorsafe.com
127.0.0.1	cdn.movies-etc.com
127.0.0.1	cdn.winsoftware.com
127.0.0.1	cdn2.movies-etc.com
127.0.0.1	www.cdorriere.it
127.0.0.1	cdorriere.it
127.0.0.1	ceewawires.org
127.0.0.1	centralmedia.ws
127.0.0.1	certumgroup.com
127.0.0.1	www.cforriere.it
127.0.0.1	cforriere.it
127.0.0.1	www.check.jupitersatellites.biz
127.0.0.1	check.jupitersatellites.biz
127.0.0.1	www.checkin100.com
127.0.0.1	checkin100.com
127.0.0.1	www.checkssecurity.com
127.0.0.1	checkssecurity.com
127.0.0.1	chelancatering.com
127.0.0.1	www.chenshijituan.com
127.0.0.1	chenshijituan.com
127.0.0.1	childrenvilla.com
127.0.0.1	www.chilly3xvids.com
127.0.0.1	chilly3xvids.com
127.0.0.1	www.chillymovs.com
127.0.0.1	chillymovs.com
127.0.0.1	chips-4-free.com
127.0.0.1	chrisswasey.com
127.0.0.1	chriswallace.net
127.0.0.1	www.cia-trjn.myvnc.com
127.0.0.1	cia-trjn.myvnc.com
127.0.0.1	www.cinemadownload.com
127.0.0.1	cinemadownload.com
127.0.0.1	www.ciorriere.it
127.0.0.1	ciorriere.it
127.0.0.1	www.cirriere.it
127.0.0.1	cirriere.it
127.0.0.1	www.citycodec.com
127.0.0.1	citycodec.com
127.0.0.1	ckick4thumbs.com
127.0.0.1	cl55.biz
127.0.0.1	clackamasliteraryreview.com
127.0.0.1	www.clckm.com
127.0.0.1	clckm.com
127.0.0.1	www.cleancodec.com
127.0.0.1	cleancodec.com
127.0.0.1	www.cleansoftwares.com
127.0.0.1	cleansoftwares.com
127.0.0.1	clearsearch.cc
127.0.0.1	clearsearch.net
127.0.0.1	clickaire.com
127.0.0.1	www.click-codec.com
127.0.0.1	click-codec.com
127.0.0.1	www.clickhere4search.com
127.0.0.1	clickhere4search.com
127.0.0.1	www.click-new-download.com
127.0.0.1	click-new-download.com
127.0.0.1	click-now.net
127.0.0.1	www.clickspring.net
127.0.0.1	clickspring.net
127.0.0.1	www.click-to-download.com
127.0.0.1	click-to-download.com
127.0.0.1	www.clicktomakeasearch.com
127.0.0.1	clicktomakeasearch.com
127.0.0.1	clickyestoenter.net
127.0.0.1	client.exeupdate.com
127.0.0.1	client.myadultexplorer.com
127.0.0.1	www.cliks.org
127.0.0.1	cliks.org
127.0.0.1	www.clipsfestival.com
127.0.0.1	clipsfestival.com
127.0.0.1	www.clipsreality.com
127.0.0.1	clipsreality.com
127.0.0.1	www.clorriere.it
127.0.0.1	clorriere.it
127.0.0.1	clrsch.com
127.0.0.1	www.clubxxxvideo.com
127.0.0.1	clubxxxvideo.com
127.0.0.1	clusif.free.fr
127.0.0.1	cmtapestry.com
127.0.0.1	www.cnetadd.com
127.0.0.1	cnetadd.com
127.0.0.1	www.cnomy.com
127.0.0.1	cnomy.com
127.0.0.1	www.cnzz.com
127.0.0.1	cnzz.com
127.0.0.1	www.cocktails-ideen.de
127.0.0.1	cocktails-ideen.de
127.0.0.1	code.ignphrases.com
127.0.0.1	codec.ninoa.com
127.0.0.1	www.codecadult18.com
127.0.0.1	codecadult18.com
127.0.0.1	www.codecbest.com
127.0.0.1	codecbest.com
127.0.0.1	www.codecbsplay.com
127.0.0.1	codecbsplay.com
127.0.0.1	www.codecdemo.com
127.0.0.1	codecdemo.com
127.0.0.1	www.codecdvd.net
127.0.0.1	codecdvd.net
127.0.0.1	www.codecdvi.com
127.0.0.1	codecdvi.com
127.0.0.1	www.codec-fun.com
127.0.0.1	codec-fun.com
127.0.0.1	www.codechard.com
127.0.0.1	codechard.com
127.0.0.1	www.codechot.net
127.0.0.1	codechot.net
127.0.0.1	www.codechq.net
127.0.0.1	codechq.net
127.0.0.1	www.codecmeg.net
127.0.0.1	codecmeg.net
127.0.0.1	www.codecmega.com
127.0.0.1	codecmega.com
127.0.0.1	www.codecmega.net
127.0.0.1	codecmega.net
127.0.0.1	www.codecmoon.com
127.0.0.1	codecmoon.com
127.0.0.1	www.codecmpg.com
127.0.0.1	codecmpg.com
127.0.0.1	www.codecnice.net
127.0.0.1	codecnice.net
127.0.0.1	www.codecnitro.com
127.0.0.1	codecnitro.com
127.0.0.1	www.codecops.net
127.0.0.1	codecops.net
127.0.0.1	www.codecplay.com
127.0.0.1	codecplay.com
127.0.0.1	www.codecpretty.net
127.0.0.1	codecpretty.net
127.0.0.1	www.codecpro.net
127.0.0.1	codecpro.net
127.0.0.1	www.codecred.net
127.0.0.1	codecred.net
127.0.0.1	www.codecsoft.net
127.0.0.1	codecsoft.net
127.0.0.1	www.codecthe.com
127.0.0.1	codecthe.com
127.0.0.1	www.codectime.com
127.0.0.1	codectime.com
127.0.0.1	www.codecultra.net
127.0.0.1	codecultra.net
127.0.0.1	www.codecvids.com
127.0.0.1	codecvids.com
127.0.0.1	www.codecvip.com
127.0.0.1	codecvip.com
127.0.0.1	www.codecviva.com
127.0.0.1	codecviva.com
127.0.0.1	www.codeczang.net
127.0.0.1	codeczang.net
127.0.0.1	www.codrriere.it
127.0.0.1	codrriere.it
127.0.0.1	www.coeriere.it
127.0.0.1	coeriere.it
127.0.0.1	www.coerriere.it
127.0.0.1	coerriere.it
127.0.0.1	www.cofrriere.it
127.0.0.1	cofrriere.it
127.0.0.1	www.cogrriere.it
127.0.0.1	cogrriere.it
127.0.0.1	www.coirriere.it
127.0.0.1	coirriere.it
127.0.0.1	command.adservs.com
127.0.0.1	www.commonname.com
127.0.0.1	commonname.com
127.0.0.1	www.computerpcgames.net
127.0.0.1	computerpcgames.net
127.0.0.1	www.computerrecover.com
127.0.0.1	computerrecover.com
127.0.0.1	config.180solutions.com
127.0.0.1	www.congtouzailai.net
127.0.0.1	congtouzailai.net
127.0.0.1	www.content.dollarrevenue.com
127.0.0.1	content.dollarrevenue.com
127.0.0.1	www.content.ireit.com
127.0.0.1	content.ireit.com
127.0.0.1	content.onerateld.com
127.0.0.1	www.contentmatch.net
127.0.0.1	contentmatch.net
127.0.0.1	www.contextplus.net
127.0.0.1	contextplus.net
127.0.0.1	www.contra-virus.com
127.0.0.1	contra-virus.com
127.0.0.1	www.controlmeh.com
127.0.0.1	controlmeh.com
127.0.0.1	www.convenient-search.com
127.0.0.1	convenient-search.com
127.0.0.1	www.cookingluck.com
127.0.0.1	cookingluck.com
127.0.0.1	www.cooldeskalert.com
127.0.0.1	cooldeskalert.com
127.0.0.1	coolfetishsite.com
127.0.0.1	coolfreehost.com
127.0.0.1	coolfreepage.com
127.0.0.1	coolfreepages.com
127.0.0.1	cool-homepage.co
127.0.0.1	cool-homepage.com
127.0.0.1	coolmoneysearch.com
127.0.0.1	www.coolonlinebusiness.com
127.0.0.1	coolonlinebusiness.com
127.0.0.1	coolpornsearch.com
127.0.0.1	cool-search.net
127.0.0.1	cool-search.netfartpost.com
127.0.0.1	coolsearcher.info
127.0.0.1	www.coolservecorp.net
127.0.0.1	coolservecorp.net
127.0.0.1	www.coolwebsearch.com
127.0.0.1	coolwebsearch.com
127.0.0.1	cool-web-search.com
127.0.0.1	coolwebsearsh.com
127.0.0.1	www.coolwwwsearch.com
127.0.0.1	coolwwwsearch.com
127.0.0.1	cool-xxx.net
127.0.0.1	www.coorriere.it
127.0.0.1	coorriere.it
127.0.0.1	copmtraine.com
127.0.0.1	www.coprriere.it
127.0.0.1	coprriere.it
127.0.0.1	www.core.psyche-evolution.com
127.0.0.1	core.psyche-evolution.com
127.0.0.1	www.coreiere.it
127.0.0.1	coreiere.it
127.0.0.1	www.coreri

lolocks · Answer

je comprend pas j'arrive pas à poster la suite il doit y avoir, une limite de temps pour poster, je reessaye plus tard !

afideg · Answer

Re,

Non, il n'y a pas de limite de temps.
Poste-le en plusieurs parties ( ou laisse tomber la partie hosts )

Le rapport LopS&D a été demandé là « le contenu du rapport C:\lopR.txt en § D)-


Merci
Al.

lolocks · Answer

bah désolé alors je ne sais pas pourquoi ça ne voulait pas passer, je vous poste le reste des rapports en delaissant la partie host si j'ai bien compris ce que c'est !

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\system32\ot.ico supprimé
C:\WINDOWS\system32	s.ico supprimé
C:\Documents and Settings\mortier\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk supprimé
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Antivirus XP 2008 supprimé
C:\DOCUME~1\ALLUSE~1\MENUDM~1\Antivirus XP 2008.lnk supprimé
C:\Program Files\akl\ supprimé

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1CF3D093-6617-4ADA-951E-2FDCF915DEA5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{94DE5A7D-3A0F-4837-894A-11F0F94D2982}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{1CF3D093-6617-4ADA-951E-2FDCF915DEA5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1CF3D093-6617-4ADA-951E-2FDCF915DEA5}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"IPC Configuration Utility"="IPC Configuration Utility"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{020487CC-FC04-4B1E-863F-D9801796230B}"="Windows Installer Class"

[HKEY_CLASSES_ROOT\CLSID\{020487CC-FC04-4B1E-863F-D9801796230B}\InProcServer32]
@="C:\DOCUME~1\mortier\LOCALS~1\Temp\wndutl32.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{020487CC-FC04-4B1E-863F-D9801796230B}\InProcServer32]
@="C:\DOCUME~1\mortier\LOCALS~1\Temp\wndutl32.dll"



»»»»»»»»»»»»»»»»»»»»»»»» Fin

Le rapport lopR


   --------------------\  Lop S&D 4.2.3-4   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3400+ )
   BIOS Date: 11/09/06 15:00:21 Ver: 08.00.12
   BOOT : Fail-safe boot

   "C:\Lop SD" ( MAJ : 23-08-2008|10:35 )
   Option : [2] ( 23/08/2008|13:33 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\mortier\Cookies\mortier@adultfriendfinder[1].txt
   Supprime! - C:\DOCUME~1\mortier\Cookies\mortier@partypoker[1].txt
   Supprime! - C:\Program Files\Circle Developement
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1  

   [13/10/2005|20:19] C:\DOCUME~1\ADMINI~1\APPLIC~1\desktop.ini
   [18/08/2006|15:27] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [06/08/2006|10:32] C:\DOCUME~1\ADMINI~1\APPLIC~1\Media Player Classic
   [13/10/2005|19:30] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [08/06/2006|15:24] C:\DOCUME~1\ADMINI~1\APPLIC~1\Mozilla

   [20/10/2005|12:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [20/04/2008|15:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [15/03/2007|13:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [02/11/2005|14:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
   [18/03/2008|19:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
   [13/10/2005|20:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
   [20/04/2008|11:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
   [21/11/2007|00:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [09/05/2007|14:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EarMaster
   [11/07/2008|14:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [07/03/2006|13:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [07/03/2006|13:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log
   [05/03/2008|21:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [24/06/2008|20:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [11/08/2008|15:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [19/10/2005|22:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
   [24/12/2007|19:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Musicnotes
   [04/09/2006|20:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
   [04/04/2007|20:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ProStroke Golf
   [19/02/2008|23:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QTSBandwidthCache
   [17/06/2006|21:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [07/03/2006|16:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Corporation
   [04/08/2008|19:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [13/10/2005|20:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [04/09/2006|11:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
   [14/12/2007|20:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

   [13/10/2005|20:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
   [13/10/2005|19:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [02/11/2006|18:30] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [22/08/2008|15:08] C:\DOCUME~1\mortier\APPLIC~1\~tmp.html
   [13/09/2006|12:20] C:\DOCUME~1\mortier\APPLIC~1\3M
   [09/01/2008|14:29] C:\DOCUME~1\mortier\APPLIC~1\Adobe
   [20/10/2005|12:55] C:\DOCUME~1\mortier\APPLIC~1\AdobeUM
   [13/10/2005|22:37] C:\DOCUME~1\mortier\APPLIC~1\Ahead
   [15/03/2007|13:57] C:\DOCUME~1\mortier\APPLIC~1\Apple Computer
   [14/11/2005|17:24] C:\DOCUME~1\mortier\APPLIC~1\Atari
   [20/03/2007|03:16] C:\DOCUME~1\mortier\APPLIC~1\Azureus
   [13/08/2006|09:52] C:\DOCUME~1\mortier\APPLIC~1\BitTorrent
   [03/11/2007|04:34] C:\DOCUME~1\mortier\APPLIC~1\BSplayer Pro
   [15/12/2005|20:21] C:\DOCUME~1\mortier\APPLIC~1\Cakewalk
   [25/11/2006|02:36] C:\DOCUME~1\mortier\APPLIC~1\Camfrog
   [28/11/2006|19:18] C:\DOCUME~1\mortier\APPLIC~1\CamfrogBar
   [22/08/2008|15:08] C:\DOCUME~1\mortier\APPLIC~1\config.cfg
   [21/11/2007|02:00] C:\DOCUME~1\mortier\APPLIC~1\Datalayer
   [13/10/2005|20:19] C:\DOCUME~1\mortier\APPLIC~1\desktop.ini
   [11/11/2006|15:30] C:\DOCUME~1\mortier\APPLIC~1\Dev-Cpp
   [29/12/2007|20:37] C:\DOCUME~1\mortier\APPLIC~1\DivX
   [19/12/2006|22:55] C:\DOCUME~1\mortier\APPLIC~1\DriveCleaner 2006 Free
   [29/07/2008|18:05] C:\DOCUME~1\mortier\APPLIC~1\dvdcss
   [09/05/2007|14:32] C:\DOCUME~1\mortier\APPLIC~1\EarMaster
   [09/05/2006|13:41] C:\DOCUME~1\mortier\APPLIC~1\EoRezo
   [04/04/2007|16:32] C:\DOCUME~1\mortier\APPLIC~1\ezpinst.exe
   [04/04/2007|16:32] C:\DOCUME~1\mortier\APPLIC~1\ezplay.cat
   [04/04/2007|16:32] C:\DOCUME~1\mortier\APPLIC~1\ezplay.sys
   [30/04/2008|04:08] C:\DOCUME~1\mortier\APPLIC~1\FunWebProducts
   [14/04/2008|15:19] C:\DOCUME~1\mortier\APPLIC~1\GDIPFONTCACHEV1.DAT
   [19/02/2008|16:09] C:\DOCUME~1\mortier\APPLIC~1\GetRight
   [19/02/2008|16:03] C:\DOCUME~1\mortier\APPLIC~1\GetRightToGo
   [09/01/2008|14:28] C:\DOCUME~1\mortier\APPLIC~1\Google
   [15/04/2007|20:39] C:\DOCUME~1\mortier\APPLIC~1\Help
   [07/03/2006|13:47] C:\DOCUME~1\mortier\APPLIC~1\HP
   [13/10/2005|19:34] C:\DOCUME~1\mortier\APPLIC~1\Identities
   [24/07/2008|08:42] C:\DOCUME~1\mortier\APPLIC~1\Idol View Each
   [17/04/2008|22:20] C:\DOCUME~1\mortier\APPLIC~1\InstallShield
   [04/04/2007|16:32] C:\DOCUME~1\mortier\APPLIC~1\JGESBISO.inf
   [04/04/2007|16:32] C:\DOCUME~1\mortier\APPLIC~1\JGESBISO.ini
   [04/04/2007|16:32] C:\DOCUME~1\mortier\APPLIC~1\JGESBISO.log
   [01/04/2006|21:40] C:\DOCUME~1\mortier\APPLIC~1\Lavasoft
   [30/06/2006|17:10] C:\DOCUME~1\mortier\APPLIC~1\Leadertech
   [29/12/2007|19:20] C:\DOCUME~1\mortier\APPLIC~1\LG Electronics
   [13/11/2006|01:14] C:\DOCUME~1\mortier\APPLIC~1\Lionhead Studios
   [01/01/2007|21:34] C:\DOCUME~1\mortier\APPLIC~1\Macromedia
   [20/10/2005|22:58] C:\DOCUME~1\mortier\APPLIC~1\Media Player Classic
   [11/07/2008|03:57] C:\DOCUME~1\mortier\APPLIC~1\Microsoft
   [17/11/2005|18:45] C:\DOCUME~1\mortier\APPLIC~1\Mozilla
   [23/12/2007|13:57] C:\DOCUME~1\mortier\APPLIC~1\MSN6
   [20/03/2006|12:36] C:\DOCUME~1\mortier\APPLIC~1\NeroVision
   [25/10/2007|00:53] C:\DOCUME~1\mortier\APPLIC~1\Nokia
   [01/11/2007|15:53] C:\DOCUME~1\mortier\APPLIC~1\Nokia Multimedia Player
   [23/08/2008|13:24] C:\DOCUME~1\mortier\APPLIC~1\OpenOffice.org2
   [05/05/2008|22:36] C:\DOCUME~1\mortier\APPLIC~1\Orangeline Interactive
   [11/08/2006|21:36] C:\DOCUME~1\mortier\APPLIC~1\PC Suite
   [04/04/2007|16:32] C:\DOCUME~1\mortier\APPLIC~1\pcouffin.cat
   [04/04/2007|16:32] C:\DOCUME~1\mortier\APPLIC~1\pcouffin.inf
   [04/04/2007|16:32] C:\DOCUME~1\mortier\APPLIC~1\pcouffin.log
   [04/04/2007|16:32] C:\DOCUME~1\mortier\APPLIC~1\pcouffin.sys
   [11/07/2008|14:57] C:\DOCUME~1\mortier\APPLIC~1\Real
   [15/07/2008|01:28] C:\DOCUME~1\mortier\APPLIC~1hcablj0el4r
   [17/07/2007|18:48] C:\DOCUME~1\mortier\APPLIC~1\SecuROM
   [16/03/2008|20:50] C:\DOCUME~1\mortier\APPLIC~1\Sports Interactive
   [02/11/2005|18:39] C:\DOCUME~1\mortier\APPLIC~1\Sun
   [03/05/2006|13:02] C:\DOCUME~1\mortier\APPLIC~1\Talkback
   [25/03/2006|03:51] C:\DOCUME~1\mortier\APPLIC~1	eamspeak2
   [20/10/2005|22:56] C:\DOCUME~1\mortier\APPLIC~1\vlc
   [04/04/2007|16:43] C:\DOCUME~1\mortier\APPLIC~1\Vso

   [09/01/2006|04:00] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [23/08/2008 12:41][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [14/03/2006 16:20][--a------] C:\WINDOWS	asks\wordpad.job
   [23/08/2008 13:25][--ah-----] C:\WINDOWS	asks\SA.DAT
   [24/04/2003 14:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [20/10/2005|12:51] C:\Program Files\Adobe
   [22/04/2008|13:27] C:\Program Files\Ahead
   [26/09/2006|07:26] C:\Program Files\Alcohol Soft
   [18/02/2008|17:44] C:\Program Files\Alice
   [14/10/2005|12:02] C:\Program Files\Alwil Software
   [20/04/2008|15:25] C:\Program Files\Apple Software Update
   [16/06/2007|08:10] C:\Program Files\Avast4
   [27/06/2008|16:13] C:\Program Files\AVIcodec
   [20/10/2005|22:44] C:\Program Files\AviSynth 2.5
   [20/03/2007|03:16] C:\Program Files\Azureus
   [26/01/2007|19:34] C:\Program Files\Cakewalk
   [23/05/2007|11:11] C:\Program Files\caltos
   [26/01/2007|19:34] C:\Program Files\Camfrog
   [19/02/2008|21:24] C:\Program Files\Canon
   [14/12/2007|20:32] C:\Program Files\CCleaner
   [26/08/2006|19:58] C:\Program Files\Cedelia
   [13/09/2006|12:28] C:\Program Files\CHRYOPROD
   [05/05/2008|22:36] C:\Program Files\Citrus Alarm Clock
   [27/06/2008|16:32] C:\Program Files\Combined Community Codec Pack
   [07/03/2006|16:58] C:\Program Files\Common Files
   [13/10/2005|19:28] C:\Program Files\ComPlus Applications
   [18/03/2008|19:53] C:\Program Files\Creative
   [12/12/2006|23:10] C:\Program Files\DAEMON Tools
   [05/04/2007|00:24] C:\Program Files\DaemonTools_WhenUSave_Installer
   [23/10/2007|22:43] C:\Program Files\Deck-It
   [11/03/2006|19:29] C:\Program Files\Dictionnaire
   [04/09/2006|20:25] C:\Program Files\DIFX
   [12/06/2008|21:29] C:\Program Files\DivX
   [11/11/2007|23:09] C:\Program Files\DVD Shrink
   [18/10/2006|09:58] C:\Program Files\EA SPORTS
   [09/05/2007|14:32] C:\Program Files\EarMaster Pro 5
   [30/07/2008|20:31] C:\Program Files\eMule
   [09/05/2006|13:41] C:\Program Files\eoRezo
   [18/06/2008|16:35] C:\Program Files\Everest Poker
   [30/09/2006|02:37] C:\Program Files\Executive Software
   [20/02/2008|15:33] C:\Program Files\eXeem
   [20/07/2008|17:07] C:\Program Files\ffdsasetts.reg
   [20/07/2008|17:07] C:\Program Files\ffdssetts.reg
   [20/07/2008|17:07] C:\Program Files\ffdsvsetts.reg
   [22/08/2008|15:45] C:\Program Files\Fichiers communs
   [06/10/2006|15:11] C:\Program Files\Folding@Home
   [27/05/2007|20:17] C:\Program Files\FunWebProducts
   [26/01/2007|19:35] C:\Program Files\Fx Audio Conveter
   [01/07/2006|00:11] C:\Program Files\GameShadow
   [05/06/2008|19:50] C:\Program Files\GetRight
   [27/05/2008|18:15] C:\Program Files\GetUserID
   [11/07/2008|14:53] C:\Program Files\Google
   [04/04/2007|12:53] C:\Program Files\Guitar Pro 5
   [17/04/2008|22:20] C:\Program Files\Hercules
   [07/03/2006|13:44] C:\Program Files\Hewlett-Packard
   [23/05/2006|15:05] C:\Program Files\HHD Software
   [07/03/2006|13:44] C:\Program Files\HP
   [08/09/2006|15:45] C:\Program Files\ICQLite
   [19/03/2006|17:26] C:\Program Files\ICQToolbar
   [27/06/2008|05:02] C:\Program Files\Idol View Each
   [08/05/2008|21:47] C:\Program Files\InstallShield Installation Information
   [12/06/2008|09:48] C:\Program Files\Internet Explorer
   [10/04/2006|16:32] C:\Program Files\Invisible Secrets 4
   [20/04/2008|15:28] C:\Program Files\iPod
   [22/04/2008|03:08] C:\Program Files\iTunes
   [21/07/2008|05:36] C:\Program Files\Java
   [09/03/2008|16:38] C:\Program Files\JeffProd
   [04/08/2008|19:19] C:\Program Files\Kingpin
   [18/09/2006|00:46] C:\Program Files\K-Lite Codec Pack
   [20/10/2007|22:32] C:\Program Files\Klondike WAP Browser
   [01/04/2006|21:40] C:\Program Files\Lavasoft
   [27/06/2008|04:54] C:\Program Files\Learning Essentials
   [29/12/2007|19:08] C:\Program Files\LG Electronics
   [02/01/2007|13:57] C:\Program Files\Lionhead Studios Ltd
   [02/03/2008|15:53] C:\Program Files\Ludiclub
   [17/10/2005|22:14] C:\Program Files\Messenger
   [16/04/2008|00:09] C:\Program Files\Messenger Plus! Live
   [10/11/2006|13:48] C:\Program Files\Microsoft ActiveSync
   [10/05/2007|03:02] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [13/10/2005|19:31] C:\Program Files\microsoft frontpage
   [17/07/2007|18:47] C:\Program Files\Microsoft Games
   [24/06/2008|20:27] C:\Program Files\Microsoft Office
   [24/06/2008|20:26] C:\Program Files\Microsoft Visual Studio
   [24/06/2008|20:17] C:\Program Files\Microsoft Visual Studio 8
   [24/06/2008|20:28] C:\Program Files\Microsoft Works
   [24/06/2008|20:23] C:\Program Files\Microsoft.NET
   [14/10/2005|11:35] C:\Program Files\Movie Maker
   [03/08/2006|17:57] C:\Program Files\Mozilla Firefox
   [06/11/2007|15:10] C:\Program Files\Mozilla Firefox 2 Beta 1
   [20/07/2008|17:07] C:\Program Files\mpc1.reg
   [20/07/2008|17:07] C:\Program Files\mpc2.reg
   [20/07/2008|17:07] C:\Program Files\mpc3.reg
   [20/07/2008|17:07] C:\Program Files\mpc4.reg
   [20/07/2008|17:07] C:\Program Files\mpc5.reg
   [20/07/2008|17:07] C:\Program Files\mpc6.reg
   [20/07/2008|17:07] C:\Program Files\mpc7.reg
   [24/06/2008|20:27] C:\Program Files\MSBuild
   [08/08/2006|16:17] C:\Program Files\MSN
   [13/10/2005|19:28] C:\Program Files\MSN Gaming Zone
   [26/02/2008|22:55] C:\Program Files\MSN Messenger
   [14/10/2006|11:18] C:\Program Files\MSXML 4.0
   [30/07/2008|20:48] C:\Program Files\MSXML 6.0
   [27/05/2007|20:17] C:\Program Files\MyWebSearch
   [14/10/2005|11:34] C:\Program Files\NetMeeting
   [15/07/2008|01:26] C:\Program Files
gurrd
   [03/03/2008|19:22] C:\Program Files\Nicolas MERLET
   [05/06/2008|13:13] C:\Program Files\OpenOffice.org 2.4
   [14/06/2007|03:02] C:\Program Files\Outlook Express
   [13/09/2006|12:17] C:\Program Files\Pense-bete
   [04/04/2007|23:23] C:\Program Files\pics-factory Toolbar
   [10/04/2008|14:06] C:\Program Files\Pop Art Studio 2.2
   [30/09/2006|02:06] C:\Program Files\PowerQuest
   [20/04/2008|15:27] C:\Program Files\QuickTime
   [21/09/2006|01:15] C:\Program Files\Raveille
   [11/07/2008|14:54] C:\Program Files\Real
   [19/10/2007|11:07] C:\Program Files\Realtek
   [13/10/2005|22:21] C:\Program Files\Realtek AC97
   [15/07/2008|01:28] C:\Program Fileshcablj0el4r
   [26/01/2007|19:38] C:\Program Files\Ripp-it_AM
   [29/11/2005|17:19] C:\Program Files\RngInterstitial.dll
   [19/10/2007|11:06] C:\Program Files\S3
   [20/07/2008|17:09] C:\Program Files\Satsuki Decoder Pack
   [20/07/2008|17:07] C:\Program Files\satsukidecodersettings.ini
   [13/10/2005|19:28] C:\Program Files\Services en ligne
   [24/10/2006|14:46] C:\Program Files\Singles
   [07/03/2006|16:57] C:\Program Files\Sony
   [22/08/2008|15:46] C:\Program Files\SPYWAREfighter
   [20/08/2008|16:30] C:\Program Files\Starcraft
   [23/08/2008|12:26] C:\Program Files\Steam
   [26/04/2008|17:46] C:\Program Files\STV
   [26/04/2008|17:46] C:\Program Files\TD74 Corporation
   [10/06/2006|19:16] C:\Program Files\Teamspeak2_RC2
   [18/02/2008|17:44] C:\Program Files\TechCity Solutions
   [10/06/2006|00:31] C:\Program Files\Temp
   [10/12/2006|16:15] C:\Program Files\The Weather Channel FW
   [13/10/2005|19:42] C:\Program Files\Tiscali_Triway_WiFi
   [22/04/2008|13:03] C:\Program Files\Trend Micro
   [08/09/2006|15:44] C:\Program Files\TVTuner4
   [04/04/2007|16:22] C:\Program Files\UltraISO
   [05/03/2006|16:23] C:\Program Files\Uninstall Information
   [19/10/2007|11:04] C:\Program Files\VIA
   [01/04/2007|20:01] C:\Program Files\VideoLAN
   [04/04/2007|16:32] C:\Program Files\VSO
   [18/03/2008|02:19] C:\Program Files\Warblade
   [03/12/2006|17:08] C:\Program Files\Webteh
   [15/03/2008|00:09] C:\Program Files\Winamp
   [26/02/2008|22:55] C:\Program Files\Windows Live
   [20/10/2007|18:46] C:\Program Files\Windows Live Safety Center
   [11/11/2006|15:32] C:\Program Files\Windows Live Toolbar
   [02/11/2006|17:37] C:\Program Files\Windows Media Connect 2
   [02/11/2006|17:41] C:\Program Files\Windows Media Player
   [14/10/2005|11:34] C:\Program Files\Windows NT
   [13/10/2005|20:34] C:\Program Files\WindowsUpdate
   [15/04/2007|20:39] C:\Program Files\WinRAR
   [23/10/2007|21:14] C:\Program Files\Winwap Technologies
   [13/10/2005|19:31] C:\Program Files\xerox
   [05/05/2008|22:30] C:\Program Files\X'nBeep 1.1
   [14/12/2007|20:32] C:\Program Files\Yahoo!
   [24/07/2008|11:22] C:\Program Files\YesMessenger
   [16/03/2008|20:47] C:\Program Files\Zero G Registry

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [26/01/2007|19:33] C:\Program Files\Fichiers communs\Adobe
   [13/10/2005|22:26] C:\Program Files\Fichiers communs\Ahead
   [20/04/2008|15:24] C:\Program Files\Fichiers communs\Apple
   [22/08/2008|15:45] C:\Program Files\Fichiers communs\Application
   [18/06/2007|19:51] C:\Program Files\Fichiers communs\Blizzard Entertainment
   [10/11/2006|13:48] C:\Program Files\Fichiers communs\Designer
   [11/04/2008|17:15] C:\Program Files\Fichiers communs\DriveCleaner 2006 Free
   [04/04/2007|16:22] C:\Program Files\Fichiers communs\EZB Systems
   [24/11/2006|10:24] C:\Program Files\Fichiers communs\InstallShield
   [02/11/2005|18:38] C:\Program Files\Fichiers communs\Java
   [11/08/2008|15:25] C:\Program Files\Fichiers communs\Microsoft Shared
   [13/10/2005|19:29] C:\Program Files\Fichiers communs\MSSoap
   [17/10/2005|22:24] C:\Program Files\Fichiers communs\NSV
   [13/10/2005|20:19] C:\Program Files\Fichiers communs\ODBC
   [11/07/2008|14:55] C:\Program Files\Fichiers communs\Real
   [13/10/2005|19:29] C:\Program Files\Fichiers communs\Services
   [24/07/2006|18:15] C:\Program Files\Fichiers communs\snpstd
   [23/05/2006|15:05] C:\Program Files\Fichiers communs\Sony Shared
   [13/10/2005|20:19] C:\Program Files\Fichiers communs\SpeechEngines
   [22/02/2006|11:54] C:\Program Files\Fichiers communs\Synacast
   [24/06/2008|20:37] C:\Program Files\Fichiers communs\System
   [11/07/2008|14:55] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 14 Processus )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-08-23 13:34:53
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 328
 
   --------------------\  Recherche d'autres infections

   --------------------\  ROGUES ..

   C:\DOCUME~1\mortier\APPLIC~1\DriveCleaner 2006 Free
   C:\PROGRA~1\FICHIE~1\DriveCleaner 2006 Free

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\mortier\Bureau\bordel\Crack No Cd Football Manager fm 2007 Fr.rar
   C:\DOCUME~1\mortier\Bureau\bordel	ab\guitar pro\Guitar Pro 5.0 Full Crack.rar
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\c\Crack Ov Dawn
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\c\Cracknell, Debbie
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\c\Crack Ov Dawn\Crack Ov Dawn - Miss Suicide.gp4
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\c\Crack Ov Dawn\Crack Ov Dawn - Rise And Fall.gp4
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\c\Cracknell, Debbie\Cracknell, Debbie - Guitar Talk.gp4
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\f\Faith No More\Faith No More - Crack Hitler.gp3
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\l\Leftover Crack
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\l\Leftover Crack\Leftover Crack - Gang Control.gp4
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\l\Leftover Crack\Leftover Crack - Nazi White Trash.gp4
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\l\Leftover Crack\Leftover Crack - Operation Mouve.gp4
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\l\Limp Bizkit\Limp Bizkit - Crack Addict (2).gp4
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\l\Limp Bizkit\Limp Bizkit - Crack Addict (3).gp4
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\l\Limp Bizkit\Limp Bizkit - Crack Addict.gp4
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\m\Malmsteen, Yngwie\Malmsteen, Yngwie - Cracking The Whip.gp4
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\p\Pixies\Pixies - Crackity Jones.gp3
   C:\DOCUME~1\mortier\Bureau\bordel	ab	ab2\s\Soliz, David\Soliz, David - Crack Kills.gp4


   [F:4][D:7]-> C:\DOCUME~1\mortier\LOCALS~1\Temp
   [F:329][D:0]-> C:\DOCUME~1\mortier\Cookies
   [F:23713][D:32]-> C:\DOCUME~1\mortier\LOCALS~1\TEMPOR~1\content.IE5

   --------------------\  Fin du rapport a 13:37:25
 et le rapport hijack arrive tout de suite

lolocks · Answer

le rapport hijack :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:02:59, on 23/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\WINDOWS\vsnpstd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\VMSnap23.exe
C:\WINDOWS\Domino.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\abobkzqz.exe
C:\WINDOWS\svzip.exe
C:\Program Files\SPYWAREfighter\spftray.exe
C:\Documents and Settings\mortier\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\mortier\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\svhoster.exe
C:\WINDOWSunsql.exe
C:\WINDOWS\sv.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\winlogon.exe
C:\WINDOWS\abobkzqz.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: IE to GetRight Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BigDogPath323VMSnap] C:\WINDOWS\VMSnap23.exe
O4 - HKLM\..\Run: [BigDogPath323Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [lphceblj0el4r] C:\WINDOWS\system32\lphceblj0el4r.exe
O4 - HKLM\..\Run: [SMrhcablj0el4r] C:\Program Fileshcablj0el4rhcablj0el4r.exe
O4 - HKLM\..\Run: [HlpAplDsc] C:\WINDOWS\abobkzqz.exe
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\system32\3076b.exe
O4 - HKLM\..\Run: [WinLogon] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [runsql] C:\WINDOWSunsql.exe
O4 - HKLM\..\Run: [netsv32] C:\WINDOWS\sv.exe
O4 - HKLM\..\Run: [netzip] C:\WINDOWS\svzip.exe
O4 - HKLM\..\Run: [net64] C:\WINDOWS\svhoster.exe
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\system32\3076b.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\mortier\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Burn bleh] C:\DOCUME~1\mortier\APPLIC~1\IDOLVI~1\Mix wait.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\system32\3076b.exe
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\system32\3076b.exe
O4 - HKLM\..\Policies\Explorer\Run: [t8FKk1gbQQ] C:\Documents and Settings\All Users\Application Data\czcferof\yjshohcb.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Startup: YouTube Uploader.lnk = C:\Documents and Settings\mortier\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
O4 - Global Startup: Citrus Alarm Clock.lnk = C:\Program Files\Citrus Alarm Clock\Citrus Alarm Clock.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZN
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5CA8D349-C6E7-11D4-8166-009027DF3BB2} (France Telecom MDDK ActiveX Control) - http://accueil.ava.serveur-ava.com/stkid_data/ocx/mDKid.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O21 - SSODL: SetSmart - {6643B857-DF80-9FFB-CB0D-0082ED053567} - C:\Program Files
gurrd\SetSmart.dll
O22 - SharedTaskScheduler: IPC Configuration Utility - IPC Configuration Utility - (no file)
O22 - SharedTaskScheduler: Windows Installer Class - {020487CC-FC04-4B1E-863F-D9801796230B} - C:\DOCUME~1\mortier\LOCALS~1\Temp\wndutl32.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe (file missing)
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe
O23 - Service: Windows Log - Unknown owner - C:\WINDOWS\system32
vsvcd.exe (file missing)

afideg · Answer

(suite) A)- Supprime SmitfraudFix et LopS&D B)- Télécharge et installe Malwarebyte's Anti-Malware http://www.malwarebytes.org/mbam/program/mbam-setup.exe A la fin de l'installation, veille à ce que l'option "Mettre à jour Malwarebytes Anti-Malware" soit cochée. >>> clique sur "Terminer" NB : Si un message s’affiche signalant qu'il te manque COMCTL32.OCX alors télécharge-le ici : https://www.malekal.com/tutorial-aboutbuster/ - Fais les mises à jour (clique sur "Mises à jour" puis "Recherche de mises à jour") Lance Malwarebyte's Anti-Malware en double-cliquant sur l'icône sur le bureau. Au premier lancement, une fenêtre t'annonce que la version est gratuite >>> clique sur ok Laisse les Mises à jour se télécharger *** Referme le programme *** Redémarre en "Mode sans échec" Regarde ici pour exécuter le mode sans échec, sans stresser : < http://www.coupdepoucepc.com/modules/news/article.php?storyid=253 > Choisir sa session habituelle, (pas le compte "Administrateur" ou une autre). Lance Malwarebyte's Anti-Malware Onglet "Recherche" >>> coche « Exécuter un examen complet » >>> « Rechercher » Sélectionne ton disque dur >>> clic sur « Lancer l'examen » A la fin du scan >>> clique sur « Afficher les résultats » >>> « Enregistrer le Rapport » Si des malwares ont été détectés, leur liste s'affiche. Suppression des éléments détectés >>>> clique sur « Supprimer la sélection » J'insiste sur Supprimer la sélection (MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine). S'il t'est demandé de redémarrer >>> clique sur "Yes" Sinon, arrêter puis redémarrer la PC. Un rapport de scan s'ouvre, poste le rapport. (MBAM va ouvrir le bloc-notes et y copier le rapport d'analyse qui peut être retrouvé sous l'onglet « Rapports/logs ». Fermer le bloc-notes. Fermer MBAM en cliquant sur « Quitter ») Si problèmes, suivre ce tutoriel < https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm > C)- (Tu gardes toujours encore branchés les disques externes amovibles) • - Désactive ta restauration système, comme ceci: Clic sur « Démarrer » Clic droit sur « Poste de travail », puis sur « Propriétés », Vas sur l’onglet « Restauration système » Tu y coches la case « Désactiver la restauration » Termine par [Appliquer] [OK] •- Suppression et traitement. 1°- Télécharger _OTMoveIt (de Old_Timer) sur ton Bureau. http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe 2°- Double-cliquer sur OTMoveIt.exe pour le lancer. 3°- Dans le cadre de OTMoveIt2 : "Paste List of Files/Folders to be moved" http://nsa01.casimages.com/img/2008/04/04/0804041233502840681.jpg faire un copier/coller de cette liste en gras, telle quelle: C:\Documents and Settings\mortier\Bureau\bordel\Crack No Cd Football Manager fm 2007 Fr.rar C:\Documents and Settings\mortier\Bureau\bordel ab\guitar pro\Guitar Pro 5.0 Full Crack.rar C:\Documents and Settings\mortier\Bureau\bordel ab ab2 C:\Documents and Settings\mortier\Application Data\DriveCleaner 2006 Free C:\Program Files\Fichiers communs\DriveCleaner 2006 Free C:\Documents and Settings\mortier\Local Settings\Temp\wndutl32.dll C:\Program Files\MyWebSearch C:\WINDOWS\system32 vsvcd.exe 4°- Clique sur le bouton rouge MoveIt! pour lancer la suppression. -Le résultat apparaîtra dans le cadre "Results". Note : Copier tout ce qui se trouve dans la zone “Results” (sous la barre verte) dans le Presse-papiers en sélectionnant TOUTES LES LIGNES puis en appuyant simultanément sur les touches CTRL et C (ou, après les avoir sélectionnées, en faisant un clic-droit puis en choisissant Copier), et coller ces résultats en réponse sur le forum (clic-droit > coller). * Clique sur "Exit" pour fermer Fermer OTMoveIt2 5°- Note: Si un fichier ou un dossier ne peut pas être déplacé immédiatement, un redémarrage sera peut-être nécessaire afin de terminer le processus de déplacement. Si le redémarrage de la machine vous est demandé, choisir Oui/Yes. Nécessaire après toute action dans les registres, il te sera demandé de redémarrer le pc pour achever la suppression. • Ensuite réactive ta restauration système, comme ceci: Clic droit sur « Poste de travail », puis sur « Propriétés », Vas sur l’onglet « Restauration système » Tu décoches la case « Désactiver la restauration » Termine par [Appliquer] [OK] 6°- Le rapport se trouve en C:\_OTMoveIt\MovedFiles; tu ouvres le dossier et tu trouveras le rapport à poster. (fichier de ce type ********_******.log (mm/jj/aaaa_hh/mm/ss = date et horaire de la suppression) D)- Télécharge combofix.exe http://download.bleepingcomputer.com/sUBs/ComboFix.exe de sUBs et sauvegarde le sur ton bureau (et pas ailleurs). • Assure toi que tous les programmes sont fermés avant de commencer. • ==> Déconnecte ton PC d'Internet et referme les fenêtres de tous les programmes en cours. • ==> Désactive provisoirement (et seulement le temps de l'utilisation de ComboFix), la protection en temps réel de ton Antivirus et de ton Antispywares, (activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil). • Double-clique combofix.exe afin de l'exécuter. • Clique sur "Oui" au message de Limitation de Garantie qui s'affiche. • Il est possible que ton pare-feu (firewall) te demande si tu acceptes ou non l'accès de nircmd.cfexe à la zone sûre: accepte. • Ou bien --> Réponds oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. • Ne ferme pas la fenêtre qui vient de s'ouvrir, tu te retrouverais avec un bureau vide. • Laisse se dérouler le scan. • /!\ Pendant la durée de cette étape, ne te sers pas du pc et n'ouvre aucun programme. Soit patient (même si tu penses que le PC est arrêté) ; les temps « d'arrêt apparent » sont parfois de plusieurs minutes (il y a ± 40 étapes d’analyse)./i\ • Lorsque l'analyse sera terminée, un rapport apparaîtra. • Copie-colle ce rapport dans ta prochaine réponse. • Le rapport se trouve dans : C:\Combofix.txt (si jamais). E) Poste un nouveau rapport HijackThis Bonne chance Al.

lolocks · Answer

je n'ai pas de disque dur externe branché, donc l'etape de desactivation n'est pas necessaire ?

et merci pour le temps pris, ça doit etre long de taper tout ça !

afideg · Answer

Re,

Si, ça n'a pas de relation.


Merci
Al.

afideg · Answer

Allo ?

jfkpresident · Answer

A l'huile ;))

désolé ...j'ai pas pu m'empeché -;

afideg · Answer

;)

Rigole quoi ! ... pour l'écoulement ... hum!
C'est bon de rire un peu le dimmanche matin.

Al.
Salut JFK

Tu n'as pas vu passer notre Loch Ness , pardon lolocks   ?

lolocks · Answer

salut mes doctour house de mon PC désolé mais hier soir je pendais la cremaillere d'un ami (c'est interessant ma vie hein ?) je vais finir les procedures aujourd'hui j'en suis à la desactivation, et je vous poste tout ça !

merci vous etes geniaux !

lolocks · Answer

alors j'ai fait une betise il me manque un rapport de malaware et je ne sais pas ou je l'ai mis, faute avouée à demi pardonée ?

je vous poste le reste des rapports
merci !

le premier Malware


Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1078
Windows 5.1.2600 Service Pack 2

00:45:28 24/08/2008
mbam-log-08-24-2008 (00-45-19).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 191057
Temps écoulé: 2 hour(s), 19 minute(s), 22 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 168
Valeur(s) du Registre infectée(s): 25
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 39
Fichier(s) infecté(s): 167

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{98635087-3f5d-418f-990c-b1efe0797a3b} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{38a7c9da-8db7-4d0f-a7b1-c4b1a305bddb} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{8d292ec0-6792-4a38-82ed-73a087e41ba6} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{d778513b-1c40-4819-b0c5-49e40b39afd0} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.datacontrol (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.datacontrol.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{8ca01f0e-987c-49c3-b852-2f1ac4a7094c} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{991aac62-b100-47ce-8b75-253965244f69} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{0f8ecf4f-3646-4c3a-8881-8e138ffcaf70} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{b813095c-81c0-4e40-aa14-67520372b987} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c9d7be3e-141a-4c85-8cd6-32461f3df2c7} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{cff4ce82-3aa2-451f-9b77-7165605fb835} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.2 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{8e6f1830-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{8e6f1832-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a9571378-68a1-443d-b082-284f960c6d17} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.shellviewcontrol (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{621feacd-8857-43a6-ae26-451d670d5370} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2763e333-b168-41a0-a112-d35f96f410c0} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2eff3cf7-99c1-4c29-bc2b-68e057e22340} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2eff3cf7-99c1-4c29-bc2b-68e057e22340} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\funwebproducts.shellviewcontrol.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{e79dfbc0-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{3e720450-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\mywebsearch.outlookaddin (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{adb01e81-3c79-4272-a0f1-7b2be7a782dc} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\mywebsearch.outlookaddin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{7473d290-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{07b18ea0-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{53ced2d0-5e9a-4761-9005-648404e6f7e5} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{29d67d3c-509a-4544-903f-c8c1b8236554} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{938aa51a-996c-4884-98ce-80dd16a5c9da} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{5954b2db-09a7-4023-847c-107539dc560d} (Rogue.DriveCleaner) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{020487cc-fc04-4b1e-863f-d9801796230b} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{84da4fdf-a1cf-4195-8688-3e961f505983} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{d9fffb27-d62a-4d64-8cec-1ff006528805} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{0d26bc71-a633-4e71-ad31-eadc3a1b6a3a} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{4f43b1f3-0ce8-493b-96d2-990cec05edbb} (Rogue.DriveCleaner) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{c8cecde3-1ae1-4c4a-ad82-6d5b00212144} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{7e66936c-fea0-4984-ad26-7b6661ac5b2e} (Adware.Hotbar) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallhcablj0el4r (Rogue.Multiple) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWAREhcablj0el4r (Rogue.Multiple) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER	ypelib (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Servicesdriv (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-f3embed (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mywebsearch email plugin (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mywebsearch email plugin (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Rununsql (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
etsv32 (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
et64 (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateWin (Backdoor.Bot) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateWin (Backdoor.Bot) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\UpdateWin (Backdoor.Bot) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\UpdateWin (Backdoor.Bot) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
etzip (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\UpdateWin (Worm.Sdbot) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\UpdateWin (Worm.Sdbot) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OLE\UpdateWin (Worm.Sdbot) -> No action taken.
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Control\Lsa\UpdateWin (Worm.Sdbot) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphceblj0el4r (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhcablj0el4r (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> No action taken.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\Fichiers communs\DriveCleaner 2006 Free (Rogue.DriveCleaner) -> No action taken.
C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Avatar (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Cache (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Game (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\icons (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Message (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\MSNBackgrounds (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Notifier (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\SrchAstt (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\SrchAstt\1.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\Shared\Cache (Adware.MyWebSearch) -> No action taken.
C:\WINDOWS\system\DRIVER (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\DAP (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\DAP\LOG (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\DAP\NTLOG (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> No action taken.
C:\Program Fileshcablj0el4r (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\mortier\Application Data\DriveCleaner 2006 Free (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\mortier\Application Data\DriveCleaner 2006 Free\Logs (Rogue.DriveCleaner) -> No action taken.
C:\Documents and Settings\mortier\Application Datahcablj0el4r (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\mortier\Application Datahcablj0el4r\Quarantine (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\mortier\Application Datahcablj0el4r\Quarantine\Autorun (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\mortier\Application Datahcablj0el4r\Quarantine\Autorun\HKCU (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\mortier\Application Datahcablj0el4r\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\mortier\Application Datahcablj0el4r\Quarantine\Autorun\HKLM (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\mortier\Application Datahcablj0el4r\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\mortier\Application Datahcablj0el4r\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\mortier\Application Datahcablj0el4r\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\mortier\Application Datahcablj0el4r\Quarantine\BrowserObjects (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\mortier\Application Datahcablj0el4r\Quarantine\Packages (Rogue.Multiple) -> No action taken.

Fichier(s) infecté(s):
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> No action taken.
C:\WINDOWSunsql.exe (Trojan.Downloader) -> No action taken.
C:\WINDOWS\sv.exe (Trojan.Downloader) -> No action taken.
C:\WINDOWS\svhoster.exe (Trojan.Downloader) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\Internet Explorer\msimg32.dll (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MSN Messengeriched20.dll (Adware.MyWeb.FunWeb) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL (Adware.MyWeb.FunWeb) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE (Adware.MyWeb.FunWeb) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{FCA39979-343B-4438-8709-4F3561240730}\RP1069\A0305767.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{FCA39979-343B-4438-8709-4F3561240730}\RP1069\A0305769.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{FCA39979-343B-4438-8709-4F3561240730}\RP1069\A0305770.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{FCA39979-343B-4438-8709-4F3561240730}\RP1069\A0305771.exe (Trojan.Downloader) -> No action taken.
C:\WINDOWS\system\DRIVER\cygcrypt-0.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\f3PSSavr.scr (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Cache\06C1935C (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Cache\06C19466.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Cache\06C1962B.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Cache\06C19764.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Cache\06C198BB.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Cache\06DB62B9.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Cache\06DB81F9.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Cache\06DB8479.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Cache\06DB8573.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Cache\06DB867D.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Cache\files.ini (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\History\search2 (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\icons\CM.ICO (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\icons\MFC.ICO (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\icons\PSS.ICO (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\icons\WB.ICO (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\ScreenSaver\Images\012A98CB.urr (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html (Adware.MyWebSearch) -> No action taken.
C:\WINDOWS\system\DRIVER\Copy (2) of 1.txt (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\Copy (20) of 687525.txt (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\cygwin1.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\Driver32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\New Text Document (5).txt (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\servicelogon.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\servicesmgr.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\svchostlogon.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\win32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\win32.dll~ (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\winlogon.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> No action taken.
C:\Program Fileshcablj0el4r\database.dat (Rogue.Multiple) -> No action taken.
C:\Program Fileshcablj0el4r\license.txt (Rogue.Multiple) -> No action taken.
C:\Program Fileshcablj0el4r\MFC71.dll (Rogue.Multiple) -> No action taken.
C:\Program Fileshcablj0el4r\MFC71ENU.DLL (Rogue.Multiple) -> No action taken.
C:\Program Fileshcablj0el4r\msvcp71.dll (Rogue.Multiple) -> No action taken.
C:\Program Fileshcablj0el4r\msvcr71.dll (Rogue.Multiple) -> No action taken.
C:\Program Fileshcablj0el4rhcablj0el4r.exe.local (Rogue.Multiple) -> No action taken.
C:\Program Fileshcablj0el4r\Uninstall.exe (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\mortier\Application Data\DriveCleaner 2006 Free\Logs\update.log (Rogue.DriveCleaner) -> No action taken.
C:\WINDOWS\winlogon.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\3076b.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\a.bat (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\base64.tmp (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\FVProtect.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\userconfig9x.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\winsystem.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\zip1.tmp (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\zip2.tmp (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\zip3.tmp (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\zipped.tmp (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\bdn.com (Trojan.Agent) -> No action taken.
C:\WINDOWS\iTunesMusic.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\mssecu.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\akttzn.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\anticipator.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\awtoolb.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\bdn.com (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\bsva-egihsg52.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\dpcproxy.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\hoproxy.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\hxiwlgpm.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\hxiwlgpm.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\msgp.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\msnbho.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\mssecu.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\msvchost.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\mtr2.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\mwin32.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32
etode.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32
ewsd32.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\ps1.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\psof1.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\psoft1.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32egc64.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32egm64.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\Rundl1.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\sncntr.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\ssurf022.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\ssvchost.com (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\ssvchost.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\sysreq.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32	aack.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32	aack.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32	emp#01.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32	hun.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32	hun32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\VBIEWER.OCX (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\vcatchpi.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\winlogonpc.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\winsystem.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\WINWGPX.EXE (Trojan.Agent) -> No action taken.
C:\WINDOWS\svzip.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\vbsys2.dll (Trojan.Clicker) -> No action taken.
C:\WINDOWS\system32\blphceblj0el4r.scr (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\phceblj0el4r.bmp (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\mortier\Application Data\config.cfg (Malware.Trace) -> No action taken.
C:\Documents and Settings\mortier\Application Data\~tmp.html (Malware.Trace) -> No action taken.

lolocks · Answer

Move it 1:

C:\Documents and Settings\mortier\Bureau\bordel\Crack No Cd Football Manager fm 2007 Fr.rar moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab\guitar pro\Guitar Pro 5.0 Full Crack.rar moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zámek, Visací moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\ZZ Top moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zyklon moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zwan moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zuly moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zu lAut moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zouaviso moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zornik moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zorba The Greek moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zonata moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zombie, Rob moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zombie Guts moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zombie moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zoe moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zitarroza, Alfredo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Ziras, Theodore moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zinchuk, Victor moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zimmer, Hans moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zikney Thfat moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Ziggy Rusby Band (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Ziggy moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Ziggens (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zheng Jun moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zhang Zhen Yue moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zevon, Warren moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zero Down moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zero 7 moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zequinha A moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zeprity moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zephyr21 moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zenamon, Jaime moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zemlyane moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zemfira moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zelmani, Sophie moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zebrahead moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zdob Si Zdub moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zazie moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zaza, Neil moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zawinul, Joe moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zaret, Hy moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zappa, Riccardo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zappa, Franck moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zao moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zambonis From Ottawa moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zakk Wylde & Black Label Society moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zabriskie Point moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Zabranjeno Pusenje moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z\Z-Row moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\z moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yö moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yuzo Koshiro moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yuquijiro Yocoh moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yupanqui, Atahualpa moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\YUP moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\yun Band moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yukka moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yu Grupa moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Ypogeia Revmata moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Young, Neil moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Young, John Paul moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Younes Migri moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Youn, Micahel moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\You am I moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yoshimatsu, Takashi moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\York, Andrew moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yonatan Hakatan moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yoe91 moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yockey, Elijah moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yoakam, Dwight moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yo, Andrew moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yo La Tengo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yes moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yeni Türkü moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yellowcard moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yellow Monkey (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yellow bananas, The moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yellow moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yeah Yeah Yeahs (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\ye moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yasar, Yaºar moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yarosvet moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yaroslav moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yardbirds moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yanni moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yankovic, Weird Al moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yandell, Paul moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yamaoka, Akira moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Yaghmaei, Kaveh moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y\Y&T moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\y moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\XYZ moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\Xytraz moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\XXL moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\xvwei, xv moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\Xutos E Pontapés moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\XPDC moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\XMetalX moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\XIII Stoleti moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\Xiefielia, Jay moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\Xentrix moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\Xenon moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\XDef moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\Xavier, Moisés moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\Xavier Sky moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\Xatzidakis, Manos moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\Xargon moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\Xaiphodius moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\X-Vision moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\X-Marika moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\X-Ecutioners moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x\X Japan moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\x moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wyse moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wyrd moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wyclef Jean moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wyatt, Keith moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\WWO moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\WWF moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wuthering Heights moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wunjo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wriggles (Les) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wrens (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wozniak Tadeusz moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Worship moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Worms moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wooten, Victor moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Woos moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Woodpickers, Eddie moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wonders (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wonder, Stevie moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wolfsbane moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wolfox moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wolford, Spencer moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wolfmother moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wolfgang moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wolf, Howlin' moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wolf, Howlin moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wohlstandskinder (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wnorowski, Justin moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wlochaty moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wizzard moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wizo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wizard moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Witt, Marcos moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Without A Name moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Within Temptation moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Withered Beauty moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Withamea moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Witchfinder General moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Witches (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Witchery moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wishbone Ash moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wir Sind Helden moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wintersun moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Winter, Johnny moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Winter Hill moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Winston Cowboy moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Winnerbäck, Lars moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wings Of Freedom moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wings moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Winger moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Windstorm moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Windir moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Windfall moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wince moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wilson, Jackie moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wiloyoh moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Williams, Robbie moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Williams, Mason moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Williams, Len moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Williams, John moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Williams, Jerry moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Williams, Hank moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Williams, Andy moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wilki moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wilk, Artur moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wildhearts (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wilde, Kim moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wild Cherry moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wild Arms moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wilcox, David moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wigwam moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wig Wam moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Whoyeah moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Who (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Whitesnake moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\WhitePink moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\WhiteCross moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Whiteberry moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\White, Stephen moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\White, John moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\White, Barry moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\White Zombie moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\White Widow moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\White Stripes moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\White Lion moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Whiplash moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Where Is The Kid moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\When You Die - Gorefest moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wheatus moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Whatever moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Whateva Turns You On moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wham! moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Westmeier, Hans moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wes Montgomery moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wereworm moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Weller, Paul moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Welch, Gillian moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Weiss, Silvius Leopold moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Weirdfred moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Weird Things for Weird People moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Weiner, Dave moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Weill, Kurt moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Weiland, Klaus moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Weiglein, Will moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Weezer moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Ween moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wednesday 13 moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wedding Present (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Webber, Lloyd moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Weaver, Sylvester moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Weather Report moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Weakerthans (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\We Are Scientists moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wayne, Jeff moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Watson, Wayne moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Watson, Doc moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Watkins (Frankie and Gary) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Waters, Roger moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Waters, Muddy moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Watcha moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Watain moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wasted Lovers moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\WASP moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Warriorland moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Warren G moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Warrant moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Warmen moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Warmachine moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Warm Up Exercises moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Warlock moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Waring, Steve moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wardrop, Graham moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Ward, Anita moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Warcry moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\War Sucks moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\War moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wanderer (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wampas (Les) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Waltari moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Walsh, Joe moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Walls Of Jericho moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wallflowers (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wallau moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wales moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Waldir Azevedo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wakeman, Rick moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Waive moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Waits, Tom moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Waite, John moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wainwright, Rufus moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wah Wah Mega (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wagner, Richard moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w\Wagner moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\w moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Völund Smed moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vérzik, Rómeó moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vágyálom moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vypsana Fixa moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vulgaires Machins (Les) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vulcano moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vrävarna moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vreeswijk, Cornelis moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\VPX moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Voyeur (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vox Artis moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Voulzy, Laurent moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vopli Vidoplyasova moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Voodoo Glow Skulls moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Von Bondies (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vomit Remnants moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Volume! moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Voltage moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Volrathv moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Volovan moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Volcano, I'm Still Excited moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Voivod moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Voisine, Roch moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vodenski, Pavel moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vltava moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vlatko Stefanovski moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vlad moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vixen moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vivvica Music moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vivinopatch moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vivaldi, Antonio moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vitturi, Eduardo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vital Remains moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vision Divine moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Visdommen moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Virtuocity moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Virtu@l Lulu moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Virsia moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Virgin Steele moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Virgin moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Viper moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Violin lesson moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Violetta, Darling moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Violent Femmes moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Violent Dreams moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Violent Delight moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vintersorg moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vinterland moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vinnie Vincents Invasion moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vines (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vincent, Gene moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Villodo, Angel moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Village People moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vili Vesterinen moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Viikate moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vigor Mortis moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vieira Rocha, Jordano moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vieilles Salopes (Les) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vidoll moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Videodrone moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vidal, Gonzalo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vidal, Christina moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Victor Garcia moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Viciouscircle) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vicious Rumors moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vicious Crusade moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vicente, Amigo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vibrazioni (Le) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vibert, Luke moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vian, Boris moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vex Red moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Veszedelmes Viszonyok moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vestlandsfanden moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Verve Pipe moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Verve (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vertigo Smog moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vertical Slip moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vertical Horizon moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Versini, Jean-Marc moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Veronica moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vermelho, Barao moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Verlangen moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Verdiale moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Verdena moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Venus moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Ventures (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Ventura, J moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Venom moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Venin Noir moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Venegas, Julieta moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vendetta Red moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Velvet Underground (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Velvet Revolver moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Veloso, Rui moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Veloso, Caetano moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\velikicirkussum, scalpel moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Veliki, Vladimir moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Veliciano, José moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vela Puerca, La moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vegastar moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\vega4 moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vega, Suzanne moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vega moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Veen, Herman van moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vedran, Hrenic moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vaya Con Dios moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vavel moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vaughan, Stevie Ray moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vastüdö moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vast moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vassiliu, Pierre moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Varius Manx moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Various moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vantroi moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vanquish moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vanooy, Ivan moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vanilla Ninja moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vanilla Ice moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vanilla Flavoured Fart moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vangelis moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\vangelion moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vandenberg moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vanden Plas moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vandals, The moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\van Velzen, Richard moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Van Phuc, Pham moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Van Halen moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Van Gogh moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Van Bergeyk, Ton moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vamp moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vama Veche moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\ValSka (Les) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Valkyrie moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Valjak, Parni moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Valee, Rudy moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vaka - Sigur Ros moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vai, Steve moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vagodin moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vader moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\vachon, philip moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\Vaamadeva moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\V8 moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\V.p.c.f.V (Les) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v\V, Paul moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\v moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\u_lookuperr moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Uzeb moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Utada, Hikaru moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Usher moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Useless I.D moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Used (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\USA moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Urszula moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Urlaub, Farin moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Uriah Heep moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Urban, Keith moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Urban Dance Squad moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unwritten Law moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unsociables (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unseen (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unsane moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unresolved Verdict moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unrequited moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unos Panas Ahí moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unmercyful moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unloco moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unload moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unleashed moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unkown (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unknowo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unknownh moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unknownf moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\unknownband moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unknownb moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unknown Theory moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unknown (TV) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unknown (Movie) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unknown moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unkle moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\UNK moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unión (La) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\United Live moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unit 56 moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Union Underground moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Union 13 moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Uniklubi moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unicorns (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\UNICORNIO, CESAR moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unholy Trinity moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unger, Jay moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unforgiven moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unfold moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unfamous Electric Overdrive Ensemble (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unearth moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Undertones (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Underoath moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Underhell moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Underground Vibes moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Undeclinable moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Uncommonmenfrommars moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unbound Violence moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Unband (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Umiliani, Piero moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Umaturman moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Ulver moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Ultreia moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Ultraspank moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Ultimatum moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Ultima Thule moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Uliczny Opryszek Oi moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Ukuku moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\uknown moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Ukelele (Hawaian Guitar) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\UK SUBS moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\UHF moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Uglyz (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Ugly Kid Joe moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Ugly Casanova moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\UFO moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Uematsu, Nobuo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Uelnem, Matt moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Ueda, Masami moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\Ubago, Alex moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\U2 moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\U.S. Bombs moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\U.D.O moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\U-Piter moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\u monkeys moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u\U 96 moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2\u moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Têtes Raides moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tété moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Técnica moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tyrian moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tyrant moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tyr moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Type O Negative moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tyketto moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tygers Of Pan Tang moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\TY Sestry moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Two Ton Shoe moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Two Timers moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Twisted Sister moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Twisted Machine moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Twisted Coil moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Twin Obscenity moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Twilightning moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Twilight Theater moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Twilight moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tweak moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Twain, Shania moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tvangeste moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\TV And Movie Theme Songs moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tutu moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Turns To Silence moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Turner, Trik moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Turner, Tina moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Turnau, Grzegorz moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Turlough O'Carolan moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Turkish Delight moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Turisas moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Turin Brakes moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Turilli, Luca moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Turbonegro moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Turbo Bober moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Turbo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tupac moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tunstall, KT moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tunisian Folk moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tungsten moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tue Loup moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tsunami Bomb moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tse, Nicholas moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\TSA (Tajne Stowarzyszenie Abstynentów) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trypes moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2		ryo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\TRUSTcompany moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trust moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\True Sounds Of Liberty moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trucks moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trouble moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trotsky Vengarán moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Troshen, V moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trooper moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tronic moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trombe Di Falloppio moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trollem moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Troll moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trois Accords (Les) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Troilo, Anibal moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Troggs (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trivium moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Triumph moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tristyle moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tristania moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trischka, Tony moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tripping Daisy moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tripod moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trigun moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trigger Happy moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trigger Finger moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tricky moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tribute moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tribal Tech moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tri Yann moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trews (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tres, Los moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trenet, Charles moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tree63 moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Treble Charger moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trax (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Travis moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Traveling Wilburys (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trauma moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trash, Exercises moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trapt moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Transplants (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Transmetal moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Transient moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trans-Siberian Orchestra (TSO) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trammps (The) moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Train moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Trail Of Dead moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tragically Hip moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Traffic moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Traditionnal moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Traditional moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tracktor Bowling moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Traced moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tr3sdeCorazon moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Toy Dolls moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Toxik moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Toxic Holocaust moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Townshend, Pete moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Townsend, Devin moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Towner, Ralph moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Towersound moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tower Of Power moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Toussaint, Olivier moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Toussaint, Allen moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\TouchStyle Licks moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Toto 53 moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Toto moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tosteer moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tosh, Peter moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Torrini, Emiliana moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Torre Fuerte moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Torfrock moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Toquinho moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Top Gear moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tool moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Too Many Humans moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tony Macalpine, Tony moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tonic moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Toni Lioret Project moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tone Loc moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Ton Steine Scherben moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tomte moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tommy Tutone moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tommy James and the Shondells moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tomatito moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tomahawk moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tolkki, Timo moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tokyo Dragons, The moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tokio Hotel moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tokaleewak moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Todos Tus Muertos moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Todd moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tocotronic moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Toadies moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Toad The Wet Sprocket moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\To Separate The Flesh From The Bones moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\To My Surprise moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\To Die For moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\To Cherish moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\To\Die\For moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\To\Die moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\To moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\TNT moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\TMK moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab	ab2	\Tk moved successfully.
C:\Documents and Settings\mortier\Bureau\bordel	ab

lolocks · Answer

en gros ce ne sont que mes tablatures de guitare, si vous avez besoin de la liste complete, je veux bien vous l'envoyer mais ça va prendre 15 pages, je vous envoie que ce qui n'est pas de mes tablatures, si vous avez besoin des tabs demandez je le fereais ! fin du rapport en excluant les tabs File/Folder C:\Documents and Settings\mortier\Application Data\DriveCleaner 2006 Free not found. File/Folder C:\Program Files\Fichiers communs\DriveCleaner 2006 Free not found. File/Folder C:\Documents and Settings\mortier\Local Settings\Temp\wndutl32.dll not found. File/Folder C:\Program Files\MyWebSearch not found. File/Folder C:\WINDOWS\system32 vsvcd.exe not found. OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08242008_121917 le copier coller à la fin de move it C:\Documents and Settings\mortier\Bureau\bordel ab ab2\3 moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\2\2wo moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\2\2pac moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\2\28 Days moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\2\23 P.H moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\2\20-70 moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\2\2's (The) moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\2\2 Unlimited moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\2 moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\1\1st Man For Her moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\1\1Kempfi1 moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\1\1974 ad, pahilo junema moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\1\1349 moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\1\12 Stones moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\1\10 Years moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\1\1 God moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\1\1 (The) moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\1 moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\0\015B moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\0\0 Art moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2\0 moved successfully. C:\Documents and Settings\mortier\Bureau\bordel ab ab2 moved successfully. File/Folder C:\Documents and Settings\mortier\Application Data\DriveCleaner 2006 Free not found. File/Folder C:\Program Files\Fichiers communs\DriveCleaner 2006 Free not found. File/Folder C:\Documents and Settings\mortier\Local Settings\Temp\wndutl32.dll not found. File/Folder C:\Program Files\MyWebSearch not found. File/Folder C:\WINDOWS\system32 vsvcd.exe not found. OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08242008_121917 le combofix ComboFix 08-08-23.03 - mortier 2008-08-24 12:29:21.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.373 [GMT 2:00] Endroit: C:\Documents and Settings\mortier\Bureau\ComboFix.exe * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrateur avmonlog C:\Documents and Settings\mortier\Application Data\FunWebProducts C:\Documents and Settings\mortier\err.log C:\Documents and Settings\mortier avmonlog . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NTLOAD -------\Legacy_WINDOWS_LOG -------\Service_Windows Log ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-24 to 2008-08-24 )))))))))))))))))))))))))))))))))))) . 2008-08-24 12:19 . 2008-08-24 12:19 d-------- C:\_OTMoveIt 2008-08-24 00:47 . 2008-08-24 12:36 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-08-24 00:47 . 2008-08-24 00:47 1,409 --a------ C:\WINDOWS\QTFont.for 2008-08-23 18:33 . 2008-08-23 18:33 d-------- C:\Documents and Settings\mortier\Application Data\Malwarebytes 2008-08-23 18:33 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-23 18:32 . 2008-08-23 18:33 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-23 18:32 . 2008-08-23 18:32 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-23 18:32 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-23 13:33 . 2008-08-23 13:37 d-------- C:\Lop SD 2008-08-23 13:17 . 2008-08-23 13:29 4,290 --a------ C:\WINDOWS\system32 mp.reg 2008-08-23 13:16 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-08-23 13:16 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-08-23 13:16 . 2008-08-21 23:41 87,552 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-08-23 13:16 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-08-23 13:16 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-08-23 13:16 . 2008-08-14 21:52 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe 2008-08-23 13:16 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe 2008-08-23 13:16 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-08-23 13:16 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-08-23 13:16 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-08-23 11:07 . 2008-08-23 11:07 d--h----- C:\WINDOWS\system32\GroupPolicy 2008-08-22 15:45 . 2008-08-22 15:45 d-------- C:\Program Files\Fichiers communs\Application 2008-08-22 15:44 . 2008-08-22 15:46 d-------- C:\Program Files\SPYWAREfighter 2008-08-22 15:08 . 2008-08-22 15:10 144 --ahs---- C:\WINDOWS\system32\3023743158.dat 2008-08-15 13:51 . 2008-08-15 13:51 53,248 --a------ C:\WINDOWS\abobkzqz.exe 2008-07-30 20:48 . 2008-07-30 20:48 d-------- C:\Program Files\MSXML 6.0 2008-07-24 06:48 . 2008-07-24 11:22 d-------- C:\Program Files\YesMessenger . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-24 10:36 --------- d-----w C:\Program Files\Steam 2008-08-23 22:48 --------- d-----w C:\Documents and Settings\mortier\Application Data\OpenOffice.org2 2008-08-20 14:30 --------- d-----w C:\Program Files\Starcraft 2008-08-11 13:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-08-04 17:19 --------- d-----w C:\Program Files\Kingpin 2008-08-04 17:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-07-30 18:31 --------- d-----w C:\Program Files\eMule 2008-07-29 16:05 --------- d-----w C:\Documents and Settings\mortier\Application Data\dvdcss 2008-07-24 06:42 --------- d-----w C:\Documents and Settings\mortier\Application Data\Idol View Each 2008-07-21 03:36 --------- d-----w C:\Program Files\Java 2008-07-20 15:09 --------- d-----w C:\Program Files\Satsuki Decoder Pack 2008-07-20 15:07 680 ----a-w C:\Program Files\mpc2.reg 2008-07-20 15:07 596 ----a-w C:\Program Files\mpc1.reg 2008-07-20 15:07 562 ----a-w C:\Program Files\mpc4.reg 2008-07-20 15:07 33,668 ----a-w C:\Program Files\ffdsvsetts.reg 2008-07-20 15:07 3,476 ----a-w C:\Program Files\mpc7.reg 2008-07-20 15:07 3,216 ----a-w C:\Program Files\ffdssetts.reg 2008-07-20 15:07 3,026 ----a-w C:\Program Files\mpc3.reg 2008-07-20 15:07 18,156 ----a-w C:\Program Files\mpc6.reg 2008-07-20 15:07 15,890 ----a-w C:\Program Files\mpc5.reg 2008-07-20 15:07 119 ----a-w C:\Program Files\satsukidecodersettings.ini 2008-07-20 15:07 1,526 ----a-w C:\Program Files\ffdsasetts.reg 2008-07-14 23:26 --------- d-----w C:\Program Files gurrd 2008-07-11 12:55 --------- d-----w C:\Program Files\Fichiers communs\xing shared 2008-07-11 12:55 --------- d-----w C:\Program Files\Fichiers communs\Real 2008-07-11 12:54 --------- d-----w C:\Program Files\Real 2008-07-11 12:53 --------- d-----w C:\Program Files\Google 2008-06-27 14:32 --------- d-----w C:\Program Files\Combined Community Codec Pack 2008-06-27 14:13 --------- d-----w C:\Program Files\AVIcodec 2008-06-27 03:02 --------- d-----w C:\Program Files\Idol View Each 2008-06-27 02:54 --------- d-----w C:\Program Files\Learning Essentials 2008-06-24 18:28 --------- d-----w C:\Program Files\Microsoft Works 2008-06-24 18:27 --------- d-----w C:\Program Files\MSBuild 2008-06-24 18:23 --------- d-----w C:\Program Files\Microsoft.NET 2008-06-24 18:17 --------- d-----w C:\Program Files\Microsoft Visual Studio 8 2008-06-01 20:12 69,632 ----a-w C:\WINDOWS\ScUnin.exe 2008-04-14 13:19 21,792 -c--a-w C:\Documents and Settings\mortier\Application Data\GDIPFONTCACHEV1.DAT 2007-04-04 14:32 94,080 -c--a-w C:\Documents and Settings\mortier\Application Data\ezplay.sys 2007-04-04 14:32 87,608 -c--a-w C:\Documents and Settings\mortier\Application Data\ezpinst.exe 2007-04-04 14:32 47,360 -c--a-w C:\Documents and Settings\mortier\Application Data\pcouffin.sys 2005-11-29 15:19 774,144 ----a-w C:\Program Files\RngInterstitial.dll 2006-08-29 00:03 14 -csh--w C:\WINDOWS\mswtpdxp.dll 2006-08-29 21:09 21 -csh--w C:\WINDOWS\prwttrxp.dll 2006-08-29 00:03 21 -csh--w C:\WINDOWS\system32\dpwttaxp.dll 2006-08-29 00:03 14 -csh--w C:\WINDOWS\system32\mswtpaxp.dll 2006-08-29 21:09 2 -csh--w C:\WINDOWS\system32\verwttxp.dll . ------- Sigcheck ------- 2008-06-20 12:44 360960 744e57c99232201ae98c49168b918f48 C:\WINDOWS\$hf_mig$\KB951748\SP2QFE cpip.sys 2008-06-20 13:51 361600 9aefa14bd6b182d61e3119fa5f436d3d C:\WINDOWS\$hf_mig$\KB951748\SP3GDR cpip.sys 2008-06-20 13:59 361600 ad978a1b783b5719720cff204b666c8e C:\WINDOWS\$hf_mig$\KB951748\SP3QFE cpip.sys 2007-10-30 19:20 360064 90caff4b094573449a0872a0f919b178 C:\WINDOWS\$NtUninstallKB951748$ cpip.sys 2008-06-20 12:45 360320 1cc09561e21a48a7f649a40f18235860 C:\WINDOWS\system32\dllcache cpip.sys 2008-06-20 12:45 360320 1cc09561e21a48a7f649a40f18235860 C:\WINDOWS\system32\drivers cpip.sys . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Update"="C:\Documents and Settings\mortier\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-07-16 21:59 119280] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:55 5674352] "Steam"="C:\Program Files\Steam\Steam.exe" [2008-07-09 04:52 1271032] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-07-11 14:53 122368] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-07-11 14:53 171448] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] "AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 18:57 81408] "snpstd"="C:\WINDOWS\vsnpstd.exe" [2004-06-10 13:48 286720] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "BigDogPath323VMSnap"="C:\WINDOWS\VMSnap23.exe" [2006-09-19 14:26 212992] "BigDogPath323Domino"="C:\WINDOWS\Domino.exe" [2006-06-28 02:54 49152] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2008-07-11 14:54 185896] "HlpAplDsc"="C:\WINDOWS\abobkzqz.exe" [2008-08-15 13:51 53248] "spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe" [2008-02-21 15:37 115344] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-20 01:10 110592 C:\WINDOWS\system32\bthprops.cpl] "VTTimer"="VTTimer.exe" [2005-03-08 21:33 53248 C:\WINDOWS\system32\VTTimer.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-03-04 16:44 16006656 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "ConnectHomeDirToRoot"= 0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "SetSmart"= {6643B857-DF80-9FFB-CB0D-0082ED053567} - C:\Program Files gurrd\SetSmart.dll [2008-07-15 01:26 102400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.X264"= x264vfw.dll "VIDC.3iv2"= 3ivxVfWCodec.dll "msacm.l3fhg"= mp3fhg.acm [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd] --a------ 2004-06-10 13:48 286720 C:\WINDOWS\vsnpstd.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\eMule\emule.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\Program Files\Alwil Software\Avast4\ashAvast.exe"= "C:\Program Files\eXeem\client.dll"= "C:\Program Files\Tiscali_Triway_WiFi\Wizard\CTD_FirmwareUpgrader.exe"= "C:\Program Files\VideoLAN\VLC\vlc.exe"= "C:\WINDOWS\system32\svchost.exe"= "C:\WINDOWS\system32\mmc.exe"= "C:\WINDOWS\system32\dplaysvr.exe"= "C:\Program Files\MSN Messenger\msnmsgr.exe"= "C:\Program Files\MSN Messenger\livecall.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\GetRight\GetRight.exe"= "C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe"= "C:\Program Files\Starcraft\StarCraft.exe"= "C:\Program Files\iTunes\iTunes.exe"= "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"= "C:\Program Files\Steam\steamapps\nosferatus434\counter-strike\hl.exe"= "C:\Program Files\Real\RealPlayer\realplay.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8413:TCP"= 8413:TCP:ppLive "4428:UDP"= 4428:UDP:ppLive "12311:TCP"= 12311:TCP:NortonAV "16679:TCP"= 16679:TCP:NortonAV "18573:TCP"= 18573:TCP:NortonAV "15683:TCP"= 15683:TCP:NortonAV "18010:TCP"= 18010:TCP:NortonAV "14454:TCP"= 14454:TCP:NortonAV "18938:TCP"= 18938:TCP:NortonAV "18272:TCP"= 18272:TCP:NortonAV "14213:TCP"= 14213:TCP:NortonAV "17632:TCP"= 17632:TCP:NortonAV "12832:TCP"= 12832:TCP:NortonAV "12282:TCP"= 12282:TCP:NortonAV "17844:TCP"= 17844:TCP:NortonAV "13235:TCP"= 13235:TCP:NortonAV "1094:UDP"= 1094:UDP:Windows Media Format SDK (winamp.exe) "1095:UDP"= 1095:UDP:Windows Media Format SDK (winamp.exe) R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R3 S3G700;S3G700;C:\WINDOWS\system32\DRIVERS\S3G700m.sys [2005-10-15 22:19] R3 SpyFighter;SpyFighter Guard Device;C:\Program Files\SPYWAREfighter\spyfighter.sys [2008-02-21 15:38] R3 SPYWAREfighterRP;SPYWAREfighterRP;C:\Program Files\SPYWAREfighter\spfprc.exe [2008-02-21 15:37] R3 vmfilter323;323 filter service, Normal;C:\WINDOWS\system32\drivers\vmfilter323.sys [2006-08-08 11:25] R3 ZSMC326;TD74 USB2.0 PC Camera(VC0323);C:\WINDOWS\system32\Drivers\usbvm323.sys [2007-04-24 11:56] S2 713xTVCard;SAA7134 TV Card;C:\WINDOWS\system32\DRIVERS\SAA713x.sys [2005-03-15 13:00] S3 3xHybrid;Pinnacle PCTV Stereo service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2004-11-22 12:33] S3 Asushwio;Asushwio;C:\WINDOWS\system32\drivers\Asushwio.sys [2004-04-28 01:26] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e122ec9-4a9e-11dd-8a58-001a92b25956}] \Shell\AutoRun\command - 1dg.exe \Shell\explore\Command - 1dg.exe \Shell\open\Command - 1dg.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b7eb031c-3c92-11da-bf27-0011d865e4a7}] \Shell\AutoRun\command - G:\Autorun\UbiAutorun.exe . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' 2008-08-23 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] 2006-03-14 C:\WINDOWS\Tasks\wordpad.job - C:\Program Files\Windows NT\Accessoires\wordpad.exe [2004-08-20 01:10] . - - - - ORPHANS REMOVED - - - - HKCU-Run-Burn bleh - C:\DOCUME~1\mortier\APPLIC~1\IDOLVI~1\Mix wait.exe HKLM-Run-InCD - C:\Program Files\Ahead\InCD\InCD.exe HKLM-Run-My Web Search Bar Search Scope Monitor - C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe HKLM-Explorer_Run-t8FKk1gbQQ - C:\Documents and Settings\All Users\Application Data\czcferof\yjshohcb.exe SharedTaskScheduler-IPC Configuration Utility - (no file) SharedTaskScheduler-{020487CC-FC04-4B1E-863F-D9801796230B} - (no file) Notify-AtiExtEvent - (no file) MSConfigStartUp-BitTorrent - C:\Program Files\BitTorrent\bittorrent.exe MSConfigStartUp-SpySpotter System Defender - C:\Program Files\SpySpotter3\Defender.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\mortier\Application Data\Mozilla\Firefox\Profiles\9jnmrcyf.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://french.ircfast2.com/index.php?rvs=hompag FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-24 12:36:49 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . --------------------- DLLs a charg‚ sous des processus courants --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\PROGRA~1\Google\GOOGLE~1\GOOGLE~3.DLL . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32 undll32.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Documents and Settings\mortier\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.bin C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\verclsid.exe . ************************************************************************** . Temps d'accomplissement: 2008-08-24 12:44:25 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-24 10:44:19 Pre-Run: 47,645,360,128 octets libres Post-Run: 47,984,852,992 octets libres 277 --- E O F --- 2008-08-11 13:31:24

lolocks · Answer

et enfin ce bon vieux Jack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:04:06, on 24/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\VMSnap23.exe
C:\WINDOWS\Domino.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\abobkzqz.exe
C:\Program Files\SPYWAREfighter\spftray.exe
C:\Documents and Settings\mortier\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Documents and Settings\mortier\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: IE to GetRight Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BigDogPath323VMSnap] C:\WINDOWS\VMSnap23.exe
O4 - HKLM\..\Run: [BigDogPath323Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [HlpAplDsc] C:\WINDOWS\abobkzqz.exe
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\mortier\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\mortier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Startup: YouTube Uploader.lnk = C:\Documents and Settings\mortier\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
O4 - Global Startup: Citrus Alarm Clock.lnk = C:\Program Files\Citrus Alarm Clock\Citrus Alarm Clock.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5CA8D349-C6E7-11D4-8166-009027DF3BB2} (France Telecom MDDK ActiveX Control) - http://accueil.ava.serveur-ava.com/stkid_data/ocx/mDKid.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O21 - SSODL: SetSmart - {6643B857-DF80-9FFB-CB0D-0082ED053567} - C:\Program Files
gurrd\SetSmart.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe (file missing)
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe

lolocks · Answer

euh au fait j'avais oublié c'est normal que je n'ai plus l'incone avast à coté de l'horloge, de toute façon c'est pas très grave je crois que vous voulez me faire changer d'antivirus mais c'est juste que ça aidera peut etre un peu votre diagnostique !

afideg · Answer

???

Win32.Banker.FS Trojan.SpyAgent.DA

30 réponses

Discussions similaires