Besoin de logiciel anti cheval de troie

O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe

---> Trojan.PWS.Onlinegames.NXE est une infection qui se propage par disques amovibles.
Il se copie sur les supports amovibles telles que les flash drives, cds, memory cards, usb disks.

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

Salut,

- Télécharge HijackThis V 2.02 (HijackThis Installer) :
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

- Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

- Clique sur Install ensuite sur I Accept

- Clique sur Do a scan system and save log file

- Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.

- Télécharge et installe MalwareByte's Anti-Malware :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

- Mets-le à jour

- Redémarre en mode sans échec (Recommandé) :
https://www.malekal.com/demarrer-windows-mode-sans-echec/

- Choisis ta session habituelle

- Fais un scan complet avec MalwareByte's Anti-Malware

- Supprime tout ce que le logiciel trouve, enregistre le rapport

- Redémarre en mode normal et poste le rapport ici

Tutorial :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

C'est juste ma méthode.

linas ---> Merci de créer ton propre topic.

O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\3.bin\MWSBAR.DLL
O3 - Toolbar: Hotbar - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Hotbar\bin\10.2.232.0\HostIE.dll
O3 - Toolbar: iWin Toolbar - {ce0c2586-da36-452b-acdb-320d9bcb19bf} - C:\Program Files\iWin\tbiWin.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"
O4 - HKLM\..\Run: [ItsTV] "C:\Program Files\ItsLabel\ItsTV.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Documents and Settings\All Users\Documents\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\3.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon.exe
O4 - HKLM\..\Run: [PlatriumWeather] "C:\Program Files\Platrium\bin\1.2.103.0\Weather.exe" -auto
O4 - HKLM\..\Run: [PlatriumSA] "C:\Program Files\Platrium\bin\1.2.103.0\PlatriumSA.exe"
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\3.bin\m3SrchMn.exe" /m=0
O4 - HKLM\..\Run: [HotbarOE] C:\Program Files\Hotbar\bin\10.2.232.0\OEAddOn.exe
O4 - HKLM\..\Run: [HotbarSA] "C:\Program Files\Hotbar\bin\10.2.232.0\HotbarSA.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [HiYo] C:\Program Files\HiYo\bin\HiYo.exe /RunFromStartup
O4 - HKCU\..\Run: [msnmsgr] ~"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [mmksy] "c:\documents and settings\lili\local settings\application data\mmksy.exe" mmksy
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; FunWebProducts; SIMBAR={8D0CB1D0-A9BF-11DD-8A1F-000D61E427A4}; Platrium 1.2.103.0; P_IT_EF70077EB4765A5430AE98; Hotbar 10.2.232.0)" -"http://www.internetgamebox.com/igb/content/new/motocross/motocross.html"
O4 - HKUS\S-1-5-21-1935655697-2049760794-682003330-1003\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'Martine')
O4 - HKUS\S-1-5-21-1935655697-2049760794-682003330-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Martine')
O4 - HKUS\S-1-5-21-1935655697-2049760794-682003330-1003\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c (User 'Martine')
O4 - HKUS\S-1-5-21-1935655697-2049760794-682003330-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Martine')
O4 - Startup: iWin Desktop Alerts.lnk = C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin2.valueactive.eu/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iWinGamesInstaller - iWin Inc. - C:\Program Files\iWin Games\iWinGamesInstaller.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\3.bin\mwssvc.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

Je vous signale que bien que payant la license a BidefenderIS V2009
celui ci a ete tout a fait incapable de lutter contre le"system KAMSOFT"
MON SAUVEUR a ete " TROJAN REMOVER" grand merci a lui
la version demo 30j suffit amplement

Bert

***** THE SYSTEM HAS BEEN RESTARTED *****
2009-02-17 03:10:30: Trojan Remover has been restarted
The AppInitDLLs Registry entry has been reset
=======================================================
Removing the following registry keys:
HKCR\CLSID\{6230596F-3A44-4CDF-815B-372FA03C75D6} - already removed (or did not exist)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\clbdriver.sys - already removed (or did not exist)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\clbdriver.sys - already removed (or did not exist)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\mlJCTMcY - already removed (or did not exist)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1110380F-241D-47FE-B4A5-D3ACF1279C97} - already removed (or did not exist)
HKCR\CLSID\{1110380F-241D-47FE-B4A5-D3ACF1279C97} - already removed (or did not exist)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4253FCA-971C-42E3-99A3-8096A125935B} - already removed (or did not exist)
HKCR\CLSID\{F4253FCA-971C-42E3-99A3-8096A125935B} - already removed (or did not exist)
=======================================================
=======================================================
Deleting the following registry value(s):
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[Windows UDP Control Center] - already deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\[{6230596F-3A44-4CDF-815B-372FA03C75D6}] - already deleted
HKLM\SYSTEM\CurrentControlSet\Services\clbdriver\[ImagePath] - already deleted
=======================================================
Unable to rename C:\WINDOWS\system32\drivers\clbdriver.sys to C:\WINDOWS\system32\drivers\clbdriver.sys.vir
(C:\WINDOWS\system32\drivers\clbdriver.sys does not appear to exist)
2009-02-17 03:10:30: Trojan Remover closed
************************************************************

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.5.2563. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 03:01:32 17 févr. 2009
Using Database v7287
Operating System: Windows XP Home Edition (SP3) [Build: 5.1.2600]
File System: NTFS
UserData directory: C:\Documents and Settings\Pascal\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory: C:\Documents and Settings\Pascal\Mes documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
AVG Anti-Virus
AVG Anti-Virus
AVG Anti-Virus

************************************************************

************************************************************
03:01:32: Scanning ----------WIN.INI-----------
WIN.INI found in C:\WINDOWS

************************************************************
03:01:32: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\WINDOWS

************************************************************
03:01:32: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
03:01:37: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [Explorer.exe]
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1037824 bytes
Created: 2006-03-02 07:00
Modified: 2008-04-13 21:34
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\WINDOWS\system32\userinit.exe,]
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
26624 bytes
Created: 2006-03-02 07:00
Modified: 2008-04-13 21:34
Company: Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
Key value: [logonui.exe]
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
515584 bytes
Created: 2006-03-02 07:00
Modified: 2008-04-13 21:34
Company: Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Value Name: load
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: RemoteControl
Value Data: "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
56928 bytes
Created: 2007-07-09 14:06
Modified: 2006-11-23 14:10
Company: Cyberlink Corp.
--------------------
Value Name: LanguageShortcut
Value Data: "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
C:\Program Files\CyberLink\PowerDVD\Language\Language.exe
54832 bytes
Created: 2007-07-09 14:06
Modified: 2006-12-05 21:55
Company:
--------------------
Value Name: NvCplDaemon
Value Data: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
C:\WINDOWS\system32\NvCpl.dll
7311360 bytes
Created: 2006-01-24 05:15
Modified: 2006-01-24 05:15
Company: NVIDIA Corporation
--------------------
Value Name: nwiz
Value Data: nwiz.exe /install
C:\WINDOWS\system32\nwiz.exe
1519616 bytes
Created: 2006-01-24 05:15
Modified: 2006-01-24 05:15
Company: NVIDIA Corporation
--------------------
Value Name: NvMediaCenter
Value Data: RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
C:\WINDOWS\system32\NvMcTray.dll
86016 bytes
Created: 2006-01-24 05:15
Modified: 2006-01-24 05:15
Company: NVIDIA Corporation
--------------------
Value Name: NeroFilterCheck
Value Data: C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
155648 bytes
Created: 2006-01-12 14:40
Modified: 2006-01-12 14:40
Company: Nero AG
--------------------
Value Name: High Definition Audio Property Page Shortcut
Value Data: HDAShCut.exe
C:\WINDOWS\system32\HDAShCut.exe
61952 bytes
Created: 2004-10-27 14:21
Modified: 2004-10-27 14:21
Company: Windows (R) Server 2003 DDK provider
--------------------
Value Name: VX1000
Value Data: C:\WINDOWS\vVX1000.exe
C:\WINDOWS\vVX1000.exe
707376 bytes
Created: 2006-06-29 18:42
Modified: 2006-10-13 16:04
Company: Microsoft Corporation
--------------------
Value Name: LifeCam
Value Data: "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
C:\Program Files\Microsoft LifeCam\LifeExp.exe
277296 bytes
Created: 2006-10-13 16:01
Modified: 2006-10-13 16:01
Company: Microsoft Corporation
--------------------
Value Name: HP Software Update
Value Data: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
49152 bytes
Created: 2006-12-10 20:52
Modified: 2006-12-10 20:52
Company: Hewlett-Packard Co.
--------------------
Value Name: SunJavaUpdateSched
Value Data: "C:\Program Files\Java\jre6\bin\jusched.exe"
C:\Program Files\Java\jre6\bin\jusched.exe
136600 bytes
Created: 2008-12-15 11:07
Modified: 2008-12-15 11:07
Company: Sun Microsystems, Inc.
--------------------
Value Name: SoundMAXPnP
Value Data: C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
-R- 925696 bytes
Created: 2008-09-09 14:39
Modified: 2005-05-19 20:11
Company: Analog Devices, Inc.
--------------------
Value Name: SoundMAX
Value Data: "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
716800 bytes
Created: 2008-09-09 14:39
Modified: 2005-09-07 14:35
Company: Analog Devices, Inc.
--------------------
Value Name: WinampAgent
Value Data: "C:\Program Files\Winamp\winampa.exe"
C:\Program Files\Winamp\winampa.exe [file not found to scan]
--------------------
Value Name: QuickTime Task
Value Data: "C:\Program Files\QuickTime\qttask.exe" -atboottime
C:\Program Files\QuickTime\qttask.exe
413696 bytes
Created: 2008-11-04 10:30
Modified: 2008-11-04 10:30
Company: Apple Inc.
--------------------
Value Name: iTunesHelper
Value Data: "C:\Program Files\iTunes\iTunesHelper.exe"
C:\Program Files\iTunes\iTunesHelper.exe
290088 bytes
Created: 2008-11-20 13:20
Modified: 2008-11-20 13:20
Company: Apple Inc.
--------------------
Value Name: AVG8_TRAY
Value Data: C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
1601304 bytes
Created: 2008-12-19 22:52
Modified: 2009-01-30 16:16
Company: AVG Technologies CZ, s.r.o.
--------------------
Value Name: Locks open bore help
Value Data: C:\Documents and Settings\All Users\Application Data\Dumb Save Locks Open\dent bin.exe
C:\Documents and Settings\All Users\Application Data\Dumb Save Locks Open\dent bin.exe
716800 bytes
Created: 2009-02-03 13:01
Modified: 2009-02-17 02:56
Company: Ttanp renwire boithewb
--------------------
Value Name: Windows UDP Control Center
Value Data: fxstaller.exe
C:\WINDOWS\fxstaller.exe
-RHS- 48690 bytes
Created: 2009-02-16 19:36
Modified: 2009-02-16 15:36
Company: [no info]
fxstaller.exe - this registry value has been removed
C:\WINDOWS\fxstaller.exe - running process located and terminated
C:\WINDOWS\fxstaller.exe - READ-ONLY, HIDDEN and SYSTEM file attributes removed
C:\WINDOWS\fxstaller.exe - file renamed to: C:\WINDOWS\fxstaller.exe.vir
--------------------
Value Name: EoEngine
Value Data: "C:\Program Files\EoRezo\EoEngine.exe"
C:\Program Files\EoRezo\EoEngine.exe
472872 bytes
Created: 2009-02-16 22:24
Modified: 2008-11-25 15:56
Company:
--------------------
Value Name: SoftwareHelper
Value Data: C:\Documents and Settings\Pascal\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Documents and Settings\Pascal\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
368224 bytes
Created: 2009-02-16 22:25
Modified: 2008-12-09 10:13
Company: EoRezo
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
1237896 bytes
Created: 2009-02-17 02:59
Modified: 2009-02-05 19:52
Company: Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}
Value Data: "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
143360 bytes
Created: 2006-12-23 17:05
Modified: 2006-12-23 17:05
Company: Nero AG
--------------------
Value Name: ctfmon.exe
Value Data: C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
15360 bytes
Created: 2006-03-02 07:00
Modified: 2008-04-13 21:33
Company: Microsoft Corporation
--------------------
Value Name: MsnMsgr
Value Data: "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
3885408 bytes
Created: 2009-02-06 18:51
Modified: 2009-02-06 18:51
Company: Microsoft Corporation
--------------------
Value Name: SRS Audio Sandbox
Value Data: "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe [file not found to scan]
--------------------
Value Name: swg
Value Data: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
68856 bytes
Created: 2007-07-27 12:42
Modified: 2007-07-27 12:42
Company: Google Inc.
--------------------
Value Name: ares vista
Value Data: "C:\Program Files\Ares Vista\AresVista.exe" -h
C:\Program Files\Ares Vista\AresVista.exe [file not found to scan]
--------------------
Value Name: Google Update
Value Data: "C:\Documents and Settings\Pascal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
C:\Documents and Settings\Pascal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
133104 bytes
Created: 2009-01-06 12:15
Modified: 2009-01-06 12:15
Company: Google Inc.
--------------------
Value Name: Drvpeak
Value Data: C:\DOCUME~1\Pascal\APPLIC~1\ARMYSP~1\MAPI PROGRAM CAMP.exe
C:\DOCUME~1\Pascal\APPLIC~1\ARMYSP~1\MAPI PROGRAM CAMP.exe
569344 bytes
Created: 2009-01-09 12:44
Modified: 2009-02-03 13:00
Company: Anca
--------------------
Value Name: WMPNSCFG
Value Data: C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
204288 bytes
Created: 2006-11-03 08:59
Modified: 2006-11-03 08:59
Company: Microsoft Corporation
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty

************************************************************
03:01:54: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File: shell32.dll - this file is expected and has been left in place
----------
ValueName: {6230596F-3A44-4CDF-815B-372FA03C75D6}
File: C:\WINDOWS\system32\mlJCTMcY.dll
C:\WINDOWS\system32\mlJCTMcY.dll - this registry value has been removed [file not found to scan]
HKCR\CLSID\{6230596F-3A44-4CDF-815B-372FA03C75D6} - this key has been removed
----------

************************************************************
03:01:58: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
03:01:58: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\WINDOWS\system32\PHOTOI~1.SCR
C:\WINDOWS\system32\PHOTOI~1.SCR
163840 bytes
Created: 2008-04-05 11:09
Modified: 2001-11-02 14:10
Company: ArcSoft Inc.
--------------------

************************************************************
03:01:58: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}
Path: "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
C:\WINDOWS\system32\rundll32.exe
33792 bytes
Created: 2006-03-02 07:00
Modified: 2008-04-13 21:34
Company: Microsoft Corporation
----------
Key: {6BF52A52-394A-11d3-B153-00C04F79FAA6}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
C:\WINDOWS\INF\wmp11.inf
2441 bytes
Created: 2006-11-03 09:03
Modified: 2006-11-03 09:03
Company: [no info]
----------

************************************************************
03:01:59: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: AppMgmt
%SystemRoot%\System32\appmgmts.dll - file is globally excluded (file cannot be found)
--------------------
Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)
--------------------

************************************************************
03:01:59: Scanning ----- SERVICES REGISTRY KEYS -----
Key: aawservice
ImagePath: "C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe"
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
611664 bytes
Created: 2008-05-12 12:38
Modified: 2009-02-16 23:35
Company: Lavasoft
----------
Key: ADIHdAudAddService
ImagePath: system32\drivers\ADIHdAud.sys
C:\WINDOWS\system32\drivers\ADIHdAud.sys
-R- 141312 bytes
Created: 2008-09-09 14:39
Modified: 2005-10-05 04:21
Company: Analog Devices, Inc.
----------
Key: AEAudioService
ImagePath: system32\drivers\AEAudio.sys
C:\WINDOWS\system32\drivers\AEAudio.sys
-R- 127872 bytes
Created: 2008-09-09 14:39
Modified: 2005-03-04 07:53
Company: Andrea Electronics Corporation
----------
Key: Apple Mobile Device
ImagePath: "C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
132424 bytes
Created: 2008-11-07 14:28
Modified: 2008-11-07 14:28
Company: Apple Inc.
----------
Key: avg8emc
ImagePath: C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
903960 bytes
Created: 2008-12-19 22:52
Modified: 2009-01-30 16:15
Company: AVG Technologies CZ, s.r.o.
----------
Key: avg8wd
ImagePath: C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
298264 bytes
Created: 2008-12-19 22:52
Modified: 2009-01-30 16:15
Company: AVG Technologies CZ, s.r.o.
----------
Key: AvgLdx86
ImagePath: \SystemRoot\System32\Drivers\avgldx86.sys
C:\WINDOWS\System32\Drivers\avgldx86.sys
325128 bytes
Created: 2008-12-19 22:52
Modified: 2009-01-30 16:16
Company: AVG Technologies CZ, s.r.o.
----------
Key: AvgMfx86
ImagePath: \SystemRoot\System32\Drivers\avgmfx86.sys
C:\WINDOWS\System32\Drivers\avgmfx86.sys
27656 bytes
Created: 2008-12-19 22:52
Modified: 2009-01-30 16:16
Company: AVG Technologies CZ, s.r.o.
----------
Key: AvgTdiX
ImagePath: \SystemRoot\System32\Drivers\avgtdix.sys
C:\WINDOWS\System32\Drivers\avgtdix.sys
107272 bytes
Created: 2008-12-19 22:52
Modified: 2009-01-30 16:16
Company: AVG Technologies CZ, s.r.o.
----------
Key: BCM42RLY
ImagePath: \??\C:\WINDOWS\System32\BCM42RLY.SYS
C:\WINDOWS\System32\BCM42RLY.SYS
17992 bytes
Created: 2007-07-09 14:23
Modified: 2005-02-01 17:18
Company: Broadcom Corporation
----------
Key: Bonjour Service
ImagePath: "C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Program Files\Bonjour\mDNSResponder.exe
238888 bytes
Created: 2008-12-12 11:17
Modified: 2008-12-12 11:17
Company: Apple Inc.
----------
Key: clbdriver
ImagePath: \??\globalroot\systemroot\system32\drivers\clbdriver.sys
C:\WINDOWS\system32\drivers\clbdriver.sys - has a *known* Malware filename: ROOTKIT.AGENT
C:\WINDOWS\system32\drivers\clbdriver.sys - this registry value has been removed [file not found to scan]
"SafeBoot\Minimal" registry entry for [clbdriver.sys] removed
"SafeBoot\Network" registry entry for [clbdriver.sys] removed
C:\WINDOWS\system32\drivers\clbdriver.sys - unable to take ownership/change permissions
C:\WINDOWS\system32\drivers\clbdriver.sys - marked for renaming when the PC is restarted (if it exists)
----------
Key: fssfltr
ImagePath: system32\DRIVERS\fssfltr_tdi.sys
C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
55152 bytes
Created: 2009-02-16 21:56
Modified: 2009-02-06 18:08
Company: Microsoft Corporation
----------
Key: fsssvc
ImagePath: "C:\Program Files\Windows Live\Family Safety\fsssvc.exe"
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
533360 bytes
Created: 2009-02-06 18:08
Modified: 2009-02-06 18:08
Company: Microsoft Corporation
----------
Key: grmnusb
ImagePath: system32\drivers\grmnusb.sys
C:\WINDOWS\system32\drivers\grmnusb.sys
7296 bytes
Created: 2008-07-06 13:06
Modified: 2003-09-23 09:42
Company: GARMIN Corp.
----------
Key: GTNDIS5
ImagePath: \??\C:\WINDOWS\system32\GTNDIS5.SYS
C:\WINDOWS\system32\GTNDIS5.SYS
15872 bytes
Created: 2007-07-09 14:23
Modified: 2003-09-25 21:15
Company: Printing Communications Assoc., Inc. (PCAUSA)
----------
Key: gupdate1c98e0e58c1f5c4
ImagePath: "C:\Program Files\Google\Update\GoogleUpdate.exe" /svc
C:\Program Files\Google\Update\GoogleUpdate.exe
133104 bytes
Created: 2009-02-13 14:07
Modified: 2009-02-13 14:07
Company: Google Inc.
----------
Key: gusvc
ImagePath: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
182768 bytes
Created: 2007-07-16 19:44
Modified: 2009-02-13 14:06
Company: Google
----------
Key: HdAudAddService
ImagePath: system32\drivers\HdAudio.sys
C:\WINDOWS\system32\drivers\HdAudio.sys
145920 bytes
Created: 2004-10-27 14:21
Modified: 2004-10-27 14:21
Company: Windows (R) Server 2003 DDK provider
----------
Key: HPZid412
ImagePath: system32\DRIVERS\HPZid412.sys
C:\WINDOWS\system32\DRIVERS\HPZid412.sys
-R- 49920 bytes
Created: 2008-07-19 16:50
Modified: 2006-12-06 01:02
Company: HP
----------
Key: HPZipr12
ImagePath: system32\DRIVERS\HPZipr12.sys
C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
-R- 16496 bytes
Created: 2008-07-19 16:50
Modified: 2006-12-06 01:02
Company: HP
----------
Key: HPZius12
ImagePath: system32\DRIVERS\HPZius12.sys
C:\WINDOWS\system32\DRIVERS\HPZius12.sys
-R- 21568 bytes
Created: 2008-07-19 16:49
Modified: 2006-12-06 01:02
Company: HP
----------
Key: JavaQuickStarterService
ImagePath: "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"
C:\Program Files\Java\jre6\bin\jqs.exe
152984 bytes
Created: 2008-12-15 11:07
Modified: 2008-12-15 11:07
Company: Sun Microsystems, Inc.
----------
Key: MS1000
ImagePath: System32\DRIVERS\MS1000.sys
C:\WINDOWS\System32\DRIVERS\MS1000.sys
5376 bytes
Created: 2009-02-16 22:49
Modified: 2009-02-16 22:49
Company: [no info]
----------
Key: MSCamSvc
ImagePath: "C:\Program Files\Microsoft LifeCam\MSCamS32.exe"
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
207664 bytes
Created: 2006-10-13 16:01
Modified: 2006-10-13 16:01
Company: Microsoft Corporation
----------
Key: MTsensor
ImagePath: system32\DRIVERS\ASACPI.sys
C:\WINDOWS\system32\DRIVERS\ASACPI.sys
-R- 5810 bytes
Created: 2007-07-09 14:04
Modified: 2004-08-12 21:56
Company:
----------
Key: NMIndexingService
ImagePath: "C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe"
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
262144 bytes
Created: 2006-12-23 16:54
Modified: 2006-12-23 16:54
Company: Nero AG
----------
Key: NVENETFD
ImagePath: system32\DRIVERS\NVENETFD.sys
C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
-R- 34176 bytes
Created: 2007-07-09 14:05
Modified: 2006-02-16 21:28
Company: NVIDIA Corporation
----------
Key: nvnetbus
ImagePath: system32\DRIVERS\nvnetbus.sys
C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
-R- 13056 bytes
Created: 2007-07-09 14:05
Modified: 2006-02-16 21:28
Company: NVIDIA Corporation
----------
Key: RichVideo
ImagePath: "C:\Program Files\CyberLink\Shared Files\RichVideo.exe"
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
167936 bytes
Created: 2007-07-09 14:06
Modified: 2005-08-07 07:54
Company:
----------
Key: RT61
ImagePath: system32\DRIVERS\RT61.sys
C:\WINDOWS\system32\DRIVERS\RT61.sys
356096 bytes
Created: 2007-07-09 14:23
Modified: 2005-10-27 14:06
Company: Ralink Technology Inc.
----------
Key: SeaPort
ImagePath: "C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe"
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
226656 bytes
Created: 2009-01-14 17:53
Modified: 2009-01-14 17:53
Company: Microsoft Corp.
----------
Key: SenFiltService
ImagePath: system32\drivers\Senfilt.sys
C:\WINDOWS\system32\drivers\Senfilt.sys
-R- 393088 bytes
Created: 2008-09-09 14:39
Modified: 2005-08-11 00:49
Company: Sensaura
----------
Key: SQTECH905C
ImagePath: System32\Drivers\Capt905c.sys
C:\WINDOWS\System32\Drivers\Capt905c.sys
33890 bytes
Created: 2008-04-05 11:12
Modified: 2005-07-13 10:08
Company: Service & Quality Technology.
----------
Key: SRS_SSCFilter
ImagePath: system32\drivers\srs_sscfilter_i386.sys
C:\WINDOWS\system32\drivers\srs_sscfilter_i386.sys
-R- 39552 bytes
Created: 2007-07-13 11:12
Modified: 2007-05-03 09:28
Company:
----------
Key: SwPrv
ImagePath: C:\WINDOWS\system32\dllhost.exe /Processid:{401EB1D0-84F1-41F8-895E-FE35F5B899C8}
C:\WINDOWS\system32\dllhost.exe
5120 bytes
Created: 2006-03-02 07:00
Modified: 2008-04-13 21:34
Company: Microsoft Corporation
----------
Key: VX1000
ImagePath: system32\DRIVERS\VX1000.sys
C:\WINDOWS\system32\DRIVERS\VX1000.sys
1966000 bytes
Created: 2006-06-29 18:42
Modified: 2006-10-13 16:04
Company: Microsoft Corporation
----------
Key: WMP54Gv4SVC
ImagePath: "C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe"
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
41025 bytes
Created: 2007-07-09 14:23
Modified: 2004-02-06 21:56
Company: GEMTEKS
----------
Key: WpdUsb
ImagePath: system32\DRIVERS\wpdusb.sys
C:\WINDOWS\system32\DRIVERS\wpdusb.sys
38528 bytes
Created: 2004-08-11 00:45
Modified: 2006-10-18 19:00
Company: Microsoft Corporation
----------

************************************************************
03:02:27: Scanning -----VXD ENTRIES-----

************************************************************
03:02:27: Scanning ----- WINLOGON\NOTIFY DLLS -----
Key : avgrsstarter
DLLName: avgrsstx.dll
C:\WINDOWS\system32\avgrsstx.dll
10520 bytes
Created: 2008-12-19 22:52
Modified: 2009-01-30 16:16
Company: AVG Technologies CZ, s.r.o.
----------
Key : mlJCTMcY
DLLName: mlJCTMcY.dll
mlJCTMcY.dll - this reference has been removed [file not found to scan]
----------

************************************************************
03:02:33: Scanning ----- CONTEXTMENUHANDLERS -----
Key: AVG8 Shell Extension
CLSID: {9F97547E-4609-42C5-AE0C-81C61FFAEBC3}
Path: C:\Program Files\AVG\AVG8\avgse.dll
C:\Program Files\AVG\AVG8\avgse.dll
117528 bytes
Created: 2008-12-19 22:52
Modified: 2009-01-30 16:15
Company: AVG Technologies CZ, s.r.o.
----------

************************************************************
03:02:33: Scanning ----- FOLDER\COLUMNHANDLERS -----

************************************************************
03:02:33: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {1110380F-241D-47FE-B4A5-D3ACF1279C97}
BHO: C:\WINDOWS\system32\wvUmjKbb.dll
C:\WINDOWS\system32\wvUmjKbb.dll - this BHO was being loaded by the following key:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1110380F-241D-47FE-B4A5-D3ACF1279C97} - this key has been removed [file not found to scan]
C:\WINDOWS\system32\wvUmjKbb.dll - this BHO was referenced by the following key:
HKEY_CLASSES_ROOT\CLSID\{1110380F-241D-47FE-B4A5-D3ACF1279C97} - this key has been removed
----------
Key: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
BHO: C:\Program Files\AVG\AVG8\avgssie.dll
C:\Program Files\AVG\AVG8\avgssie.dll
1078552 bytes
Created: 2008-12-19 22:52
Modified: 2009-01-30 16:15
Company: AVG Technologies CZ, s.r.o.
----------
Key: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B}
BHO: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
92504 bytes
Created: 2009-01-14 17:49
Modified: 2009-01-14 17:49
Company: Microsoft Corp.
----------
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: C:\Program Files\Java\jre6\bin\ssv.dll
C:\Program Files\Java\jre6\bin\ssv.dll
320920 bytes
Created: 2008-12-15 11:07
Modified: 2008-12-15 11:07
Company: Sun Microsystems, Inc.
----------
Key: {9030D464-4C02-4ABF-8ECC-5164760863C6}
BHO: C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
408448 bytes
Created: 2009-01-22 15:41
Modified: 2009-01-22 15:41
Company: Microsoft Corporation
----------
Key: {A057A204-BACC-4D26-9990-79A187E2698E}
BHO: C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
1968920 bytes
Created: 2008-12-19 22:52
Modified: 2009-01-30 16:16
Company: [COMPANYNAME]----------------------------
----------
Key: {AA58ED58-01DD-4d91-8333-CF10577473F7}
BHO: C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
251504 bytes
Created: 2009-01-17 03:21
Modified: 2009-01-16 22:49
Company: [no info]
----------
Key: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
BHO: C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
657904 bytes
Created: 2009-01-17 03:21
Modified: 2009-01-17 03:21
Company: Google Inc.
----------
Key: {C7B76B90-3455-4AE6-A752-EAC4D19689E5}
BHO: C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll
C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll
42792 bytes
Created: 2009-02-16 22:25
Modified: 2008-11-18 15:15
Company: EoRezo
----------
Key: {C84D72FE-E17D-4195-BB24-76C02E2E7C4E}
BHO: C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
522224 bytes
Created: 2009-01-16 22:49
Modified: 2009-01-16 22:49
Company: Google Inc.
----------
Key: {DBC80044-A445-435b-BC74-9C25C1C588A9}
BHO: C:\Program Files\Java\jre6\bin\jp2ssv.dll
C:\Program Files\Java\jre6\bin\jp2ssv.dll
34816 bytes
Created: 2008-12-15 11:07
Modified: 2008-12-15 11:07
Company: Sun Microsystems, Inc.
----------
Key: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}
BHO: C:\Program Files\Windows Live\Toolbar\wltcore.dll
C:\Program Files\Windows Live\Toolbar\wltcore.dll
1068904 bytes
Created: 2009-02-06 18:17
Modified: 2009-02-06 18:17
Company: Microsoft Corporation
----------
Key: {E7E6F031-17CE-4C07-BC86-EABFE594F69C}
BHO: C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
73728 bytes
Created: 2008-12-15 11:07
Modified: 2008-12-15 11:07
Company: Sun Microsystems, Inc.
----------
Key: {F4253FCA-971C-42E3-99A3-8096A125935B}
BHO: C:\WINDOWS\nfavxwdbsbq.dll
C:\WINDOWS\nfavxwdbsbq.dll - this BHO was being loaded by the following key:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4253FCA-971C-42E3-99A3-8096A125935B} - this key has been removed [file not found to scan]
C:\WINDOWS\nfavxwdbsbq.dll - this BHO was referenced by the following key:
HKEY_CLASSES_ROOT\CLSID\{F4253FCA-971C-42E3-99A3-8096A125935B} - this key has been removed
----------

************************************************************
03:02:39: Scanning ----- SHELLSERVICEOBJECTS -----

************************************************************
03:02:39: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
03:02:39: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
03:02:39: Scanning ----- APPINIT_DLLS -----
AppInitDLLs entry = [rgonbf.dll,cwgudx.dll]
rgonbf.dll - this reference will be removed [file not found to scan]
----------
cwgudx.dll - this reference will be removed [file not found to scan]
----------

************************************************************
03:02:43: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
03:02:44: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
-HS- 84 bytes
Created: 2007-07-09 09:31
Modified: 2007-07-09 13:47
Company: [no info]
--------------------
HP Digital Imaging Monitor.lnk - links to C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
210520 bytes
Created: 2007-01-02 20:40
Modified: 2007-01-02 20:40
Company: Hewlett-Packard Co.
--------------------

************************************************************
No User Startup Groups were located to check

************************************************************
03:02:44: Scanning ----- SCHEDULED TASKS -----
Taskname: AppleSoftwareUpdate.job
File: C:\Program Files\Apple Software Update\SoftwareUpdate.exe
C:\Program Files\Apple Software Update\SoftwareUpdate.exe
566592 bytes
Created: 2008-07-30 11:34
Modified: 2008-07-30 11:34
Company: Apple Inc.
Parameters: -task
Next Run Time: 2009-02-18 17:26:00
Status: La tâche est prête à s'exécuter à l'heure prévue
Creator: SYSTEM
Comments: [blank]
----------
Taskname: B412DC9491854640.job
File: c:\docume~1\pascal\applic~1\armysp~1\proxybikebib.exe
c:\docume~1\pascal\applic~1\armysp~1\proxybikebib.exe
450560 bytes
Created: 2009-01-09 12:45
Modified: 2009-02-03 13:01
Company: Tessu dse
Parameters: [blank]
Next Run Time: 2009-02-17 04:00:00
Status: La tâche est prête à s'exécuter à l'heure prévue
Creator: Pascal
Comments: [blank]
----------
Taskname: Google Software Updater.job
File: C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
182768 bytes
Created: 2007-07-16 19:44
Modified: 2009-02-13 14:06
Company: Google
Parameters: scheduled_start
Next Run Time: 2009-02-17 10:38:00
Status: La tâche n'a pas encore été exécutée
Creator: SYSTEM
Comments: Google Updater keeps your Google software up to date. If Google Updater Service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work.
----------
Taskname: GoogleUpdateTaskMachine.job
File: C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
133104 bytes
Created: 2009-02-13 14:07
Modified: 2009-02-13 14:07
Company: Google Inc.
Parameters: /c
Next Run Time: Never
Status: La tâche est prête à s'exécuter à l'heure prévue
Creator: Pascal
Comments: Keeps your Google software up to date. If this task is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This task uninstalls itself when there is no Google software using it.
----------
Taskname: GoogleUpdateTaskUserS-1-5-21-682003330-179605362-725345543-1004.job
File: C:\Documents and Settings\Pascal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Documents and Settings\Pascal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
133104 bytes
Created: 2009-01-06 12:15
Modified: 2009-01-06 12:15
Company: Google Inc.
Parameters: /c
Next Run Time: Never
Status: La tâche est prête à s'exécuter à l'heure prévue
Creator: Pascal
Comments: Keeps your Google software up to date. If this task is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This task uninstalls itself when there is no Google software using it.
----------
Taskname: User_Feed_Synchronization-{3536C6D3-C7EC-437A-9E7F-DB4442020AEE}.job
File: C:\WINDOWS\system32\msfeedssync.exe
C:\WINDOWS\system32\msfeedssync.exe
13312 bytes
Created: 2006-10-17 10:58
Modified: 2009-01-15 02:01
Company: Microsoft Corporation
Parameters: sync
Next Run Time: 2009-02-17 03:17:00
Status: La tâche est prête à s'exécuter à l'heure prévue
Creator: Pascal
Comments: Met à jour les flux système obsolètes.
----------

************************************************************
03:02:46: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

************************************************************
03:02:46: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Documents and Settings\Pascal\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Pascal\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
921654 bytes
Created: 2007-07-10 18:00
Modified: 2009-02-09 19:48
Company: [no info]
----------
Web Desktop Wallpaper: %USERPROFILE%\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Pascal\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
921654 bytes
Created: 2007-07-10 18:00
Modified: 2009-02-09 19:48
Company: [no info]
----------
Checks for rogue DNS NameServers completed
----------
----------
Additional checks completed

************************************************************
03:02:50: Scanning ----- RUNNING PROCESSES -----

C:\WINDOWS\System32\smss.exe
[1 loaded module]
--------------------
C:\WINDOWS\system32\csrss.exe
[13 loaded modules in total]
--------------------
C:\WINDOWS\system32\winlogon.exe
[69 loaded modules in total]
--------------------
C:\WINDOWS\system32\services.exe
[26 loaded modules in total]
--------------------
C:\WINDOWS\system32\lsass.exe
[57 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[49 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[37 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
[154 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[29 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[31 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[46 loaded modules in total]
--------------------
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe - file already scanned
[30 loaded modules in total]
--------------------
C:\WINDOWS\system32\spoolsv.exe
[52 loaded modules in total]
--------------------
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe - file already scanned
[24 loaded modules in total]
--------------------
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe - file already scanned
[28 loaded modules in total]
--------------------
C:\Program Files\Bonjour\mDNSResponder.exe - file already scanned
[31 loaded modules in total]
--------------------
C:\Program Files\Google\Update\GoogleUpdate.exe - file already scanned
[25 loaded modules in total]
--------------------
C:\WINDOWS\Explorer.EXE - file already scanned
[109 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[40 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
[33 loaded modules in total]
--------------------
C:\Program Files\Java\jre6\bin\jqs.exe - file already scanned
[82 loaded modules in total]
--------------------
C:\Program Files\Microsoft LifeCam\MSCamS32.exe - file already scanned
[15 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
[29 loaded modules in total]
--------------------
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe - file already scanned
[21 loaded modules in total]
--------------------
C:\WINDOWS\system32\nvsvc32.exe
[33 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
[34 loaded modules in total]
--------------------
C:\Program Files\CyberLink\Shared Files\RichVideo.exe - file already scanned
[18 loaded modules in total]
--------------------
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe - file already scanned
[39 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[39 loaded modules in total]
--------------------
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe - file already scanned
[9 loaded modules in total]
--------------------
C:\PROGRA~1\AVG\AVG8\avgemc.exe - file already scanned
[53 loaded modules in total]
--------------------
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
[81 loaded modules in total]
--------------------
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
[7 loaded modules in total]
--------------------
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
[31 loaded modules in total]
--------------------
C:\Program Files\Windows Media Player\WMPNetwk.exe
[67 loaded modules in total]
--------------------
C:\WINDOWS\vVX1000.exe - file already scanned
[22 loaded modules in total]
--------------------
C:\Program Files\AVG\AVG8\avgcsrvx.exe
[7 loaded modules in total]
--------------------
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe - file already scanned
[18 loaded modules in total]
--------------------
C:\Program Files\Java\jre6\bin\jusched.exe - file already scanned
[39 loaded modules in total]
--------------------
C:\Program Files\Analog Devices\Core\smax4pnp.exe - file already scanned
[33 loaded modules in total]
--------------------
C:\WINDOWS\System32\alg.exe
[30 loaded modules in total]
--------------------
C:\Program Files\iTunes\iTunesHelper.exe - file already scanned
[50 loaded modules in total]
--------------------
C:\WINDOWS\system32\wbem\wmiapsrv.exe
[42 loaded modules in total]
--------------------
C:\PROGRA~1\AVG\AVG8\avgtray.exe - file already scanned
[35 loaded modules in total]
--------------------
C:\Program Files\Internet Explorer\IEXPLORE.EXE
[39 loaded modules in total]
--------------------
C:\Program Files\EoRezo\EoEngine.exe - file already scanned
[58 loaded modules in total]
--------------------
C:\Documents and Settings\Pascal\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe - file already scanned
[27 loaded modules in total]
--------------------
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe - file already scanned
[41 loaded modules in total]
--------------------
C:\WINDOWS\system32\ctfmon.exe - file already scanned
[24 loaded modules in total]
--------------------
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
[44 loaded modules in total]
--------------------
C:\Program Files\iPod\bin\iPodService.exe
[26 loaded modules in total]
--------------------
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe - file already scanned
[33 loaded modules in total]
--------------------
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe - file already scanned
[51 loaded modules in total]
--------------------
C:\Documents and Settings\Pascal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe - file already scanned
[25 loaded modules in total]
--------------------
C:\Program Files\Internet Explorer\IEXPLORE.EXE
[45 loaded modules in total]
--------------------
C:\Program Files\Internet Explorer\IEXPLORE.EXE
[45 loaded modules in total]
--------------------
C:\Program Files\Windows Media Player\WMPNSCFG.exe - file already scanned
[24 loaded modules in total]
--------------------
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
[62 loaded modules in total]
--------------------
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
[25 loaded modules in total]
--------------------
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
[70 loaded modules in total]
--------------------
C:\Program Files\AVG\AVG8\avgscanx.exe
[22 loaded modules in total]
--------------------
C:\Program Files\AVG\AVG8\avgcsrvx.exe
[7 loaded modules in total]
--------------------
C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe
[41 loaded modules in total]
--------------------
C:\Program Files\Internet Explorer\iexplore.exe
[55 loaded modules in total]
--------------------
C:\Program Files\Internet Explorer\iexplore.exe
[150 loaded modules in total]
--------------------
C:\Program Files\Windows Live\Toolbar\wltuser.exe
[39 loaded modules in total]
--------------------
C:\Program Files\AVG\AVG8\avgui.exe
[38 loaded modules in total]
--------------------
C:\Documents and Settings\Pascal\Application Data\Simply Super Software\Trojan Remover\ydc715.exe
FileSize: 2929528
[This is a Trojan Remover component]
[65 loaded modules in total]
--------------------

************************************************************
03:04:25: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
03:04:25: Scanning ------ %TEMP% DIRECTORY ------
C:\DOCUME~1\Pascal\LOCALS~1\Temp\0c4550fd-b9b0-4690-b0f8-deddf8d273f5.tmp appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\755dde5b-d4cb-46b3-ae52-595fef83688b.tmp appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\lqtuipja.dll
56732 bytes
Created: 2008-07-29 21:45
Modified: 2008-07-30 00:09
Company: [no info]
C:\DOCUME~1\Pascal\LOCALS~1\Temp\lqtuipja.dll appears to contain: TROJAN.VIRTUMONDE
C:\DOCUME~1\Pascal\LOCALS~1\Temp\lqtuipja.dll - file renamed to: C:\DOCUME~1\Pascal\LOCALS~1\Temp\lqtuipja.dll.vir
--------------------
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~107a7a81668d61c7c355c5b5a200?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~107a7a81668d61c7c355c5b5a200?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~1233d77624a74e1c7c749540c9800?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~1233d77624a74e1c7c749540c9800?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~1387e9911c48e1c7ffd74d1ac500?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~1387e9911c48e1c7ffd74d1ac500?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~1433d7718a5c41c7c74950791100?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~1433d7718a5c41c7c74950791100?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~153e59c8111d91c8960084120900?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~153e59c8111d91c8960084120900?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~1773a07dc441c836269fefa900?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~1773a07dc441c836269fefa900?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~18b1c74a1e191c8a6855101e900?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~18b1c74a1e191c8a6855101e900?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~1c1ffce71263b1c7c355bd5d6700?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~1c1ffce71263b1c7c355bd5d6700?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~1d3e59fc10bca1c89603c91a900?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~1d3e59fc10bca1c89603c91a900?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2171ba20221501c89832cd499f00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2171ba20221501c89832cd499f00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~233e59fcfde51c89602fab00600?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~233e59fcfde51c89602fab00600?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~25bfb8ee9be11c8a6107ef91600?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~25bfb8ee9be11c8a6107ef91600?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~261ffce094f71c7c355c2221b00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~261ffce094f71c7c355c2221b00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2828a77673931c8a6854182a000?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2828a77673931c8a6854182a000?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~293e59c8fe951c89602d5bb9300?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~293e59c8fe951c89602d5bb9300?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~29663520a3b01c7ca50f762f300?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~29663520a3b01c7ca50f762f300?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~29a3c946a1711c85e2490b9fa00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~29a3c946a1711c85e2490b9fa00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2b825435db7c1c7c355b5052c00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2b825435db7c1c7c355b5052c00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2b8257f57f6341c8aa6f61dca100?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2b8257f57f6341c8aa6f61dca100?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2d147ce6a3a81c85e2491eb2700?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2d147ce6a3a81c85e2491eb2700?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2d15f07c206131c7e75b4b9d7900?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2d15f07c206131c7e75b4b9d7900?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2de030d11afd61c89357a8978800?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2de030d11afd61c89357a8978800?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2f3e59c3117d11c8960311565d00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2f3e59c3117d11c8960311565d00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2f3e59fdf7961c89602e409af00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~2f3e59fdf7961c89602e409af00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~32cefacf877f1c7c81f5fca8e00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~32cefacf877f1c7c81f5fca8e00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~335a1fe294481c81dd2d68d9600?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~335a1fe294481c81dd2d68d9600?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~338f9c62d26f51c7c353da913600?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~338f9c62d26f51c7c353da913600?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~36768b9adc61c89f4fb4866b00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~36768b9adc61c89f4fb4866b00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3affb60fedf6f1c7d4ade2a14900?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3affb60fedf6f1c7d4ade2a14900?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3bd5606e98951c7c415e7765e00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3bd5606e98951c7c415e7765e00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3c1ffce798651c7c355bd5d6700?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3c1ffce798651c7c355bd5d6700?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3cffb635e7c921c8317cf79c9900?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3cffb635e7c921c8317cf79c9900?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3d61e7721c0f81c7ffd94fca200?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3d61e7721c0f81c7ffd94fca200?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3db71f0a517c61c7c74f1dd21700?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3db71f0a517c61c7c74f1dd21700?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3dfb6dd1a97401c7c353e0871700?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3dfb6dd1a97401c7c353e0871700?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3f4d89cee7491c836d2afc4c700?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~3f4d89cee7491c836d2afc4c700?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~40416f60a2e01c7ca50f762f300?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~40416f60a2e01c7ca50f762f300?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~406ac489c011c7c4163c19d900?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~406ac489c011c7c4163c19d900?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~438f9c7fd2891c7c353cfd6a100?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~438f9c7fd2891c7c353cfd6a100?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~45be84bfcbffd1c7c4c6fec15400?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~45be84bfcbffd1c7c4c6fec15400?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~45e512bd55921c8524abdab800?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~45e512bd55921c8524abdab800?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~49bfb8ef961d1c8a6108e785f00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~49bfb8ef961d1c8a6108e785f00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a021fe4179681c8992f960ce800?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a021fe4179681c8992f960ce800?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a026be412eda1c8992f8c838000?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a026be412eda1c8992f8c838000?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a0275e4164da1c8992f9ad19c00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a0275e4164da1c8992f9ad19c00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a027be418a2c1c8992f87becc00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a027be418a2c1c8992f87becc00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a0283e417e0b1c8992f81c8eb00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a0283e417e0b1c8992f81c8eb00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a02cde4193ca1c8992f91483400?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a02cde4193ca1c8992f91483400?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a02cfe4179191c8992f9f965000?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a02cfe4179191c8992f9f965000?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a186fe415ff91c8992f7aa1dd00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a186fe415ff91c8992f7aa1dd00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a18d5e415cd61c8992f75dd2900?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a18d5e415cd61c8992f75dd2900?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a18f6e416d2e1c8992fd79d9300?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a18f6e416d2e1c8992fd79d9300?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a4b9fe4187d81c8992f534b1000?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a4b9fe4187d81c8992f534b1000?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a4ba4e4177fe1c8992f3a425f00?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a4ba4e4177fe1c8992f3a425f00?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a4bd6e41914b1c8992f40384000?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a4bd6e41914b1c8992f40384000?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a4bf5e418cb01c8992f5cd47800?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a4bf5e418cb01c8992f5cd47800?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a5103e4fdd31c8992fa91fb800?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a5103e4fdd31c8992fa91fb800?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a5150e4159f91c8992fb177f300?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a5150e4159f91c8992fb177f300?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a51fbe415cad1c8992fab821200?d appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a51fbe415cad1c8992fab821200?g appears to be in-use/locked
C:\DOCUME~1\Pascal\LOCALS~1\Temp\~4a5c0de41829e1c