Méchant Trojan Résolu

Question

Bonjour,

J'étais venu dans ce site il y a quelques temps et on m'avait merveilleusement dépanné à l'époque.
Voilà, j'ai un Popup qui s'ouvre régulièrement (Windows Security Alert) du nom de Trojan-spy.HTML.Bankfraud.dq....

Ci-après, le rapport de smitfraudfix...Quelqu'un pourrait-il me guider svp?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:47:26, on 12.09.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device 

Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\All Users\Application Data\dozydgpe\fgvefidy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\UltraDVD\DVDMon.exe
C:\WINDOWS\system32
mjwvkzc.exe
C:\Program Files\Wireless\Gigaset USB Stick 54\GUI.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication 

Foundation\infocard.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - 

C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - 

{3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program 

Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program 

Files\BitComet	ools\BitCometBHO_1.1.9.24.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - 

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program 

Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {86E91425-D7F6-44D6-9BFB-2E58EE831AD5} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - 

{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft 

Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program 

files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - 

C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program 

files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\QuickTime\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers 

communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [\VIE1.exe] C:\Windows\System32\VIE1.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager 

Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program 

Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [UltraDVDMon] C:\Program Files\UltraDVD\DVDMon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [appsys] C:\WINDOWS\system32	ejslkbm.exe
O4 - HKCU\..\Run: [\VIE1.exe] C:\Windows\System32\VIE1.exe
O4 - HKCU\..\Run: [dbsyscmd] C:\WINDOWS\system32
mjwvkzc.exe
O4 - HKLM\..\Policies\Explorer\Run: [] 
O4 - HKLM\..\Policies\Explorer\Run: [QPSBoxqHkA] C:\Documents and Settings\All 

Users\Application Data\dozydgpe\fgvefidy.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE 

LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE 

RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 

'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 

'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 

7.0\Readereader_sl.exe
O4 - Global Startup: Moniteur Gigaset WLAN Adapter.lnk = C:\Program Files\Wireless\Gigaset USB 

Stick 54\GUI.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - 

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program 

Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - 

C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program 

Files\BitComet	ools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - 

C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - 

{85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - 

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - 

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - 

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network 

Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - 

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program 

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - 

C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - 

http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - 

http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation 

Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - 

http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - 

http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - 

http://update.microsoft.com/...

11938343
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - 

http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe
O21 - SSODL: cmdcfginfo - {13B0C94A-82A5-8535-D797-0AE9EEB02EF7} - C:\Program 

Files\suefwe\cmdcfginfo.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers 

communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program 

Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program 

Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program 

Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program 

Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - 

C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - 

C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google 

Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program 

Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program 

Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers 

communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec 

AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program 

Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers 

communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec 

AntiVirus\Rtvscan.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - 

C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Destrio5 · Answer

Salut,

- Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) : 
http://siri.urz.free.fr/Fix/SmitfraudFix.exe ou http://www.geekstogo.com/forum/files/file/6-smitfraudfix/ 

- Enregistre-le sur le bureau

- Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée

- Un rapport sera généré, poste-le dans ta prochaine réponse.

[*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]

** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de SmitfraudFix

Shaze · Answer

Merci beaucoup Destrio!
Voilà le rapport:


SmitFraudFix v2.349

Rapport fait à 22:43:38.31, 12.09.2008
Executé à partir de C:\Documents and Settings\malik\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\All Users\Application Data\dozydgpe\fgvefidy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\UltraDVD\DVDMon.exe
C:\WINDOWS\system32
mjwvkzc.exe
C:\Program Files\Wireless\Gigaset USB Stick 54\GUI.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\WINDOWS\System32\NOTEPAD.EXE
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1	www.legal-at-spybot.info
127.0.0.1	legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\malik


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\malik\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\malik\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!



»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte Fast Ethernet PCI de base SiS 900 - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

Destrio5 · Answer

- Redémarre ton ordinateur en mode sans échec :
https://blog.sosordi.net/

- Double-clique sur SmitfraudFix.exe, choisis l'option 2 et Entrée

- Réponds O(oui) à ces deux questions si elles te sont posées

Voulez-vous nettoyer le registre ?
Corriger le fichier infecté ?

- Un rapport sera généré, sauvegarde-le sur le bureau

- Redémarre en mode normal

- Poste le rapport SmitfraudFix

Shaze · Answer

Voilà le rapport. J'espère que c'est correct:



SmitFraudFix v2.345

Rapport fait à  0:06:41.73, 13.09.2008
Executé à partir de C:\Program Files\SmitfraudFix\SmitfraudFix\SmitfraudFix\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.100888290cs.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	www.10sek.com
127.0.0.1	10sek.com
127.0.0.1	www.123topsearch.com
127.0.0.1	123topsearch.com
127.0.0.1	www.132.com
127.0.0.1	132.com
127.0.0.1	www.136136.net
127.0.0.1	136136.net
127.0.0.1	www.163ns.com
127.0.0.1	163ns.com
127.0.0.1	171203.com
127.0.0.1	17-plus.com
127.0.0.1	www.1800searchonline.com
127.0.0.1	1800searchonline.com
127.0.0.1	www.180searchassistant.com
127.0.0.1	180searchassistant.com
127.0.0.1	www.180solutions.com
127.0.0.1	180solutions.com
127.0.0.1	www.181.365soft.info
127.0.0.1	181.365soft.info
127.0.0.1	www.1987324.com
127.0.0.1	1987324.com
127.0.0.1	www.1-domains-registrations.com
127.0.0.1	1-domains-registrations.com
127.0.0.1	www.1sexparty.com
127.0.0.1	1sexparty.com
127.0.0.1	www.1stantivirus.com
127.0.0.1	1stantivirus.com
127.0.0.1	www.1stpagehere.com
127.0.0.1	1stpagehere.com
127.0.0.1	www.1stsearchportal.com
127.0.0.1	1stsearchportal.com
127.0.0.1	2.82211.net
127.0.0.1	www.2006ooo.com
127.0.0.1	2006ooo.com
127.0.0.1	www.2007-download.com
127.0.0.1	2007-download.com
127.0.0.1	www.2020search.com
127.0.0.1	2020search.com
127.0.0.1	20x2p.com
127.0.0.1	www.24.365soft.info
127.0.0.1	24.365soft.info
127.0.0.1	www.24-7pharmacy.info
127.0.0.1	24-7pharmacy.info
127.0.0.1	www.24-7searching-and-more.com
127.0.0.1	24-7searching-and-more.com
127.0.0.1	www.24teen.com
127.0.0.1	24teen.com
127.0.0.1	2ndpower.com
127.0.0.1	www.2search.com
127.0.0.1	2search.com
127.0.0.1	www.2search.org
127.0.0.1	2search.org
127.0.0.1	www.2squared.com
127.0.0.1	2squared.com
127.0.0.1	www.3322.org
127.0.0.1	3322.org
127.0.0.1	365soft.info
127.0.0.1	www.36site.com
127.0.0.1	36site.com
127.0.0.1	3721.com
127.0.0.1	39-93.com
127.0.0.1	www.3bay.it
127.0.0.1	3bay.it
127.0.0.1	www.3xclipsonline.com
127.0.0.1	3xclipsonline.com
127.0.0.1	www.3xcurves.com
127.0.0.1	3xcurves.com
127.0.0.1	www.3xfestival.com
127.0.0.1	3xfestival.com
127.0.0.1	www.3x-festival.com
127.0.0.1	3x-festival.com
127.0.0.1	www.3x-galls.com
127.0.0.1	3x-galls.com
127.0.0.1	www.3xmiracle.com
127.0.0.1	3xmiracle.com
127.0.0.1	www.3xmoviesblog.com
127.0.0.1	3xmoviesblog.com
127.0.0.1	www.404dns.com
127.0.0.1	404dns.com
127.0.0.1	www.4199.com
127.0.0.1	4199.com
127.0.0.1	www.4corn.net
127.0.0.1	4corn.net
127.0.0.1	www.4ebay.it
127.0.0.1	4ebay.it
127.0.0.1	4klm.com
127.0.0.1	www.4mpg.com
127.0.0.1	4mpg.com
127.0.0.1	www.5zgmu7o20kt5d8yq.com
127.0.0.1	5zgmu7o20kt5d8yq.com
127.0.0.1	www.680180.net
127.0.0.1	680180.net
127.0.0.1	www.6sek.com
127.0.0.1	6sek.com
127.0.0.1	www.70-music.com
127.0.0.1	70-music.com
127.0.0.1	www.7322.com
127.0.0.1	7322.com
127.0.0.1	75tz.com
127.0.0.1	www.777search.com
127.0.0.1	777search.com
127.0.0.1	www.777top.com
127.0.0.1	777top.com
127.0.0.1	www.7939.com
127.0.0.1	7939.com
127.0.0.1	www.7search.com
127.0.0.1	7search.com
127.0.0.1	80gw6ry3i3x3qbrkwhxhw.032439.com
127.0.0.1	www.80-music.com
127.0.0.1	80-music.com
127.0.0.1	82211.net
127.0.0.1	8866.org
127.0.0.1	www.88vcd.com
127.0.0.1	88vcd.com
127.0.0.1	www.8ad.com
127.0.0.1	8ad.com
127.0.0.1	www.90-music.com
127.0.0.1	90-music.com
127.0.0.1	www.9505.com
127.0.0.1	9505.com
127.0.0.1	www.971searchbox.com
127.0.0.1	971searchbox.com
127.0.0.1	9mmporn.com
127.0.0.1	a.bestmanage.org
127.0.0.1	www.aaabesthomepage.com
127.0.0.1	aaabesthomepage.com
127.0.0.1	aaasexypics.com
127.0.0.1	www.aaawebfinder.com
127.0.0.1	aaawebfinder.com
127.0.0.1	www.aaqadarsztriv.com
127.0.0.1	aaqadarsztriv.com
127.0.0.1	www.aaqada-rsztriv.com
127.0.0.1	aaqada-rsztriv.com
127.0.0.1	www.aaqadaueorn.com
127.0.0.1	aaqadaueorn.com
127.0.0.1	www.aaqada-ueorn.com
127.0.0.1	aaqada-ueorn.com
127.0.0.1	www.aaqada-ygco.com
127.0.0.1	aaqada-ygco.com
127.0.0.1	www.aaqada-ymct.com
127.0.0.1	aaqada-ymct.com
127.0.0.1	aavc.com
127.0.0.1	www.abccodec.com
127.0.0.1	abccodec.com
127.0.0.1	www.abcdperformance.com
127.0.0.1	abcdperformance.com
127.0.0.1	www.abc-find.info
127.0.0.1	abc-find.info
127.0.0.1	www.abcsearch.com
127.0.0.1	abcsearch.com
127.0.0.1	www.abetterinternet.com
127.0.0.1	abetterinternet.com
127.0.0.1	www.abnetsoft.info
127.0.0.1	abnetsoft.info
127.0.0.1	www.aboutclicker.com
127.0.0.1	aboutclicker.com
127.0.0.1	www.abrp.net
127.0.0.1	abrp.net
127.0.0.1	www.absolutee.com
127.0.0.1	absolutee.com
127.0.0.1	www.abyssmedia.com
127.0.0.1	abyssmedia.com
127.0.0.1	www.ac66.cn
127.0.0.1	ac66.cn
127.0.0.1	access.navinetwork.com
127.0.0.1	access.rapid-pass.net
127.0.0.1	www.accessactivexvideo.com
127.0.0.1	accessactivexvideo.com
127.0.0.1	www.accessclips.com
127.0.0.1	accessclips.com
127.0.0.1	www.access-dvd.com
127.0.0.1	access-dvd.com
127.0.0.1	www.accesskeygenerator.com
127.0.0.1	accesskeygenerator.com
127.0.0.1	www.accessthefuture.net
127.0.0.1	accessthefuture.net
127.0.0.1	www.accessvid.net
127.0.0.1	accessvid.net
127.0.0.1	www.acemedic.com
127.0.0.1	acemedic.com
127.0.0.1	www.ace-webmaster.com
127.0.0.1	ace-webmaster.com
127.0.0.1	acjp.com
127.0.0.1	www.acrobat-2007.com
127.0.0.1	acrobat-2007.com
127.0.0.1	www.acrobat-8.com
127.0.0.1	acrobat-8.com
127.0.0.1	www.acrobat-center.com
127.0.0.1	acrobat-center.com
127.0.0.1	www.acrobat-hq.com
127.0.0.1	acrobat-hq.com
127.0.0.1	www.acrobatreader-8.com
127.0.0.1	acrobatreader-8.com
127.0.0.1	www.acrobat-reader-8.de
127.0.0.1	acrobat-reader-8.de
127.0.0.1	www.acrobat-stop.com
127.0.0.1	acrobat-stop.com
127.0.0.1	www.actionbreastcancer.org
127.0.0.1	actionbreastcancer.org
127.0.0.1	www.activesearcher.info
127.0.0.1	activesearcher.info
127.0.0.1	www.activexaccessobject.com
127.0.0.1	activexaccessobject.com
127.0.0.1	www.activexaccessvideo.com
127.0.0.1	activexaccessvideo.com
127.0.0.1	www.activexemedia.com
127.0.0.1	activexemedia.com
127.0.0.1	www.activexmediaobject.com
127.0.0.1	activexmediaobject.com
127.0.0.1	www.activexmediapro.com
127.0.0.1	activexmediapro.com
127.0.0.1	www.activexmediasite.com
127.0.0.1	activexmediasite.com
127.0.0.1	www.activexmediasoftware.com
127.0.0.1	activexmediasoftware.com
127.0.0.1	www.activexmediasource.com
127.0.0.1	activexmediasource.com
127.0.0.1	www.activexmediatool.com
127.0.0.1	activexmediatool.com
127.0.0.1	www.activexmediatour.com
127.0.0.1	activexmediatour.com
127.0.0.1	www.activexsoftwares.com
127.0.0.1	activexsoftwares.com
127.0.0.1	www.activexsource.com
127.0.0.1	activexsource.com
127.0.0.1	www.activexupdate.com
127.0.0.1	activexupdate.com
127.0.0.1	www.activexvideo.com
127.0.0.1	activexvideo.com
127.0.0.1	www.activexvideotool.com
127.0.0.1	activexvideotool.com
127.0.0.1	www.ad.marketingsector.com
127.0.0.1	ad.marketingsector.com
127.0.0.1	www.ad.mokead.com
127.0.0.1	ad.mokead.com
127.0.0.1	ad.oinadserver.com
127.0.0.1	ad.outerinfoads.com
127.0.0.1	www.ad25.com
127.0.0.1	ad25.com
127.0.0.1	www.ad45.com
127.0.0.1	ad45.com
127.0.0.1	www.ad77.com
127.0.0.1	ad77.com
127.0.0.1	www.ad86.com
127.0.0.1	ad86.com
127.0.0.1	www.adamsupportgroup.org
127.0.0.1	adamsupportgroup.org
127.0.0.1	www.adarmor.com
127.0.0.1	adarmor.com
127.0.0.1	www.adasearch.com
127.0.0.1	adasearch.com
127.0.0.1	adaware.cc
127.0.0.1	www.adawarenow.com
127.0.0.1	adawarenow.com
127.0.0.1	adchannel.contextplus.net
127.0.0.1	www.addetect.com
127.0.0.1	addetect.com
127.0.0.1	www.add-hhh.info
127.0.0.1	add-hhh.info
127.0.0.1	www.addictivetechnologies.com
127.0.0.1	addictivetechnologies.com
127.0.0.1	www.addictivetechnologies.net
127.0.0.1	addictivetechnologies.net
127.0.0.1	www.addioerrori.com
127.0.0.1	addioerrori.com
127.0.0.1	www.add-manager.com
127.0.0.1	add-manager.com
127.0.0.1	www.adgate.info
127.0.0.1	adgate.info
127.0.0.1	www.adintelligence.net
127.0.0.1	adintelligence.net
127.0.0.1	www.adioserrores.com
127.0.0.1	adioserrores.com
127.0.0.1	www.adipics.com
127.0.0.1	adipics.com
127.0.0.1	www.adlogix.com
127.0.0.1	adlogix.com
127.0.0.1	www.admin2cash.biz
127.0.0.1	admin2cash.biz
127.0.0.1	adnet-plus.com
127.0.0.1	www.adnetserver.com
127.0.0.1	adnetserver.com
127.0.0.1	adobe-download-now.com
127.0.0.1	www.adobe-downloads.com
127.0.0.1	adobe-downloads.com
127.0.0.1	www.adobe-reader-8.fr
127.0.0.1	adobe-reader-8.fr
127.0.0.1	www.adprotect.com
127.0.0.1	adprotect.com
127.0.0.1	ads.centralmedia.ws
127.0.0.1	ads.k8l.info
127.0.0.1	ads.kmpads.com
127.0.0.1	ads.kw.revenue.net
127.0.0.1	ads.marketingsector.com
127.0.0.1	ads.searchingbooth.com
127.0.0.1	ads.z-quest.com
127.0.0.1	ads1.revenue.net
127.0.0.1	www.ads183.com
127.0.0.1	ads183.com
127.0.0.1	www.adscontex.com
127.0.0.1	adscontex.com
127.0.0.1	www.adservices1.enhance.com
127.0.0.1	adservices1.enhance.com
127.0.0.1	adservs.com
127.0.0.1	www.adsextend.net
127.0.0.1	adsextend.net
127.0.0.1	www.adshttp.com
127.0.0.1	adshttp.com
127.0.0.1	www.adsniffer.com
127.0.0.1	adsniffer.com
127.0.0.1	www.adsonwww.com
127.0.0.1	adsonwww.com
127.0.0.1	www.adspics.com
127.0.0.1	adspics.com
127.0.0.1	www.adsrevenue.net
127.0.0.1	adsrevenue.net
127.0.0.1	www.adtrak.net
127.0.0.1	adtrak.net
127.0.0.1	adtrgt.com
127.0.0.1	www.adult18codec.com
127.0.0.1	adult18codec.com
127.0.0.1	www.adult777search.info
127.0.0.1	adult777search.info
127.0.0.1	www.adultan.com
127.0.0.1	adultan.com
127.0.0.1	www.adultcodec-2008.com
127.0.0.1	adultcodec-2008.com
127.0.0.1	www.adultcodecstars.com
127.0.0.1	adultcodecstars.com
127.0.0.1	www.adult-engine-search.com
127.0.0.1	adult-engine-search.com
127.0.0.1	www.adult-erotic-guide.net
127.0.0.1	adult-erotic-guide.net
127.0.0.1	www.adultfilmsite.com
127.0.0.1	adultfilmsite.com
127.0.0.1	www.adult-friends-finder.net
127.0.0.1	adult-friends-finder.net
127.0.0.1	adultgambling.org
127.0.0.1	adult-host.org
127.0.0.1	www.adulthyperlinks.com
127.0.0.1	adulthyperlinks.com
127.0.0.1	www.adultmovieplus.com
127.0.0.1	adultmovieplus.com
127.0.0.1	www.adult-mpg.net
127.0.0.1	adult-mpg.net
127.0.0.1	adult-personal.us
127.0.0.1	adultsgames.net
127.0.0.1	www.adultsonlyvids.com
127.0.0.1	adultsonlyvids.com
127.0.0.1	www.adultsper.com
127.0.0.1	adultsper.com
127.0.0.1	www.adulttds.com
127.0.0.1	adulttds.com
127.0.0.1	www.adultzoneworld.com
127.0.0.1	adultzoneworld.com
127.0.0.1	www.advancedcleaner.com
127.0.0.1	advancedcleaner.com
127.0.0.1	www.advcash.biz
127.0.0.1	advcash.biz
127.0.0.1	advert.exaccess.ru
127.0.0.1	www.advertisemoney.info
127.0.0.1	advertisemoney.info
127.0.0.1	advertising.paltalk.com
127.0.0.1	www.advertising-money.info
127.0.0.1	advertising-money.info
127.0.0.1	ad-ware.cc
127.0.0.1	www.ad-w-a-r-e.com
127.0.0.1	ad-w-a-r-e.com
127.0.0.1	www.a-d-w-a-r-e.com
127.0.0.1	a-d-w-a-r-e.com
127.0.0.1	www.adware.pro
127.0.0.1	adware.pro
127.0.0.1	www.adwarealert.com
127.0.0.1	adwarealert.com
127.0.0.1	www.ad-warealert.com
127.0.0.1	ad-warealert.com
127.0.0.1	www.adwarearrest.com
127.0.0.1	adwarearrest.com
127.0.0.1	www.adwarebazooka.com
127.0.0.1	adwarebazooka.com
127.0.0.1	www.adwarecommander.com
127.0.0.1	adwarecommander.com
127.0.0.1	www.adwarefinder.com
127.0.0.1	adwarefinder.com
127.0.0.1	www.adwaregold.com
127.0.0.1	adwaregold.com
127.0.0.1	www.adwarepatrol.com
127.0.0.1	adwarepatrol.com
127.0.0.1	www.adwareplatinum.com
127.0.0.1	adwareplatinum.com
127.0.0.1	www.adwareprotectionsite.com
127.0.0.1	adwareprotectionsite.com
127.0.0.1	www.adwarepunisher.com
127.0.0.1	adwarepunisher.com
127.0.0.1	www.adwareremover.ws
127.0.0.1	adwareremover.ws
127.0.0.1	www.adwaresafety.com
127.0.0.1	adwaresafety.com
127.0.0.1	www.adwarexp.com
127.0.0.1	adwarexp.com
127.0.0.1	affiliate.idownload.com
127.0.0.1	www.aflgate.com
127.0.0.1	aflgate.com
127.0.0.1	africaspromise.org
127.0.0.1	agava.com
127.0.0.1	agava.ru
127.0.0.1	agentstudio.com
127.0.0.1	www.aginegialle.it
127.0.0.1	aginegialle.it
127.0.0.1	www.ahnenforschung.de
127.0.0.1	ahnenforschung.de
127.0.0.1	www.aifind.info
127.0.0.1	aifind.info
127.0.0.1	www.airtleworld.com
127.0.0.1	airtleworld.com
127.0.0.1	www.aitalia.it
127.0.0.1	aitalia.it
127.0.0.1	akamai.downloadv3.com
127.0.0.1	www.aklitalia.it
127.0.0.1	aklitalia.it
127.0.0.1	akril.com
127.0.0.1	alcatel.ws
127.0.0.1	www.alertspy.com
127.0.0.1	alertspy.com
127.0.0.1	www.alfacleaner.com
127.0.0.1	alfacleaner.com
127.0.0.1	alfa-search.com
127.0.0.1	www.alialia.it
127.0.0.1	alialia.it
127.0.0.1	www.aliotalia.it
127.0.0.1	aliotalia.it
127.0.0.1	www.alirtalia.it
127.0.0.1	alirtalia.it
127.0.0.1	www.alitaia.it
127.0.0.1	alitaia.it
127.0.0.1	www.alitaklia.it
127.0.0.1	alitaklia.it
127.0.0.1	www.alitala.it
127.0.0.1	alitala.it
127.0.0.1	www.alitali.it
127.0.0.1	alitali.it
127.0.0.1	www.alitaliaq.it
127.0.0.1	alitaliaq.it
127.0.0.1	www.alitalias.it
127.0.0.1	alitalias.it
127.0.0.1	www.alitaliaz.it
127.0.0.1	alitaliaz.it
127.0.0.1	www.alitalioa.it
127.0.0.1	alitalioa.it
127.0.0.1	www.alitalisa.it
127.0.0.1	alitalisa.it
127.0.0.1	www.alitaliua.it
127.0.0.1	alitaliua.it
127.0.0.1	www.alitalkia.it
127.0.0.1	alitalkia.it
127.0.0.1	www.alitaloia.it
127.0.0.1	alitaloia.it
127.0.0.1	www.alitaluia.it
127.0.0.1	alitaluia.it
127.0.0.1	www.alitaslia.it
127.0.0.1	alitaslia.it
127.0.0.1	www.alitlia.it
127.0.0.1	alitlia.it
127.0.0.1	www.alitralia.it
127.0.0.1	alitralia.it
127.0.0.1	www.alitsalia.it
127.0.0.1	alitsalia.it
127.0.0.1	www.aliutalia.it
127.0.0.1	aliutalia.it
127.0.0.1	www.all1count.net
127.0.0.1	all1count.net
127.0.0.1	www.all4internet.com
127.0.0.1	all4internet.com
127.0.0.1	allabtcars.com
127.0.0.1	allabtjeeps.com
127.0.0.1	www.all-bittorrent.com
127.0.0.1	all-bittorrent.com
127.0.0.1	www.allcollisions.com
127.0.0.1	allcollisions.com
127.0.0.1	www.allcybersearch.com
127.0.0.1	allcybersearch.com
127.0.0.1	www.alldnserrors.com
127.0.0.1	alldnserrors.com
127.0.0.1	www.all-downloads-now.com
127.0.0.1	all-downloads-now.com
127.0.0.1	www.all-edonkey.com
127.0.0.1	all-edonkey.com
127.0.0.1	www.allertaminacce.com
127.0.0.1	allertaminacce.com
127.0.0.1	allforadult.com
127.0.0.1	allhyperlinks.com
127.0.0.1	www.alliesecurity.com
127.0.0.1	alliesecurity.com
127.0.0.1	all-inet.com
127.0.0.1	allinternetbusiness.com
127.0.0.1	www.all-limewire.com
127.0.0.1	all-limewire.com
127.0.0.1	www.allmegabucks.com
127.0.0.1	allmegabucks.com
127.0.0.1	www.allprotections.com
127.0.0.1	allprotections.com
127.0.0.1	www.allresultz.net
127.0.0.1	allresultz.net
127.0.0.1	www.allsearch.us
127.0.0.1	allsearch.us
127.0.0.1	www.allsecuritynotes.com
127.0.0.1	allsecuritynotes.com
127.0.0.1	www.allsecuritysite.com
127.0.0.1	allsecuritysite.com
127.0.0.1	www.allstarsvideos.net
127.0.0.1	allstarsvideos.net
127.0.0.1	www.alltiettantivirus.com
127.0.0.1	alltiettantivirus.com
127.0.0.1	www.alltruesoftware.com
127.0.0.1	alltruesoftware.com
127.0.0.1	www.allvideoactivex.com
127.0.0.1	allvideoactivex.com
127.0.0.1	www.almanah.biz
127.0.0.1	almanah.biz
127.0.0.1	almarvideos.com
127.0.0.1	www.aloitalia.it
127.0.0.1	aloitalia.it
127.0.0.1	www.aluitalia.it
127.0.0.1	aluitalia.it
127.0.0.1	www.amaena.com
127.0.0.1	amaena.com
127.0.0.1	amandamountains.com
127.0.0.1	www.amateurliveshow.com
127.0.0.1	amateurliveshow.com
127.0.0.1	www.amediasoftware.com
127.0.0.1	amediasoftware.com
127.0.0.1	www.amediasource.com
127.0.0.1	amediasource.com
127.0.0.1	www.americanautobargains.com
127.0.0.1	americanautobargains.com
127.0.0.1	www.americancarbargains.com
127.0.0.1	americancarbargains.com
127.0.0.1	american-teens.net
127.0.0.1	amigeek.com
127.0.0.1	www.amigobore.com
127.0.0.1	amigobore.com
127.0.0.1	amisbusiness.com
127.0.0.1	www.ampmsearch.com
127.0.0.1	ampmsearch.com
127.0.0.1	www.analcord.com
127.0.0.1	analcord.com
127.0.0.1	analmovi.com
127.0.0.1	www.anarchylolita.com
127.0.0.1	anarchylolita.com
127.0.0.1	anarchyporn.com
127.0.0.1	www.andromedical.com
127.0.0.1	andromedical.com
127.0.0.1	www.animepornmag.com
127.0.0.1	animepornmag.com
127.0.0.1	anin.org
127.0.0.1	www.anjpn-avxiz.biz
127.0.0.1	anjpn-avxiz.biz
127.0.0.1	www.anjpnzqav.biz
127.0.0.1	anjpnzqav.biz
127.0.0.1	www.anjpn-zqav.biz
127.0.0.1	anjpn-zqav.biz
127.0.0.1	annaromeo.com
127.0.0.1	www.antiddos.us
127.0.0.1	antiddos.us
127.0.0.1	www.antiespiadorado.com
127.0.0.1	antiespiadorado.com
127.0.0.1	www.antiespionspack.com
127.0.0.1	antiespionspack.com
127.0.0.1	www.antigusanos2008.com
127.0.0.1	antigusanos2008.com
127.0.0.1	www.antispamassistant.com
127.0.0.1	antispamassistant.com
127.0.0.1	www.antispamdeluxe.com
127.0.0.1	antispamdeluxe.com
127.0.0.1	www.antispionage.com
127.0.0.1	antispionage.com
127.0.0.1	www.antispionagepro.com
127.0.0.1	antispionagepro.com
127.0.0.1	www.antispyadvanced.com
127.0.0.1	antispyadvanced.com
127.0.0.1	www.antispydns.biz
127.0.0.1	antispydns.biz
127.0.0.1	www.antispykit.com
127.0.0.1	antispykit.com
127.0.0.1	www.antispylab.com
127.0.0.1	antispylab.com
127.0.0.1	www.antispyshield.com
127.0.0.1	antispyshield.com
127.0.0.1	www.antispysolutions.com
127.0.0.1	antispysolutions.com
127.0.0.1	www.antispyware.com
127.0.0.1	antispyware.com
127.0.0.1	www.antispywareboot.com
127.0.0.1	antispywareboot.com
127.0.0.1	www.antispywarebot.com
127.0.0.1	antispywarebot.com
127.0.0.1	www.antispywarebox.com
127.0.0.1	antispywarebox.com
127.0.0.1	www.antispywaredownloads.com
127.0.0.1	antispywaredownloads.com
127.0.0.1	www.antispywaresuite.com
127.0.0.1	antispywaresuite.com
127.0.0.1	www.antispywareupdates.net
127.0.0.1	antispywareupdates.net
127.0.0.1	www.antispywarexp.com
127.0.0.1	antispywarexp.com
127.0.0.1	www.antispyweb.net
127.0.0.1	antispyweb.net
127.0.0.1	www.antiver2008.com
127.0.0.1	antiver2008.com
127.0.0.1	www.antivermins.com
127.0.0.1	antivermins.com
127.0.0.1	www.anti-vermins.com
127.0.0.1	anti-vermins.com
127.0.0.1	www.antivir2007.com
127.0.0.1	antivir2007.com
127.0.0.1	www.antivirgear.com
127.0.0.1	antivirgear.com
127.0.0.1	www.antivirus.fastfreedownload.com
127.0.0.1	antivirus.fastfreedownload.com
127.0.0.1	www.antivirus2008x.com
127.0.0.1	antivirus2008x.com
127.0.0.1	www.antivirusadvance.com
127.0.0.1	antivirusadvance.com
127.0.0.1	www.antivirusaskeladd.com
127.0.0.1	antivirusaskeladd.com
127.0.0.1	www.antivirusgereedschap.com
127.0.0.1	antivirusgereedschap.com
127.0.0.1	www.antivirusgolden.com
127.0.0.1	antivirusgolden.com
127.0.0.1	www.antivirus-hq.net
127.0.0.1	antivirus-hq.net
127.0.0.1	www.antiviruspcsuite.com
127.0.0.1	antiviruspcsuite.com
127.0.0.1	www.antiviruspremium.com
127.0.0.1	antiviruspremium.com
127.0.0.1	www.anti-virus-pro.com
127.0.0.1	anti-virus-pro.com
127.0.0.1	www.antivirusprotector.com
127.0.0.1	antivirusprotector.com
127.0.0.1	www.antivirus-scanner.com
127.0.0.1	antivirus-scanner.com
127.0.0.1	www.antivirusscherm.com
127.0.0.1	antivirusscherm.com
127.0.0.1	www.antivirussecuritypro.com
127.0.0.1	antivirussecuritypro.com
127.0.0.1	www.antivirus-stop.com
127.0.0.1	antivirus-stop.com
127.0.0.1	www.antivirussuite.com
127.0.0.1	antivirussuite.com
127.0.0.1	www.antiworm2008.com
127.0.0.1	antiworm2008.com
127.0.0.1	www.antiwurm2008.com
127.0.0.1	antiwurm2008.com
127.0.0.1	antrocity.com
127.0.0.1	www.anyofus.com
127.0.0.1	anyofus.com
127.0.0.1	www.anysn.seproger.com
127.0.0.1	anysn.seproger.com
127.0.0.1	anything4health.com
127.0.0.1	www.apicpreview.com
127.0.0.1	apicpreview.com
127.0.0.1	www.appealcircuit.com
127.0.0.1	appealcircuit.com
127.0.0.1	www.approvedlinks.com
127.0.0.1	approvedlinks.com
127.0.0.1	apps.deskwizz.com
127.0.0.1	apps.webservicehost.com
127.0.0.1	www.aprotectedpage.com
127.0.0.1	aprotectedpage.com
127.0.0.1	apsua.com
127.0.0.1	www.archivioadulti.com
127.0.0.1	archivioadulti.com
127.0.0.1	www.archiviosex.net
127.0.0.1	archiviosex.net
127.0.0.1	aregay.com
127.0.0.1	www.ares.click-new-download.com
127.0.0.1	ares.click-new-download.com
127.0.0.1	www.ares-freebie.com
127.0.0.1	ares-freebie.com
127.0.0.1	www.arespro2007.com
127.0.0.1	arespro2007.com
127.0.0.1	www.aresultra.com
127.0.0.1	aresultra.com
127.0.0.1	www.ares-usa.com
127.0.0.1	ares-usa.com
127.0.0.1	arheo.com
127.0.0.1	arizonaweb.org
127.0.0.1	armitageinn.com
127.0.0.1	www.arquivojpgs.smtp.ru
127.0.0.1	arquivojpgs.smtp.ru
127.0.0.1	artachnid.com
127.0.0.1	art-func.com
127.0.0.1	art-xxx.com
127.0.0.1	www.asafebrowser.com
127.0.0.1	asafebrowser.com
127.0.0.1	www.asafetyalways.com
127.0.0.1	asafetyalways.com
127.0.0.1	www.asafetynotice.com
127.0.0.1	asafetynotice.com
127.0.0.1	www.asafetypage.com
127.0.0.1	asafetypage.com
127.0.0.1	www.asdbiz.biz
127.0.0.1	asdbiz.biz
127.0.0.1	www.asdeykuddq.com
127.0.0.1	asdeykuddq.com
127.0.0.1	www.asecurebar.com
127.0.0.1	asecurebar.com
127.0.0.1	www.asecureboard.com
127.0.0.1	asecureboard.com
127.0.0.1	www.asecurevalue.com
127.0.0.1	asecurevalue.com
127.0.0.1	www.asecurityissue.com
127.0.0.1	asecurityissue.com
127.0.0.1	www.asecuritynotice.com
127.0.0.1	asecuritynotice.com
127.0.0.1	www.asecuritypaper.com
127.0.0.1	asecuritypaper.com
127.0.0.1	www.asecuritystuff.com
127.0.0.1	asecuritystuff.com
127.0.0.1	www.asfadaptation.com
127.0.0.1	asfadaptation.com
127.0.0.1	asiankingkong.com
127.0.0.1	www.asianpornmag.com
127.0.0.1	asianpornmag.com
127.0.0.1	www.asiantoolbar.com
127.0.0.1	asiantoolbar.com
127.0.0.1	www.asidseiupc.com
127.0.0.1	asidseiupc.com
127.0.0.1	www.aslitalia.it
127.0.0.1	aslitalia.it
127.0.0.1	ass-gals.com
127.0.0.1	www.assureprotection.com
127.0.0.1	assureprotection.com
127.0.0.1	asta-killer.com
127.0.0.1	www.astrologie-server.com
127.0.0.1	astrologie-server.com
127.0.0.1	www.asupereva.it
127.0.0.1	asupereva.it
127.0.0.1	www.ataprogram.com
127.0.0.1	ataprogram.com
127.0.0.1	athenrye.com
127.0.0.1	www.atotalsafety.com
127.0.0.1	atotalsafety.com
127.0.0.1	www.atrueprotection.com
127.0.0.1	atrueprotection.com
127.0.0.1	www.atruesecurity.com
127.0.0.1	atruesecurity.com
127.0.0.1	www.attackware.com
127.0.0.1	attackware.com
127.0.0.1	www.attrezzi.biz
127.0.0.1	attrezzi.biz
127.0.0.1	www.aucunsvirus.com
127.0.0.1	aucunsvirus.com
127.0.0.1	www.aulde.net
127.0.0.1	aulde.net
127.0.0.1	www.aupereva.it
127.0.0.1	aupereva.it
127.0.0.1	www.autobargains.org
127.0.0.1	autobargains.org
127.0.0.1	www.autobargainsnetwork.com
127.0.0.1	autobargainsnetwork.com
127.0.0.1	www.autocontext.begun.ru
127.0.0.1	autocontext.begun.ru
127.0.0.1	autoescrowpay.com
127.0.0.1	www.avadvance.com
127.0.0.1	avadvance.com
127.0.0.1	www.avast.free-software-center.com
127.0.0.1	avast.free-software-center.com
127.0.0.1	www.avast-2007.com
127.0.0.1	avast-2007.com
127.0.0.1	www.avast-downloads.com
127.0.0.1	avast-downloads.com
127.0.0.1	www.avast-hq.com
127.0.0.1	avast-hq.com
127.0.0.1	www.avforce.com
127.0.0.1	avforce.com
127.0.0.1	www.avg.grab-it-today.net
127.0.0.1	avg.grab-it-today.net
127.0.0.1	www.avg.softwarecenterz.com
127.0.0.1	avg.softwarecenterz.com
127.0.0.1	www.avg-secure.com
127.0.0.1	avg-secure.com
127.0.0.1	www.aviadaptation.com
127.0.0.1	aviadaptation.com
127.0.0.1	avian-ads.com
127.0.0.1	www.avicoupler.com
127.0.0.1	avicoupler.com
127.0.0.1	www.avideoaxaccess.com
127.0.0.1	avideoaxaccess.com
127.0.0.1	www.avideosurfer.com
127.0.0.1	avideosurfer.com
127.0.0.1	www.avidirection.com
127.0.0.1	avidirection.com
127.0.0.1	www.aviewersoft.com
127.0.0.1	aviewersoft.com
127.0.0.1	www.avihelper.com
127.0.0.1	avihelper.com
127.0.0.1	www.avitool.com
127.0.0.1	avitool.com
127.0.0.1	www.avpcheckupdate.com
127.0.0.1	avpcheckupdate.com
127.0.0.1	www.avsmanufacture.com
127.0.0.1	avsmanufacture.com
127.0.0.1	www.avsystemcare.com
127.0.0.1	avsystemcare.com
127.0.0.1	www.avxizaaqada.biz
127.0.0.1	avxizaaqada.biz
127.0.0.1	www.avxiz-anjpn.biz
127.0.0.1	avxiz-anjpn.biz
127.0.0.1	www.avxizueorn.biz
127.0.0.1	avxizueorn.biz
127.0.0.1	www.avxiz-ueorn.biz
127.0.0.1	avxiz-ueorn.biz
127.0.0.1	www.avxiz-vtvcp.biz
127.0.0.1	avxiz-vtvcp.biz
127.0.0.1	www.avxiz-ygco.biz
127.0.0.1	avxiz-ygco.biz
127.0.0.1	www.avxiz-zqav.biz
127.0.0.1	avxiz-zqav.biz
127.0.0.1	www.awarenesstech.com
127.0.0.1	awarenesstech.com
127.0.0.1	www.awarninglist.com
127.0.0.1	awarninglist.com
127.0.0.1	awbeta.net-nucleus.com
127.0.0.1	www.awesomehomepage.com
127.0.0.1	awesomehomepage.com
127.0.0.1	awmcash.biz
127.0.0.1	awmdabest.com
127.0.0.1	www.axemediasoftware.com
127.0.0.1	axemediasoftware.com
127.0.0.1	www.aximageobject.com
127.0.0.1	aximageobject.com
127.0.0.1	www.axmediaproject.com
127.0.0.1	axmediaproject.com
127.0.0.1	www.axmediasoftware.com
127.0.0.1	axmediasoftware.com
127.0.0.1	www.axmediasolutions.com
127.0.0.1	axmediasolutions.com
127.0.0.1	www.axobjectpage.com
127.0.0.1	axobjectpage.com
127.0.0.1	www.axobjectsource.com
127.0.0.1	axobjectsource.com
127.0.0.1	www.axsoftwaretool.com
127.0.0.1	axsoftwaretool.com
127.0.0.1	www.axvideoproject.com
127.0.0.1	axvideoproject.com
127.0.0.1	www.axvideosetup.com
127.0.0.1	axvideosetup.com
127.0.0.1	ayakawamura.com
127.0.0.1	ayb.dns-look-up.com
127.0.0.1	ayb.netbios-wait.com
127.0.0.1	ayumitaniguchi.com
127.0.0.1	azebar.com
127.0.0.1	www.azureusclub.com
127.0.0.1	azureusclub.com
127.0.0.1	www.azureus-freebie.com
127.0.0.1	azureus-freebie.com
127.0.0.1	www.azzetta.it
127.0.0.1	azzetta.it
127.0.0.1	b.casalemedia.com
127.0.0.1	b122.mcboo.com
127.0.0.1	www.babe.k-lined.com
127.0.0.1	babe.k-lined.com
127.0.0.1	www.babe.the-killer.bz
127.0.0.1	babe.the-killer.bz
127.0.0.1	www.babenet.com
127.0.0.1	babenet.com
127.0.0.1	www.babespornmag.com
127.0.0.1	babespornmag.com
127.0.0.1	www.babeweb.de
127.0.0.1	babeweb.de
127.0.0.1	www.baccarat-other.info
127.0.0.1	baccarat-other.info
127.0.0.1	www.backstripgirls.com
127.0.0.1	backstripgirls.com
127.0.0.1	backup.mabou.org
127.0.0.1	www.balotierra.com
127.0.0.1	balotierra.com
127.0.0.1	bannedhost.net
127.0.0.1	barbudafarms.com
127.0.0.1	www.bardownload.com
127.0.0.1	bardownload.com
127.0.0.1	barnandfence.com
127.0.0.1	batsearch.com
127.0.0.1	baygraphicsllc.com
127.0.0.1	bbbsearch.com
127.0.0.1	bb-search.com
127.0.0.1	www.bcnproduction.com
127.0.0.1	bcnproduction.com
127.0.0.1	bdsmlibrary.net
127.0.0.1	www.bdsmpornmag.com
127.0.0.1	bdsmpornmag.com
127.0.0.1	www.bearshare.click-new-download.com
127.0.0.1	bearshare.click-new-download.com
127.0.0.1	www.bearshare.download-me.info
127.0.0.1	bearshare.download-me.info
127.0.0.1	www.bearshare.mp3-muzic.com
127.0.0.1	bearshare.mp3-muzic.com
127.0.0.1	www.bearshare-download.org
127.0.0.1	bearshare-download.org
127.0.0.1	www.bearshare-downloads.net
127.0.0.1	bearshare-downloads.net
127.0.0.1	www.bearsharelive.co.uk
127.0.0.1	bearsharelive.co.uk
127.0.0.1	www.bearshare-music-downloads.com
127.0.0.1	bearshare-music-downloads.com
127.0.0.1	www.bearsharepro2007.com
127.0.0.1	bearsharepro2007.com
127.0.0.1	www.bearshare-usa.com
127.0.0.1	bearshare-usa.com
127.0.0.1	bedhome.com
127.0.0.1	bediadance.com
127.0.0.1	www.beebappyy.biz
127.0.0.1	beebappyy.biz
127.0.0.1	www.begin2search.com
127.0.0.1	begin2search.com
127.0.0.1	bellabasketsfl.com
127.0.0.1	bernaolatwin.com
127.0.0.1	www.berufe-jobs.de
127.0.0.1	berufe-jobs.de
127.0.0.1	www.berufe-server.de
127.0.0.1	berufe-server.de
127.0.0.1	www.berufe-welt.de
127.0.0.1	berufe-welt.de
127.0.0.1	www.berufs-wahl.de
127.0.0.1	berufs-wahl.de
127.0.0.1	www.beruijindegunhadesun.com
127.0.0.1	beruijindegunhadesun.com
127.0.0.1	www.best3xclips.com
127.0.0.1	best3xclips.com
127.0.0.1	www.bestadults.com
127.0.0.1	bestadults.com
127.0.0.1	best-counter.com
127.0.0.1	bestcrawler.com
127.0.0.1	www.bestdailyvids.com
127.0.0.1	bestdailyvids.com
127.0.0.1	bestfor.ru
127.0.0.1	www.bestfuckvids.com
127.0.0.1	bestfuckvids.com
127.0.0.1	best-hardpics.com
127.0.0.1	www.bestmanage.org
127.0.0.1	bestmanage.org
127.0.0.1	www.bestmanage0.org
127.0.0.1	bestmanage0.org
127.0.0.1	www.bestmanage1.org
127.0.0.1	bestmanage1.org
127.0.0.1	www.bestmanage2.org
127.0.0.1	bestmanage2.org
127.0.0.1	www.bestmanage3.org
127.0.0.1	bestmanage3.org
127.0.0.1	www.bestmanage4.org
127.0.0.1	bestmanage4.org
127.0.0.1	www.bestmanage5.org
127.0.0.1	bestmanage5.org
127.0.0.1	www.bestmanage6.org
127.0.0.1	bestmanage6.org
127.0.0.1	www.bestmanage7.org
127.0.0.1	bestmanage7.org
127.0.0.1	www.bestmanage8.org
127.0.0.1	bestmanage8.org
127.0.0.1	www.bestmanage9.org
127.0.0.1	bestmanage9.org
127.0.0.1	www.bestmovszone.com
127.0.0.1	bestmovszone.com
127.0.0.1	www.bestoffersnetworks.com
127.0.0.1	bestoffersnetworks.com
127.0.0.1	bestporngate.com
127.0.0.1	www.bestsafetyguide.net
127.0.0.1	bestsafetyguide.net
127.0.0.1	www.bestsearch.cc
127.0.0.1	bestsearch.cc
127.0.0.1	www.bestsearchworld.info
127.0.0.1	bestsearchworld.info
127.0.0.1	www.best-spyware.info
127.0.0.1	best-spyware.info
127.0.0.1	www.best-targeted-traffic.com
127.0.0.1	best-targeted-traffic.com
127.0.0.1	www.best-voyeur.info
127.0.0.1	best-voyeur.info
127.0.0.1	bestweblinks.com
127.0.0.1	best-winning-casino.com
127.0.0.1	www.bestworldgirls-for-u.net
127.0.0.1	bestworldgirls-for-u.net
127.0.0.1	www.bestxclips.com
127.0.0.1	bestxclips.com
127.0.0.1	bestxporno.com
127.0.0.1	www.bestxxxmpegs.com
127.0.0.1	bestxxxmpegs.com
127.0.0.1	www.bettersearch.biz
127.0.0.1	bettersearch.biz
127.0.0.1	www.bgazzetta.it
127.0.0.1	bgazzetta.it
127.0.0.1	www.bgoogle.it
127.0.0.1	bgoogle.it
127.0.0.1	www.bigcodecadult.com
127.0.0.1	bigcodecadult.com
127.0.0.1	www.bigcodecadult2008.com
127.0.0.1	bigcodecadult2008.com
127.0.0.1	www.bigcodecadult2008-17.com
127.0.0.1	bigcodecadult2008-17.com
127.0.0.1	www.bighot18adult2008.com
127.0.0.1	bighot18adult2008.com
127.0.0.1	www.bighot18-adult2008.com
127.0.0.1	bighot18-adult2008.com
127.0.0.1	www.bighot18codec2008.com
127.0.0.1	bighot18codec2008.com
127.0.0.1	www.bighot18-codec2008.com
127.0.0.1	bighot18-codec2008.com
127.0.0.1	www.bigtrafficnetwork.com
127.0.0.1	bigtrafficnetwork.com
127.0.0.1	www.bigwww.com
127.0.0.1	bigwww.com
127.0.0.1	www.bill.de
127.0.0.1	bill.de
127.0.0.1	bin.errorprotector.com
127.0.0.1	bins.media-motor.net
127.0.0.1	bins2.media-motor.net
127.0.0.1	bis.180solutions.com
127.0.0.1	bitchesonline.net
127.0.0.1	www.bitcomet-freebie.com
127.0.0.1	bitcomet-freebie.com
127.0.0.1	www.bittorrent.click-new-download.com
127.0.0.1	bittorrent.click-new-download.com
127.0.0.1	biz.biz
127.0.0.1	www.bkvcompany.com
127.0.0.1	bkvcompany.com
127.0.0.1	www.blackblues00.com
127.0.0.1	blackblues00.com
127.0.0.1	www.blackcodec.com
127.0.0.1	blackcodec.com
127.0.0.1	www.blackcodec.net
127.0.0.1	blackcodec.net
127.0.0.1	www.blackhats.tc
127.0.0.1	blackhats.tc
127.0.0.1	www.blackhawksoftware.com
127.0.0.1	blackhawksoftware.com
127.0.0.1	blackjack-free.net
127.0.0.1	www.blacklegion.info
127.0.0.1	blacklegion.info
127.0.0.1	blazefind.com
127.0.0.1	blender.xu.pl
127.0.0.1	www.blockcheckercontrol.com
127.0.0.1	blockcheckercontrol.com
127.0.0.1	blondetgp.com
127.0.0.1	www.blue-elefant.com
127.0.0.1	blue-elefant.com
127.0.0.1	www.bm.theaimonline.com
127.0.0.1	bm.theaimonline.com
127.0.0.1	www.bnmgate.com
127.0.0.1	bnmgate.com
127.0.0.1	bodaciousbabette.com
127.0.0.1	www.bonzi.com
127.0.0.1	bonzi.com
127.0.0.1	boobdoll.com
127.0.0.1	boobsandtits.com
127.0.0.1	boobsclub.com
127.0.0.1	www.bookedspace.com
127.0.0.1	bookedspace.com
127.0.0.1	www.boom.com.vn
127.0.0.1	boom.com.vn
127.0.0.1	www.boomgirltv.com
127.0.0.1	boomgirltv.com
127.0.0.1	boredlife.com
127.0.0.1	bowlofogumbo.com
127.0.0.1	www.bpfq02.com
127.0.0.1	bpfq02.com
127.0.0.1	www.bqgate.com
127.0.0.1	bqgate.com
127.0.0.1	br.errorsafe.com
127.0.0.1	br.winantivirus.com
127.0.0.1	br.winfixer.com
127.0.0.1	bradcoem.org
127.0.0.1	www.braincodec.com
127.0.0.1	braincodec.com
127.0.0.1	brandiyoung.com
127.0.0.1	www.bravesentry.com
127.0.0.1	bravesentry.com
127.0.0.1	www.breenten.biz
127.0.0.1	breenten.biz
127.0.0.1	www.brodbfm.net
127.0.0.1	brodbfm.net
127.0.0.1	brookeburn.com
127.0.0.1	www.browserwise.com
127.0.0.1	browserwise.com
127.0.0.1	bsa.safetydownload.com
127.0.0.1	www.bsplaycodec.com
127.0.0.1	bsplaycodec.com
127.0.0.1	bucps.com
127.0.0.1	buhartes.info
127.0.0.1	buldog-stats.com
127.0.0.1	www.bullseye-network.com
127.0.0.1	bullseye-network.com
127.0.0.1	burgerkingbigscreen.com
127.0.0.1	www.burningsite.com
127.0.0.1	burningsite.com
127.0.0.1	www.burnsrecyclinginc.com
127.0.0.1	burnsrecyclinginc.com
127.0.0.1	buscards.net
127.0.0.1	bustyrussell.com
127.0.0.1	www.busysearch.net
127.0.0.1	busysearch.net
127.0.0.1	buttejazz.org
127.0.0.1	www.buy-find.info
127.0.0.1	buy-find.info
127.0.0.1	buyselldomain.net
127.0.0.1	www.buytraff.biz
127.0.0.1	buytraff.biz
127.0.0.1	buz.ru
127.0.0.1	www.bvdtechinque.com
127.0.0.1	bvdtechinque.com
127.0.0.1	www.bvirgilio.it
127.0.0.1	bvirgilio.it
127.0.0.1	c.centralmedia.ws
127.0.0.1	www.c.enhance.com
127.0.0.1	c.enhance.com
127.0.0.1	c.goclick.com
127.0.0.1	www.c4tdownload.com
127.0.0.1	c4tdownload.com
127.0.0.1	www.c5.www4free.info
127.0.0.1	c5.www4free.info
127.0.0.1	www.cache.surfaccuracy.com
127.0.0.1	cache.surfaccuracy.com
127.0.0.1	cache.ysbweb.com
127.0.0.1	www.cadesfinjeriokas.com
127.0.0.1	cadesfinjeriokas.com
127.0.0.1	calcioturris.com
127.0.0.1	www.calendaralerts.net
127.0.0.1	calendaralerts.net
127.0.0.1	www.callinghome.biz
127.0.0.1	callinghome.biz
127.0.0.1	www.cameouk.co.uk
127.0.0.1	cameouk.co.uk
127.0.0.1	cameup.com
127.0.0.1	www.camouflageclothingonline.net
127.0.0.1	camouflageclothingonline.net
127.0.0.1	campaigns.outerinfo.net
127.0.0.1	camup.net
127.0.0.1	canberracricketcoaching.com
127.0.0.1	candycantaloupes.com
127.0.0.1	www.canidetect.org
127.0.0.1	canidetect.org
127.0.0.1	www.cantfind.com
127.0.0.1	cantfind.com
127.0.0.1	careers.dulcineasystems.net
127.0.0.1	carsands.com
127.0.0.1	carsrentals.net
127.0.0.1	cartoes.uol.com.br
127.0.0.1	www.casalemedia.com
127.0.0.1	casalemedia.com
127.0.0.1	www.cashdeluxe.net
127.0.0.1	cashdeluxe.net
127.0.0.1	www.cashengines.com
127.0.0.1	cashengines.com
127.0.0.1	cashsearch.biz
127.0.0.1	www.cashsurfers.com
127.0.0.1	cashsurfers.com
127.0.0.1	www.cashunlim.com
127.0.0.1	cashunlim.com
127.0.0.1	casino.com.free.game.pogo.gratisdownloads.nl
127.0.0.1	casino2win.net
127.0.0.1	casino-gambling-1.net
127.0.0.1	casino-gambling-2.net
127.0.0.1	casinomidas.net
127.0.0.1	casinonline.net
127.0.0.1	casino-onlines.net
127.0.0.1	www.castingsamateur.com
127.0.0.1	castingsamateur.com
127.0.0.1	catallogue.com
127.0.0.1	www.catch-dc.info
127.0.0.1	catch-dc.info
127.0.0.1	categories.mygeek.com
127.0.0.1	catsss.da.ru
127.0.0.1	caxa.ru
127.0.0.1	cazygirls-world.com
127.0.0.1	cc.panet.org
127.0.0.1	www.ccecaedbebfcaf.com
127.0.0.1	ccecaedbebfcaf.com
127.0.0.1	cclebali.org
127.0.0.1	www.ccorriere.it
127.0.0.1	ccorriere.it
127.0.0.1	www.cdcopysite.com
127.0.0.1	cdcopysite.com
127.0.0.1	www.cdegate.com
127.0.0.1	cdegate.com
127.0.0.1	cdn.drivecleaner.com
127.0.0.1	cdn.errorsafe.com
127.0.0.1	cdn.movies-etc.com
127.0.0.1	cdn.winsoftware.com
127.0.0.1	cdn2.movies-etc.com
127.0.0.1	www.cdorriere.it
127.0.0.1	cdorriere.it
127.0.0.1	ceewawires.org
127.0.0.1	centralmedia.ws
127.0.0.1	certumgroup.com
127.0.0.1	www.cforriere.it
127.0.0.1	cforriere.it
127.0.0.1	www.check.jupitersatellites.biz
127.0.0.1	check.jupitersatellites.biz
127.0.0.1	www.checkin100.com
127.0.0.1	checkin100.com
127.0.0.1	www.checkssecurity.com
127.0.0.1	checkssecurity.com
127.0.0.1	chelancatering.com
127.0.0.1	www.chenshijituan.com
127.0.0.1	chenshijituan.com
127.0.0.1	childrenvilla.com
127.0.0.1	www.chilly3xvids.com
127.0.0.1	chilly3xvids.com
127.0.0.1	www.chillymovs.com
127.0.0.1	chillymovs.com
127.0.0.1	chips-4-free.com
127.0.0.1	chrisswasey.com
127.0.0.1	chriswallace.net
127.0.0.1	www.cia-trjn.myvnc.com
127.0.0.1	cia-trjn.myvnc.com
127.0.0.1	www.cinemadownload.com
127.0.0.1	cinemadownload.com
127.0.0.1	www.ciorriere.it
127.0.0.1	ciorriere.it
127.0.0.1	www.cirriere.it
127.0.0.1	cirriere.it
127.0.0.1	www.citycodec.com
127.0.0.1	citycodec.com
127.0.0.1	ckick4thumbs.com
127.0.0.1	cl55.biz
127.0.0.1	clackamasliteraryreview.com
127.0.0.1	www.clckm.com
127.0.0.1	clckm.com
127.0.0.1	www.cleancodec.com
127.0.0.1	cleancodec.com
127.0.0.1	www.cleansoftwares.com
127.0.0.1	cleansoftwares.com
127.0.0.1	clearsearch.cc
127.0.0.1	clearsearch.net
127.0.0.1	clickaire.com
127.0.0.1	www.click-codec.com
127.0.0.1	click-codec.com
127.0.0.1	www.clickhere4search.com
127.0.0.1	clickhere4search.com
127.0.0.1	www.click-new-download.com
127.0.0.1	click-new-download.com
127.0.0.1	click-now.net
127.0.0.1	www.clickspring.net
127.0.0.1	clickspring.net
127.0.0.1	www.click-to-download.com
127.0.0.1	click-to-download.com
127.0.0.1	www.clicktomakeasearch.com
127.0.0.1	clicktomakeasearch.com
127.0.0.1	clickyestoenter.net
127.0.0.1	client.exeupdate.com
127.0.0.1	client.myadultexplorer.com
127.0.0.1	www.cliks.org
127.0.0.1	cliks.org
127.0.0.1	www.clipsfestival.com
127.0.0.1	clipsfestival.com
127.0.0.1	www.clipsreality.com
127.0.0.1	clipsreality.com
127.0.0.1	www.clorriere.it
127.0.0.1	clorriere.it
127.0.0.1	clrsch.com
127.0.0.1	www.clubxxxvideo.com
127.0.0.1	clubxxxvideo.com
127.0.0.1	clusif.free.fr
127.0.0.1	cmtapestry.com
127.0.0.1	www.cnetadd.com
127.0.0.1	cnetadd.com
127.0.0.1	www.cnomy.com
127.0.0.1	cnomy.com
127.0.0.1	www.cnzz.com
127.0.0.1	cnzz.com
127.0.0.1	www.cocktails-ideen.de
127.0.0.1	cocktails-ideen.de
127.0.0.1	code.ignphrases.com
127.0.0.1	codec.ninoa.com
127.0.0.1	www.codecadult18.com
127.0.0.1	codecadult18.com
127.0.0.1	www.codecbest.com
127.0.0.1	codecbest.com
127.0.0.1	www.codecbsplay.com
127.0.0.1	codecbsplay.com
127.0.0.1	www.codecdemo.com
127.0.0.1	codecdemo.com
127.0.0.1	www.codecdvd.net
127.0.0.1	codecdvd.net
127.0.0.1	www.codecdvi.com
127.0.0.1	codecdvi.com
127.0.0.1	www.codec-fun.com
127.0.0.1	codec-fun.com
127.0.0.1	www.codechard.com
127.0.0.1	codechard.com
127.0.0.1	www.codechot.net
127.0.0.1	codechot.net
127.0.0.1	www.codechq.net
127.0.0.1	codechq.net
127.0.0.1	www.codecmeg.net
127.0.0.1	codecmeg.net
127.0.0.1	www.codecmega.com
127.0.0.1	codecmega.com
127.0.0.1	www.codecmega.net
127.0.0.1	codecmega.net
127.0.0.1	www.codecmoon.com
127.0.0.1	codecmoon.com
127.0.0.1	www.codecmpg.com
127.0.0.1	codecmpg.com
127.0.0.1	www.codecnice.net
127.0.0.1	codecnice.net
127.0.0.1	www.codecnitro.com
127.0.0.1	codecnitro.com
127.0.0.1	www.codecops.net
127.0.0.1	codecops.net
127.0.0.1	www.codecplay.com
127.0.0.1	codecplay.com
127.0.0.1	www.codecpretty.net
127.0.0.1	codecpretty.net
127.0.0.1	www.codecpro.net
127.0.0.1	codecpro.net
127.0.0.1	www.codecred.net
127.0.0.1	codecred.net
127.0.0.1	www.codecsoft.net
127.0.0.1	codecsoft.net
127.0.0.1	www.codecthe.com
127.0.0.1	codecthe.com
127.0.0.1	www.codectime.com
127.0.0.1	codectime.com
127.0.0.1	www.codecultra.net
127.0.0.1	codecultra.net
127.0.0.1	www.codecvids.com
127.0.0.1	codecvids.com
127.0.0.1	www.codecvip.com
127.0.0.1	codecvip.com
127.0.0.1	www.codecviva.com
127.0.0.1	codecviva.com
127.0.0.1	www.codeczang.net
127.0.0.1	codeczang.net
127.0.0.1	www.codrriere.it
127.0.0.1	codrriere.it
127.0.0.1	www.coeriere.it
127.0.0.1	coeriere.it
127.0.0.1	www.coerriere.it
127.0.0.1	coerriere.it
127.0.0.1	www.cofrriere.it
127.0.0.1	cofrriere.it
127.0.0.1	www.cogrriere.it
127.0.0.1	cogrriere.it
127.0.0.1	www.coirriere.it
127.0.0.1	coirriere.it
127.0.0.1	command.adservs.com
127.0.0.1	www.commonname.com
127.0.0.1	commonname.com
127.0.0.1	www.computerpcgames.net
127.0.0.1	computerpcgames.net
127.0.0.1	www.computerrecover.com
127.0.0.1	computerrecover.com
127.0.0.1	config.180solutions.com
127.0.0.1	www.content.dollarrevenue.com
127.0.0.1	content.dollarrevenue.com
127.0.0.1	www.content.ireit.com
127.0.0.1	content.ireit.com
127.0.0.1	content.onerateld.com
127.0.0.1	www.contentmatch.net
127.0.0.1	contentmatch.net
127.0.0.1	www.contextplus.net
127.0.0.1	contextplus.net
127.0.0.1	www.contra-virus.com
127.0.0.1	contra-virus.com
127.0.0.1	www.controlmeh.com
127.0.0.1	controlmeh.com
127.0.0.1	www.convenient-search.com
127.0.0.1	convenient-search.com
127.0.0.1	www.cookingluck.com
127.0.0.1	cookingluck.com
127.0.0.1	www.cooldeskalert.com
127.0.0.1	cooldeskalert.com
127.0.0.1	coolfetishsite.com
127.0.0.1	coolfreehost.com
127.0.0.1	coolfreepage.com
127.0.0.1	coolfreepages.com
127.0.0.1	cool-homepage.co
127.0.0.1	cool-homepage.com
127.0.0.1	coolmoneysearch.com
127.0.0.1	www.coolonlinebusiness.com
127.0.0.1	coolonlinebusiness.com
127.0.0.1	coolpornsearch.com
127.0.0.1	cool-search.net
127.0.0.1	cool-search.netfartpost.com
127.0.0.1	coolsearcher.info
127.0.0.1	www.coolservecorp.net
127.0.0.1	coolservecorp.net
127.0.0.1	www.coolwebsearch.com
127.0.0.1	coolwebsearch.com
127.0.0.1	cool-web-search.com
127.0.0.1	coolwebsearsh.com
127.0.0.1	www.coolwwwsearch.com
127.0.0.1	coolwwwsearch.com
127.0.0.1	cool-xxx.net
127.0.0.1	www.coorriere.it
127.0.0.1	coorriere.it
127.0.0.1	copmtraine.com
127.0.0.1	www.coprriere.it
127.0.0.1	coprriere.it
127.0.0.1	www.core.psyche-evolution.com
127.0.0.1	core.psyche-evolution.com
127.0.0.1	www.coreiere.it
127.0.0.1	coreiere.it
127.0.0.1	www.coreriere.it
127.0.0.1	coreriere.it
127.0.0.1	www.corrdiere.it
127.0.0.1	corrdiere.it
127.0.0.1	www.correiere.it
127.0.0.1	correiere.it
127.0.0.1	www.corrfiere.it
127.0.0.1	corrfiere.it
127.0.0.1	www.corrgiere.it
127.0.0.1	corrgiere.it
127.0.0.1	www.corridere.it
127.0.0.1	corridere.it
127.0.0.1	www.corriedre.it
127.0.0.1	corriedre.it
127.0.0.1	www.corriee.it
127.0.0.1	corriee.it
127.0.0.1	www.corrieere.it
127.0.0.1	corrieere.it
127.0.0.1	www.corriefre.it
127.0.0.1	corriefre.it
127.0.0.1	www.corriegre.it
127.0.0.1	corriegre.it
127.0.0.1	www.corrierde.it
127.0.0.1	corrierde.it
127.0.0.1	www.corriered.it
127.0.0.1	corriered.it
127.0.0.1	www.corrieree.it
127.0.0.1	corrieree.it
127.0.0.1	www.corrieref.it
127.0.0.1	corrieref.it
127.0.0.1	www.corrierer.it
127.0.0.1	corrierer.it
127.0.0.1	www.corrieres.it
127.0.0.1	corrieres.it
127.0.0.1	www.corrierew.it
127.0.0.1	corrierew.it
127.0.0.1	www.corrierfe.it
127.0.0.1	corrierfe.it
127.0.0.1	www.corrierge.it
127.0.0.1	corrierge.it
127.0.0.1	www.corrierr.it
127.0.0.1	corrierr.it
127.0.0.1	www.corrierre.it
127.0.0.1	corrierre.it
127.0.0.1	www.corrierse.it
127.0.0.1	corrierse.it
127.0.0.1	www.corrierte.it
127.0.0.1	corrierte.it
127.0.0.1	www.corrierw.it
127.0.0.1	corrierw.it
127.0.0.1	www.corrierwe.it
127.0.0.1	corrierwe.it
127.0.0.1	www.corriesre.it
127.0.0.1	corriesre.it
127.0.0.1	www.corriete.it
127.0.0.1	corriete.it
127.0.0.1	www.corrietre.it
127.0.0.1	corrietre.it
127.0.0.1	www.corriewre.it
127.0.0.1	corriewre.it
127.0.0.1	www.corrifere.it
127.0.0.1	corrifere.it
127.0.0.1	www.corriiere.it
127.0.0.1	corriiere.it
127.0.0.1	www.corrilere.it
127.0.0.1	corrilere.it
127.0.0.1	www.corrioere.it
127.0.0.1	corrioere.it
127.0.0.1	www.corrire.it
127.0.0.1	corrire.it
127.0.0.1	www.corrirere.it
127.0.0.1	corrirere.it
127.0.0.1	www.corrirre.it
127.0.0.1	corrirre.it
127.0.0.1	www.corrisere.it
127.0.0.1	corrisere.it
127.0.0.1	www.corriuere.it
127.0.0.1	corriuere.it
127.0.0.1	www.corriwere.it
127.0.0.1	corriwere.it
127.0.0.1	www.corriwre.it
127.0.0.1	corriwre.it
127.0.0.1	www.corrliere.it
127.0.0.1	corrliere.it
127.0.0.1	www.corroere.it
127.0.0.1	corroere.it
127.0.0.1	www.corroiere.it
127.0.0.1	corroiere.it
127.0.0.1	www.corrriere.it
127.0.0.1	corrriere.it
127.0.0.1	www.corrtiere.it
127.0.0.1	corrtiere.it
127.0.0.1	www.corruere.it
127.0.0.1	corruere.it
127.0.0.1	www.corruiere.it
127.0.0.1	corruiere.it
127.0.0.1	www.cortiere.it
127.0.0.1	cortiere.it
127.0.0.1	www.cortriere.it
127.0.0.1	cortriere.it
127.0.0.1	www.costrike.com
127.0.0.1	costrike.com
127.0.0.1	www.cotriere.it
127.0.0.1	cotriere.it
127.0.0.1	www.cotrriere.it
127.0.0.1	cotrriere.it
127.0.0.1	couldnotfind.com
127.0.0.1	count.cc
127.0.0.1	count.hitscount.net
127.0.0.1	count-all.com
127.0.0.1	www.countdutycall.info
127.0.0.1	countdutycall.info
127.0.0.1	counter.sexmaniack.com
127.0.0.1	www.courtrecordslookup.com
127.0.0.1	courtrecordslookup.com
127.0.0.1	www.cporriere.it
127.0.0.1	cporriere.it
127.0.0.1	www.cprriere.it
127.0.0.1	cprriere.it
127.0.0.1	cpvfeed.com
127.0.0.1	cracks.me.uk
127.0.0.1	www.cracks4all.com
127.0.0.1	cracks4all.com
127.0.0.1	www.crapsgold.info
127.0.0.1	crapsgold.info
127.0.0.1	www.crazygirls-world.com
127.0.0.1	crazygirls-world.com
127.0.0.1	www.crazywinnings.com
127.0.0.1	crazywinnings.com
127.0.0.1	creamedcutties.com
127.0.0.1	www.createaccesskey.com
127.0.0.1	createaccesskey.com
127.0.0.1	www.creatonsoft.com
127.0.0.1	creatonsoft.com
127.0.0.1	creditsearchonline.com
127.0.0.1	crestring.com
127.0.0.1	crooder.com
127.0.0.1	www.crriere.it
127.0.0.1	crriere.it
127.0.0.1	www.cryptdrive.com
127.0.0.1	cryptdrive.com
127.0.0.1	www.crystalysmedia.com
127.0.0.1	crystalysmedia.com
127.0.0.1	www.csx.adservs.com
127.0.0.1	csx.adservs.com
127.0.0.1	cts.180solutions.com
127.0.0.1	www.cuisinartoven.com
127.0.0.1	cuisinartoven.com
127.0.0.1	www.curedc.info
127.0.0.1	curedc.info
127.0.0.1	www.curepcsolutions.com
127.0.0.1	curepcsolutions.com
127.0.0.1	curvedspaces.com
127.0.0.1	www.cutadult.com
127.0.0.1	cutadult.com
127.0.0.1	www.cvirgilio.it
127.0.0.1	cvirgilio.it
127.0.0.1	www.cvorriere.it
127.0.0.1	cvorriere.it
127.0.0.1	cvs.jps.ru
127.0.0.1	cvsymphony.com
127.0.0.1	www.cxorriere.it
127.0.0.1	cxorriere.it
127.0.0.1	www.cyberrape.com
127.0.0.1	cyberrape.com
127.0.0.1	cydom.com
127.0.0.1	www.cydoor.com
127.0.0.1	cydoor.com
127.0.0.1	www.daily3xlinks.com
127.0.0.1	daily3xlinks.com
127.0.0.1	www.dailybestclips.com
127.0.0.1	dailybestclips.com
127.0.0.1	daily-gals.com
127.0.0.1	www.dailyhugemovs.com
127.0.0.1	dailyhugemovs.com
127.0.0.1	www.dailykeys.com
127.0.0.1	dailykeys.com
127.0.0.1	www.dailypornmag.com
127.0.0.1	dailypornmag.com
127.0.0.1	dailyteenspic.com
127.0.0.1	www.dailytoolbar.com
127.0.0.1	dailytoolbar.com
127.0.0.1	www.dailyxvids.com
127.0.0.1	dailyxvids.com
127.0.0.1	dancingbabycd.com
127.0.0.1	www.dapsol.com
127.0.0.1	dapsol.com
127.0.0.1	www.dapsolution.com
127.0.0.1	dapsolution.com
127.0.0.1	www.data-hoster.com
127.0.0.1	data-hoster.com
127.0.0.1	datanotary.com
127.0.0.1	datareco.com
127.0.0.1	www.dateanybabe.com
127.0.0.1	dateanybabe.com
127.0.0.1	www.dateanychick.com
127.0.0.1	dateanychick.com
127.0.0.1	www.datingdoctorsite.com
127.0.0.1	datingdoctorsite.com
127.0.0.1	www.dating-galaxy.info
127.0.0.1	dating-galaxy.info
127.0.0.1	dating-search.net
127.0.0.1	davemarshall.org
127.0.0.1	db105.com
127.0.0.1	www.dbdecicated.com
127.0.0.1	dbdecicated.com
127.0.0.1	www.dbxcompany.com
127.0.0.1	dbxcompany.com
127.0.0.1	dcdl.dmcast.com
127.0.0.1	dcfitusa.com
127.0.0.1	www.dcorriere.it
127.0.0.1	dcorriere.it
127.0.0.1	www.dcurtis.com
127.0.0.1	dcurtis.com
127.0.0.1	dcww.dmcast.com
127.0.0.1	de.ag
127.0.0.1	de.drivecleaner.com
127.0.0.1	de.errorsafe.com
127.0.0.1	de.winantivirus.com
127.0.0.1	de98.remsys.org
127.0.0.1	www.debay.it
127.0.0.1	debay.it
127.0.0.1	www.decknews.com
127.0.0.1	decknews.com
127.0.0.1	dedmazay.3322.org
127.0.0.1	www.dedsearch.com
127.0.0.1	dedsearch.com
127.0.0.1	defaultsearch.net
127.0.0.1	www.defensaantimalware.com
127.0.0.1	defensaantimalware.com
127.0.0.1	www.deja-rue.com
127.0.0.1	deja-rue.com
127.0.0.1	www.delficodec.com
127.0.0.1	delficodec.com
127.0.0.1	www.democodec.com
127.0.0.1	democodec.com
127.0.0.1	www.derklaif.biz
127.0.0.1	derklaif.biz
127.0.0.1	www.derrari.it
127.0.0.1	derrari.it
127.0.0.1	desarrollocreativo.com
127.0.0.1	www.deskbar.worldtostart.com
127.0.0.1	deskbar.worldtostart.com
127.0.0.1	www.deskwizz.com
127.0.0.1	deskwizz.com
127.0.0.1	www.destroy-spyware.net
127.0.0.1	destroy-spyware.net
127.0.0.1	www.destruktor.to.pl
127.0.0.1	destruktor.to.pl
127.0.0.1	www.detectivehound.com
127.0.0.1	detectivehound.com
127.0.0.1	www.detectivesearches.com
127.0.0.1	detectivesearches.com
127.0.0.1	dev.ntcor.com
127.0.0.1	develip.com
127.0.0.1	dewis.spb.ru
127.0.0.1	dewis.us
127.0.0.1	df809jow4wj2304lfd0sf9fsd0a2t4ldf809jow4wj2304lfd0sf9fsd0a2t4ld.biz
127.0.0.1	www.dgbusiness.com
127.0.0.1	dgbusiness.com
127.0.0.1	dialer2004.com
127.0.0.1	www.dialerclub.com
127.0.0.1	dialerclub.com
127.0.0.1	www.dialer-shop.com
127.0.0.1	dialer-shop.com
127.0.0.1	www.dialoff.com
127.0.0.1	dialoff.com
127.0.0.1	www.did.i-used.cc
127.0.0.1	did.i-used.cc
127.0.0.1	dietpills4free.com
127.0.0.1	dietpussy.com
127.0.0.1	www.digikeygen.com
127.0.0.1	digikeygen.com
127.0.0.1	digistreamsa.com
127.0.0.1	www.digitalcoders.net
127.0.0.1	digitalcoders.net
127.0.0.1	www.digitalfan.com
127.0.0.1	digitalfan.com
127.0.0.1	digital-pornography.com
127.0.0.1	dionforvalleycouncil.org
127.0.0.1	www.directdvdpro.com
127.0.0.1	directdvdpro.com
127.0.0.1	www.directnameservice.com
127.0.0.1	directnameservice.com
127.0.0.1	www.directporta.info
127.0.0.1	directporta.info
127.0.0.1	www.directsearchzone.com
127.0.0.1	directsearchzone.com
127.0.0.1	www.diskretter.com
127.0.0.1	diskretter.com
127.0.0.1	dist.checkin100.com
127.0.0.1	dl.ad-ware.cc
127.0.0.1	dl.malwarewipe.com
127.0.0.1	dl.mcboo.com
127.0.0.1	www.dl.targetsaver.com
127.0.0.1	dl.targetsaver.com
127.0.0.1	dl.web-nexus.net
127.0.0.1	dl1.antivermins.com
127.0.0.1	dl1.antivirgear.com
127.0.0.1	dl1.spydawn.com
127.0.0.1	dl1.virusprotectpro.com
127.0.0.1	dl10.spyfalcon.com
127.0.0.1	dl16.spyfalcon.com
127.0.0.1	dl2.spyfalcon.com
127.0.0.1	dl2.spyheal.com
127.0.0.1	dl2.spywarestrike.com
127.0.0.1	dl3.spyfalcon.com
127.0.0.1	dl3.spyheal.com
127.0.0.1	dl3.spywarestrike.com
127.0.0.1	dl4.spyfalcon.com
127.0.0.1	dl4.spywarestrike.com
127.0.0.1	dl5.spyfalcon.com
127.0.0.1	dl5.spywarestrike.com
127.0.0.1	dl6.spywarestrike.com
127.0.0.1	dl7.spywarestrike.com
127.0.0.1	dl8.spyheal.com
127.0.0.1	dl8.spywarestrike.com
127.0.0.1	dl9.spyfalcon.com
127.0.0.1	dload.contextplus.net
127.0.0.1	www.dltsolution.com
127.0.0.1	dltsolution.com
127.0.0.1	www.dmcast.com
127.0.0.1	dmcast.com
127.0.0.1	www.dmqfirm.com
127.0.0.1	dmqfirm.com
127.0.0.1	www.dnaads.com
127.0.0.1	dnaads.com
127.0.0.1	dnl.mabou.org
127.0.0.1	www.dns-look-up.com
127.0.0.1	dns-look-up.com
127.0.0.1	doctorwaldron.com
127.0.0.1	document-not-found.pornpic.org
127.0.0.1	doggyaction.com
127.0.0.1	www.dogproblemswebsite.com
127.0.0.1	dogproblemswebsite.com
127.0.0.1	doktorxxx.com
127.0.0.1	dollarrevenue.com
127.0.0.1	www.domaincar.com
127.0.0.1	domaincar.com
127.0.0.1	domains2003.net
127.0.0.1	domains-for-you-online.com
127.0.0.1	domain-your-registration.com
127.0.0.1	domkrat.com
127.0.0.1	www.doofo.com
127.0.0.1	doofo.com
127.0.0.1	www.dotcomtoolbar.com
127.0.0.1	dotcomtoolbar.com
127.0.0.1	down.136136.net
127.0.0.1	download.abetterinternet.com
127.0.0.1	download.adintelligence.net
127.0.0.1	www.download.antispywarebot.com
127.0.0.1	download.antispywarebot.com
127.0.0.1	www.download.bardownload.com
127.0.0.1	download.bardownload.com
127.0.0.1	www.download.bravesentry.com
127.0.0.1	download.bravesentry.com
127.0.0.1	download.cdn.drivecleaner.com
127.0.0.1	download.cdn.errorsafe.com
127.0.0.1	download.cdn.winsoftware.com
127.0.0.1	download.contextplus.net
127.0.0.1	download.errorsafe.com
127.0.0.1	www.download.jupitersatellites.biz
127.0.0.1	download.jupitersatellites.biz
127.0.0.1	download.malwarealarm.com
127.0.0.1	download.searchtabs.net
127.0.0.1	www.download.secureyournet.biz
127.0.0.1	download.secureyournet.biz
127.0.0.1	download.spyonthis.net
127.0.0.1	download.spy-shredder.com
127.0.0.1	download.systemdoctor.com
127.0.0.1	download.winantispyware.com
127.0.0.1	download.winantivirus.com
127.0.0.1	download.windrivecleaner.com
127.0.0.1	download.winfixer.com
127.0.0.1	download10.spywarequake.com
127.0.0.1	download11.spywarequake.com
127.0.0.1	download12.spywarequake.com
127.0.0.1	download13.spywarequake.com
127.0.0.1	download15.spywarequake.com
127.0.0.1	download2.spywarequake.com
127.0.0.1	www.download-2007.com
127.0.0.1	download-2007.com
127.0.0.1	download3.spyaxe.com
127.0.0.1	download3.spywarequake.com
127.0.0.1	www.download3xpics.com
127.0.0.1	download3xpics.com
127.0.0.1	download4.spyaxe.com
127.0.0.1	download4.spywarequake.com
127.0.0.1	download5.spyaxe.com
127.0.0.1	download5.spywarequake.com
127.0.0.1	download6.spyaxe.com
127.0.0.1	download7.spywarequake.com
127.0.0.1	download8.spywarequake.com
127.0.0.1	download9.spywarequake.com
127.0.0.1	www.downloadacceleratorsite.com
127.0.0.1	downloadacceleratorsite.com
127.0.0.1	www.download-ad-aware.com
127.0.0.1	download-ad-aware.com
127.0.0.1	www.download-all-4-free.com
127.0.0.1	download-all-4-free.com
127.0.0.1	www.download-all-area.com
127.0.0.1	download-all-area.com
127.0.0.1	www.download-antivir.com
127.0.0.1	download-antivir.com
127.0.0.1	www.downloadanysong.com
127.0.0.1	downloadanysong.com
127.0.0.1	www.downloadaresnow.com
127.0.0.1	downloadaresnow.com
127.0.0.1	www.download-avast.com
127.0.0.1	download-avast.com
127.0.0.1	www.downloadcorporation.com
127.0.0.1	downloadcorporation.com
127.0.0.1	www.download-dvdshrink.com
127.0.0.1	download-dvdshrink.com
127.0.0.1	www.dow

Destrio5 · Answer

---> Télécharge HostsXpert sur ton Bureau :
http://www.funkytoad.com/download/HostsXpert.zip

---> Décompresse-le (Clic droit >> Extraire ici)

---> Double-clique sur HostsXpert pour le lancer

---> clique sur le bouton "Restore MS Hosts File" puis ferme le programme

PS : Avant de cliquer sur le bouton "Restore MS Hosts File", vérifie que le cadenas en haut à gauche est ouvert sinon tu vas avoir un message d'erreur.

Shaze · Answer

Voilà, j'ai fait ce que tu m'as dit..

Et maintenant?

Destrio5 · Answer

---> Fais un scan rapide avec MBAM, supprime tout ce qu'il trouve et poste le rapport :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

Shaze · Answer

Hello,

Le rapport:

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1145
Windows 5.1.2600 Service Pack 2

13.09.2008 18:45:19
mbam-log-2008-09-13 (18-45-19).txt

Type de recherche: Examen rapide
Eléments examinés: 52190
Temps écoulé: 16 minute(s), 52 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 36
Valeur(s) du Registre infectée(s): 11
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 11
Fichier(s) infecté(s): 211

Processus mémoire infecté(s):
C:\WINDOWS\system32\lphc1ndj0e90t.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\blphc1ndj0e90t.scr (Trojan.FakeAlert) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\videoegg.activexloader (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{168dc258-1455-4e61-8590-9dac2f27b675} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1a8642f1-dc80-4edc-a39d-0fb62a58b455} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3f91eb90-ef62-44ee-a685-fac29af111cd} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c29c7e4-5321-4cad-be2e-877666bed5df} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{83dfb6ee-ab18-41b5-86d4-b544a141d67e} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{88d6cf0e-cf70-4c24-bf6e-e4e414bc649c} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8f6a82a2-d7b1-443e-bb9f-f7dc887dd618} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9856e2d8-ffb2-4fe5-8cad-d5ad6a35a804} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a3d06987-c35e-49e4-8fe2-ac67b9fbfb4c} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a58c497b-3ee2-45e7-9594-daca6be2a0d0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ad0a3058-fd49-4f98-a514-fd055201835e} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ad5915ea-b61a-4dba-b5c8-ef4b2df0a3c7} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bb187c0d-6f53-4f3e-9590-98fd3a7364a2} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c5041fd9-4819-4dc4-b20e-c950b5b03d2a} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d17726cc-d4dd-4c4a-9671-471d56e413b5} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{db8cce99-59c6-4552-8bfc-058feb38d6ce} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{dc3a04ee-cdd7-4407-915c-a5502f97eecd} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e1a63484-a022-4d42-830a-fbd411514440} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e282c728-189d-419e-8ee2-1601f4b39ba5} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\videoegg.activexloader.1 (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{450b9e4d-4014-4de3-b34e-014a81468293} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{d28cd14c-50be-4cfa-951e-b37f25da3472} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER	ypelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videoegg.com/publisher,version=0.2.0 (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videoegg.com/updater,version=0.2.0 (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Servicesdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dbsyscmd (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qpsboxqhka (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vie1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vie1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphc1ndj0e90t (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\inrhc5ndj0e90t (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461 (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\messages (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Updater (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Updater\2663 (Adware.VideoEgg) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32
mjwvkzc.exe (Trojan.FakeAlert.H) -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\dozydgpe\fgvefidy.exe (Trojan.FakeAlert.H) -> Delete on reboot.
C:\Program Files\VideoEgg\Loader\2663
pvideoegg-loader.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\VideoEgg\user.dat (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\publisher.ver (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461\avcodec.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461\crashRpt.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461\dataCollection.tmp (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461\FLVEncoder.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461\lame_enc.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461\LevelMeter.ax (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461\libcurlve.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461\libpng.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461
pvideoegg-publisher.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461emoteblacklist (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461eport.log (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461eport.zip (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461\VideoEgg_FLVWriter.ax (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461\zlib.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\aol_watermark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\audio_combo.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\audio_source.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\big_gray_logo.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\big_logo_cropped.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\blank_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\button_browse_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\button_browse_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\button_browse_up.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\camcorders_title.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\camcorder_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\camcorder_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\corners_bottom_left.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\corners_bottom_left_curve.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\corners_bottom_right.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\corners_top_right.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\done.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\done_capture.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\done_capture_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\done_capture_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\done_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\done_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\dropshadow_bottom_left.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\dropshadow_horiz.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\dropshadow_vertical.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\dropzone.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\dv_fast_forward.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\dv_pause.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\dv_play.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\dv_rewind.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\dv_stop.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\email_instructions.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\email_sent.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\email_sent_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\email_sent_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\eraser.CUR (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\eraser_cursor.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\file_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\file_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\help.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_camcorder.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_camcorders.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_camcorder_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_camcorder_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_ff.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_file_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_file_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_pause.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_phone_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_phone_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_play.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_rewind.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_stop.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_webcam.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_webcams.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_webcam_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\icon_webcam_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\loading.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\loading_movie.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\locating.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\logo.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\logo_bottom.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\logo_middle.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\logo_top.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\mobile_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\mobile_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\mobile_slide_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\movie_placeholder.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\ok.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\ok_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\ok_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\player_fast_forward.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\player_fast_forward_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\player_fill.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\player_pause.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\player_play.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\player_rewind.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\player_rewind_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\player_rewind_to_start.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\playhead.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\powered_by.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\progress.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\imagesefresh_list_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\imagesefresh_list_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\imagesefresh_list_up.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\imagesestart.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\imagesestart_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\start_capture.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\start_capture_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\start_capture_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\start_capture_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\start_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\start_over_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\start_slider.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\stop_capture.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\stop_capture_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\stop_capture_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\stop_capture_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\stop_slider.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images	ab_slide_deselected.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images	ape_control.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images	ext_camcorder.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images	ext_camcorder_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images	ext_file.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images	ext_file_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images	ext_phone.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images	ext_phone_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images	ext_webcam.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images	ext_webcam_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images	itle.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\upload.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\uploading.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\uploading_fill.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\uploading_high.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\uploading_low.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\uploading_medium.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\uploading_thumbnail.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\upload_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\upload_from.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\upload_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\volume_gray.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\volume_green.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\volume_high.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\volume_low.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\volume_orange.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\volume_red.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\volume_slider.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\waiting_for_email.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\webcams_title.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\webcam_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\images\webcam_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Publisher\3461esources\VideoEgg\messages\messages.en-US.bundle (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Updater\updater.ver (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Updater\2663\libcurlve.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Application Data\VideoEgg\Updater\2663\updater.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Program Files\MSA\msa0.dat (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\MSA\msa1.dat (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
C:\winlo.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\akttzn.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\anticipator.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\awtoolb.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bsva-egihsg52.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dpcproxy.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\emesx.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hoproxy.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hxiwlgpm.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hxiwlgpm.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\medup012.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msgp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msnbho.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mtr2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mwin32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
etode.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
ewsd32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ps1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\psof1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\psoft1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32egc64.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32egm64.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Rundl1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sncntr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssurf022.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssvchost.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sysreq.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	aack.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	aack.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	emp#01.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	hun.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	hun32.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\VBIEWER.OCX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vcatchpi.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winlogonpc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winsystem.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WINWGPX.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\serauth1.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\serauth2.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vbsys2.dll (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\blphc1ndj0e90t.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lphc1ndj0e90t.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Local Settings\Temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Local Settings\Temp\.ttE.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\malik\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

Destrio5 · Answer

---> Relance MBAM, va dans Quarantaine et supprime tout

---> Poste un nouveau rapport HijackThis

Shaze · Answer

Le rapport Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:13:43, on 13.09.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\UltraDVD\DVDMon.exe
C:\Program Files\Wireless\Gigaset USB Stick 54\GUI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.9.24.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {86E91425-D7F6-44D6-9BFB-2E58EE831AD5} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\QuickTime\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [UltraDVDMon] C:\Program Files\UltraDVD\DVDMon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [appsys] C:\WINDOWS\system32	ejslkbm.exe
O4 - HKLM\..\Policies\Explorer\Run: [] 
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Moniteur Gigaset WLAN Adapter.lnk = C:\Program Files\Wireless\Gigaset USB Stick 54\GUI.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O21 - SSODL: cmdcfginfo - {13B0C94A-82A5-8535-D797-0AE9EEB02EF7} - C:\Program Files\suefwe\cmdcfginfo.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Destrio5 · Answer

Important : Désactive TeaTimer, le résident de Spybot, il va gêner la désinfection en empêchant la modification des BHO.

--->  Démarre Spybot, clique sur Mode, coche Mode avancé
---> A gauche, clique sur Outils, puis sur Résident
--->  Décoche la case devant Résident "TeaTimer" :
http://apu.mabul.org/up/5/apu-5-gpdx9e06cwz2dypom2q7n6nc.jpg
--->  Quitte Spybot

Note : Je te conseille de ne pas le réactiver, il a été incapable d'empêcher l'infection de ton PC.

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

Shaze · Answer

Salut! VOilà le rapport demandé..Mais je crois que je n'arrive plus à activer mon antivirus :( (symantec) ComboFix 08-09-13.03 - malik 2008-09-14 4:53:28.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.194 [GMT 2:00] Lancé depuis: C:\Documents and Settings\malik\Bureau\ComboFix.exe [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\WINDOWS\smdat32m.sys . ((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-14 au 2008-09-14 )))))))))))))))))))))))))))))))))))) . 2008-09-13 17:49 . 2008-09-13 17:49 d-------- C:\Documents and Settings\malik\Application Data\Malwarebytes 2008-09-13 17:48 . 2008-09-13 17:49 d-------- C:\Program Files\Anti-Malware 2008-09-13 17:48 . 2008-09-13 17:48 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-13 17:48 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-13 17:48 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-09-12 22:43 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-09-12 22:43 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-09-12 22:43 . 2008-09-08 23:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-09-12 22:43 . 2008-09-02 16:51 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-09-12 22:43 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-09-12 22:43 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-09-12 22:43 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-09-11 21:36 . 2008-09-14 05:13 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-09-11 21:36 . 2008-09-11 21:36 1,409 --a------ C:\WINDOWS\QTFont.for 2008-09-05 01:12 . 2008-09-05 01:12 d-------- C:\Program Files\Sun 2008-09-05 00:29 . 2008-09-13 00:07 2,106 --a------ C:\WINDOWS\system32 mp.reg 2008-09-04 23:51 . 2008-09-13 18:45 d-------- C:\Program Files\MSA 2008-09-02 00:18 . 2008-09-02 00:18 d-------- C:\Program Files\suefwe 2008-09-02 00:18 . 2008-09-13 18:49 d-------- C:\Documents and Settings\All Users\Application Data\dozydgpe 2008-08-29 20:08 . 2008-08-29 20:08 d-------- C:\WINDOWS\system32\Adobe 2008-08-19 21:57 . 2008-05-01 16:31 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-14 03:07 --------- d-----w C:\Program Files\Symantec AntiVirus 2008-09-13 21:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-09-05 17:44 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-09-04 23:10 --------- d-----w C:\Program Files\Java 2007-01-08 00:33 32 ----a-r C:\Documents and Settings\All Users\hash.dat 2006-10-11 16:54 218,112 -c--a-w C:\Program Files\HijackThis.exe 2005-10-16 20:50 56 --sh--r C:\WINDOWS\system32\7CF46AD7D7.sys . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-08-07 700416] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 68856] "UltraDVDMon"="C:\Program Files\UltraDVD\DVDMon.exe" [2002-12-25 337920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2005-06-02 48752] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-06-23 85696] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 413696] "iTunesHelper"="C:\Program Files\QuickTime\iTunes\iTunesHelper.exe" [2008-03-30 267048] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2008-06-12 185896] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{93994DE8-8239-4655-B1D1-5F4E91300429}"= "C:\PROGRA~1\DVDREG~1\DVDShell.dll" [2004-10-09 49152] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "cmdcfginfo"= {13B0C94A-82A5-8535-D797-0AE9EEB02EF7} - C:\Program Files\suefwe\cmdcfginfo.dll [2008-09-02 122880] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.XVID"= xvid.dll "vidc.3iv2"= 3ivxVfWCodec.dll "msacm.divxa32"= divxa32.acm "VIDC.HFYU"= huffyuv.dll "VIDC.i263"= i263_32.drv "msacm.imc"= imc32.acm "VIDC.VP31"= vp31vfw.dll "vidc.X264"= x264vfw.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli scecli [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] --a------ 2005-09-14 21:05 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2006-02-19 02:41 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-06-12 23:38 185896 C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\Real\RealPlayer\realplay.exe"= "C:\Program Files\Bluewin\Netopia_Router\Wizard\NetAgentBW.exe"= "C:\WINDOWS\system32\dpvsetup.exe"= "C:\StubInstaller.exe"= "C:\Program Files\BitComet\BitComet.exe"= "C:\Documents and Settings\malik\Bureau\Kor's\SopCast_062\SopCast\SopCast.exe"= "C:\Program Files\Warcraft III\Warcraft III.exe"= "C:\Program Files\Warcraft III\War3.exe"= "C:\WINDOWS\system32\rtcshare.exe"= "C:\Program Files\NetMeeting\conf.exe"= "C:\Program Files\Ares\Ares.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"= "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"= "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"= "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"= "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"= "C:\Program Files\Windows Media Player\wmplayer.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\QuickTime\iTunes\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "23867:TCP"= 23867:TCP:BitComet 23867 TCP "23867:UDP"= 23867:UDP:BitComet 23867 UDP R3 AVMBTPARALLEL;AVM Bluetooth Druckeranschluss;C:\WINDOWS\system32\DRIVERS\avmbtpar.sys [2005-03-14 60288] R3 AVMBTSERIAL;AVM Bluetooth Kommunikationsanschluss;C:\WINDOWS\system32\DRIVERS\avmbtser.sys [2005-03-14 61056] R3 AVMBTSND;AVM Bluetooth Audio Driver;C:\WINDOWS\system32\drivers\avmbtsnd.sys [2005-03-14 49664] R3 CBPSp50;CBPSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\CBPSp50.sys [2005-11-19 20096] R3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 16768] R3 ZD1211BU(Siemens);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(Siemens);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-06-27 450560] S3 AVMCOWAN;AVM ISDN CoNDIS WAN CAPI Driver;C:\WINDOWS\system32\DRIVERS\avmcowan.sys [2005-03-14 53248] S3 BFHU_CFG;AVM BlueFRITZ!USB 2.0 HCI Config Switch Driver;C:\WINDOWS\system32\DRIVERS\bfhu_cfg.sys [2005-03-14 6656] S3 bfhubase;BlueFRITZ! USB 2.5(WinXP/2000);C:\WINDOWS\system32\DRIVERS\bfhubase.sys [2005-03-14 831424] S3 CAPI_CIP;AVM Bluetooth CAPI-Controller;C:\WINDOWS\system32\DRIVERS\capi_cip.sys [2005-03-14 374144] S3 Envy24HFS;Gamesurround Fortissimo 4 Audio Controller WDM;C:\WINDOWS\system32\drivers\Envy24HF.sys [ ] S3 HCWBT8xx;Hauppauge WinTV 848/9 WDM Video Driver;C:\WINDOWS\system32\drivers\HCWBT8XX.sys [2004-05-24 446020] S3 LwAdiHid;Périphériques numériques WingMan Logitech (détection automatique);C:\WINDOWS\system32\DRIVERS\LwAdiHid.sys [2004-08-04 20864] S3 NETBFPAN;AVM Bluetooth Netzwerkadapter;C:\WINDOWS\system32\DRIVERS etbfpan.sys [2005-03-14 33354] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 15104] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{69ad2498-beda-11dc-a884-0010dce439d2}] \Shell\AutoRun\command - H:\ \Shell\open\Command - rundll32.exe .\hiw.dll,InstallM . Contenu du dossier 'Tƒches planifi‚es' . - - - - ORPHELINS SUPPRIMES - - - - BHO-{86E91425-D7F6-44D6-9BFB-2E58EE831AD5} - (no file) HKCU-Run-appsys - C:\WINDOWS\system32 ejslkbm.exe MSConfigStartUp-EnvyHFCPL - C:\Program Files\Gamesurround Fortissimo 4 mixer\EnMixCPL.exe MSConfigStartUp-swg - C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe . ------- Examen suppl‚mentaire ------- . O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 . . ------- File Associations (Beta) ------- . inifile=%SystemRoot%\System32\NOTEPAD.EXE %1" . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-14 05:11:22 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cach‚s ... Recherche d'‚l‚ments en d‚marrage automatique cach‚s ... Recherche de fichiers cach‚s ... Scan termin‚ avec succŠs Fichiers cach‚s: 0 ************************************************************************** . ------------------------ Autres processus actifs ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcSrv.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\CTSVCCDA.EXE C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Wireless\Gigaset USB Stick 54\GUI.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Heure de fin: 2008-09-14 5:22:31 - La machine a red‚marr‚ [malik] ComboFix-quarantined-files.txt 2008-09-14 03:22:22 Avant-CF: 1,041,043,456 octets libres AprŠs-CF: 1,774,940,160 octets libres 199 --- E O F --- 2008-09-09 22:46:57

Destrio5 · Answer

En redémarrant, Symantec revient ?

Shaze · Answer

non, lorsque je lance Symantec Antivirus, j'ai le message d'erreur suivant:
An error occured while loading savrt32.dll

et tout se ferme...

Destrio5 · Answer

---> Désinstalle Norton avec ceci :
ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe

---> Installe Antivir :
http://dlce.antivir.com/preversion_fr/preversion_fr_exe.html

---> Fais un scan complet avec Antivir, mets en quarantaine tout ce qu'il trouve et poste le rapport

Shaze · Answer

j'ai eu un message d'erreur et je ne suis pas sure d'avoir pu mettre les 19 fichiers infectés en quarantaine.. Neanmoins, voici le rapport: Avira AntiVir Personal Date de création du fichier de rapport : dimanche 14 septembre 2008 17:00 La recherche porte sur 1612438 souches de virus. Détenteur de la licence :Avira AntiVir PersonalEdition Classic Numéro de série : 0000149996-ADJIE-0001 Plateforme : Windows XP Version de Windows :(Service Pack 2) [5.1.2600] Mode Boot : Démarré normalement Identifiant : SYSTEM Nom de l'ordinateur :SHAZE Informations de version : BUILD.DAT : 8.1.0.47 16931 Bytes 19/08/2008 11:45:00 AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:49 AVSCAN.DLL : 8.1.4.1 49921 Bytes 21/07/2008 13:44:27 LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:16 LUKERES.DLL : 8.1.4.0 13057 Bytes 04/07/2008 07:30:27 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34 ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15 ANTIVIR2.VDF : 7.0.6.153 3341312 Bytes 12/09/2008 14:57:34 ANTIVIR3.VDF : 7.0.6.154 2048 Bytes 12/09/2008 14:57:34 Version du moteur: 8.1.1.28 AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21 AESCRIPT.DLL : 8.1.0.70 319866 Bytes 14/09/2008 14:57:41 AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49 AERDL.DLL : 8.1.1.1 397683 Bytes 14/09/2008 14:57:39 AEPACK.DLL : 8.1.2.1 364917 Bytes 15/07/2008 12:58:35 AEOFFICE.DLL : 8.1.0.23 196987 Bytes 14/09/2008 14:57:39 AEHEUR.DLL : 8.1.0.51 1397111 Bytes 14/09/2008 14:57:38 AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48 AEGEN.DLL : 8.1.0.36 315764 Bytes 14/09/2008 14:57:36 AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21 AECORE.DLL : 8.1.1.11 172406 Bytes 14/09/2008 14:57:36 AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48 AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:02 AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:27:58 AVREP.DLL : 8.0.0.2 98344 Bytes 14/09/2008 14:57:35 AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:37 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:19 AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:46 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02 SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:36 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:07 RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 04/07/2008 07:23:16 RCTEXT.DLL : 8.0.52.1 86273 Bytes 17/07/2008 10:08:43 Configuration pour la recherche actuelle : Nom de la tâche..................: Contrôle intégral du système Fichier de configuration.........: c:\program files\avira\antivir personaledition classic\sysscan.avp Documentation....................: bas Action principale................: interactif Action secondaire................: ignorer Recherche sur les secteurs d'amorçage maître: marche Recherche sur les secteurs d'amorçage: marche Secteurs d'amorçage..............: C:, D:, E:, Recherche dans les programmes actifs: marche Recherche en cours sur l'enregistrement: marche Recherche de Rootkits............: arrêt Fichier mode de recherche........: Sélection de fichiers intelligente Recherche sur les archives.......: marche Limiter la profondeur de récursivité: 20 Archive Smart Extensions.........: marche Heuristique de macrovirus........: marche Heuristique fichier..............: moyen Début de la recherche : dimanche 14 septembre 2008 17:00 La recherche sur les processus démarrés commence : Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés Processus de recherche 'infocard.exe' - '1' module(s) sont contrôlés Processus de recherche 'WLLoginProxy.exe' - '1' module(s) sont contrôlés Processus de recherche 'iPodService.exe' - '1' module(s) sont contrôlés Processus de recherche 'GUI.exe' - '1' module(s) sont contrôlés Processus de recherche 'iexplore.exe' - '1' module(s) sont contrôlés Processus de recherche 'DVDMon.exe' - '1' module(s) sont contrôlés Processus de recherche 'GoogleToolbarNotifier.exe' - '1' module(s) sont contrôlés Processus de recherche 'ctfmon.exe' - '1' module(s) sont contrôlés Processus de recherche 'CTSyncU.exe' - '1' module(s) sont contrôlés Processus de recherche 'realsched.exe' - '1' module(s) sont contrôlés Processus de recherche 'iTunesHelper.exe' - '1' module(s) sont contrôlés Processus de recherche 'jusched.exe' - '1' module(s) sont contrôlés Processus de recherche 'alg.exe' - '1' module(s) sont contrôlés Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés Processus de recherche 'ati2evxx.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'HPZipm12.exe' - '1' module(s) sont contrôlés Processus de recherche 'CTSVCCDA.EXE' - '1' module(s) sont contrôlés Processus de recherche 'AppleMobileDeviceService.exe' - '1' module(s) sont contrôlés Processus de recherche 'LVPrcSrv.exe' - '1' module(s) sont contrôlés Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'ati2evxx.exe' - '1' module(s) sont contrôlés Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés Processus de recherche 'services.exe' - '1' module(s) sont contrôlés Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés '38' processus ont été contrôlés avec '38' modules La recherche sur les secteurs d'amorçage maître commence : Secteur d'amorçage maître HD0 [INFO] Aucun virus trouvé ! La recherche sur les secteurs d'amorçage commence : Secteur d'amorçage 'C:\' [INFO] Aucun virus trouvé ! Secteur d'amorçage 'D:\' [INFO] Aucun virus trouvé ! Secteur d'amorçage 'E:\' [INFO] Aucun virus trouvé ! La recherche sur les renvois aux fichiers exécutables (registre) commence. Le registre a été contrôlé ( '54' fichiers). La recherche sur les fichiers sélectionnés commence : Recherche débutant dans 'C:\' C:\hiberfil.sys [AVERTISSEMENT] Impossible d'ouvrir le fichier ! C:\pagefile.sys [AVERTISSEMENT] Impossible d'ouvrir le fichier ! C:\Program Files\Microsoft AntiSpyware\Quarantine\8448685A-80F5-43E1-8314-9C82A1\524CA7CF-7174-4813-8F08-F5F4CF [RESULTAT] Contient le cheval de Troie TR/StartPage.qr.DLL [REMARQUE] TR/StartPage.qr.DLL:[HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN]:=sz:>=SZ:about:blank [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '49012f41.qua' ! [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127715.dll [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127718.dll [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127719.dll [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127720.dll [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127721.dll [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127722.ax [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127723.dll [RESULTAT] Contient le cheval de Troie TR/Drop.Softomat.AN [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127724.dll [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127725.dll [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127726.ax [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127727.dll [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127729.dll [RESULTAT] Contient le cheval de Troie TR/Drop.Softomat.AN [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127730.dll [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127731.exe [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127773.scr [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127774.exe [RESULTAT] Contient le cheval de Troie TR/Killav.28714 [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127780.exe [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. C:\System Volume Information\_restore{7C65D443-E2FE-4D7A-BABD-92342190D12F}\RP835\A0127781.exe [RESULTAT] Contient le cheval de Troie TR/Trash.Gen [REMARQUE] Le fichier a été repéré pour une suppression après un redémarrage. Recherche débutant dans 'D:\' Recherche débutant dans 'E:\' Fin de la recherche : dimanche 14 septembre 2008 18:29 Temps nécessaire: 1:29:32 Heure(s) La recherche a été effectuée intégralement 8605 Les répertoires ont été contrôlés 398057 Des fichiers ont été contrôlés 19 Des virus ou programmes indésirables ont été trouvés 0 Des fichiers ont été classés comme suspects 0 Des fichiers ont été supprimés 0 Des virus ou programmes indésirables ont été réparés 1 Les fichiers ont été déplacés dans la quarantaine 0 Les fichiers ont été renommés 2 Impossible de contrôler des fichiers 398036 Fichiers non infectés 3343 Les archives ont été contrôlées 2 Avertissements 19 Consignes

Destrio5 · Answer

- Crée un fichier Bloc-notes avec le texte qui se trouve dans l'encadré ci-dessous (copie/colle): 



REGEDIT4

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{69ad2498-beda-11dc-a884-0010dce439d2}] 



- Enregistre ce fichier dans : Bureau
- Nom du fichier : fix.reg
- Type : tous les fichiers !!
- Clique sur Enregistrer
- Quitte le Bloc-notes

Utilisation du fichier : fix.reg :
Double-clique sur le fichier (Bureau) / Accepte l'avertissement concernant la fusion / ne pas s'étonner de ne rien voir / valide le message disant que la fusion est terminée.

Shaze · Answer

c'est bon, c'est fait...

les valeurs ont été rajoutées au registre.

et maintenant?

Destrio5 · Answer

---> Télécharge OTMoveIt2 à partir du lien ci-dessous : 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe 

---> Enregistre le fichier sur le Bureau.

---> Double-clique sur le fichier OTMoveIt2.exe pour lancer l'outil.
Assure-toi que la case Unregister Dll's and Ocx's soit bien cochée.

---> Copie l'intégralité du texte ci-dessous et colle-le dans la fenêtre intitulée Paste List Of Files/Folders to Move.



C:\Program Files\MSA\
C:\Program Files\suefwe\
C:\Documents and Settings\All Users\Application Data\dozydgpe\



---> Clique sur MoveIt! pour lancer la suppression.
Lorsqu'un résultat apparaît dans le cadre Results, clique sur Exit.

Note : Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur YES. 

---> Poste le rapport de OTMoveIt qui se trouve dans C:\_OTMoveIt\MovedFiles.

Shaze · Answer

Voilà:

C:\Program Files\MSA moved successfully.
C:\Program Files\suefwe moved successfully.
C:\Documents and Settings\All Users\Application Data\dozydgpe moved successfully.
 
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09142008_192613

Destrio5 · Answer

Poste un nouveau rapport HijackThis.

Shaze · Answer

Mon Hijackthis n'est pas forcément la version la + récente...

Le rapport:

Logfile of HijackThis v1.99.1
Scan saved at 19:39:37, on 14.09.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\UltraDVD\DVDMon.exe
C:\Program Files\Wireless\Gigaset USB Stick 54\GUI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.9.24.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\QuickTime\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [UltraDVDMon] C:\Program Files\UltraDVD\DVDMon.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Moniteur Gigaset WLAN Adapter.lnk = C:\Program Files\Wireless\Gigaset USB Stick 54\GUI.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: cmdcfginfo - {13B0C94A-82A5-8535-D797-0AE9EEB02EF7} - C:\Program Files\suefwe\cmdcfginfo.dll (file missing)
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Destrio5 · Answer

Utilise la nouvelle version.

Shaze · Answer

Voilà,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:49:08, on 14.09.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\UltraDVD\DVDMon.exe
C:\Program Files\Wireless\Gigaset USB Stick 54\GUI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.9.24.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\QuickTime\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [UltraDVDMon] C:\Program Files\UltraDVD\DVDMon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Moniteur Gigaset WLAN Adapter.lnk = C:\Program Files\Wireless\Gigaset USB Stick 54\GUI.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O21 - SSODL: cmdcfginfo - {13B0C94A-82A5-8535-D797-0AE9EEB02EF7} - C:\Program Files\suefwe\cmdcfginfo.dll (file missing)
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Destrio5 · Answer

---> Relance HijackThis et choisis Do a system scan only

---> Coche les cases qui sont devant les lignes suivantes :

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank 

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"     

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime     

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot     

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe     

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')     

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')     

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')     

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')     

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe     

O21 - SSODL: cmdcfginfo - {13B0C94A-82A5-8535-D797-0AE9EEB02EF7} - C:\Program Files\suefwe\cmdcfginfo.dll (file missing) 

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe     

---> Clique en bas sur Fix checked. Mets oui si HijackThis te demande quelque chose.

---> Redémarre ton PC et poste un nouveau rapport HijackThis

Shaze · Answer

Voilà le rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:03:28, on 14.09.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\QuickTime\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Wireless\Gigaset USB Stick 54\GUI.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.9.24.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\QuickTime\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Moniteur Gigaset WLAN Adapter.lnk = C:\Program Files\Wireless\Gigaset USB Stick 54\GUI.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Destrio5 · Answer

Tu as encore des problèmes ou on peut passer à la dernière étape ?

Shaze · Answer

A part un programme que j'avais désinstallé et qui réapparaît après le redémarrage (Creative), Rien à Signaler au niveau des attaques de popups :)))

Je suis prêt pour la dernière étape.

Destrio5 · Answer

Quel programme ?

Destrio5 · Answer

Fix cette ligne :

O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"

Shaze · Answer

Ca y est!

Destrio5 · Answer

Ça a marché ?

Shaze · Answer

J'ai en + effacé d'autres composantes Creative et redémarré..Alors il ne se lance plus ce qui est une bonne nouvelle..

Mais il reste certaines icones que je ne peux pas delete sur le bureau par exemple (Sony Ericsson gestionnaire de fichiers) et sur le menu Démarrer il reste Creative-->Enregistrement du Produit

Mais ca n'a pas l'air de gêner alors avec ton approbation, je suis tout ouïe pour la dernière étape.

Destrio5 · Answer

---> Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
https://www.ccleaner.com/ccleaner/download

---> Lance-le. Va dans "Options" puis "Avancé", tu décoches la case "Effacer uniquement les fichiers etc...". Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage. Puis tu vas dans "Registre", tu fais "Chercher des erreurs". Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.

---> Télécharge Tools Cleaner sur ton bureau.
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
Clique sur Recherche et laisse le scan agir.
Clique sur Suppression pour finaliser. 
Tu peux, si tu le souhaites, te servir des Options facultatives.
Clique sur Quitter pour obtenir le rapport. 
Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger :
http://www.infos-du-net.com/forum/272480-11-desactiver-activer-restauration-systeme

---> Je te conseille de créer un point de restauration que tu pourras utiliser plus tard si tu as un problème :
https://www.vulgarisation-informatique.com/creer-point-restauration.php

Shaze · Answer

[ Rapport ToolsCleaner version 2.2.3 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Combofix.txt: trouvé !
C:\hijackthis.log: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\malik\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\malik\Bureau\OtMoveIt2.exe: trouvé !
C:\Documents and Settings\malik\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\malik\Bureau\SmitFraudfix: trouvé !
C:\Program Files\HijackThis.exe: trouvé !
C:\Program Files\hijackthis.log: trouvé !
C:\Program Files\HijackThis: trouvé !
C:\Program Files\SmitFraudfix: trouvé !
C:\Program Files\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\HijackThis\hijackthis.log: trouvé !
C:\Program Files\SmitfraudFix\SmitFraudfix: trouvé !
C:\Program Files\SmitfraudFix\SmitfraudFix\SmitFraudfix: trouvé !
C:\Program Files\SmitfraudFix\SmitfraudFix\SmitfraudFix\SmitFraudFix.zip: trouvé !
C:\Program Files\SmitfraudFix\SmitfraudFix\SmitfraudFix\SmitFraudfix: trouvé !
C:\Program Files\SmitfraudFix\SmitfraudFix\SmitfraudFix\SmitfraudFix\SmitFraudfix: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\malik\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\malik\Bureau\OtMoveIt2.exe: supprimé !
C:\Documents and Settings\malik\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Program Files\HijackThis.exe: supprimé !
C:\Program Files\HijackThis\HijackThis.exe: supprimé !
C:\Program Files\SmitfraudFix\SmitfraudFix\SmitfraudFix\SmitFraudFix.zip: supprimé !
C:\Combofix.txt: supprimé !
C:\hijackthis.log: supprimé !
C:\Program Files\hijackthis.log: supprimé !
C:\Program Files\HijackThis\hijackthis.log: supprimé !
C:\Qoobox: supprimé !
C:\_OtMoveIt: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\malik\Bureau\SmitFraudfix: supprimé !
C:\Program Files\HijackThis: supprimé !
C:\Program Files\SmitFraudfix: supprimé !

Fichiers temporaires nettoyés !

Destrio5 · Answer

Tu peux supprimer ComboFix et Tools Cleaner.

Shaze · Answer

Je les ai simplement mis dans la corbeille depuis le bureau (je ne trouvais pas le programme depuis Suppression de Programmes)

VOilà qui est fait.

Destrio5 · Answer

Des questions ?

Shaze · Answer

Non. Je n'ai rien à dire. Du travail de pro :)

Oui au fait, une question: Est-ce qu'on a fini?

Destrio5 · Answer

Oui.

Destrio5 · Answer

"Non. Je n'ai rien à dire. Du travail de pro :)"
---> Voilà ce que j'ai reçu, ça fait plaisir ;)

Bonne fin de soirée.

Méchant Trojan - Page 3

Discussions similaires

Newsletters