Encore une victime de Smart Antivirus 2009... Fermé

Question

Bonjour,

c'est en voulant installer un codec cracke (coreAVC) que je viens de paralyser mon PC.
Voici mon rapport HiJackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:43: VIRUS ALERT!, on 15/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Spyware Doctor\pctsGui.exe
C:\Program Files\Trend Micro\HijackThis\couroucoucou.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 

http://www.neuf.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 

http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 

https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 

https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 

https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 

https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 

*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: QXK Olive - {11dfb01a-0852-4955-9747-c59e21dbbda5} - 

C:\WINDOWS\dfmlxbpkvlo.dll (file missing)
O2 - BHO: (no name) - {492ba5b1-4197-4557-bbfa-9f0eb88855d2} - (no file)
O2 - BHO: (no name) - {90935776-8a57-42fb-96a0-38c76b5686f9} - 

C:\WINDOWS\system32\jkkIAsqR.dll (file missing)
O2 - BHO: (no name) - {da44977c-000e-4e39-9a52-3458c8a36ec4} - 

C:\WINDOWS\system32\hgGyXqrO.dll (file missing)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program 

Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: peltodgx - {0FA15166-39DA-4DAB-9B1A-0DDDBACA8BD5} - 

C:\WINDOWS\peltodgx.dll (file missing)
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - 

res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Save with Download Manager... - file://C:\Program Files\J 

River\Media Center\DMDownload.htm
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program 

Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program 

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - 

-{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program 

Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - 

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - 

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - 

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - 

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - 

{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {e59eb121-f339-4851-a3ba-fe49c35617c2} - C:\Program 

Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {e59eb121-f339-4851-a3ba-fe49c35617c2} - C:\Program 

Files\ICQ6\ICQ.exe
O16 - DPF: Yahoo! Checkers - http://download.games.yahoo.com/games/clients/y/kt4_x.cab
O16 - DPF: Yahoo! Chess - http://download2.games.yahoo.com/games/clients/y/ct5_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: {131EB16C-BD58-443F-8151-6DFBB0DA1778} (Anark Client 3.0 ActiveX Control) - 

http://install.anark.com/client/version3/windows-ie/en/AMClient.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - 

http://static.windupdates.com/cab/CDT/ie/bridge-c446.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} - 
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - 

http://fr.midas.games.yahoo.net/ctl/kingcomie.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - 

http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl 

Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - 

http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - 

http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} - 

http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - 

C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: qomcyark - qoMcyARk.dll (file missing)
O21 - SSODL: onfwbsak - {70886A6F-9422-4899-96C0-75570EFADC40} - 

C:\WINDOWS\onfwbsak.dll
O21 - SSODL: rwlfsdmk - {3FDB954E-B673-4CD2-89BC-77E66B4A4A0C} - 

C:\WINDOWS\rwlfsdmk.dll
O22 - SharedTaskScheduler: werkjdnfi8wnkjmdfdfkefn - 

{C5AF49A2-94F3-42BD-F434-3604812C897D} - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers 

communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - 

C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG 

Anti-Spyware 7.5\guard.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY 

Shared\Service\Boonty.exe
O23 - Service: CSIScanner (csiscanner) - Prevx - C:\Program Files\PrevxCSI\prevxcsi.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - 

C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - 

C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (ipod service) - Apple Inc. - C:\Program 

Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools Auxiliary Service (sdauxservice) - PC Tools - C:\Program 

Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdcoreservice) - PC Tools - C:\Program 

Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - 

C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software 

GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

totobetourne · Answer

bonjour

commencons par cela et voyons ce qu il te trouve.

Telecharges malwares bytes anti malwares :

Malwarebytes Anti-Malware: http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Tutoriel Malwarebytes Anti-Malware: https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm 
fais comme indique,mise a jour , scan complet en mode sans echec et les rapports.

garde le et lance un scan tout les mois comme indique.

si tu as ad aware tu peux desinstalle car il ne reconnait plus grand chose.

sherred · Answer

Téléchargez Combifix 
http://download.bleepingcomputer.com/sUBs/ComboFix.exe ou
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/ ou
https://forospyware.com
puis renommez le bidule.exe 
Déconnectez vous d'internet et fermez toutes tes applications et programmes 
Double-cliquez sur "bidule.exe" 
Appuyer sur la touche Y (Yes) pour démarrer le scan 
Ne pas cliquer dans la fenêtre de Combofix durant l'analyse 
Le rapport sera crée sous la racine: C:\Combofix.txt

Emile · Answer

Merci!

Voici le rapport de Malwarebytes, je n'ai encore rien supprime:

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1134
Windows 5.1.2600 Service Pack 2

15/08/2008 16:24:22
mbam-log-2008-08-15 (16-24-11).txt

Type de recherche: Examen rapide
Eléments examinés: 50920
Temps écoulé: 5 minute(s), 52 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 11
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 24
Dossier(s) infecté(s): 7
Fichier(s) infecté(s): 17

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{64de95e5-0a25-4dd9-a472-97bc1d419101} (Trojan.Zlob) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{23624bd0-2a69-4f91-be6a-9f1f22b72c13} (Rogue.VirusHeat) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\WakeNet (Trojan.Adware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebVideo (Trojan.FakeAlert) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\searchmigrateddefaulturl (Trojan.Zlob) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\searchmigrateddefaulturl (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Trojan.Zlob) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://internetsearchservice.com/search?q=%s) Good: (https://www.google.com/?gws_rd=ssl -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://internetsearchservice.com/search?q=%s) Good: (https://www.google.com/?gws_rd=ssl -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (https://internetsearchservice.com/606/search-engine-optimization-seo-specialist-in-phoenix-az/?q{searchTerms}) Good: (https://www.google.com/?gws_rd=ssl -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (https://internetsearchservice.com/606/search-engine-optimization-seo-specialist-in-phoenix-az/?q{searchTerms}) Good: (https://www.google.com/?gws_rd=ssl -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 Good: (https://www.google.com/?gws_rd=ssl -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (55639-OEM-0011903-00109) -> No action taken.
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (Hijack.Explorer) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispAppearancePage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
C:\Program Files\VirusHeat 4.4 (Rogue.VirusHeat) -> No action taken.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> No action taken.
C:\Program Files\DivoCodec (Trojan.Downloader) -> No action taken.
C:\Program Files\Smart Antivirus 2009 (Rogue.SmartAntivirus) -> No action taken.
C:\Program Files\Smart Antivirus 2009\Infected (Rogue.SmartAntivirus) -> No action taken.
C:\Program Files\Smart Antivirus 2009\Suspicious (Rogue.SmartAntivirus) -> No action taken.
C:\WINDOWS\system32\527631 (Trojan.BHO) -> No action taken.

Fichier(s) infecté(s):
C:\WINDOWS\system32\ivrtuwmf.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\fmwutrvi.ini (Trojan.Vundo.H) -> No action taken.
C:\Program Files\VirusHeat 4.4\VirusHeat 4.4.exe (Rogue.VirusHeat) -> No action taken.
C:\WINDOWS\rwlfsdmk.dll (Trojan.Zlob) -> No action taken.
C:\WINDOWS\system32\pmnmklJB.dll (Trojan.Vundo) -> No action taken.
C:\Program Files\VirusHeat 4.4\ignored.lst (Rogue.VirusHeat) -> No action taken.
C:\Program Files\VirusHeat 4.4\vpp.ini (Rogue.VirusHeat) -> No action taken.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> No action taken.
C:\Program Files\Smart Antivirus 2009\Smart Antivirus-2009.exe (Rogue.SmartAntivirus) -> No action taken.
C:\Program Files\Smart Antivirus 2009\vscan.tsi (Rogue.SmartAntivirus) -> No action taken.
C:\Program Files\Smart Antivirus 2009\zlib.dll (Rogue.SmartAntivirus) -> No action taken.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> No action taken.
C:\WINDOWS\BM9ba52c9a.xml (Trojan.Vundo) -> No action taken.
C:\WINDOWS\BM9ba52c9a.txt (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\gaetan\Bureau\Smart Antivirus-2009.lnk (Rogue.SmartAntivirus) -> No action taken.
C:\Documents and Settings\gaetan\Application Data\Microsoft\Internet Explorer\Quick Launch\Smart Antivirus-2009.lnk (Rogue.SmartAntivirus) -> No action taken.
C:\Documents and Settings\gaetan\Application Data\TmpRecentIcons\Smart Antivirus-2009.lnk (Rogue.Link) -> No action taken.

Lyonnais92 · Answer

Bonjour,

dans l'ordre :

eradiquer le Zlob correctement

Ouvre ce lien  (merci a S!RI pour ce programme). http://siri.urz.free.fr/Fix/SmitfraudFix.php 
et télécharge SmitfraudFix.exe.

Regarde le tuto
Exécute le en choisissant l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.

Poste le; tout de suite car sinon il va être écrasé

Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 



Relance le programme Smitfraud, 
Cette fois choisit l’option 2, répond oui a tous ; 
Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum


Ensuite, les autres infections décelés par MBAM :

relance MBAM et supprime tout en fin, de scan.

Poste le rapport.

Enfin, pour voir l'état des lieux :

Fais redémarrer l'ordi.

Télécharge ici : 

http://images.malwareremoval.com/random/RSIT.exe 

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau. 

Double-clique sur RSIT.exe afin de lancer RSIT. 

Clique Continue à l'écran Disclaimer. 

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence. 

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. 

Poste le contenu de log.txt (<<qui sera affiché) 
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches). 

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

Emile · Answer

OK, voici le 1er rapport SmitFraudFix:

SmitFraudFix v2.356

Rapport fait à 16:47:04,42, 15/08/2008
Executé à partir de C:\Installs\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1	legal-at-spybot.info
127.0.0.1	www.legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\fbxrqtwn.exe PRESENT !
C:\WINDOWS\onfwbsak.dll PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\gaetan


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\gaetan\Application Data

C:\Documents and Settings\gaetan\Application Data\Microsoft\Internet Explorer\Quick Launch\Smart Antivirus-2009.lnk PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

C:\DOCUME~1\gaetan\MENUDM~1\PROGRA~1\Smart Antivirus 2009 PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\gaetan\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau

C:\DOCUME~1\gaetan\Bureau\Smart Antivirus-2009.lnk PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 

C:\Program Files\Smart Antivirus 2009\ PRESENT !
C:\Program Files\VirusHeat 4.4\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{C5AF49A2-94F3-42BD-F434-3604812C897D}"="werkjdnfi8wnkjmdfdfkefn"



»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5C8DED17-1255-4BF6-8A46-3834C1EF7FAC}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5C8DED17-1255-4BF6-8A46-3834C1EF7FAC}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5C8DED17-1255-4BF6-8A46-3834C1EF7FAC}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{5C8DED17-1255-4BF6-8A46-3834C1EF7FAC}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Emile · Answer

2e rapport SmitFraudFix, apres nettoyage:

SmitFraudFix v2.356

Rapport fait à 16:53:06,10, 15/08/2008
Executé à partir de C:\Installs\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{C5AF49A2-94F3-42BD-F434-3604812C897D}"="werkjdnfi8wnkjmdfdfkefn"


»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost
127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
127.0.0.1 errorprotector.com ## added by CiD
127.0.0.1 errorsafe.com ## added by CiD
127.0.0.1 es.winantivirus.com ## added by CiD
127.0.0.1 fr.winantivirus.com ## added by CiD
127.0.0.1 fr.winfixer.com ## added by CiD
127.0.0.1 go.drivecleaner.com ## added by CiD
127.0.0.1 go.errorsafe.com ## added by CiD
127.0.0.1 go.winantispyware.com ## added by CiD
127.0.0.1 go.winantivirus.com ## added by CiD
127.0.0.1 hk.winantivirus.com ## added by CiD
127.0.0.1 instlog.errorsafe.com ## added by CiD
127.0.0.1 instlog.winantivirus.com ## added by CiD
127.0.0.1 instlog.winfixer.com ## added by CiD
127.0.0.1 jsp.drivecleaner.com ## added by CiD
127.0.0.1 kb.errorsafe.com ## added by CiD
127.0.0.1 kb.winantivirus.com ## added by CiD
127.0.0.1 nl.errorsafe.com ## added by CiD
127.0.0.1 se.errorsafe.com ## added by CiD
127.0.0.1 secure.drivecleaner.com ## added by CiD
127.0.0.1 secure.errorsafe.com ## added by CiD
127.0.0.1 secure.winantispam.com ## added by CiD
127.0.0.1 secure.winantispy.com ## added by CiD
127.0.0.1 secure.winantivirus.com ## added by CiD
127.0.0.1 support.winantivirus.com ## added by CiD
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
127.0.0.1 ulog.winantivirus.com ## added by CiD
127.0.0.1 utils.errorsafe.com ## added by CiD
127.0.0.1 utils.winantivirus.com ## added by CiD
127.0.0.1 utils.winfixer.com ## added by CiD
127.0.0.1 winantispyware.com ## added by CiD
127.0.0.1 winantivirus.com ## added by CiD
127.0.0.1 winfixer.com ## added by CiD
127.0.0.1 winfixer2006.com ## added by CiD
127.0.0.1 winsoftware.com ## added by CiD
127.0.0.1 www.drivecleaner.com ## added by CiD
127.0.0.1 www.errorprotector.com ## added by CiD
127.0.0.1 www.errorsafe.com ## added by CiD
127.0.0.1 www.systemdoctor.com ## added by CiD
127.0.0.1 www.utils.winfixer.com ## added by CiD
127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
127.0.0.1 www.win-virus-pro.com ## added by CiD
127.0.0.1 www.winantispam.com ## added by CiD
127.0.0.1 www.winantispy.com ## added by CiD
127.0.0.1 www.winantispyware.com ## added by CiD
127.0.0.1 www.winantivirus.com ## added by CiD
127.0.0.1 www.winantiviruspro.com ## added by CiD
127.0.0.1 www.windrivecleaner.com ## added by CiD
127.0.0.1 www.windrivesafe.com ## added by CiD
127.0.0.1 www.winfixer.com ## added by CiD
127.0.0.1 www.winfixer2006.com ## added by CiD
127.0.0.1 www.winsoftware.com ## added by CiD
127.0.0.1	007guard.com
127.0.0.1	www.007guard.com
127.0.0.1	008i.com
127.0.0.1	008k.com
127.0.0.1	www.008k.com
127.0.0.1	00hq.com
127.0.0.1	www.00hq.com
127.0.0.1	010402.com
127.0.0.1	032439.com
127.0.0.1	www.032439.com
127.0.0.1	1001-search.info
127.0.0.1	www.1001-search.info
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	100sexlinks.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	123topsearch.com
127.0.0.1	www.123topsearch.com
127.0.0.1	132.com
127.0.0.1	www.132.com
127.0.0.1	136136.net
127.0.0.1	www.136136.net
127.0.0.1	139mm.com
127.0.0.1	www.139mm.com
127.0.0.1	163ns.com
127.0.0.1	www.163ns.com
127.0.0.1	171203.com
127.0.0.1	17-plus.com
127.0.0.1	1800searchonline.com
127.0.0.1	www.1800searchonline.com
127.0.0.1	180searchassistant.com
127.0.0.1	www.180searchassistant.com
127.0.0.1	180solutions.com
127.0.0.1	www.180solutions.com
127.0.0.1	181.365soft.info
127.0.0.1	www.181.365soft.info
127.0.0.1	1987324.com
127.0.0.1	www.1987324.com
127.0.0.1	1-domains-registrations.com
127.0.0.1	www.1-domains-registrations.com
127.0.0.1	1-extreme.biz
127.0.0.1	www.1-extreme.biz
127.0.0.1	1sexparty.com
127.0.0.1	www.1sexparty.com
127.0.0.1	1stantivirus.com
127.0.0.1	www.1stantivirus.com
127.0.0.1	1stpagehere.com
127.0.0.1	www.1stpagehere.com
127.0.0.1	1stsearchportal.com
127.0.0.1	www.1stsearchportal.com
127.0.0.1	2.82211.net
127.0.0.1	www.2006ooo.com
127.0.0.1	2007-download.com
127.0.0.1	www.2007-download.com
127.0.0.1	2020search.com
127.0.0.1	www.2020search.com
127.0.0.1	20x2p.com
127.0.0.1	24.365soft.info
127.0.0.1	www.24.365soft.info
127.0.0.1	24-7pharmacy.info
127.0.0.1	www.24-7pharmacy.info
127.0.0.1	24-7searching-and-more.com
127.0.0.1	www.24-7searching-and-more.com
127.0.0.1	24teen.com
127.0.0.1	www.24teen.com
127.0.0.1	2every.net
127.0.0.1	www.2every.net
127.0.0.1	2ndpower.com
127.0.0.1	2search.com
127.0.0.1	www.2search.com
127.0.0.1	2search.org
127.0.0.1	www.2search.org
127.0.0.1	2squared.com
127.0.0.1	www.2squared.com
127.0.0.1	3322.org
127.0.0.1	www.3322.org
127.0.0.1	365soft.info
127.0.0.1	36site.com
127.0.0.1	www.36site.com
127.0.0.1	3721.com
127.0.0.1	39-93.com
127.0.0.1	3abetterinternet.com
127.0.0.1	www.3abetterinternet.com
127.0.0.1	3bay.it
127.0.0.1	www.3bay.it
127.0.0.1	3ebay.it
127.0.0.1	www.3ebay.it
127.0.0.1	404dns.com
127.0.0.1	www.404dns.com
127.0.0.1	4199.com
127.0.0.1	www.4199.com
127.0.0.1	4corn.net
127.0.0.1	www.4corn.net
127.0.0.1	4ebay.it
127.0.0.1	www.4ebay.it
127.0.0.1	4klm.com
127.0.0.1	4repubblica.it
127.0.0.1	www.4repubblica.it
127.0.0.1	4softget.com
127.0.0.1	www.4softget.com
127.0.0.1	5iscali.it
127.0.0.1	www.5iscali.it
127.0.0.1	5repubblica.it
127.0.0.1	www.5repubblica.it
127.0.0.1	5starvideos.com
127.0.0.1	www.5starvideos.com
127.0.0.1	5tiscali.it
127.0.0.1	www.5tiscali.it
127.0.0.1	5zgmu7o20kt5d8yq.com
127.0.0.1	www.5zgmu7o20kt5d8yq.com
127.0.0.1	6iscali.it
127.0.0.1	www.6iscali.it
127.0.0.1	6sek.com
127.0.0.1	www.6sek.com
127.0.0.1	6tiscali.it
127.0.0.1	www.6tiscali.it
127.0.0.1	7322.com
127.0.0.1	www.7322.com
127.0.0.1	75tz.com
127.0.0.1	777search.com
127.0.0.1	www.777search.com
127.0.0.1	777top.com
127.0.0.1	www.777top.com
127.0.0.1	7939.com
127.0.0.1	www.7939.com
127.0.0.1	7search.com
127.0.0.1	www.7search.com
127.0.0.1	80gw6ry3i3x3qbrkwhxhw.032439.com
127.0.0.1	82211.net
127.0.0.1	8866.org
127.0.0.1	8ad.com
127.0.0.1	www.8ad.com
127.0.0.1	9505.com
127.0.0.1	www.9505.com
127.0.0.1	971searchbox.com
127.0.0.1	www.971searchbox.com
127.0.0.1	a.bestmanage.org
127.0.0.1	aaasexypics.com
127.0.0.1	aaawebfinder.com
127.0.0.1	www.aaawebfinder.com
127.0.0.1	abc-find.info
127.0.0.1	www.abc-find.info
127.0.0.1	abetterinternet.com
127.0.0.1	www.abetterinternet.com
127.0.0.1	abnetsoft.info
127.0.0.1	www.abnetsoft.info
127.0.0.1	aboutclicker.com
127.0.0.1	www.aboutclicker.com
127.0.0.1	abrp.net
127.0.0.1	www.abrp.net
127.0.0.1	absolutee.com
127.0.0.1	www.absolutee.com
127.0.0.1	abyssmedia.com
127.0.0.1	www.abyssmedia.com
127.0.0.1	ac66.cn
127.0.0.1	www.ac66.cn
127.0.0.1	access.Navinetwork.com
127.0.0.1	access.rapid-pass.net
127.0.0.1	accessactivexvideo.com
127.0.0.1	www.accessactivexvideo.com
127.0.0.1	accessclips.com
127.0.0.1	www.accessclips.com
127.0.0.1	access-dvd.com
127.0.0.1	www.access-dvd.com
127.0.0.1	accesskeygenerator.com
127.0.0.1	www.accesskeygenerator.com
127.0.0.1	accessorygeeks.com
127.0.0.1	www.accessorygeeks.com
127.0.0.1	accessthefuture.net
127.0.0.1	www.accessthefuture.net
127.0.0.1	accessvid.net
127.0.0.1	www.accessvid.net
127.0.0.1	acemedic.com
127.0.0.1	www.acemedic.com
127.0.0.1	ace-webmaster.com
127.0.0.1	www.ace-webmaster.com
127.0.0.1	acrobat-2007.com
127.0.0.1	www.acrobat-2007.com
127.0.0.1	acrobat-8.com
127.0.0.1	www.acrobat-8.com
127.0.0.1	acrobat-center.com
127.0.0.1	www.acrobat-center.com
127.0.0.1	acrobat-hq.com
127.0.0.1	www.acrobat-hq.com
127.0.0.1	acrobatreader-8.com
127.0.0.1	www.acrobatreader-8.com
127.0.0.1	acrobat-reader-8.de
127.0.0.1	www.acrobat-reader-8.de
127.0.0.1	acrobat-stop.com
127.0.0.1	www.acrobat-stop.com
127.0.0.1	actionbreastcancer.org
127.0.0.1	www.actionbreastcancer.org
127.0.0.1	activesearcher.info
127.0.0.1	www.activesearcher.info
127.0.0.1	activexaccessobject.com
127.0.0.1	www.activexaccessobject.com
127.0.0.1	activexaccessvideo.com
127.0.0.1	www.activexaccessvideo.com
127.0.0.1	activexemedia.com
127.0.0.1	www.activexemedia.com
127.0.0.1	activexmediaobject.com
127.0.0.1	www.activexmediaobject.com
127.0.0.1	activexmediapro.com
127.0.0.1	www.activexmediapro.com
127.0.0.1	activexmediasite.com
127.0.0.1	www.activexmediasite.com
127.0.0.1	activexmediasoftware.com
127.0.0.1	www.activexmediasoftware.com
127.0.0.1	activexmediasource.com
127.0.0.1	www.activexmediasource.com
127.0.0.1	activexmediatool.com
127.0.0.1	www.activexmediatool.com
127.0.0.1	activexmediatour.com
127.0.0.1	www.activexmediatour.com
127.0.0.1	activexsoftwares.com
127.0.0.1	www.activexsoftwares.com
127.0.0.1	activexsource.com
127.0.0.1	www.activexsource.com
127.0.0.1	activexupdate.com
127.0.0.1	www.activexupdate.com
127.0.0.1	activexvideo.com
127.0.0.1	www.activexvideo.com
127.0.0.1	activexvideotool.com
127.0.0.1	www.activexvideotool.com
127.0.0.1	ad.marketingsector.com
127.0.0.1	www.ad.marketingsector.com
127.0.0.1	ad.mokead.com
127.0.0.1	www.ad.mokead.com
127.0.0.1	ad.yieldmanager.com
127.0.0.1	www.ad.yieldmanager.com
127.0.0.1	ad25.com
127.0.0.1	ad45.com
127.0.0.1	ad77.com
127.0.0.1	ad86.com
127.0.0.1	adamsupportgroup.org
127.0.0.1	www.adamsupportgroup.org
127.0.0.1	adarmor.com
127.0.0.1	www.adarmor.com
127.0.0.1	adasearch.com
127.0.0.1	www.adasearch.com
127.0.0.1	adaware.cc
127.0.0.1	adawarenow.com
127.0.0.1	www.adawarenow.com
127.0.0.1	addictivetechnologies.com
127.0.0.1	www.addictivetechnologies.com
127.0.0.1	addictivetechnologies.net
127.0.0.1	www.addictivetechnologies.net
127.0.0.1	add-manager.com
127.0.0.1	www.add-manager.com
127.0.0.1	adgate.info
127.0.0.1	www.adgate.info
127.0.0.1	adipics.com
127.0.0.1	www.adipics.com
127.0.0.1	admin2cash.biz
127.0.0.1	www.admin2cash.biz
127.0.0.1	adnet-plus.com
127.0.0.1	adobe-download-now.com
127.0.0.1	adobe-downloads.com
127.0.0.1	www.adobe-downloads.com
127.0.0.1	adobe-reader-8.fr
127.0.0.1	www.adobe-reader-8.fr
127.0.0.1	adprotect.com
127.0.0.1	www.adprotect.com
127.0.0.1	ads.centralmedia.ws
127.0.0.1	ads.k8l.info
127.0.0.1	ads.kmpads.com
127.0.0.1	ads.marketingsector.com
127.0.0.1	ads.searchingbooth.com
127.0.0.1	ads.z-quest.com
127.0.0.1	ads183.com
127.0.0.1	www.ads183.com
127.0.0.1	adscontex.com
127.0.0.1	www.adscontex.com
127.0.0.1	adservices1.enhance.com
127.0.0.1	www.adservices1.enhance.com
127.0.0.1	adservs.com
127.0.0.1	adsextend.net
127.0.0.1	www.adsextend.net
127.0.0.1	adshttp.com
127.0.0.1	www.adshttp.com
127.0.0.1	adsonwww.com
127.0.0.1	www.adsonwww.com
127.0.0.1	adspics.com
127.0.0.1	www.adspics.com
127.0.0.1	adtrak.net
127.0.0.1	www.adtrak.net
127.0.0.1	adtrgt.com
127.0.0.1	adult777search.info
127.0.0.1	www.adult777search.info
127.0.0.1	adultan.com
127.0.0.1	www.adultan.com
127.0.0.1	adult-engine-search.com
127.0.0.1	www.adult-engine-search.com
127.0.0.1	adult-erotic-guide.net
127.0.0.1	www.adult-erotic-guide.net
127.0.0.1	adultfilmsite.com
127.0.0.1	www.adultfilmsite.com
127.0.0.1	adult-friends-finder.net
127.0.0.1	www.adult-friends-finder.net
127.0.0.1	adultgambling.org
127.0.0.1	adult-host.org
127.0.0.1	adulthyperlinks.com
127.0.0.1	www.adulthyperlinks.com
127.0.0.1	adultmovieplus.com
127.0.0.1	www.adultmovieplus.com
127.0.0.1	adult-personal.us
127.0.0.1	adultsgames.net
127.0.0.1	adultsper.com
127.0.0.1	www.adultsper.com
127.0.0.1	adulttds.com
127.0.0.1	www.adulttds.com
127.0.0.1	adultzoneworld.com
127.0.0.1	www.adultzoneworld.com
127.0.0.1	advcash.biz
127.0.0.1	www.advcash.biz
127.0.0.1	advert.exaccess.ru
127.0.0.1	advertisemoney.info
127.0.0.1	www.advertisemoney.info
127.0.0.1	advertising.paltalk.com
127.0.0.1	advertising-money.info
127.0.0.1	www.advertising-money.info
127.0.0.1	ad-ware.cc
127.0.0.1	ad-w-a-r-e.com
127.0.0.1	www.ad-w-a-r-e.com
127.0.0.1	a-d-w-a-r-e.com
127.0.0.1	www.a-d-w-a-r-e.com
127.0.0.1	adwarebazooka.com
127.0.0.1	www.adwarebazooka.com
127.0.0.1	adwarefinder.com
127.0.0.1	www.adwarefinder.com
127.0.0.1	adwareprotectionsite.com
127.0.0.1	www.adwareprotectionsite.com
127.0.0.1	adwarepunisher.com
127.0.0.1	www.adwarepunisher.com
127.0.0.1	aflgate.com
127.0.0.1	www.aflgate.com
127.0.0.1	africaspromise.org
127.0.0.1	agava.com
127.0.0.1	agava.ru
127.0.0.1	agentstudio.com
127.0.0.1	aginegialle.it
127.0.0.1	www.aginegialle.it
127.0.0.1	www.aifind.info
127.0.0.1	aifind.info
127.0.0.1	airtleworld.com
127.0.0.1	www.airtleworld.com
127.0.0.1	aitalia.it
127.0.0.1	www.aitalia.it
127.0.0.1	akamai.downloadv3.com
127.0.0.1	aklitalia.it
127.0.0.1	www.aklitalia.it
127.0.0.1	akril.com
127.0.0.1	alcatel.ws
127.0.0.1	alfacleaner.com
127.0.0.1	www.alfacleaner.com
127.0.0.1	alfa-search.com
127.0.0.1	alialia.it
127.0.0.1	www.alialia.it
127.0.0.1	aliotalia.it
127.0.0.1	www.aliotalia.it
127.0.0.1	alirtalia.it
127.0.0.1	www.alirtalia.it
127.0.0.1	alitaia.it
127.0.0.1	www.alitaia.it
127.0.0.1	alitaklia.it
127.0.0.1	www.alitaklia.it
127.0.0.1	alitala.it
127.0.0.1	www.alitala.it
127.0.0.1	alitali.it
127.0.0.1	www.alitali.it
127.0.0.1	alitaliaq.it
127.0.0.1	www.alitaliaq.it
127.0.0.1	alitalias.it
127.0.0.1	www.alitalias.it
127.0.0.1	alitaliaz.it
127.0.0.1	www.alitaliaz.it
127.0.0.1	alitalioa.it
127.0.0.1	www.alitalioa.it
127.0.0.1	alitalisa.it
127.0.0.1	www.alitalisa.it
127.0.0.1	alitaliua.it
127.0.0.1	www.alitaliua.it
127.0.0.1	alitalkia.it
127.0.0.1	www.alitalkia.it
127.0.0.1	alitaloia.it
127.0.0.1	www.alitaloia.it
127.0.0.1	alitaluia.it
127.0.0.1	www.alitaluia.it
127.0.0.1	alitaslia.it
127.0.0.1	www.alitaslia.it
127.0.0.1	alitlia.it
127.0.0.1	www.alitlia.it
127.0.0.1	alitralia.it
127.0.0.1	www.alitralia.it
127.0.0.1	alitsalia.it
127.0.0.1	www.alitsalia.it
127.0.0.1	aliutalia.it
127.0.0.1	www.aliutalia.it
127.0.0.1	ALL1COUNT.NET
127.0.0.1	www.ALL1COUNT.NET
127.0.0.1	all4internet.com
127.0.0.1	www.all4internet.com
127.0.0.1	allabtcars.com
127.0.0.1	allabtjeeps.com
127.0.0.1	all-bittorrent.com
127.0.0.1	www.all-bittorrent.com
127.0.0.1	www.allcybersearch.com
127.0.0.1	allcybersearch.com
127.0.0.1	alldnserrors.com
127.0.0.1	www.alldnserrors.com
127.0.0.1	all-downloads-now.com
127.0.0.1	www.all-downloads-now.com
127.0.0.1	all-edonkey.com
127.0.0.1	www.all-edonkey.com
127.0.0.1	allforadult.com
127.0.0.1	allhyperlinks.com
127.0.0.1	alliesecurity.com
127.0.0.1	www.alliesecurity.com
127.0.0.1	all-inet.com
127.0.0.1	allinternetbusiness.com
127.0.0.1	all-limewire.com
127.0.0.1	www.all-limewire.com
127.0.0.1	allmegabucks.com
127.0.0.1	www.allmegabucks.com
127.0.0.1	allprotections.com
127.0.0.1	www.allprotections.com
127.0.0.1	allresultz.net
127.0.0.1	www.allresultz.net
127.0.0.1	allsecuritynotes.com
127.0.0.1	www.allsecuritynotes.com
127.0.0.1	allsecuritysite.com
127.0.0.1	www.allsecuritysite.com
127.0.0.1	allstarsvideos.net
127.0.0.1	www.allstarsvideos.net
127.0.0.1	alltruesoftware.com
127.0.0.1	www.alltruesoftware.com
127.0.0.1	allvideoactivex.com
127.0.0.1	www.allvideoactivex.com
127.0.0.1	almanah.biz
127.0.0.1	www.almanah.biz
127.0.0.1	almarvideos.com
127.0.0.1	aloitalia.it
127.0.0.1	www.aloitalia.it
127.0.0.1	aluitalia.it
127.0.0.1	www.aluitalia.it
127.0.0.1	amaena.com
127.0.0.1	www.amaena.com
127.0.0.1	amandamountains.com
127.0.0.1	amateurliveshow.com
127.0.0.1	www.amateurliveshow.com
127.0.0.1	amediasoftware.com
127.0.0.1	www.amediasoftware.com
127.0.0.1	amediasource.com
127.0.0.1	www.amediasource.com
127.0.0.1	americancarbargains.com
127.0.0.1	www.americancarbargains.com
127.0.0.1	american-teens.net
127.0.0.1	amigeek.com
127.0.0.1	amisbusiness.com
127.0.0.1	ampmsearch.com
127.0.0.1	www.ampmsearch.com
127.0.0.1	analcord.com
127.0.0.1	www.analcord.com
127.0.0.1	analmovi.com
127.0.0.1	anarchylolita.com
127.0.0.1	www.anarchylolita.com
127.0.0.1	anarchyporn.com
127.0.0.1	andromedical.com
127.0.0.1	www.andromedical.com
127.0.0.1	animepornmag.com
127.0.0.1	www.animepornmag.com
127.0.0.1	anin.org
127.0.0.1	anjpn-avxiz.biz
127.0.0.1	www.anjpn-avxiz.biz
127.0.0.1	anjpnzqav.biz
127.0.0.1	www.anjpnzqav.biz
127.0.0.1	anjpn-zqav.biz
127.0.0.1	www.anjpn-zqav.biz
127.0.0.1	annaromeo.com
127.0.0.1	antiddos.us
127.0.0.1	www.antiddos.us
127.0.0.1	Antiespiadorado.com
127.0.0.1	www.Antiespiadorado.com
127.0.0.1	Antiespionspack.com
127.0.0.1	www.Antiespionspack.com
127.0.0.1	Antigusanos2008.com
127.0.0.1	www.Antigusanos2008.com
127.0.0.1	Antispionage.com
127.0.0.1	www.Antispionage.com
127.0.0.1	Antispionagepro.com
127.0.0.1	www.Antispionagepro.com
127.0.0.1	antispydns.biz
127.0.0.1	www.antispydns.biz
127.0.0.1	antispylab.com
127.0.0.1	www.antispylab.com
127.0.0.1	antispysolutions.com
127.0.0.1	www.antispysolutions.com
127.0.0.1	antispyware.com
127.0.0.1	www.antispyware.com
127.0.0.1	antispywarebot.com
127.0.0.1	www.antispywarebot.com
127.0.0.1	antispywarebox.com
127.0.0.1	www.antispywarebox.com
127.0.0.1	antispywaredownloads.com
127.0.0.1	www.antispywaredownloads.com
127.0.0.1	Antispywaresuite.com
127.0.0.1	www.Antispywaresuite.com
127.0.0.1	Antispyweb.net
127.0.0.1	www.Antispyweb.net
127.0.0.1	Antiver2008.com
127.0.0.1	www.Antiver2008.com
127.0.0.1	antivermins.com
127.0.0.1	www.antivermins.com
127.0.0.1	anti-vermins.com
127.0.0.1	www.anti-vermins.com
127.0.0.1	antivir2007.com
127.0.0.1	www.antivir2007.com
127.0.0.1	antivirgear.com
127.0.0.1	www.antivirgear.com
127.0.0.1	antivirus.fastfreedownload.com
127.0.0.1	www.antivirus.fastfreedownload.com
127.0.0.1	antivirusgolden.com
127.0.0.1	www.antivirusgolden.com
127.0.0.1	antivirus-hq.net
127.0.0.1	www.antivirus-hq.net
127.0.0.1	anti-virus-pro.com
127.0.0.1	www.anti-virus-pro.com
127.0.0.1	antivirusprotector.com
127.0.0.1	www.antivirusprotector.com
127.0.0.1	antivirussecuritypro.com
127.0.0.1	www.antivirussecuritypro.com
127.0.0.1	antivirus-stop.com
127.0.0.1	www.antivirus-stop.com
127.0.0.1	Antiworm2008.com
127.0.0.1	www.Antiworm2008.com
127.0.0.1	Antiwurm2008.com
127.0.0.1	www.Antiwurm2008.com
127.0.0.1	antrocity.com
127.0.0.1	anyofus.com
127.0.0.1	www.anyofus.com
127.0.0.1	anysn.seproger.com
127.0.0.1	www.anysn.seproger.com
127.0.0.1	anything4health.com
127.0.0.1	apicpreview.com
127.0.0.1	www.apicpreview.com
127.0.0.1	appealcircuit.com
127.0.0.1	www.appealcircuit.com
127.0.0.1	approvedlinks.com
127.0.0.1	www.approvedlinks.com
127.0.0.1	apps.deskwizz.com
127.0.0.1	apps.webservicehost.com
127.0.0.1	aprotectedpage.com
127.0.0.1	www.aprotectedpage.com
127.0.0.1	apsua.com
127.0.0.1	archiviosex.net
127.0.0.1	www.archiviosex.net
127.0.0.1	aregay.com
127.0.0.1	ares-freebie.com
127.0.0.1	www.ares-freebie.com
127.0.0.1	arespro2007.com
127.0.0.1	www.arespro2007.com
127.0.0.1	aresultra.com
127.0.0.1	www.aresultra.com
127.0.0.1	ares-usa.com
127.0.0.1	www.ares-usa.com
127.0.0.1	arheo.com
127.0.0.1	arizonaweb.org
127.0.0.1	armitageinn.com
127.0.0.1	arquivojpgs.smtp.ru
127.0.0.1	www.arquivojpgs.smtp.ru
127.0.0.1	artachnid.com
127.0.0.1	art-func.com
127.0.0.1	art-xxx.com
127.0.0.1	asafebrowser.com
127.0.0.1	www.asafebrowser.com
127.0.0.1	asafetynotice.com
127.0.0.1	www.asafetynotice.com
127.0.0.1	asafetypage.com
127.0.0.1	www.asafetypage.com
127.0.0.1	asdbiz.biz
127.0.0.1	www.asdbiz.biz
127.0.0.1	asdeykuddq.com
127.0.0.1	www.asdeykuddq.com
127.0.0.1	asecurebar.com
127.0.0.1	www.asecurebar.com
127.0.0.1	asecureboard.com
127.0.0.1	www.asecureboard.com
127.0.0.1	asecurevalue.com
127.0.0.1	www.asecurevalue.com
127.0.0.1	asecurityissue.com
127.0.0.1	www.asecurityissue.com
127.0.0.1	asecuritynotice.com
127.0.0.1	www.asecuritynotice.com
127.0.0.1	asecuritypaper.com
127.0.0.1	www.asecuritypaper.com
127.0.0.1	asecuritystuff.com
127.0.0.1	www.asecuritystuff.com
127.0.0.1	asiankingkong.com
127.0.0.1	asianpornmag.com
127.0.0.1	www.asianpornmag.com
127.0.0.1	asiantoolbar.com
127.0.0.1	www.asiantoolbar.com
127.0.0.1	asidseiupc.com
127.0.0.1	www.asidseiupc.com
127.0.0.1	aslitalia.it
127.0.0.1	www.aslitalia.it
127.0.0.1	ass-gals.com
127.0.0.1	assureprotection.com
127.0.0.1	www.assureprotection.com
127.0.0.1	asta-killer.com
127.0.0.1	asupereva.it
127.0.0.1	www.asupereva.it
127.0.0.1	athenrye.com
127.0.0.1	atotalsafety.com
127.0.0.1	www.atotalsafety.com
127.0.0.1	atrueprotection.com
127.0.0.1	www.atrueprotection.com
127.0.0.1	atruesecurity.com
127.0.0.1	www.atruesecurity.com
127.0.0.1	attackware.com
127.0.0.1	www.attackware.com
127.0.0.1	attrezzi.biz
127.0.0.1	www.attrezzi.biz
127.0.0.1	aulde.net
127.0.0.1	www.aulde.net
127.0.0.1	aupereva.it
127.0.0.1	www.aupereva.it
127.0.0.1	autocontext.begun.ru
127.0.0.1	www.autocontext.begun.ru
127.0.0.1	autoescrowpay.com
127.0.0.1	avast.free-software-center.com
127.0.0.1	www.avast.free-software-center.com
127.0.0.1	avast-2007.com
127.0.0.1	www.avast-2007.com
127.0.0.1	avast-downloads.com
127.0.0.1	www.avast-downloads.com
127.0.0.1	avast-hq.com
127.0.0.1	www.avast-hq.com
127.0.0.1	avforce.com
127.0.0.1	www.avforce.com
127.0.0.1	avg.grab-it-today.net
127.0.0.1	www.avg.grab-it-today.net
127.0.0.1	avg.softwarecenterz.com
127.0.0.1	www.avg.softwarecenterz.com
127.0.0.1	avg-secure.com
127.0.0.1	www.avg-secure.com
127.0.0.1	avian-ads.com
127.0.0.1	avideoaxaccess.com
127.0.0.1	www.avideoaxaccess.com
127.0.0.1	avideosurfer.com
127.0.0.1	www.avideosurfer.com
127.0.0.1	aviewersoft.com
127.0.0.1	www.aviewersoft.com
127.0.0.1	avpcheckupdate.com
127.0.0.1	www.avpcheckupdate.com
127.0.0.1	avxizaaqada.biz
127.0.0.1	www.avxizaaqada.biz
127.0.0.1	avxiz-anjpn.biz
127.0.0.1	www.avxiz-anjpn.biz
127.0.0.1	avxizueorn.biz
127.0.0.1	www.avxizueorn.biz
127.0.0.1	avxiz-ueorn.biz
127.0.0.1	www.avxiz-ueorn.biz
127.0.0.1	avxiz-vtvcp.biz
127.0.0.1	www.avxiz-vtvcp.biz
127.0.0.1	avxiz-ygco.biz
127.0.0.1	www.avxiz-ygco.biz
127.0.0.1	avxiz-zqav.biz
127.0.0.1	www.avxiz-zqav.biz
127.0.0.1	awarninglist.com
127.0.0.1	www.awarninglist.com
127.0.0.1	awbeta.net-nucleus.com
127.0.0.1	awesomehomepage.com
127.0.0.1	www.awesomehomepage.com
127.0.0.1	awmcash.biz
127.0.0.1	awmdabest.com
127.0.0.1	axemediasoftware.com
127.0.0.1	www.axemediasoftware.com
127.0.0.1	aximageobject.com
127.0.0.1	www.aximageobject.com
127.0.0.1	axmediaproject.com
127.0.0.1	www.axmediaproject.com
127.0.0.1	axmediasoftware.com
127.0.0.1	www.axmediasoftware.com
127.0.0.1	axmediasolutions.com
127.0.0.1	www.axmediasolutions.com
127.0.0.1	axobjectpage.com
127.0.0.1	www.axobjectpage.com
127.0.0.1	axobjectsource.com
127.0.0.1	www.axobjectsource.com
127.0.0.1	axsoftwaretool.com
127.0.0.1	www.axsoftwaretool.com
127.0.0.1	axvideoproject.com
127.0.0.1	www.axvideoproject.com
127.0.0.1	axvideosetup.com
127.0.0.1	www.axvideosetup.com
127.0.0.1	ayakawamura.com
127.0.0.1	ayumitaniguchi.com
127.0.0.1	azebar.com
127.0.0.1	azureusclub.com
127.0.0.1	www.azureusclub.com
127.0.0.1	azureus-freebie.com
127.0.0.1	www.azureus-freebie.com
127.0.0.1	azzetta.it
127.0.0.1	www.azzetta.it
127.0.0.1	b.casalemedia.com
127.0.0.1	babe.k-lined.com
127.0.0.1	www.babe.k-lined.com
127.0.0.1	babe.the-killer.bz
127.0.0.1	www.babe.the-killer.bz
127.0.0.1	babenet.com
127.0.0.1	www.babenet.com
127.0.0.1	babespornmag.com
127.0.0.1	www.babespornmag.com
127.0.0.1	babeweb.de
127.0.0.1	www.babeweb.de
127.0.0.1	baccarat-other.info
127.0.0.1	www.baccarat-other.info
127.0.0.1	Backstripgirls.com
127.0.0.1	www.Backstripgirls.com
127.0.0.1	backup.mabou.org
127.0.0.1	balotierra.com
127.0.0.1	www.balotierra.com
127.0.0.1	bannedhost.net
127.0.0.1	barbudafarms.com
127.0.0.1	bardownload.com
127.0.0.1	www.bardownload.com
127.0.0.1	barnandfence.com
127.0.0.1	batsearch.com
127.0.0.1	baygraphicsllc.com
127.0.0.1	bbbsearch.com
127.0.0.1	bb-search.com
127.0.0.1	bdsmlibrary.net
127.0.0.1	bdsmpornmag.com
127.0.0.1	www.bdsmpornmag.com
127.0.0.1	bearshare.download-me.info
127.0.0.1	www.bearshare.download-me.info
127.0.0.1	bearshare.mp3-muzic.com
127.0.0.1	www.bearshare.mp3-muzic.com
127.0.0.1	bearshare-download.org
127.0.0.1	www.bearshare-download.org
127.0.0.1	bearshare-downloads.net
127.0.0.1	www.bearshare-downloads.net
127.0.0.1	bearsharelive.co.uk
127.0.0.1	www.bearsharelive.co.uk
127.0.0.1	bearshare-music-downloads.com
127.0.0.1	www.bearshare-music-downloads.com
127.0.0.1	bearsharepro2007.com
127.0.0.1	www.bearsharepro2007.com
127.0.0.1	bearshare-usa.com
127.0.0.1	www.bearshare-usa.com
127.0.0.1	bedhome.com
127.0.0.1	bediadance.com
127.0.0.1	beebappyy.biz
127.0.0.1	www.beebappyy.biz
127.0.0.1	begin2search.com
127.0.0.1	www.begin2search.com
127.0.0.1	bellabasketsfl.com
127.0.0.1	bernaolatwin.com
127.0.0.1	best-counter.com
127.0.0.1	bestcrawler.com
127.0.0.1	bestfor.ru
127.0.0.1	best-hardpics.com
127.0.0.1	bestmanage.org
127.0.0.1	www.bestmanage.org
127.0.0.1	bestmanage0.org
127.0.0.1	www.bestmanage0.org
127.0.0.1	bestmanage1.org
127.0.0.1	www.bestmanage1.org
127.0.0.1	bestmanage2.org
127.0.0.1	www.bestmanage2.org
127.0.0.1	bestmanage3.org
127.0.0.1	www.bestmanage3.org
127.0.0.1	bestmanage4.org
127.0.0.1	www.bestmanage4.org
127.0.0.1	bestmanage5.org
127.0.0.1	www.bestmanage5.org
127.0.0.1	bestmanage6.org
127.0.0.1	www.bestmanage6.org
127.0.0.1	bestmanage7.org
127.0.0.1	www.bestmanage7.org
127.0.0.1	bestmanage8.org
127.0.0.1	www.bestmanage8.org
127.0.0.1	bestmanage9.org
127.0.0.1	www.bestmanage9.org
127.0.0.1	bestporngate.com
127.0.0.1	bestsafetyguide.net
127.0.0.1	www.bestsafetyguide.net
127.0.0.1	best-spyware.info
127.0.0.1	www.best-spyware.info
127.0.0.1	best-targeted-traffic.com
127.0.0.1	www.best-targeted-traffic.com
127.0.0.1	best-voyeur.info
127.0.0.1	www.best-voyeur.info
127.0.0.1	bestweblinks.com
127.0.0.1	best-winning-casino.com
127.0.0.1	bestworldgirls-for-u.net
127.0.0.1	www.bestworldgirls-for-u.net
127.0.0.1	bestxporno.com
127.0.0.1	bettersearch.biz
127.0.0.1	www.bettersearch.biz
127.0.0.1	bgazzetta.it
127.0.0.1	www.bgazzetta.it
127.0.0.1	bgoogle.it
127.0.0.1	www.bgoogle.it
127.0.0.1	bigtrafficnetwork.com
127.0.0.1	www.bigtrafficnetwork.com
127.0.0.1	bigwww.com
127.0.0.1	www.bigwww.com
127.0.0.1	bins.media-motor.net
127.0.0.1	bins2.media-motor.net
127.0.0.1	bis.180solutions.com
127.0.0.1	bitchesonline.net
127.0.0.1	bitcomet-freebie.com
127.0.0.1	www.bitcomet-freebie.com
127.0.0.1	biz.biz
127.0.0.1	blackblues00.com
127.0.0.1	www.blackblues00.com
127.0.0.1	blackhats.tc
127.0.0.1	www.blackhats.tc
127.0.0.1	blackhawksoftware.com
127.0.0.1	www.blackhawksoftware.com
127.0.0.1	blackjack-free.net
127.0.0.1	blazefind.com
127.0.0.1	blender.xu.pl
127.0.0.1	blondetgp.com
127.0.0.1	blue-elefant.com
127.0.0.1	www.blue-elefant.com
127.0.0.1	bm.theaimonline.com
127.0.0.1	www.bm.theaimonline.com
127.0.0.1	bnmgate.com
127.0.0.1	www.bnmgate.com
127.0.0.1	bodaciousbabette.com
127.0.0.1	bonzi.com
127.0.0.1	www.bonzi.com
127.0.0.1	boobdoll.com
127.0.0.1	boobsandtits.com
127.0.0.1	boobsclub.com
127.0.0.1	bookedspace.com
127.0.0.1	www.bookedspace.com
127.0.0.1	boom.com.vn
127.0.0.1	www.boom.com.vn
127.0.0.1	boredlife.com
127.0.0.1	bowlofogumbo.com
127.0.0.1	bpfq02.com
127.0.0.1	www.bpfq02.com
127.0.0.1	bqgate.com
127.0.0.1	www.bqgate.com
127.0.0.1	bradcoem.org
127.0.0.1	braincodec.com
127.0.0.1	www.braincodec.com
127.0.0.1	brandiyoung.com
127.0.0.1	bravesentry.com
127.0.0.1	www.bravesentry.com
127.0.0.1	breenten.biz
127.0.0.1	www.breenten.biz
127.0.0.1	brodbfm.net
127.0.0.1	www.brodbfm.net
127.0.0.1	brookeburn.com
127.0.0.1	browserwise.com
127.0.0.1	www.browserwise.com
127.0.0.1	bucps.com
127.0.0.1	buhartes.info
127.0.0.1	buldog-stats.com
127.0.0.1	bullseye-network.com
127.0.0.1	www.bullseye-network.com
127.0.0.1	burgerkingbigscreen.com
127.0.0.1	burnsrecyclinginc.com
127.0.0.1	www.burnsrecyclinginc.com
127.0.0.1	buscards.net
127.0.0.1	bustyrussell.com
127.0.0.1	busysearch.net
127.0.0.1	www.busysearch.net
127.0.0.1	buttejazz.org
127.0.0.1	buy-find.info
127.0.0.1	www.buy-find.info
127.0.0.1	buyselldomain.net
127.0.0.1	buytraff.biz
127.0.0.1	www.buytraff.biz
127.0.0.1	buz.ru
127.0.0.1	bvirgilio.it
127.0.0.1	www.bvirgilio.it
127.0.0.1	c.centralmedia.ws
127.0.0.1	c.enhance.com
127.0.0.1	www.c.enhance.com
127.0.0.1	c.goclick.com
127.0.0.1	c4tdownload.com
127.0.0.1	www.c4tdownload.com
127.0.0.1	c5.www4free.info
127.0.0.1	www.c5.www4free.info
127.0.0.1	cache.surfaccuracy.com
127.0.0.1	www.cache.surfaccuracy.com
127.0.0.1	cache.ysbweb.com
127.0.0.1	calcioturris.com
127.0.0.1	calendaralerts.net
127.0.0.1	www.calendaralerts.net
127.0.0.1	cameouk.co.uk
127.0.0.1	www.cameouk.co.uk
127.0.0.1	cameup.com
127.0.0.1	camouflageclothingonline.net
127.0.0.1	www.camouflageclothingonline.net
127.0.0.1	camup.net
127.0.0.1	canberracricketcoaching.com
127.0.0.1	candycantaloupes.com
127.0.0.1	canidetect.org
127.0.0.1	www.canidetect.org
127.0.0.1	cantfind.com
127.0.0.1	www.cantfind.com
127.0.0.1	careers.dulcineasystems.net
127.0.0.1	carsands.com
127.0.0.1	carsrentals.net
127.0.0.1	cartoes.uol.com.br
127.0.0.1	casalemedia.com
127.0.0.1	www.casalemedia.com
127.0.0.1	cashdeluxe.net
127.0.0.1	www.cashdeluxe.net
127.0.0.1	cashengines.com
127.0.0.1	www.cashengines.com
127.0.0.1	cashsearch.biz
127.0.0.1	cashsurfers.com
127.0.0.1	www.cashsurfers.com
127.0.0.1	CashUnlim.com
127.0.0.1	www.CashUnlim.com
127.0.0.1	casino.com.free.game.pogo.gratisdownloads.nl
127.0.0.1	casino2win.net
127.0.0.1	casino-gambling-1.net
127.0.0.1	casino-gambling-2.net
127.0.0.1	casinomidas.net
127.0.0.1	casinonline.net
127.0.0.1	casino-onlines.net
127.0.0.1	castingsamateur.com
127.0.0.1	www.castingsamateur.com
127.0.0.1	catallogue.com
127.0.0.1	catch-dc.info
127.0.0.1	www.catch-dc.info
127.0.0.1	categories.mygeek.com
127.0.0.1	catsss.da.ru
127.0.0.1	caxa.ru
127.0.0.1	cc.panet.org
127.0.0.1	ccecaedbebfcaf.com
127.0.0.1	www.ccecaedbebfcaf.com
127.0.0.1	cclebali.org
127.0.0.1	ccorriere.it
127.0.0.1	www.ccorriere.it
127.0.0.1	cdegate.com
127.0.0.1	www.cdegate.com
127.0.0.1	cdn.movies-etc.com
127.0.0.1	cdn2.movies-etc.com
127.0.0.1	cdorriere.it
127.0.0.1	www.cdorriere.it
127.0.0.1	ceewawires.org
127.0.0.1	centralmedia.ws
127.0.0.1	certumgroup.com
127.0.0.1	cforriere.it
127.0.0.1	www.cforriere.it
127.0.0.1	check.jupitersatellites.biz
127.0.0.1	www.check.jupitersatellites.biz
127.0.0.1	checkin100.com
127.0.0.1	www.checkin100.com
127.0.0.1	checkssecurity.com
127.0.0.1	www.checkssecurity.com
127.0.0.1	chelancatering.com
127.0.0.1	chenshijituan.com
127.0.0.1	www.chenshijituan.com
127.0.0.1	childrenvilla.com
127.0.0.1	chips-4-free.com
127.0.0.1	chrisswasey.com
127.0.0.1	chriswallace.net
127.0.0.1	cia-trjn.myvnc.com
127.0.0.1	www.cia-trjn.myvnc.com
127.0.0.1	ciorriere.it
127.0.0.1	www.ciorriere.it
127.0.0.1	cirriere.it
127.0.0.1	www.cirriere.it
127.0.0.1	ckick4thumbs.com
127.0.0.1	cl55.biz
127.0.0.1	clackamasliteraryreview.com
127.0.0.1	cleansoftwares.com
127.0.0.1	www.cleansoftwares.com
127.0.0.1	clearsearch.cc
127.0.0.1	clearsearch.net
127.0.0.1	clickaire.com
127.0.0.1	click-codec.com
127.0.0.1	www.click-codec.com
127.0.0.1	clickhere4search.com
127.0.0.1	www.clickhere4search.com
127.0.0.1	click-now.net
127.0.0.1	clickspring.net
127.0.0.1	www.clickspring.net
127.0.0.1	click-to-download.com
127.0.0.1	www.click-to-download.com
127.0.0.1	clicktomakeasearch.com
127.0.0.1	www.clicktomakeasearch.com
127.0.0.1	clickyestoenter.net
127.0.0.1	client.exeupdate.com
127.0.0.1	client.myadultexplorer.com
127.0.0.1	cliks.org
127.0.0.1	www.cliks.org
127.0.0.1	clorriere.it
127.0.0.1	www.clorriere.it
127.0.0.1	clrsch.com
127.0.0.1	clubxxxvideo.com
127.0.0.1	www.clubxxxvideo.com
127.0.0.1	clusif.free.fr
127.0.0.1	cmtapestry.com
127.0.0.1	cnetadd.com
127.0.0.1	www.cnetadd.com
127.0.0.1	cnzz.com
127.0.0.1	www.cnzz.com
127.0.0.1	code.ignphrases.com
127.0.0.1	codec.ninoa.com
127.0.0.1	codecdvd.net
127.0.0.1	www.codecdvd.net
127.0.0.1	codec-fun.com
127.0.0.1	www.codec-fun.com
127.0.0.1	codecsoft.net
127.0.0.1	www.codecsoft.net
127.0.0.1	codrriere.it
127.0.0.1	www.codrriere.it
127.0.0.1	coeriere.it
127.0.0.1	www.coeriere.it
127.0.0.1	coerriere.it
127.0.0.1	www.coerriere.it
127.0.0.1	cofrriere.it
127.0.0.1	www.cofrriere.it
127.0.0.1	cogrriere.it
127.0.0.1	www.cogrriere.it
127.0.0.1	coirriere.it
127.0.0.1	www.coirriere.it
127.0.0.1	command.adservs.com
127.0.0.1	www.commonname.com
127.0.0.1	computerpcgames.net
127.0.0.1	www.computerpcgames.net
127.0.0.1	computerrecover.com
127.0.0.1	www.computerrecover.com
127.0.0.1	config.180solutions.com
127.0.0.1	content.dollarrevenue.com
127.0.0.1	www.content.dollarrevenue.com
127.0.0.1	content.ireit.com
127.0.0.1	www.content.ireit.com
127.0.0.1	content.onerateld.com
127.0.0.1	contentmatch.net
127.0.0.1	www.contentmatch.net
127.0.0.1	contra-virus.com
127.0.0.1	www.contra-virus.com
127.0.0.1	controlmeh.com
127.0.0.1	www.controlmeh.com
127.0.0.1	cooldeskalert.com
127.0.0.1	www.cooldeskalert.com
127.0.0.1	coolfetishsite.com
127.0.0.1	coolfreehost.com
127.0.0.1	coolfreepage.com
127.0.0.1	coolfreepages.com
127.0.0.1	cool-homepage.co
127.0.0.1	cool-homepage.com
127.0.0.1	coolmoneysearch.com
127.0.0.1	coolpornsearch.com
127.0.0.1	cool-search.net
127.0.0.1	cool-search.netfartpost.com
127.0.0.1	coolsearcher.info
127.0.0.1	coolservecorp.net
127.0.0.1	www.coolservecorp.net
127.0.0.1	coolwebsearch.com
127.0.0.1	www.coolwebsearch.com
127.0.0.1	cool-web-search.com
127.0.0.1	coolwebsearsh.com
127.0.0.1	coolwwwsearch.com
127.0.0.1	www.coolwwwsearch.com
127.0.0.1	cool-xxx.net
127.0.0.1	coorriere.it
127.0.0.1	www.coorriere.it
127.0.0.1	copmtraine.com
127.0.0.1	coprriere.it
127.0.0.1	www.coprriere.it
127.0.0.1	core.psyche-evolution.com
127.0.0.1	www.core.psyche-evolution.com
127.0.0.1	coreiere.it
127.0.0.1	www.coreiere.it
127.0.0.1	coreriere.it
127.0.0.1	www.coreriere.it
127.0.0.1	corrdiere.it
127.0.0.1	www.corrdiere.it
127.0.0.1	correiere.it
127.0.0.1	www.correiere.it
127.0.0.1	corrfiere.it
127.0.0.1	www.corrfiere.it
127.0.0.1	corrgiere.it
127.0.0.1	www.corrgiere.it
127.0.0.1	corridere.it
127.0.0.1	www.corridere.it
127.0.0.1	corriedre.it
127.0.0.1	www.corriedre.it
127.0.0.1	corriee.it
127.0.0.1	www.corriee.it
127.0.0.1	corrieere.it
127.0.0.1	www.corrieere.it
127.0.0.1	corriefre.it
127.0.0.1	www.corriefre.it
127.0.0.1	corriegre.it
127.0.0.1	www.corriegre.it
127.0.0.1	corrierde.it
127.0.0.1	www.corrierde.it
127.0.0.1	corriered.it
127.0.0.1	www.corriered.it
127.0.0.1	corrieree.it
127.0.0.1	www.corrieree.it
127.0.0.1	corrieref.it
127.0.0.1	www.corrieref.it
127.0.0.1	corrierer.it
127.0.0.1	www.corrierer.it
127.0.0.1	corrieres.it
127.0.0.1	www.corrieres.it
127.0.0.1	corrierew.it
127.0.0.1	www.corrierew.it
127.0.0.1	corrierfe.it
127.0.0.1	www.corrierfe.it
127.0.0.1	corrierge.it
127.0.0.1	www.corrierge.it
127.0.0.1	corrierr.it
127.0.0.1	www.corrierr.it
127.0.0.1	corrierre.it
127.0.0.1	www.corrierre.it
127.0.0.1	corrierse.it
127.0.0.1	www.corrierse.it
127.0.0.1	corrierte.it
127.0.0.1	www.corrierte.it
127.0.0.1	corrierw.it
127.0.0.1	www.corrierw.it
127.0.0.1	corrierwe.it
127.0.0.1	www.corrierwe.it
127.0.0.1	corriesre.it
127.0.0.1	www.corriesre.it
127.0.0.1	corriete.it
127.0.0.1	www.corriete.it
127.0.0.1	corrietre.it
127.0.0.1	www.corrietre.it
127.0.0.1	corriewre.it
127.0.0.1	www.corriewre.it
127.0.0.1	corrifere.it
127.0.0.1	www.corrifere.it
127.0.0.1	corriiere.it
127.0.0.1	www.corriiere.it
127.0.0.1	corrilere.it
127.0.0.1	www.corrilere.it
127.0.0.1	corrioere.it
127.0.0.1	www.corrioere.it
127.0.0.1	corrire.it
127.0.0.1	www.corrire.it
127.0.0.1	corrirere.it
127.0.0.1	www.corrirere.it
127.0.0.1	corrirre.it
127.0.0.1	www.corrirre.it
127.0.0.1	corrisere.it
127.0.0.1	www.corrisere.it
127.0.0.1	corriuere.it
127.0.0.1	www.corriuere.it
127.0.0.1	corriwere.it
127.0.0.1	www.corriwere.it
127.0.0.1	corriwre.it
127.0.0.1	www.corriwre.it
127.0.0.1	corrliere.it
127.0.0.1	www.corrliere.it
127.0.0.1	corroere.it
127.0.0.1	www.corroere.it
127.0.0.1	corroiere.it
127.0.0.1	www.corroiere.it
127.0.0.1	corrriere.it
127.0.0.1	www.corrriere.it
127.0.0.1	corrtiere.it
127.0.0.1	www.corrtiere.it
127.0.0.1	corruere.it
127.0.0.1	www.corruere.it
127.0.0.1	corruiere.it
127.0.0.1	www.corruiere.it
127.0.0.1	cortiere.it
127.0.0.1	www.cortiere.it
127.0.0.1	cortriere.it
127.0.0.1	www.cortriere.it
127.0.0.1	costrike.com
127.0.0.1	www.costrike.com
127.0.0.1	cotriere.it
127.0.0.1	www.cotriere.it
127.0.0.1	cotrriere.it
127.0.0.1	www.cotrriere.it
127.0.0.1	couldnotfind.com
127.0.0.1	count.cc
127.0.0.1	count.hitscount.net
127.0.0.1	count-all.com
127.0.0.1	countdutycall.info
127.0.0.1	www.countdutycall.info
127.0.0.1	counter.sexmaniack.com
127.0.0.1	cporriere.it
127.0.0.1	www.cporriere.it
127.0.0.1	cprriere.it
127.0.0.1	www.cprriere.it
127.0.0.1	cpvfeed.com
127.0.0.1	cracks.me.uk
127.0.0.1	cracks4all.com
127.0.0.1	www.cracks4all.com
127.0.0.1	crapsgold.info
127.0.0.1	www.crapsgold.info
127.0.0.1	Crazygirls-world.com
127.0.0.1	crazywinnings.com
127.0.0.1	www.crazywinnings.com
127.0.0.1	creamedcutties.com
127.0.0.1	createaccesskey.com
127.0.0.1	www.createaccesskey.com
127.0.0.1	creditsearchonline.com
127.0.0.1	crestring.com
127.0.0.1	crooder.com
127.0.0.1	crriere.it
127.0.0.1	www.crriere.it
127.0.0.1	crystalysmedia.com
127.0.0.1	www.crystalysmedia.com
127.0.0.1	csx.adservs.com
127.0.0.1	www.csx.adservs.com
127.0.0.1	cts.180solutions.com
127.0.0.1	cuisinartoven.com
127.0.0.1	www.cuisinartoven.com
127.0.0.1	curedc.info
127.0.0.1	www.curedc.info
127.0.0.1	curepcsolutions.com
127.0.0.1	www.curepcsolutions.com
127.0.0.1	curvedspaces.com
127.0.0.1	cutadult.com
127.0.0.1	www.cutadult.com
127.0.0.1	cvirgilio.it
127.0.0.1	www.cvirgilio.it
127.0.0.1	cvorriere.it
127.0.0.1	www.cvorriere.it
127.0.0.1	cvs.jps.ru
127.0.0.1	cvsymphony.com
127.0.0.1	cxorriere.it
127.0.0.1	www.cxorriere.it
127.0.0.1	cyberrape.com
127.0.0.1	www.cyberrape.com
127.0.0.1	cydom.com
127.0.0.1	cydoor.com
127.0.0.1	www.cydoor.com
127.0.0.1	daily-gals.com
127.0.0.1	dailypornmag.com
127.0.0.1	www.dailypornmag.com
127.0.0.1	dailyteenspic.com
127.0.0.1	dailytoolbar.com
127.0.0.1	www.dailytoolbar.com
127.0.0.1	dancingbabycd.com
127.0.0.1	data-hoster.com
127.0.0.1	www.data-hoster.com
127.0.0.1	datanotary.com
127.0.0.1	datareco.com
127.0.0.1	dating-galaxy.info
127.0.0.1	www.dating-galaxy.info
127.0.0.1	dating-search.net
127.0.0.1	davemarshall.org
127.0.0.1	db105.com
127.0.0.1	dbdecicated.com
127.0.0.1	www.dbdecicated.com
127.0.0.1	dbxcompany.com
127.0.0.1	www.dbxcompany.com
127.0.0.1	dcdl.dmcast.com
127.0.0.1	dcfitusa.com
127.0.0.1	dcorriere.it
127.0.0.1	www.dcorriere.it
127.0.0.1	dcurtis.com
127.0.0.1	www.dcurtis.com
127.0.0.1	dcww.dmcast.com
127.0.0.1	de.ag
127.0.0.1	de.drivecleaner.com
127.0.0.1	de98.remsys.org
127.0.0.1	debay.it
127.0.0.1	www.debay.it
127.0.0.1	dedmazay.3322.org
127.0.0.1	dedsearch.com
127.0.0.1	www.dedsearch.com
127.0.0.1	defaultsearch.net
127.0.0.1	Defensaantimalware.com
127.0.0.1	www.Defensaantimalware.com
127.0.0.1	deja-rue.com
127.0.0.1	www.deja-rue.com
127.0.0.1	derklaif.biz
127.0.0.1	www.derklaif.biz
127.0.0.1	derrari.it
127.0.0.1	www.derrari.it
127.0.0.1	desarrollocreativo.com
127.0.0.1	deskbar.worldtostart.com
127.0.0.1	www.deskbar.worldtostart.com
127.0.0.1	deskwizz.com
127.0.0.1	www.deskwizz.com
127.0.0.1	dev.ntcor.com
127.0.0.1	develip.com
127.0.0.1	dewis.spb.ru
127.0.0.1	dewis.us
127.0.0.1	df809jow4wj2304lfd0sf9fsd0a2t4ldf809jow4wj2304lfd0sf9fsd0a2t4ld.biz
127.0.0.1	dgbusiness.com
127.0.0.1	www.dgbusiness.com
127.0.0.1	dialer2004.com
127.0.0.1	dialerclub.com
127.0.0.1	www.dialerclub.com
127.0.0.1	dialer-shop.com
127.0.0.1	www.dialer-shop.com
127.0.0.1	dialoff.com
127.0.0.1	www.dialoff.com
127.0.0.1	did.i-used.cc
127.0.0.1	www.did.i-used.cc
127.0.0.1	dietpills4free.com
127.0.0.1	dietpussy.com
127.0.0.1	digikeygen.com
127.0.0.1	www.digikeygen.com
127.0.0.1	digistreamsa.com
127.0.0.1	digitalcoders.net
127.0.0.1	www.digitalcoders.net
127.0.0.1	www.digitalfan.com
127.0.0.1	digital-pornography.com
127.0.0.1	dionforvalleycouncil.org
127.0.0.1	directdvdpro.com
127.0.0.1	www.directdvdpro.com
127.0.0.1	directporta.info
127.0.0.1	www.directporta.info
127.0.0.1	directsearchzone.com
127.0.0.1	www.directsearchzone.com
127.0.0.1	dist.checkin100.com
127.0.0.1	dl.ad-ware.cc
127.0.0.1	dl.malwarewipe.com
127.0.0.1	dl.targetsaver.com
127.0.0.1	www.dl.targetsaver.com
127.0.0.1	dl.web-nexus.net
127.0.0.1	dl1.antivermins.com
127.0.0.1	dl1.antivirgear.com
127.0.0.1	dl1.spydawn.com
127.0.0.1	dl1.virusprotectpro.com
127.0.0.1	dl10.spyfalcon.com
127.0.0.1	dl16.spyfalcon.com
127.0.0.1	dl2.spyfalcon.com
127.0.0.1	dl2.spyheal.com
127.0.0.1	dl2.spywarestrike.com
127.0.0.1	dl3.spyfalcon.com
127.0.0.1	dl3.spyheal.com
127.0.0.1	dl3.spywarestrike.com
127.0.0.1	dl4.spyfalcon.com
127.0.0.1	dl4.spywarestrike.com
127.0.0.1	dl5.spyfalcon.com
127.0.0.1	dl5.spywarestrike.com
127.0.0.1	dl6.spywarestrike.com
127.0.0.1	dl7.spywarestrike.com
127.0.0.1	dl8.spyheal.com
127.0.0.1	dl8.spywarestrike.com
127.0.0.1	dl9.spyfalcon.com
127.0.0.1	dmcast.com
127.0.0.1	www.dmcast.com
127.0.0.1	dnaads.com
127.0.0.1	www.dnaads.com
127.0.0.1	dnl.mabou.org
127.0.0.1	doctorwaldron.com
127.0.0.1	document-not-found.pornpic.org
127.0.0.1	doggyaction.com
127.0.0.1	dogproblemswebsite.com
127.0.0.1	www.dogproblemswebsite.com
127.0.0.1	doktorxxx.com
127.0.0.1	dollarrevenue.com
127.0.0.1	domaincar.com
127.0.0.1	www.domaincar.com
127.0.0.1	domains2003.net
127.0.0.1	domains-for-you-online.com
127.0.0.1	domain-your-registration.com
127.0.0.1	domkrat.com
127.0.0.1	dotcomtoolbar.com
127.0.0.1	www.dotcomtoolbar.com
127.0.0.1	down.136136.net
127.0.0.1	download.abetterinternet.com
127.0.0.1	download.antispywarebot.com
127.0.0.1	www.download.antispywarebot.com
127.0.0.1	download.bardownload.com
127.0.0.1	www.download.bardownload.com
127.0.0.1	download.bravesentry.com
127.0.0.1	www.download.bravesentry.com
127.0.0.1	download.jupitersatellites.biz
127.0.0.1	www.download.jupitersatellites.biz
127.0.0.1	download.searchtabs.net
127.0.0.1	download.secureyournet.biz
127.0.0.1	www.download.secureyournet.biz
127.0.0.1	download.spyonthis.net
127.0.0.1	download.spy-shredder.com
127.0.0.1	download.winantivirus.com
127.0.0.1	download10.spywarequake.com
127.0.0.1	download11.spywarequake.com
127.0.0.1	download12.spywarequake.com
127.0.0.1	download13.spywarequake.com
127.0.0.1	download15.spywarequake.com
127.0.0.1	download2.spywarequake.com
127.0.0.1	download-2007.com
127.0.0.1	www.download-2007.com
127.0.0.1	download3.spyaxe.com
127.0.0.1	download3.spywarequake.com
127.0.0.1	download4.spyaxe.com
127.0.0.1	download4.spywarequake.com
127.0.0.1	download5.spyaxe.com
127.0.0.1	download5.spywarequake.com
127.0.0.1	download6.spyaxe.com
127.0.0.1	download7.spywarequake.com
127.0.0.1	download8.spywarequake.com
127.0.0.1	download9.spywarequake.com
127.0.0.1	download-ad-aware.com
127.0.0.1	www.download-ad-aware.com
127.0.0.1	download-all-4-free.com
127.0.0.1	www.download-all-4-free.com
127.0.0.1	download-all-area.com
127.0.0.1	www.download-all-area.com
127.0.0.1	download-antivir.com
127.0.0.1	www.download-antivir.com
127.0.0.1	downloadanysong.com
127.0.0.1	www.downloadanysong.com
127.0.0.1	download-avast.com
127.0.0.1	www.download-avast.com
127.0.0.1	downloadcorporation.com
127.0.0.1	www.downloadcorporation.com
127.0.0.1	download-dvdshrink.com
127.0.0.1	www.download-dvdshrink.com
127.0.0.1	download-for-free.net
127.0.0.1	www.download-for-free.net
127.0.0.1	downloadfreesoft.com
127.0.0.1	www.downloadfreesoft.com
127.0.0.1	downloadfreeway.com
127.0.0.1	www.downloadfreeway.com
127.0.0.1	downloadimesh.com
127.0.0.1	www.downloadimesh.com
127.0.0.1	download-itunes-now.com
127.0.0.1	www.download-itunes-now.com
127.0.0.1	download-limewire.org
127.0.0.1	www.download-limewire.org
127.0.0.1	downloadlost.tv
127.0.0.1	www.downloadlost.tv
127.0.0.1	downloadmax.net
127.0.0.1	www.downloadmax.net
127.0.0.1	download-mcafee.com
127.0.0.1	www.download-mcafee.com
127.0.0.1	download-me.info
127.0.0.1	downloadmediaax.com
127.0.0.1	www.downloadmediaax.com
127.0.0.1	downloadpics.net
127.0.0.1	www.downloadpics.net
127.0.0.1	download-real-player.com
127.0.0.1	www.download-real-player.com
127.0.0.1	downloads.180solutions.com
127.0.0.1	downloads.adaware.cc
127.0.0.1	downloadservicearea.com
127.0.0.1	www.downloadservicearea.com
127.0.0.1	downloads-free.org
127.0.0.1	www.downloads-free.org
127.0.0.1	downloadsglobe.com
127.0.0.1	www.downloadsglobe.com
127.0.0.1	download-this.us
127.0.0.1	www.download-this.us
127.0.0.1	download-trillian.com
127.0.0.1	www.download-trillian.com
127.0.0.1	downloadv3.com
127.0.0.1	www.downloadv3.com
127.0.0.1	downloadvax.com
127.0.0.1	www.downloadvax.com
127.0.0.1	download-windvd.com
127.0.0.1	www.download-windvd.com
127.0.0.1	download-winrar.com
127.0.0.1	www.download-winrar.com
127.0.0.1	downloadwizard.com
127.0.0.1	downloadzcenter.com
127.0.0.1	downloadzcentral.com
127.0.0.1	downloadzfree.com
127.0.0.1	www.downloadzfree.com
127.0.0.1	downloadznow.net
127.0.0.1	download-zone-free.com
127.0.0.1	www.download-zone-free.com
127.0.0.1	download-zone-free.net
127.0.0.1	www.download-zone-free.net
127.0.0.1	dp-host.com
127.0.0.1	dr.mcboo.com
127.0.0.1	dr.webhancer.com
127.0.0.1	www.dr.webhancer.com
127.0.0.1	dr2.webhancer.com
127.0.0.1	www.dr2.webhancer.com
127.0.0.1	dr38.mcboo.com
127.0.0.1	dr47.mcboo.com
127.0.0.1	dragqueen.gay-clan.com
127.0.0.1	drepubblica.it
127.0.0.1	www.drepubblica.it
127.0.0.1	drivecleanr.com
127.0.0.1	www.drivecleanr.com
127.0.0.1	drocherway.com
127.0.0.1	dropspam.com
127.0.0.1	www.dropspam.com
127.0.0.1	drug-sources-exposed.com
127.0.0.1	drvvv.com
127.0.0.1	dsupereva.it
127.0.0.1	www.dsupereva.it
127.0.0.1	dtlproduct.com
127.0.0.1	www.dtlproduct.com
127.0.0.1	dudu.com
127.0.0.1	www.dudu.com
127.0.0.1	dulcineasystems.net
127.0.0.1	dumpserv.com
127.0.0.1	duolaimi.net
127.0.0.1	dutch-sex.com
127.0.0.1	dvdaccess.net
127.0.0.1	www.dvdaccess.net
127.0.0.1	dvdbank.org
127.0.0.1	dvdcodec.net
127.0.0.1	www.dvdcodec.net
127.0.0.1	dvdsmovies.net
127.0.0.1	www.dvdsmovies.net
127.0.0.1	dvdsvideos.net
127.0.0.1	www.dvdsvideos.net
127.0.0.1	dvdtocdsite.com
127.0.0.1	www.dvdtocdsite.com
127.0.0.1	e3bay.it
127.0.0.1	www.e3bay.it
127.0.0.1	e4bay.it
127.0.0.1	www.e4bay.it
127.0.0.1	eager-sex.com
127.0.0.1	earthllnk.net
127.0.0.1	www.earthllnk.net
127.0.0.1	eases.net
127.0.0.1	easyantispy.com
127.0.0.1	easybestdeals.com
127.0.0.1	www.easybestdeals.com
127.0.0.1	easycategories.com
127.0.0.1	easymp3musicnow.com
127.0.0.1	www.easymp3musicnow.com
127.0.0.1	easy-pharmacy.info
127.0.0.1	www.easy-pharmacy.info
127.0.0.1	easy-search.net
127.0.0.1	easysearch4you.com
127.0.0.1	www.easysearch4you.com
127.0.0.1	easysearchingtips.com
127.0.0.1	easyspyware.com
127.0.0.1	www.easyspyware.com
127.0.0.1	easywww.info
127.0.0.1	www.easywww.info
127.0.0.1	eba6y.it
127.0.0.1	www.eba6y.it
127.0.0.1	eba7y.it
127.0.0.1	www.eba7y.it
127.0.0.1	ebaay.it
127.0.0.1	www.ebaay.it
127.0.0.1	ebagy.it
127.0.0.1	www.ebagy.it
127.0.0.1	ebahy.it
127.0.0.1	www.ebahy.it
127.0.0.1	ebajy.it
127.0.0.1	www.ebajy.it
127.0.0.1	ebaqy.it
127.0.0.1	www.ebaqy.it
127.0.0.1	ebasy.it
127.0.0.1	www.ebasy.it
127.0.0.1	ebaty.it
127.0.0.1	www.ebaty.it
127.0.0.1	ebauy.it
127.0.0.1	www.ebauy.it
127.0.0.1	ebav.com
127.0.0.1	ebaw.com
127.0.0.1	ebawy.it
127.0.0.1	www.ebawy.it
127.0.0.1	ebaxy.it
127.0.0.1	www.ebaxy.it
127.0.0.1	ebay6.it
127.0.0.1	www.ebay6.it
127.0.0.1	ebay7.it
127.0.0.1	www.ebay7.it
127.0.0.1	ebayg.it
127.0.0.1	www.ebayg.it
127.0.0.1	ebayh.it
127.0.0.1	www.ebayh.it
127.0.0.1	ebayj.it
127.0.0.1	www.ebayj.it
127.0.0.1	ebayt.it
127.0.0.1	www.ebayt.it
127.0.0.1	ebayu.it
127.0.0.1	www.ebayu.it
127.0.0.1	ebazy.it
127.0.0.1	www.ebazy.it
127.0.0.1	ebch.com
127.0.0.1	ebdv.com
127.0.0.1	ebdw.com
127.0.0.1	ebestfind.org
127.0.0.1	www.ebestfind.org
127.0.0.1	ebgay.it
127.0.0.1	www.ebgay.it
127.0.0.1	ebgo.com
127.0.0.1	ebhay.it
127.0.0.1	www.ebhay.it
127.0.0.1	ebjp.com
127.0.0.1	ebkb.com
127.0.0.1	ebkn.com
127.0.0.1	ebky.com
127.0.0.1	eblv.com
127.0.0.1	ebmu.com
127.0.0.1	ebnay.it
127.0.0.1	www.ebnay.it
127.0.0.1	ebony-pornmag.com
127.0.0.1	www.ebony-pornmag.com
127.0.0.1	ebonypornmag.com
127.0.0.1	www.ebonypornmag.com
127.0.0.1	ebqay.it
127.0.0.1	www.ebqay.it
127.0.0.1	ebsay.it
127.0.0.1	www.ebsay.it
127.0.0.1	ebsy.it
127.0.0.1	www.ebsy.it
127.0.0.1	ebvay.it
127.0.0.1	www.ebvay.it
127.0.0.1	ebvr.com
127.0.0.1	ebway.it
127.0.0.1	www.ebway.it
127.0.0.1	ebxay.it
127.0.0.1	www.ebxay.it
127.0.0.1	ebzay.it
127.0.0.1	www.ebzay.it
127.0.0.1	ecmp.com
127.0.0.1	ecosrioplatenses.org
127.0.0.1	ecstasyporn.net
127.0.0.1	ecwz.com
127.0.0.1	ecyb.com
127.0.0.1	edbay.it
127.0.0.1	www.edbay.it
127.0.0.1	edhq.com
127.0.0.1	edietprogram.com
127.0.0.1	www.edietprogram.com
127.0.0.1	edty.com
127.0.0.1	eduy.com
127.0.0.1	eebay.it
127.0.0.1	www.eebay.it
127.0.0.1	eeev.com
127.0.0.1	eepubblica.it
127.0.0.1	www.eepubblica.it
127.0.0.1	efbay.it
127.0.0.1	www.efbay.it
127.0.0.1	egbay.it
127.0.0.1	www.egbay.it
127.0.0.1	ehbay.it
127.0.0.1	www.ehbay.it
127.0.0.1	eikokoike.com
127.0.0.1	elitecodec.com
127.0.0.1	www.elitecodec.com
127.0.0.1	elitemediagroup.net
127.0.0.1	www.elitemediagroup.net
127.0.0.1	e-localad.com
127.0.0.1	emailicon.org
127.0.0.1	www.emailicon.org
127.0.0.1	emch.com
127.0.0.1	emcodec.com
127.0.0.1	www.emcodec.com
127.0.0.1	emediacodec.com
127.0.0.1	www.emediacodec.com
127.0.0.1	emule.mp3-muzic.com
127.0.0.1	www.emule.mp3-muzic.com
127.0.0.1	emuledownloadhome.com
127.0.0.1	www.emuledownloadhome.com
127.0.0.1	emule-freebie.com
127.0.0.1	www.emule-freebie.com
127.0.0.1	enay.it
127.0.0.1	www.enay.it
127.0.0.1	enbay.it
127.0.0.1	www.enbay.it
127.0.0.1	energy-factor.com
127.0.0.1	www.energy-factor.com
127.0.0.1	engineplay.com
127.0.0.1	www.engineplay.com
127.0.0.1	engine-ticket.com
127.0.0.1	www.engine-ticket.com
127.0.0.1	enhance.com
127.0.0.1	www.enhance.com
127.0.0.1	enhancevideos.com
127.0.0.1	www.enhancevideos.com
127.0.0.1	enitinvest.net
127.0.0.1	enjoywebsurf.com
127.0.0.1	entertainsite.net
127.0.0.1	www.entertainsite.net
127.0.0.1	enterthesearch.com
127.0.0.1	www.enterthesearch.com
127.0.0.1	e-plus.cc
127.0.0.1	epornsex.com
127.0.0.1	eprotectionline.com
127.0.0.1	www.eprotectionline.com
127.0.0.1	eprotectpage.com
127.0.0.1	www.eprotectpage.com
127.0.0.1	erbay.it
127.0.0.1	www.erbay.it
127.0.0.1	erepubblica.it
127.0.0.1	www.erepubblica.it
127.0.0.1	ergosites.com
127.0.0.1	erossoalice.it
127.0.0.1	www.erossoalice.it
127.0.0.1	errari.it
127.0.0.1	www.errari.it
127.0.0.1	error404site.com
127.0.0.1	www.error404site.com
127.0.0.1	error404site.net
127.0.0.1	www.error404site.net
127.0.0.1	errorkiller.com
127.0.0.1	www.errorkiller.com
127.0.0.1	errorsdns.com
127.0.0.1	www.errorsdns.com
127.0.0.1	ert0003.e76.163ns.com
127.0.0.1	ertikadeswiokinganfujas.com
127.0.0.1	www.ertikadeswiokinganfujas.com
127.0.0.1	es0-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es1-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es2-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es3-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es4-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es5-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es6-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es7-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es8-www.5zgmu7o20kt5d8yq.com
127.0.0.1	es9-www.5zgmu7o20kt5d8yq.com
127.0.0.1	esafetylist.com
127.0.0.1	www.esafetylist.com
127.0.0.1	esafetypage.com
127.0.0.1	www.esafetypage.com
127.0.0.1	esbay.it
127.0.0.1	www.esbay.it
127.0.0.1	esearch2005.com
127.0.0.1	www.esearch2005.com
127.0.0.1	esecuritynote.com
127.0.0.1	www.esecuritynote.com
127.0.0.1	esecuritypage.com
127.0.0.1	www.esecuritypage.com
127.0.0.1	esupereva.it
127.0.0.1	www.esupereva.it
127.0.0.1	etomi.all-downloads-now.com
127.0.0.1	www.etomi.all-downloads-now.com
127.0.0.1	eupdatepage.com
127.0.0.1	www.eupdatepage.com
127.0.0.1	euuu.com
127.0.0.1	evbay.it
127.0.0.1	www.evbay.it
127.0.0.1	evidence-detector.biz
127.0.0.1	evilspidercomics.com
127.0.0.1	evko.biz
127.0.0.1	www.evko.biz
127.0.0.1	ewbay.it
127.0.0.1	www.ewbay.it
127.0.0.1	ewebsearch.net
127.0.0.1	e-websitesolutions.com
127.0.0.1	ewizard.cc
127.0.0.1	exaccess.ru
127.0.0.1	www.exaccess.ru
127.0.0.1	excellentsckin.com
127.0.0.1	exeupdate.com
127.0.0.1	www.exeupdate.com
127.0.0.1	exflow.org
127.0.0.1	www.exflow.org
127.0.0.1	exit.megago.com
127.0.0.1	expandvideo.com
127.0.0.1

Lyonnais92 · Answer

RE,

problème avec le fichier hosts.

Tu pourrais remettre la fin du rapport avec l'option 2 (après la longue liste du fichier hosts 127.0.0.1 ....)

merci.

Emile · Answer

OK, je l'ai repasse une deuxieme fois car je ne trouvais plus le rapport.txt....


127.0.0.1	www.wsp2008scanner.com
127.0.0.1	wsp2008scanner.com
127.0.0.1	www.wxterriy.info
127.0.0.1	wxterriy.info
127.0.0.1	www.xyztogo.com
127.0.0.1	xyztogo.com
127.0.0.1   clients.babylon.co.il

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5C8DED17-1255-4BF6-8A46-3834C1EF7FAC}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5C8DED17-1255-4BF6-8A46-3834C1EF7FAC}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5C8DED17-1255-4BF6-8A46-3834C1EF7FAC}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{5C8DED17-1255-4BF6-8A46-3834C1EF7FAC}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{C5AF49A2-94F3-42BD-F434-3604812C897D}"="werkjdnfi8wnkjmdfdfkefn"



»»»»»»»»»»»»»»»»»»»»»»»» Fin

Emile · Answer

Le rapport MBAM.....


Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1134
Windows 5.1.2600 Service Pack 2

15/08/2008 17:46:36
mbam-log-2008-08-15 (17-46-36).txt

Type de recherche: Examen rapide
Eléments examinés: 50611
Temps écoulé: 5 minute(s), 7 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 8
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 9

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\WakeNet (Trojan.Adware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\DivoCodec (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\527631 (Trojan.BHO) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\ivrtuwmf.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fmwutrvi.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\rwlfsdmk.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pmnmklJB.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\BM9ba52c9a.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM9ba52c9a.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\gaetan\Application Data\TmpRecentIcons\Smart Antivirus-2009.lnk (Rogue.Link) -> Quarantined and deleted successfully.

geoffrey5 · Answer

Salut !!

Lyonnais92 : la désinfection avec SmitfraudFix se fait en mode sans échec

Emile · Answer

... le log de RSIT...

Logfile of random's system information tool 1.04 (written by random/random)
Run by gaetan at 2008-08-15 17:53:54
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 3 GB (4%) free of 72 GB
Total RAM: 1279 MB (68% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:54:25, on 15/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\gaetan\Bureau\RSIT.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\gaetan.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: peltodgx - {0FA15166-39DA-4DAB-9B1A-0DDDBACA8BD5} - C:\WINDOWS\peltodgx.dll (file missing)
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Save with Download Manager... - file://C:\Program Files\J River\Media Center\DMDownload.htm
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {e59eb121-f339-4851-a3ba-fe49c35617c2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {e59eb121-f339-4851-a3ba-fe49c35617c2} - C:\Program Files\ICQ6\ICQ.exe
O16 - DPF: Yahoo! Checkers - http://download.games.yahoo.com/games/clients/y/kt4_x.cab
O16 - DPF: Yahoo! Chess - http://download2.games.yahoo.com/games/clients/y/ct5_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: {131EB16C-BD58-443F-8151-6DFBB0DA1778} (Anark Client 3.0 ActiveX Control) - http://install.anark.com/client/version3/windows-ie/en/AMClient.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c446.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} - 
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://fr.midas.games.yahoo.net/ctl/kingcomie.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: qomcyark - qoMcyARk.dll (file missing)
O22 - SharedTaskScheduler: werkjdnfi8wnkjmdfdfkefn - {C5AF49A2-94F3-42BD-F434-3604812C897D} - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (ipod service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools Auxiliary Service (sdauxservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdcoreservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Emile · Answer

... et le info.txt ....

info.txt logfile of random's system information tool 1.04 2008-08-15 17:54:36

======Uninstall list======

-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{09B44E78-A988-4BC0-962F-63ECD3333708} /l1036 
-->C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\Fichiers communs\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Fichiers communs\Adobe\Acrobat 5.0\NT\Uninst.dll"
-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->C:\WINDOWS\Modio\SLAMR2KO\Setup.exe /Remove
-->C:\WINDOWS\System32\MSIEXEC.EXE /x {8855FF30-19CE-4CB1-A654-87B38369CCE1}
-->C:\WINDOWS\uninst.exe -fC:\APPS\Audioneer\NewDJ\DeIsL1.isu  -cC:\APPS\Audioneer\NewDJ\_ISREG32.DLL
-->MsiExec.exe /X{57922B53-02D4-4DFC-AC24-A3519DC1F49A}
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0AD84416-63A4-4CF3-BDDF-8FA866711FB0}\Setup.exe" 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7C6D8763-EEB7-433E-A75E-2AB44892FCA2}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BBC0D330-C37B-4472-BFB9-AA217CF0C95F}\Setup.exe" 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A174402A-2EE6-4B86-A930-7BC85A9933BD}\SETUP.EXE" -l0x40c 
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
-->stunwdm.exe
Accord-->C:\Program Files\Accord\uninstall.exe
ACDSee 9 Gestionnaire de photos-->MsiExec.exe /I{91A06334-CB8D-422A-9699-251217674FD4}
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe AIR-->C:\Program Files\Fichiers communs\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}
Adobe Color Common Settings-->C:\Program Files\Fichiers communs\Adobe\Installers\6c8e2cb4fd241c55406016127a6ab2e\Setup.exe
Adobe Color Common Settings-->MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}
Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flex Builder 3-->"C:\Program Files\Adobe\Flex Builder 3\Uninstall Adobe Flex Builder 3\Uninstall Adobe Flex Builder 3.exe"
Adobe Illustrator CS-->RunDll32 "C:\Program Files\Fichiers communs\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{91A4AD99-69CE-4745-97B7-0E0DFBECFDE5}\setup.exe"
Adobe Media Player-->msiexec /qb /x {5C74694C-A687-E3EB-FF18-B018D4A76ECD}
Adobe Media Player-->MsiExec.exe /I{5C74694C-A687-E3EB-FF18-B018D4A76ECD}
Adobe Photoshop CS-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}\setup.exe" -l0x40c 
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Setup-->MsiExec.exe /I{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}
Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~2\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~2\Install.log
Adobe SVG Viewer 3.0-->C:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Install.log
aMSN 0.96-->C:\Program Files\aMSN\uninstall.exe
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de messagerie-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5700CB73-A4FE-4DC9-AC62-B0EE99646053}\setup.exe" -l040c -out
ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
AVG Anti-Spyware 7.5-->C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
Babylon-->C:\Program Files\Babylon\Babylon-Pro\Utils\uninstbb.exe
BadCopy Pro-->C:\PROGRA~1\Jufsoft\BadCopy\UNWISE.EXE C:\PROGRA~1\Jufsoft\BadCopy\INSTALL.LOG
bitRipper-->"C:\Program Files\bitRipper\uninstall.exe"
BitTorrent 5.0.9-->"C:\Program Files\BitTorrent\uninstall.exe"
Bureau Médias de Kazaa 2.6.7-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{78903C42-CB0C-4B35-91A1-D4DEDD91F8CB}\Setup.exe" -l0x40c --AddRemove
CamfrogWEB Advanced ActiveX Plugin (remove only)-->"C:\Program Files\CFWebAdvancedU\Uninstall.exe"
CartaGoGo v3.1.8-->"C:\Program Files\CartaGoGo\unins000.exe"
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CDex extraction audio-->"C:\Program Files\CDex_150\uninstall.exe"
Converio-->"C:\Program Files\Converio 2.0\unins000.exe"
ConvertXtoDVD 2.0.5-->"C:\Program Files\vso\ConvertXtoDVD\unins000.exe"
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Correctif pour Windows XP (KB914440)-->"C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe"
Correctif Windows XP - KB834707-->C:\WINDOWS\$NtUninstallKB834707$\spuninst\spuninst.exe
Correctif Windows XP - KB867282-->C:\WINDOWS\$NtUninstallKB867282$\spuninst\spuninst.exe
Correctif Windows XP - KB873333-->C:\WINDOWS\$NtUninstallKB873333$\spuninst\spuninst.exe
Correctif Windows XP - KB873339-->C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Correctif Windows XP - KB885250-->C:\WINDOWS\$NtUninstallKB885250$\spuninst\spuninst.exe
Correctif Windows XP - KB885835-->C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Correctif Windows XP - KB885836-->C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Correctif Windows XP - KB885884-->C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe
Correctif Windows XP - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Correctif Windows XP - KB887472-->C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
Correctif Windows XP - KB887742-->C:\WINDOWS\$NtUninstallKB887742$\spuninst\spuninst.exe
Correctif Windows XP - KB888113-->C:\WINDOWS\$NtUninstallKB888113$\spuninst\spuninst.exe
Correctif Windows XP - KB888302-->C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Correctif Windows XP - KB890047-->C:\WINDOWS\$NtUninstallKB890047$\spuninst\spuninst.exe
Correctif Windows XP - KB890175-->C:\WINDOWS\$NtUninstallKB890175$\spuninst\spuninst.exe
Correctif Windows XP - KB890859-->"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Correctif Windows XP - KB891781-->C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
Correctif Windows XP - KB893086-->"C:\WINDOWS\$NtUninstallKB893086$\spuninst\spuninst.exe"
DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DVD Decrypter (Remove Only)-->"C:\Program Files\DVD Decrypter\uninstall.exe"
EAX Unified-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\EAX Unified\Uninst.isu"
eMule-->"C:\Program Files\eMule2\Uninstall.exe"
EPSON Attach To Email-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{20C45B32-5AB6-46A4-94EF-58950CAF05E5} /l1033 ADDREMOVEDLG
EPSON Easy Photo Print-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BC69DDB8-4840-4D9B-BB31-0D4DB2BA1312}\SETUP.EXE" -l0x40c UNINST
EPSON File Manager-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E86BC406-944E-41F6-ADE6-2C136734C96B}\Setup.exe" -l0x40c UNINST
EPSON Logiciel imprimante-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
EPSON Scan Assistant-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}\Setup.exe" -l0x40c -u
EPSON Scan-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0E0131B2-CF18-40D9-A331-60A3746C1204}\SETUP.EXE" -l0x40c UNINSTALL
EPSON Web-To-Page-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}\SETUP.EXE" -l0x40c -anything
ESC79_D78 Guide d’utilisation-->C:\Program Files\EPSON\TPMANUAL\ESC79_D78\FRA\USE_G\DOCUNINS.EXE
FairUse Wizard 2 LE-->"C:\Program Files\FairUse Wizard 2\un_FU-Setup_14333.exe"
FileZilla (remove only)-->"C:\Program Files\FileZilla\uninstall.exe"
Free Mp3 Wma Converter V 1.7.2-->"C:\Program Files\Free Audio Pack\unins000.exe"
Google Earth-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}\setup.exe" -l0x9  -removeonly
Guitar Pro 5.0-->"C:\Program Files\Guitar Pro 5\unins000.exe"
GX::Transcoder.net AWE-->"C:\Program Files\GXTranscoder.net AWE\unins000.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915865)-->"C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
ICQ6-->"C:\Program Files\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
Indeo® Software-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Ligos\Indeo\Uninst.isu" -c"C:\Program Files\Ligos\Indeo\Indeo System Files\indounin.dll"
iTunes-->MsiExec.exe /I{3DE0053C-FD9A-483E-B7C9-B06E4392206E}
J2SE Runtime Environment 5.0 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150040}
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Java Runtime Environment 1.1-->C:\WINDOWS\uninst.exe -f"C:\Program Files\JavaSoft\JRE\1.1\lib\DeIsL1.isu"
JGsoft EditPad Lite 5.4.5-->C:\WINDOWS\UnDeploy.exe "C:\Program Files\JGsoft\EditPadLite\Deploy.log"
K-Lite Codec Pack 3.9.5 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
LCI INTEGRALE-->MsiExec.exe /X{1BFDBCF8-7002-45C8-8B9B-F4AB667ACB32}
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LeechFTP -->C:\WINDOWS\eraser.exe KILL "C:\Program Files\LeechFTP\uninstall.uif"
LG ODD Auto Firmware Update-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6179550A-3E7C-499E-BCC9-9E8113E0A285}\Setup.exe" 
livebox-->C:\Program Files\InstallShield Installation Information\{17342E3B-0818-4A6F-BFF8-99476605ADD6}\Setup.exe -runfromtemp -l0x040c -removeonly
Magic MP3 Tagger 2.2.4d-->"C:\Program Files\Magic MP3 Tagger\unins000.exe"
MAGIX music maker 2006 demo (F)-->C:\Program Files\MAGIX\mm2006_e-version\instslct.exe
MAGIX Music Manager (F)-->C:\Program Files\MAGIX\Music_Manager\instslct.exe
MAGIX music studio 2006 deLuxe (F)-->C:\Program Files\MAGIX\ms2006_deLuxe\instslct.exe
MAGIX Photo Manager (F)-->C:\Program Files\MAGIX\Photo_Manager\instslct.exe
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 French Language Pack-->MsiExec.exe /X{E3C080B0-23F5-49AF-89F8-8E8DBC89E659}
Microsoft .NET Framework 3.0-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office XP Professional avec FrontPage-->MsiExec.exe /I{9028040C-6000-11D3-8CFE-0050048383C9}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual Keyboard-->MsiExec.exe /I{F63E8666-0F10-11D3-8258-00C04F6843FE}
Microsoft Word 2002-->MsiExec.exe /I{911B040C-6000-11D3-8CFE-0050048383C9}
Mise à jour de sécurité pour Lecteur Windows Media (KB911564)-->"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)-->"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB883939)-->"C:\WINDOWS\$NtUninstallKB883939$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB890046)-->"C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB893066)-->"C:\WINDOWS\$NtUninstallKB893066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB893756)-->"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896358)-->"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896422)-->"C:\WINDOWS\$NtUninstallKB896422$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896423)-->"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896424)-->"C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896428)-->"C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896688)-->"C:\WINDOWS\$NtUninstallKB896688$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB899587)-->"C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB899588)-->"C:\WINDOWS\$NtUninstallKB899588$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB899591)-->"C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB900725)-->"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB901017)-->"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB901214)-->"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB902400)-->"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB903235)-->"C:\WINDOWS\$NtUninstallKB903235$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB904706)-->"C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB905414)-->"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB905749)-->"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB905915)-->"C:\WINDOWS\$NtUninstallKB905915$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB908519)-->"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB908531)-->"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911280)-->"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911562)-->"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911567)-->"C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911927)-->"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB912812)-->"C:\WINDOWS\$NtUninstallKB912812$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB912919)-->"C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB913446)-->"C:\WINDOWS\$NtUninstallKB913446$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB913580)-->"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB914388)-->"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB914389)-->"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB916281)-->"C:\WINDOWS\$NtUninstallKB916281$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB917159)-->"C:\WINDOWS\$NtUninstallKB917159$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB917344)-->"C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB917422)-->"C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB917953)-->"C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB918118)-->"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB918439)-->"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB918899)-->"C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB919007)-->"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920213)-->"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920214)-->"C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920670)-->"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920683)-->"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920685)-->"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB921398)-->"C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB921503)-->"C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB921883)-->"C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB922616)-->"C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB922760)-->"C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB922819)-->"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923191)-->"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923414)-->"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923694)-->"C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923980)-->"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924191)-->"C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924270)-->"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924496)-->"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924667)-->"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB925454)-->"C:\WINDOWS\$NtUninstallKB925454$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB925486)-->"C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB925902)-->"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB926255)-->"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB926436)-->"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB927779)-->"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB927802)-->"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB928255)-->"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB928843)-->"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB929123)-->"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB930178)-->"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB931261)-->"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB931784)-->"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB932168)-->"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB933729)-->"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB935839)-->"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB935840)-->"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB936021)-->"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938829)-->"C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941202)-->"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941568)-->"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941644)-->"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941693)-->"C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943055)-->"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943460)-->"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943485)-->"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944653)-->"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB945553)-->"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946026)-->"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB948590)-->"C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB948881)-->"C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950749)-->"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB894391)-->"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB896727)-->"C:\WINDOWS\$NtUninstallKB896727$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB900485)-->"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB904942)-->"C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB910437)-->"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB916595)-->"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB920872)-->"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB922582)-->"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB925720)-->"C:\WINDOWS\$NtUninstallKB925720$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB927891)-->"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB930916)-->"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB931836)-->"C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB932823-v3)-->"C:\WINDOWS\$NtUninstallKB932823-v3$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB933360)-->"C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB936357)-->"C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB938828)-->"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Module de compatibilité pour Microsoft Office System 2007-->MsiExec.exe /X{90120000-0020-040C-0000-0000000FF1CE}
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Module de prise en charge linguistique du français de Microsoft .NET Framework 3.0-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 French Language Pack\setup.exe
Mozilla Firefox (3.0.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Multimedia Launcher-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe"  -uninstall
MultiSigno Verify-->MsiExec.exe /X{6DE9C50B-0273-4070-9E30-2CE3096E4852}
MusicVR demo-->C:\PROGRA~1\OLDFIE~1\MUSICV~1\UNWISE.EXE C:\PROGRA~1\OLDFIE~1\MUSICV~1\INSTALL.LOG
MySpaceIM-->C:\Program Files\MySpace\IM\Uninstall.exe
Navilog1 3.5.7-->"C:\Program Files\Navilog1\unins000.exe"
Nero Digital-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
Nero OEM-->C:\Program Files\Ahead
ero\uninstall\UNNERO.exe /UNINSTALL
Odebit Multimédia V3.2-->"C:\Program Files\Odebit Multimédia\V3.2\unins000.exe"
OpenMG Limited Patch 3.1-02-10-22-01-->C:\Program Files\Fichiers communs\Sony Shared\OpenMG\HotFixes\HotFix3.1-02-10-22-01\HotFixSetup\setup.exe /u
OpenMG Limited Patch 3.1-02-10-22-02-->C:\Program Files\Fichiers communs\Sony Shared\OpenMG\HotFixes\HotFix3.1-02-10-22-02\HotFixSetup\setup.exe /u
OpenMG Limited Patch 3.1-02-12-04-01-->C:\Program Files\Fichiers communs\Sony Shared\OpenMG\HotFixes\HotFix3.1-02-12-04-01\HotFixSetup\setup.exe /u
OpenMG Secure Module 3.1-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{117C01B5-9D68-4A15-85E2-A7CDFA82CEB9}\setup.exe" -l0x40c UNINSTALL
Outil de connexion Wanadoo-->C:\PROGRA~1\Wanadoo\MessageDesinstallation.exe Wanadoo
Oxemis CD Ripper-->MsiExec.exe /X{E3C38444-BDAC-40E2-9C48-F946B8D8E2AE}
Pando-->MsiExec.exe /I{C0B0FA55-D4E9-4374-9871-BBFBF2AEF0D1}
PDF Editeur 2-->C:\WINDOWS\cadkasdeinst01f.exe "C:\Program Files\PDF Editeur 2\"
PDFCreator-->C:\Program Files\PDFCreator\unins000.exe
PDF-to-Word 2.1 Demo-->C:\PROGRA~1\BLUESQ~1\demos\UNWISE.EXE /U C:\PROGRA~1\BLUESQ~1\demos\pdf2word.log
PeerTV 1.1.2-->"C:\Program Files\PeerTV\uninstall.exe"
PIF DESIGNER-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B90450DF-E781-46FD-B1F1-0C86DA40E443}\SETUP.EXE" -l0x40c anything
PowerCinema NE for Everio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{39CEE1F2-12B6-4C50-9131-04BFCA110578}\setup.exe"  -uninstall
PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe"  -uninstall
PowerISO-->"C:\Program Files\PowerISO\uninstall.exe"
PowerProducer-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\setup.exe"  -uninstall
QuickTime Alternative 2.6.0-->"C:\Program Files\QuickTime Alternative\unins000.exe"
QuickTime-->MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175}
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0
Replay Media Catcher 3.0-->"C:\WINDOWS\Replay Media Catcher\uninstall.exe" "/U:C:\Program Files\Replay Media Catcher\Uninstall\uninstall.xml"
Search Settings 1.2-->MsiExec.exe /X{D0C73318-7B4A-4D16-A0C4-3B83F075EA88}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Skype™ 3.6-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Sonic RecordNow DX-->MsiExec.exe /I{8855FF30-19CE-4CB1-A654-87B38369CCE1}
Sony Vegas Pro 8.0-->MsiExec.exe /X{7C9AD221-994C-45B2-B46D-26F5735158CF}
Spybot - Search & Destroy 1.5.2.20-->"C:\WINDOWS\unins000.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Spyware Doctor 6.0-->C:\Program Files\Spyware Doctor\unins000.exe /LOG
SubDownloader2-->"C:\Program Files\SubDownloader2\uninstall.exe"
SUPER © Version 2008.bld.30 (Mar 22, 2008)-->C:\PROGRA~1\ERIGHT~1\SUPER\Setup.exe /remove /q0
Tag&Rename 3.4.6-->"C:\Program Files\TagRename\unins000.exe"
Text-To-Speech-Runtime-->MsiExec.exe /X{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}
TrustIn Kontekstual-->regsvr32 /u /s "C:\Program Files\TrustIn Kontekstual\InTru.dll"
Unlocker 1.8.5-->C:\Program Files\Unlocker\uninst.exe
VideoLAN VLC media player 0.8.6c-->C:\Program Files\VideoLAN\VLC\uninstall.exe
VirtualDubMOD 1.5.10.2 b2540 Fr-->C:\Program Files\VirtualDubMod\UnInstall_VDMOD.exe
VobSub v2.23 (Remove Only)-->"C:\Program Files\Gabest\VobSub\uninstall.exe"
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Communication Foundation-->MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Genuine Advantage v1.3.0254.0-->MsiExec.exe /I{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows Live Sign-in Assistant-->MsiExec.exe /I{F652D238-5F29-42D5-BAF3-0115EF977EC2}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows Presentation Foundation Language Pack (FRA)-->MsiExec.exe /X{6901DD22-527A-41EF-9059-E81FEDE9E494}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation FR Language Pack-->MsiExec.exe /I{B84C141C-9A13-44BE-9A69-301D7B11D836}
Windows Workflow Foundation-->MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
Windows XP Service Pack 2-->C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
Zylom Games Player Plugin-->"C:\Program Files\Zylom Games\UninstallPlugin.exe" --uninstall

=====HijackThis Backups=====

O2 - BHO: (no name) - {c151a3b1-83ac-4b4c-8ff9-259fcc0690eb} - C:\WINDOWS\system32\jkkIAsqR.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {748d6ea8-cd59-4682-91e7-af92f4f2d40e} - C:\WINDOWS\system32\jkkLCSjG.dll
O20 - Winlogon Notify: jkklcsjg - C:\WINDOWS\SYSTEM32\jkkLCSjG.dll
O2 - BHO: C:\WINDOWS\system32\kdfgj83ke.dll - {c5af49a2-94f3-42bd-f434-3604812c897d} - C:\WINDOWS\system32\kdfgj83ke.dll
O2 - BHO: (no name) - {748d6ea8-cd59-4682-91e7-af92f4f2d40e} - C:\WINDOWS\system32\jkkLCSjG.dll
O2 - BHO: (no name) - {c151a3b1-83ac-4b4c-8ff9-259fcc0690eb} - C:\WINDOWS\system32\jkkIAsqR.dll
O20 - Winlogon Notify: jkklcsjg - C:\WINDOWS\SYSTEM32\jkkLCSjG.dll
O20 - Winlogon Notify: jkklcsjg - C:\WINDOWS\
O2 - BHO: C:\WINDOWS\system32\kdfgj83ke.dll - {c5af49a2-94f3-42bd-f434-3604812c897d} - C:\WINDOWS\system32\kdfgj83ke.dll (file missing)
O2 - BHO: (no name) - {492ba5b1-4197-4557-bbfa-9f0eb88855d2} - C:\WINDOWS\system32\jkkIAsqR.dll
O2 - BHO: (no name) - {492ba5b1-4197-4557-bbfa-9f0eb88855d2} - C:\WINDOWS\system32\jkkIAsqR.dll
O2 - BHO: QXK Olive - {11dfb01a-0852-4955-9747-c59e21dbbda5} - C:\WINDOWS\dfmlxbpkvlo.dll (file missing)
O2 - BHO: (no name) - {492ba5b1-4197-4557-bbfa-9f0eb88855d2} - (no file)
O2 - BHO: (no name) - {90935776-8a57-42fb-96a0-38c76b5686f9} - C:\WINDOWS\system32\jkkIAsqR.dll (file missing)
O2 - BHO: (no name) - {da44977c-000e-4e39-9a52-3458c8a36ec4} - C:\WINDOWS\system32\hgGyXqrO.dll (file missing)
O21 - SSODL: onfwbsak - {70886A6F-9422-4899-96C0-75570EFADC40} - C:\WINDOWS\onfwbsak.dll
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O21 - SSODL: rwlfsdmk - {3FDB954E-B673-4CD2-89BC-77E66B4A4A0C} - C:\WINDOWSwlfsdmk.dll

======Hosts File======

127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\ATI Technologies\ATI Control Panel;C:\PROGRA~1\FICHIE~1\TVNAVI~1;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\PROGRA~1	hriXXX\3D SexVilla;C:\Program Files\QuickTime Alternative\QTSystem\
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0209
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"MULTISIGNOVERIFYDIR"=C:\Program Files\Kopint-Datorg\Multisigno Verify\
"CLASSPATH"=.;C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip

-----------------EOF-----------------


Merci les gars :))

Encore une victime de Smart Antivirus 2009...

12 réponses

Discussions similaires