Hacktool.rootkit

ok verni29 merci ,il ne doit plus rien rester maintenant ?
un grand merci a toi et à chiquitine29

voila verni29 nouveau point de restoration crée.
que doije faire maintenant ?

bàt A+

voici le rapport de kspersky verni29
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Sunday, January 18, 2009 1:36:38 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 3 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 18/01/2009
Enregistrements dans la base antivirus Kaspersky : 1473341
-------------------------------------------------------------------------------

Paramètres d'analyse:
Analyser avec la base antivirus suivante: standard
Analyser les archives: vrai
Analyser les bases de messagerie: vrai

Cible de l'analyse - Poste de travail:
C:\
D:\
O:\
U:\
V:\

Statistiques de l'analyse:
Total d'objets analysés: 90433
Nombre de virus trouvés: 2
Nombre d'objets infectés: 48 / 0
Nombre d'objets suspects: 0
Durée de l'analyse: 01:32:35

Nom de l'objet infecté / Nom du virus / Dernière action
C:\Documents and Settings\f_devits\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\f_devits\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\f_devits\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\f_devits\Local Settings\History\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\f_devits\Local Settings\Temp\hsperfdata_f_devits\2092 L'objet est verrouillé ignoré
C:\Documents and Settings\f_devits\Local Settings\Temp\hsperfdata_f_devits\2396 L'objet est verrouillé ignoré
C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat L'objet est verrouillé ignoré
C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\bind[2].htm L'objet est verrouillé ignoré
C:\Documents and Settings\f_devits\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\f_devits\NTUSER.DAT.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\HW LMT\server\lmtserver\var\logs\lmtserver\lmtserver_b.log L'objet est verrouillé ignoré
C:\HW LMT\tray\log\ilmt_tray.Log L'objet est verrouillé ignoré
C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP59\A0015364.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP59\A0015372.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP60\A0015417.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP60\A0015485.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP60\A0015491.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP60\A0015508.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP60\A0015515.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP60\A0015516.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP60\A0015529.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP60\A0015539.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP60\A0015552.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015576.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015577.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015590.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015599.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015601.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015602.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015843.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015907.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015925.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015935.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015936.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015974.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015978.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0015988.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0016002.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0016003.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0016040.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0016052.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0016056.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0016057.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0016092.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0016117.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0016135.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0016149.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0016155.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0016156.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP61\A0016169.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP62\A0016173.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP63\A0016205.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP63\A0016206.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP63\A0016231.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP63\A0016232.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP63\A0016245.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP63\A0016246.exe Infecté : Trojan-PSW.Win32.Agent.lfr ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP63\A0016251.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP64\A0016427.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP64\A0016428.exe Infecté : Trojan-Downloader.Win32.Bagle.ala ignoré
C:\System Volume Information\_restore{FB19BD39-35AC-40B6-8BF9-05CC819E716F}\RP65\change.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\Netlogon.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\Internet.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré
C:\WINDOWS\Temp\Perflib_Perfdata_758.dat L'objet est verrouillé ignoré
C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

Analyse terminée.
Bàt

Hello salut Verni29
voici le log de java
JavaRa 1.13 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Sun Jan 18 10:29:16 2009

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

------------------------------------

Finished reporting.

je m'occupe à présent du point de restoration

A+
PS: il me demande "Restore point description"
comprend pas ce qu'il me veut lui

:-) A+

@fabnokOk verni29
fallais juste lui donner un nom ;-)

@+

ok un grand merci chiquitine29
bonne soirée

@+
fabnok

@fabnokvoici le rapport de TCleaner
[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\Combofix.txt: trouvé !
C:\FindyKill.txt: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Start Menu\Programs\HijackThis: trouvé !
C:\Documents and Settings\All Users\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\f_devits\Desktop\HijackThis.lnk: trouvé !
C:\Documents and Settings\f_devits\Desktop\Gmer.exe: trouvé !
C:\Documents and Settings\f_devits\Desktop\Gmer.zip: trouvé !
C:\Documents and Settings\f_devits\Desktop\HJTInstall.exe: trouvé !
C:\Documents and Settings\f_devits\Desktop\FindyKill.txt: trouvé !
C:\Documents and Settings\f_devits\Desktop\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\f_devits\Start Menu\Programs\FindyKill: trouvé !
C:\Qoobox\Quarantine\C\_OtMoveIt: trouvé !
C:\Qoobox\Quarantine\C\Program Files\FindyKill: trouvé !
C:\Qoobox\Quarantine\C\Program Files\Trend Micro\HijackThis: trouvé !
C:\WINDOWS\Gmer.exe: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\All Users\Start Menu\Programs\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\f_devits\Desktop\HijackThis.lnk: supprimé !
C:\Documents and Settings\f_devits\Desktop\Gmer.exe: supprimé !
C:\Documents and Settings\f_devits\Desktop\Gmer.zip: supprimé !
C:\Documents and Settings\f_devits\Desktop\HJTInstall.exe: supprimé !
C:\WINDOWS\Gmer.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\FindyKill.txt: supprimé !
C:\Documents and Settings\f_devits\Desktop\FindyKill.txt: supprimé !
C:\Documents and Settings\f_devits\Desktop\OTMoveIt3.exe: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Start Menu\Programs\HijackThis: supprimé !
C:\Documents and Settings\f_devits\Start Menu\Programs\FindyKill: supprimé !

salut
je n'arrive pas à virer norton ,c'est une version installée au bureau
je fais le reste ??

mais j'ai tout envoyé ce rapport est le deuxième qui tu m'a fait faire !

veux tu que je recommence la manip ?

Ouupss je vois
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP49.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP5.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP5.sys
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP50.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP51.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP52.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP53.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP54.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP55.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP56.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP57.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP58.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP59.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP6.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP6.sys
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP60.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP61.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP62.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP63.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP64.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP65.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP66.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP67.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP68.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP69.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP7.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP7.sys
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP70.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP71.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP72.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP73.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP74.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP75.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP8.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP8.sys
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP9.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP9.sys
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Fwdstat.log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\CATALOG.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\CCERASER.DLL
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\ECMSVR32.DLL
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\EECTRL.SYS
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\ERASER.GRD
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\ERASER.SIG
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\ERASER.SPM
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\ERASER.SYS
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\ESRDEF.BIN
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\NAVENG.SYS
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\NAVENG32.DLL
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\NAVEX15.SYS
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\NAVEX32A.DLL
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\NCSACERT.TXT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\SCRAUTH.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\SYMAVENG.CAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\SYMAVENG.INF
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\SYMERASE.CAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\SYMERASE.INF
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\TCDEFS.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\TCSCAN7.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\TCSCAN8.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\TCSCAN9.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\TECHNOTE.TXT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\TINF.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\TINFIDX.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\TINFL.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\TSCAN1.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\TSCAN1HD.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\V.GRD
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\V.SIG
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\VIRSCAN.INF
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\VIRSCAN1.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\VIRSCAN2.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\VIRSCAN3.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\VIRSCAN4.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\VIRSCAN5.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\VIRSCAN6.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\VIRSCAN7.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\VIRSCAN8.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\VIRSCAN9.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\VIRSCANT.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\WHATSNEW.TXT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2c4c04.vdb\ZDONE.DAT
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1022009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1042009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1062009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1072009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1082009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1092009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1102009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1112009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1122009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1132009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1142009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1152009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1162009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\[u]0/u1172009.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\12182008.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\12192008.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\12202008.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\12222008.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\12252008.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\12262008.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\12292008.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\12302008.Log
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd2b1203.vdb
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd2b1409.iad
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd2b1409.iex
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd2b1409.wdb
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd2b1e04.iad
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd2b1e04.iex
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd2b1e04.wdb
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd2b2407.iad
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd2b2407.iex
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd2b2407.wdb
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd2c4c04.vdb
c:\documents and settings\f_devits\Application Data\AVS4YOU
c:\documents and settings\f_devits\Application Data\AVS4YOU\AVSVideoConverter\profiles\aviprofiles.xml
c:\program files\Common Files\Symantec Shared
c:\program files\Common Files\Symantec Shared\ccAlert.dll
c:\program files\Common Files\Symantec Shared\ccDec.dll
c:\program files\Common Files\Symantec Shared\ccEmlPxy.dll
c:\program files\Common Files\Symantec Shared\ccErrDsp.dll
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\ccInst.dll
c:\program files\Common Files\Symantec Shared\ccL40.dll
c:\program files\Common Files\Symantec Shared\ccLgView.exe
c:\program files\Common Files\Symantec Shared\ccProd.dll
c:\program files\Common Files\Symantec Shared\ccProSub.dll
c:\program files\Common Files\Symantec Shared\ccScan.dll
c:\program files\Common Files\Symantec Shared\ccSet.dll
c:\program files\Common Files\Symantec Shared\ccSetEvt.dll
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccVrTrst.dll
c:\program files\Common Files\Symantec Shared\ccWebWnd.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2AMG.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2ARJ.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2CAB.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2GZIP.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2ID.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2LHA.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2LZ.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2RAR.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2RTF.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2SS.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2TAR.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2Text.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2TNEF.dll
c:\program files\Common Files\Symantec Shared\Decomposers\Dec2Zip.dll
c:\program files\Common Files\Symantec Shared\Decomposers\DecSDK.dll
c:\program files\Common Files\Symantec Shared\Default.rul
c:\program files\Common Files\Symantec Shared\DefUtDCD.dll
c:\program files\Common Files\Symantec Shared\ecmldr32.DLL
c:\program files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
c:\program files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT
c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
c:\program files\Common Files\Symantec Shared\Help\CCLGVIEW.CHM
c:\program files\Common Files\Symantec Shared\Help\LUALL.CHM
c:\program files\Common Files\Symantec Shared\rcAlert.dll
c:\program files\Common Files\Symantec Shared\rcApp.dll
c:\program files\Common Files\Symantec Shared\rcEmlPxy.dll
c:\program files\Common Files\Symantec Shared\rcErrDsp.dll
c:\program files\Common Files\Symantec Shared\rcEvtMgr.dll
c:\program files\Common Files\Symantec Shared\rcLgView.dll
c:\program files\Common Files\Symantec Shared\rcSetMgr.dll
c:\program files\Common Files\Symantec Shared\sevinst.exe
c:\program files\Common Files\Symantec Shared\SNDInst.exe
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SNDunin.dll
c:\program files\Common Files\Symantec Shared\SPBBC\2008-12-10-658d.kc
c:\program files\Common Files\Symantec Shared\SPBBC\2009-01-14-7e9c.kc
c:\program files\Common Files\Symantec Shared\SPBBC\bbRGen.dll
c:\program files\Common Files\Symantec Shared\SPBBC\init.kc
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log
c:\program files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.CAT
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.inf
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCEvt.dll
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\UpdMgr.exe
c:\program files\Common Files\Symantec Shared\SPManifests\ccCommon.grd
c:\program files\Common Files\Symantec Shared\SPManifests\ccCommon.sig
c:\program files\Common Files\Symantec Shared\SPManifests\ccCommon.spm
c:\program files\Common Files\Symantec Shared\SPManifests\ccOEH.grd
c:\program files\Common Files\Symantec Shared\SPManifests\ccOEH.sig
c:\program files\Common Files\Symantec Shared\SPManifests\ccOEH.spm
c:\program files\Common Files\Symantec Shared\SPManifests\eraser.grd
c:\program files\Common Files\Symantec Shared\SPManifests\eraser.sig
c:\program files\Common Files\Symantec Shared\SPManifests\eraser.spm
c:\program files\Common Files\Symantec Shared\SPManifests\LuSymProtect.grd
c:\program files\Common Files\Symantec Shared\SPManifests\LuSymProtect.sig
c:\program files\Common Files\Symantec Shared\SPManifests\LuSymProtect.spm
c:\program files\Common Files\Symantec Shared\SPManifests\scs-sav.grd
c:\program files\Common Files\Symantec Shared\SPManifests\scs-sav.sig
c:\program files\Common Files\Symantec Shared\SPManifests\scs-sav.spm
c:\program files\Common Files\Symantec Shared\SPManifests\Snd.grd
c:\program files\Common Files\Symantec Shared\SPManifests\Snd.sig
c:\program files\Common Files\Symantec Shared\SPManifests\Snd.spm
c:\program files\Common Files\Symantec Shared\SPManifests\SPBBC.grd
c:\program files\Common Files\Symantec Shared\SPManifests\SPBBC.sig
c:\program files\Common Files\Symantec Shared\SPManifests\SPBBC.spm
c:\program files\Common Files\Symantec Shared\SPManifests\SYMEVNT.GRD
c:\program files\Common Files\Symantec Shared\SPManifests\SYMEVNT.SIG
c:\program files\Common Files\Symantec Shared\SPManifests\SYMEVNT.SPM
c:\program files\Common Files\Symantec Shared\SSC\ExchngUI.ocx
c:\program files\Common Files\Symantec Shared\SSC\IMailUI.ocx
c:\program files\Common Files\Symantec Shared\SSC\LDDateTm.ocx
c:\program files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx
c:\program files\Common Files\Symantec Shared\SSC\LDVPDlgs.ocx
c:\program files\Common Files\Symantec Shared\SSC\LDVPTask.ocx
c:\program files\Common Files\Symantec Shared\SSC\ldvpui.ocx
c:\program files\Common Files\Symantec Shared\SSC\LDVPView.ocx
c:\program files\Common Files\Symantec Shared\SSC\LotNtsUI.ocx
c:\program files\Common Files\Symantec Shared\SSC\scandlgs.dll
c:\program files\Common Files\Symantec Shared\SSC\ScsComms.dll
c:\program files\Common Files\Symantec Shared\SSC\SymProtectUI.ocx
c:\program files\Common Files\Symantec Shared\SSC\Transman.dll
c:\program files\Common Files\Symantec Shared\SSC\vpshell2.dll
c:\program files\Common Files\Symantec Shared\SSC\webshell.dll
c:\program files\Common Files\Symantec Shared\Validate.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\CATALOG.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\CCERASER.DLL
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\ECBOOTIL.VXD
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\ECMSVR32.DLL
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\EECTRL.SYS
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\ERASER.GRD
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\ERASER.SIG
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\ERASER.SPM
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\ERASER.SYS
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\ESRDEF.BIN
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\HH
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\NAVENG.EXP
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\NAVENG.SYS
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\NAVENG.VXD
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\NAVENG32.DLL
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\NAVEX15.EXP
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\NAVEX15.SYS
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\NAVEX15.VXD
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\NAVEX32A.DLL
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\NCSACERT.TXT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\SCRAUTH.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\SYMAVENG.CAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\SYMAVENG.INF
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\SYMERASE.CAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\SYMERASE.INF
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\TCDEFS.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\TCSCAN7.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\TCSCAN8.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\TCSCAN9.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\TECHNOTE.TXT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\TINF.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\TINFIDX.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\TINFL.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\TSCAN1.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\TSCAN1HD.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\V.GRD
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\V.SIG
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\VIRSCAN.INF
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\VIRSCAN1.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\VIRSCAN2.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\VIRSCAN3.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\VIRSCAN4.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\VIRSCAN5.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\VIRSCAN6.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\VIRSCAN7.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\VIRSCAN8.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\VIRSCAN9.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\VIRSCANT.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\vscanmsx.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\WHATSNEW.TXT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090112.003\ZDONE.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\CATALOG.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\CCERASER.DLL
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\ECBOOTIL.VXD
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\ECMSVR32.DLL
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\EECTRL.SYS
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\ERASER.GRD
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\ERASER.SIG
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\ERASER.SPM
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\ERASER.SYS
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\ESRDEF.BIN
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\HH
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\NAVENG.EXP
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\NAVENG.SYS
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\NAVENG.VXD
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\NAVENG32.DLL
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\NAVEX15.EXP
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\NAVEX15.SYS
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\NAVEX15.VXD
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\NAVEX32A.DLL
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\NCSACERT.TXT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\SCRAUTH.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\SYMAVENG.CAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\SYMAVENG.INF
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\SYMERASE.CAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\SYMERASE.INF
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\TCDEFS.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\TCSCAN7.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\TCSCAN8.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\TCSCAN9.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\TECHNOTE.TXT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\TINF.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\TINFIDX.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\TINFL.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\TSCAN1.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\TSCAN1HD.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\V.GRD
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\V.SIG
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\VIRSCAN.INF
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\VIRSCAN1.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\VIRSCAN2.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\VIRSCAN3.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\VIRSCAN4.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\VIRSCAN5.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\VIRSCAN6.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\VIRSCAN7.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\VIRSCAN8.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\VIRSCAN9.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\VIRSCANT.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\vscanmsx.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\WHATSNEW.TXT
c:\program files\Common Files\Symantec Shared\VirusDefs\20090113.024\ZDONE.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\catalog.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\cceraser.dll
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\ecbootil.vxd
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\ecmsvr32.dll
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\eeCtrl.sys
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\ERASER.grd
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\ERASER.sig
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\ERASER.spm
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\ERASER.sys
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\esrdef.bin
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\hh
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\naveng.exp
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\naveng.sys
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\naveng.vxd
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\naveng32.dll
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\navex15.exp
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\navex15.sys
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\navex15.vxd
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\navex32a.dll
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\ncsacert.txt
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\scrauth.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\symaveng.cat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\symaveng.inf
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\SymErase.cat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\SymErase.inf
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\tcdefs.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\tcscan7.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\tcscan8.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\tcscan9.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\technote.txt
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\tinf.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\tinfidx.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\tinfl.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\tscan1.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\tscan1hd.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\v.grd
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\v.sig
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan.inf
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan1.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan2.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan3.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan4.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan5.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan6.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan7.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan8.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan9.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\VIRSCANT.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\whatsnew.txt
c:\program files\Common Files\Symantec Shared\VirusDefs\BinHub\zdone.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\definfo.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\TextHub\virscant.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\CATALOG.DAT
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\cceraser.dll
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\ecmsvr32.dll
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\eeCtrl.sys
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\ERASER.grd
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\ERASER.sig
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\ERASER.spm
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\ERASER.sys
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\esrdef.bin
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\naveng.sys
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\naveng32.dll
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\navex15.sys
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\navex32a.dll
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\ncsacert.txt
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\scrauth.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\symaveng.cat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\symaveng.inf
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\SymErase.cat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\SymErase.inf
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\tcdefs.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\tcscan7.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\tcscan8.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\tcscan9.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\technote.txt
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\tinf.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\tinfidx.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\tinfl.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\tscan1.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\tscan1hd.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\v.grd
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\v.sig
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\virscan.inf
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\virscan1.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\virscan2.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\virscan3.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\virscan4.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\virscan5.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\virscan6.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\virscan7.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\virscan8.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\virscan9.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\virscant.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\whatsnew.txt
c:\program files\Common Files\Symantec Shared\VirusDefs\tmp7d61.tmp\zdone.dat
c:\program files\Common Files\Symantec Shared\VirusDefs\usage.dat
c:\program files\FindyKill
c:\program files\FindyKill\FindyKill.cmd
c:\program files\FindyKill\tmp4.txt
c:\program files\FindyKill\Tools\icob.ico
c:\program files\FindyKill\Tools\md5deep.exe
c:\program files\FindyKill\Tools\presentation.ico
c:\program files\FindyKill\Tools\Proc.exe
c:\program files\FindyKill\Tools\Process.exe
c:\program files\FindyKill\Tools\SP2.reg
c:\program files\FindyKill\Tools\SP3.reg
c:\program files\FindyKill\Tools\swreg.exe
c:\program files\FindyKill\Tools\Uac.reg
c:\program files\FindyKill\Tools\Vista.reg
c:\program files\FindyKill\Uninstal.exe
c:\program files\Symantec AntiVirus
c:\program files\Symantec AntiVirus\Cliproxy.dll
c:\program files\Symantec AntiVirus\Cliscan.dll
c:\program files\Symantec AntiVirus\clninst.bat
c:\program files\Symantec AntiVirus\COUNTRY.DAT
c:\program files\Symantec AntiVirus\Dec3.cfg
c:\program files\Symantec AntiVirus\Default.hst
c:\program files\Symantec AntiVirus\DefFileChanges.dll
c:\program files\Symantec AntiVirus\DefUtDCD.dll
c:\program files\Symantec AntiVirus\DefUtDCS.dll
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Symantec AntiVirus\DoScan.exe
c:\program files\Symantec AntiVirus\DWHWizrd.exe
c:\program files\Symantec AntiVirus\dwLdPntScan.dll
c:\program files\Symantec AntiVirus\GenMar.dll
c:\program files\Symantec AntiVirus\I2ldvp3.dll
c:\program files\Symantec AntiVirus\IMail.dll
c:\program files\Symantec AntiVirus\LDVPREG.exe
c:\program files\Symantec AntiVirus\LuaWrap.exe
c:\program files\Symantec AntiVirus\LuHstEdt.dll
c:\program files\Symantec AntiVirus\Navap32.dll
c:\program files\Symantec AntiVirus\NAVAPI32.DLL
c:\program files\Symantec AntiVirus\NAVLU.dll
c:\program files\Symantec AntiVirus\NAVNTUTL.DLL
c:\program files\Symantec AntiVirus\nlnhook.exe
c:\program files\Symantec AntiVirus\nLNVP.dll
c:\program files\Symantec AntiVirus\nnewdefs.dll
c:\program files\Symantec AntiVirus\notesext.dll
c:\program files\Symantec AntiVirus\OEHeur.dll
c:\program files\Symantec AntiVirus\patch25d.dll
c:\program files\Symantec AntiVirus\PATCH32I.DLL
c:\program files\Symantec AntiVirus\pki\roots\[u]0/u1d476d732145d4b9c17325e4c8eca66.0.servergroupca.cer
c:\program files\Symantec AntiVirus\PLATFORM.DAT
c:\program files\Symantec AntiVirus\qscomm32.dll
c:\program files\Symantec AntiVirus\QsInfo.dll
c:\program files\Symantec AntiVirus\qspak32.dll
c:\program files\Symantec AntiVirus\Rec2.dll
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\program files\Symantec AntiVirus\SAVCProd.dll
c:\program files\Symantec AntiVirus\SavEmail.dll
c:\program files\Symantec AntiVirus\savhelp.chm
c:\program files\Symantec AntiVirus\savmain.chm
c:\program files\Symantec AntiVirus\SavRoam.exe
c:\program files\Symantec AntiVirus\savrt.cat
c:\program files\Symantec AntiVirus\savrt.dat
c:\program files\Symantec AntiVirus\savrt.inf
c:\program files\Symantec AntiVirus\savrt.sys
c:\program files\Symantec AntiVirus\SAVRT\[u]0/u575NAV~.TMP
c:\program files\Symantec AntiVirus\SAVRT\[u]0/u868NAV~.TMP
c:\program files\Symantec AntiVirus\SavRT32.dll
c:\program files\Symantec AntiVirus\savrtpel.cat
c:\program files\Symantec AntiVirus\savrtpel.inf
c:\program files\Symantec AntiVirus\Savrtpel.sys
c:\program files\Symantec AntiVirus\SCANCFG.DAT
c:\program files\Symantec AntiVirus\SCANDLVR.DLL
c:\program files\Symantec AntiVirus\SCANDRES.DLL
c:\program files\Symantec AntiVirus\SDPCK32I.dll
c:\program files\Symantec AntiVirus\SDSNAPSX.dll
c:\program files\Symantec AntiVirus\SDSND32I.DLL
c:\program files\Symantec AntiVirus\SDSOK32I.DLL
c:\program files\Symantec AntiVirus\SDSTP32I.DLL
c:\program files\Symantec AntiVirus\SMSTR32I.DLL
c:\program files\Symantec AntiVirus\SRTLEXCL.DAT
c:\program files\Symantec AntiVirus\SRTPV.DAT
c:\program files\Symantec AntiVirus\SRTSEXCL.DAT
c:\program files\Symantec AntiVirus\SymProtectStorage.dll
c:\program files\Symantec AntiVirus\SystemSnapshotRules.bin
c:\program files\Symantec AntiVirus\VPC32.exe
c:\program files\Symantec AntiVirus\VPDN_LU.exe
c:\program files\Symantec AntiVirus\vpmsece4.dll
c:\program files\Symantec AntiVirus\VPTray.exe
c:\program files\Trend Micro
c:\program files\Trend Micro\HijackThis\backups\backup-20090117-150951-683
c:\program files\Trend Micro\HijackThis\HijackThis.exe
c:\program files\Trend Micro\HijackThis\hijackthis.log
c:\windows\gmer.ini

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-12-17 au 2009-01-17 ))))))))))))))))))))))))))))))))))))
.

2009-01-17 15:55 . 2009-01-17 16:46 <DIR> d--h----- c:\documents and settings\f_devits\Application Data\drivers
2009-01-16 12:33 . 2009-01-16 12:33 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-16 12:33 . 2009-01-16 12:33 <DIR> d-------- c:\documents and settings\f_devits\Application Data\Malwarebytes
2009-01-16 12:33 . 2009-01-16 12:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-16 12:33 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-16 12:33 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-11 16:51 . 2009-01-11 16:51 <DIR> d-------- c:\documents and settings\f_devits\Application Data\Nokia
2009-01-11 16:51 . 2009-01-11 16:51 <DIR> d-------- c:\documents and settings\f_devits\Application Data\Datalayer
2009-01-07 15:35 . 2009-01-07 15:36 <DIR> d-a------ C:\Devis
2008-12-23 15:22 . 2008-12-23 15:22 <DIR> d-------- c:\windows\Sun
2008-12-23 15:21 . 2008-12-23 15:21 <DIR> d-------- c:\program files\Java
2008-12-23 15:21 . 2008-12-23 15:21 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-23 15:21 . 2008-12-23 15:21 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-12-22 18:41 . 2007-02-27 18:36 1,700,352 --a------ c:\windows\system32\GdiPlus.dll
2008-12-22 18:41 . 2007-02-27 18:36 974,848 --a------ c:\windows\system32\mfc70.dll
2008-12-22 18:41 . 2007-02-27 18:36 487,424 --a------ c:\windows\system32\msvcp70.dll
2008-12-22 11:05 . 2009-01-05 13:11 9 --a------ C:\lmtiviewbinportnumber.ini
2008-12-22 11:05 . 2009-01-05 13:11 9 --a------ C:\lmtiviewalarmportnumber.ini
2008-12-19 18:18 . 2008-12-19 18:18 <DIR> d-------- c:\windows\system32\scripting
2008-12-19 18:18 . 2008-12-19 18:18 <DIR> d-------- c:\windows\system32\en
2008-12-19 18:18 . 2008-12-19 18:18 <DIR> d-------- c:\windows\system32\bits
2008-12-19 18:18 . 2008-12-19 18:18 <DIR> d-------- c:\windows\l2schemas
2008-12-19 18:16 . 2008-12-19 18:16 <DIR> d-------- c:\windows\ServicePackFiles
2008-12-19 14:54 . 2008-12-19 14:54 <DIR> d-------- c:\program files\MSXML 4.0
2008-12-19 06:07 . 2008-04-14 01:12 4,274,816 --------- c:\windows\system32\nv4_disp.dll
2008-12-19 06:06 . 2008-04-14 01:11 1,888,992 --------- c:\windows\system32\ati3duag.dll
2008-12-18 18:47 . 2009-01-11 16:51 <DIR> d-------- c:\documents and settings\f_devits\Phone Browser
2008-12-18 18:47 . 2008-12-18 18:47 <DIR> d-------- c:\documents and settings\f_devits\Application Data\PC Suite
2008-12-18 18:46 . 2008-12-18 18:47 <DIR> d-------- c:\program files\Nokia
2008-12-18 18:46 . 2008-12-18 18:46 <DIR> d-------- c:\program files\Common Files\PCSuite
2008-12-18 18:46 . 2008-12-18 18:46 <DIR> d-------- c:\program files\Common Files\Nokia

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-16 14:26 --------- d-----w c:\program files\Windows Media Connect 2
2009-01-16 13:22 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-15 16:30 --------- d-----w c:\program files\eMule
2009-01-04 20:11 --------- d-----w c:\program files\Google
2008-12-15 20:35 --------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2008-12-12 20:41 --------- d-----w c:\documents and settings\f_devits\Application Data\Media Player Classic
2008-12-12 19:13 --------- d-----w c:\program files\Ahead
2008-12-12 19:10 --------- d-----w c:\program files\Common Files\Ahead
2008-12-12 19:10 --------- d-----w c:\documents and settings\All Users\Application Data\Ahead
2008-12-12 18:20 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-12 18:17 --------- d-----w c:\program files\SeaMAC V4
2008-12-12 18:17 --------- d-----w c:\program files\Nortel
2008-12-12 18:16 --------- d-----w c:\program files\Nortel Networks
2008-12-12 18:14 --------- d-----w c:\program files\K-Lite Codec Pack
2008-12-12 13:36 --------- d-----w c:\program files\Common Files\Adobe
2008-12-12 13:34 --------- d-----w c:\program files\QuickTime
2008-12-12 13:34 --------- d-----w c:\program files\PDFCreator
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-10 17:00 --------- d-----w c:\program files\Microsoft Works
2008-12-10 16:55 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-12-10 16:21 --------- d-----w c:\program files\Symantec
2008-12-10 16:17 --------- d-----w c:\program files\HPQ
2008-12-10 16:17 --------- d-----w c:\program files\Hewlett-Packard
2008-12-10 16:17 --------- d-----w c:\documents and settings\Administrator\Application Data\hpqLog
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of c:\documents and settings\f_devits\Application Data\drivers ----

((((((((((((((((((((((((((((( snapshot@2009-01-17_16.55.22.95 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-17 16:38:47 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_758.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-04-20 847872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-05-03 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-05-03 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-05-03 138008]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-05-02 163840]
"AccelerometerSysTrayApplet"="c:\windows\system32\AccelerometerSt.exe" [2007-01-24 124928]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]
"LmtSysMonitor"="c:\hw lmt\tray\bin\ilmt_tray.exe" [2007-10-08 53248]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 167936]
"DataLayer"="c:\program files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 1106944]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-23 136600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-02-06 561213]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-09-10 525664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-183583537-3401663046-353351459-3168\Scripts\Logon\[u]0/u\[u]0/u]
"Script"=\\flcsrv02\NETLOGON\login.bat

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\HW LMT\\server\\lmtserver\\bin\\lmt_server.exe"=
"c:\\HW LMT\\uninstall\\jre\\jre_win\\bin\\javaw.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Nortel Networks\\BTS Tools\\Til coam\\v17a301\\tidle32.exe"=
"c:\\Program Files\\Nortel Networks\\BTS Tools\\Til coam\\v17a301\\til_coam98.exe"=
"c:\\HW LMT\\client\\lmt_client.exe"=
"c:\\HW LMT\\adaptor\\serveradaptor\\NodeB\\lib\\SFTPServer.exe"=
"c:\\HW LMT\\uninstall\\jre\\jre_win\\bin\\java.exe"=
"c:\\Program Files\\Nortel Networks\\BTS Tools\\Til coam\\v16a304\\tidle32.exe"=
"c:\\Program Files\\Nortel Networks\\BTS Tools\\Til coam\\v16a304\\til_coam98.exe"=

R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2007-01-23 36608]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [?]
S3 HP24X;HP PC Card Smart Card Reader;c:\windows\system32\drivers\HP24X.sys [2007-07-17 35072]
S3 SavRoam;SAVRoam;"c:\program files\Symantec AntiVirus\SavRoam.exe" --> c:\program files\Symantec AntiVirus\SavRoam.exe [?]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-vptray - c:\progra~1\SYMANT~1\VPTray.exe

.
------- Examen supplémentaire -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-17 17:39:47
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\scardsvr.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\igfxsrvc.exe
c:\hw lmt\server\lmtserver\bin\lmt_server.exe
c:\hw lmt\uninstall\jre\jre_win\bin\javaw.exe
c:\progra~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
c:\progra~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
.
**************************************************************************
.
Heure de fin: 2009-01-17 17:42:09 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-01-17 16:42:06
ComboFix2.txt 2009-01-17 15:58:29

Avant-CF: 82,907,680,768 bytes free
Après-CF: 82,674,089,984 bytes free

1148 --- E O F --- 2009-01-14 08:53:05

chiquitine29 voici le rapport combofix
ComboFix 09-01-16.03 - f_devits 2009-01-17 17:26:15.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.482 [GMT 1:00]
Lancé depuis: c:\documents and settings\f_devits\Desktop\killbagle.exe
Commutateurs utilisés :: c:\documents and settings\f_devits\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated)
* Un nouveau point de restauration a été créé

FILE ::
c:\windows\gmer.ini
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\_OTMoveIt
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942.log
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942.res
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\allu\Crack\AVSVideoConverter.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVS4YOUHelp.chm
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSSoftwareNavigator\AVS4YOUSoftwareNavigator.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSSoftwareNavigator\AVS4YOUSoftwareNavigator.sil
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSSoftwareNavigator\unins000.dat
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSSoftwareNavigator\unins000.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\About.rtf
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\AVSVideoConverter.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\AVSVideoConverter.sib
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\data\drawimage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Football\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Football\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Football\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Football\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Football\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Football\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Football\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Football\Football.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Jeans Style\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Jeans Style\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Jeans Style\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Jeans Style\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Jeans Style\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Jeans Style\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Jeans Style\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Jeans Style\Jeans Style.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Kids\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Kids\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Kids\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Kids\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Kids\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Kids\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Kids\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Kids\Kids.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Love\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Love\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Love\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Love\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Love\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Love\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Love\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Love\Love.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Loving Hearts\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Loving Hearts\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Loving Hearts\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Loving Hearts\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Loving Hearts\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Loving Hearts\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Loving Hearts\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Loving Hearts\Loving Hearts.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Loving Hearts\LovingHearts.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Autumn\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Autumn\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Autumn\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Autumn\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Autumn\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Autumn\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Autumn\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Autumn\Seasons - Autumn.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Spring\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Spring\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Spring\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Spring\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Spring\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Spring\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Spring\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Spring\Seasons - Spring.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Summer\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Summer\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Summer\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Summer\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Summer\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Summer\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Summer\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Summer\Seasons - Summer.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Winter\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Winter\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Winter\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Winter\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Winter\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Winter\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Winter\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Winter\Seasons - Winter.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Spring\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Spring\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Spring\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Spring\advanced\layers\Main 0.JPG
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Spring\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Spring\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Spring\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Spring\Spring.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Street Racing\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Street Racing\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Street Racing\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Street Racing\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Street Racing\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Street Racing\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Street Racing\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Street Racing\Street Racing.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Summer\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Summer\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Summer\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Summer\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Summer\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Summer\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Summer\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Summer\Summer.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Travel\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Travel\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Travel\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Travel\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Travel\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Travel\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Travel\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Travel\Travel.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Bithday\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Bithday\advanced\layers\Chapters 0.JPG
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Bithday\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Bithday\advanced\layers\Main 0.JPG
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Bithday\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Bithday\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Bithday\Bithday.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Bithday\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas 2\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas 2\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas 2\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas 2\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas 2\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas 2\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas 2\Christmas 2.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas 2\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas\Christmas.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Halloween\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Halloween\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Halloween\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Halloween\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Halloween\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Halloween\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Halloween\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Halloween\Halloween.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Wedding\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Wedding\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Wedding\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Wedding\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Wedding\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Wedding\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Wedding\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Wedding\Wedding.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cartoon\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cartoon\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cartoon\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cartoon\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cartoon\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cartoon\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cartoon\Cartoon.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cartoon\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cats\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cats\advanced\layers\Chapters 0.JPG
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cats\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cats\advanced\layers\Main 0.JPG
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cats\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cats\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cats\Cats.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cats\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Dolmatines\advanced\ChapterMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Dolmatines\advanced\layers\Chapters 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Dolmatines\advanced\layers\Chapters 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Dolmatines\advanced\layers\Main 0.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Dolmatines\advanced\layers\Main 1.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Dolmatines\advanced\MainMaskImage.png
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Dolmatines\config.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Dolmatines\Dolmatines.jpg
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\lame_enc.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\profiles\3gpprofiles.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\profiles\audioeffects.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\profiles\aviprofiles.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\profiles\dvdprofiles.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\profiles\flvprofiles.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\profiles\movprofiles.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\profiles\mp4profiles.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\profiles\mpegprofiles.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\profiles\rmprofiles.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\profiles\swfprofiles.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\profiles\wmvprofiles.xml
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\unins000.dat
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\AVSVideoConverter6\unins000.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\License Agreement.rtf
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\Registration.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\Registration.sil
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\Uninstall.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\AVS4YOU\Uninstall.sil
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSAudioCompress4.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSAudioDxPlayer4.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSAudioFile4.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSAudioTransform4.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSAudioTransformEx4.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSAVIFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSBluRayFiles.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\avscodecs.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSCoreCDFS.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSCoreDW.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSCoreSVCD.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSDataWriter3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSDVDAnalyzer.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSDVDDiskExt.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSDVDFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSDVDSubpicture.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSDVDSubpictureManager.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSDVFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSFlashBuilder3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSFLICFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSFLVFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSH263Codec.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSH264Codec.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSIFOFiles.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSImageCompose3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSImageFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSImagePaint3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSImageStudio3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSImageTransform3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSImageView4.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSM2TSFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSm2vFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMatroskaFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMediaCore3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMediaFormatSettings3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMJPEGFile.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMobileDevice2ActiveSync.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMobileDevice2MTP.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMobileDevice2ToshBT.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMobileDevice2UMS.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMobileDevice2Wire.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMobileDevice2Wireless.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMPEG2Codec.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMPEG4Codec.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMPEGCodecs.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMPEGFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSMPEGPSCore.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSOGMFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSPSCore3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSQ.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSQuickTimeFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSRMFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSSWFFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSUniversalVideoConverter.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSVideoCompress3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSVideoDVDMenu3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSVideoFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSVideoISOFile.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSVideoOutFilter3.ax
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSVideoOutput3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSVideoOverlay.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSVideoPlayer.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSVOBFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\AVSWMVFile3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\Repairing.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\100% Quality Download (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\128k Dual ISDN.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\12k Substream for 28k Dial-up.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\150k LAN.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\16k Substream for 28k Dial-up.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\1M Download (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\1M Multichannel (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\1M Surround Stereo (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\256k DSL or Cable.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\26k Substream for 56k Dial-up.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\28k Dial-up.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\2M Download (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\2M Multichannel (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\2M Surround Stereo (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\350k Download (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\350k Multichannel (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\350k Surround Stereo (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\384k DSL or Cable.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\450k Download (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\450k Multichannel (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\450k Surround Stereo (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\512k DSL or Cable.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\56k Dial-up.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\5M Download (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\5M Multichannel (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\5M Surround Stereo (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\64k Single ISDN.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\70% Quality Download (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\750k Download (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\750k Multichannel (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\750k Surround Stereo (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\768k DSL or Cable.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\80% Quality Download (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\90% Quality Download (VBR).rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\General Mobile Local Playback.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\General Mobile Streaming.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\Lossless Audio.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences\PocketPC Local Playback.rpad
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\codecs\atrc.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\codecs\colorcvt.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\codecs\cook.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\codecs\drv1.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\codecs\drv2.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\codecs\drvc.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\codecs\erv3.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\codecs\erv4.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\codecs\raac.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\codecs\ralf.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\codecs\sipr.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\plugins\auth3260.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\plugins\basc3260.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\plugins\rmwrtr.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\plugins\rn5a3260.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\plugins\sdpp3260.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\plugins\smplfsys.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\pncrt.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\audiofmtconverter.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\audiolimiter.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\audiolosslesscodec.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\audiometer.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\audioresampler.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\CodecMapping.txt
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\encsession.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\enlv3260.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\eventpack.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\mediasink.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\mpeg4audiopacketizer.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\rmme3260.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\rmsessionformat.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\rmto3260.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\rmwriter.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\rnaudiocodec.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\rnaudiopacketizer.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\rnvideocodec.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\videocolorconverter.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools\videolumaadj.dll
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\BurnerService\AVSVideoBurner.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\BurnerService\AVSVideoBurner.sil
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\BurnerService\unins000.dat
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\BurnerService\unins000.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\MobileUploader\AVSMobileUploader.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\MobileUploader\AVSMobileUploader.sil
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\MobileUploader\unins000.dat
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\MobileUploader\unins000.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\Registration\unins000.dat
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\AVSMedia\Registration\unins000.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Common Files\Symantec Shared\ccApp.exe
c:\_otmoveit\MovedFiles\[u]0/u1172009_160942\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
c:\documents and settings\All Users\Application Data\AVS4YOU
c:\documents and settings\All Users\Application Data\Symantec
c:\documents and settings\All Users\Application Data\Symantec\Common Client\ccEmlPxy.dat
c:\documents and settings\All Users\Application Data\Symantec\Common Client\settings.bak
c:\documents and settings\All Users\Application Data\Symantec\Common Client\settings.dat
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\1.Configuration.Log.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\1.Product.Inventory.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\1.Settings.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\10.Product.Inventory.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\10.Settings.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\2.Product.Inventory.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\2.Settings.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\3.Product.Inventory.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\3.Settings.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\4.Product.Inventory.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\4.Settings.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\5.Product.Inventory.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\5.Settings.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\6.Product.Inventory.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\6.Settings.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\7.Product.Inventory.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\7.Settings.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\8.Product.Inventory.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\8.Settings.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\9.Product.Inventory.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\9.Settings.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Configuration.Log.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\1231429965jtun_sav10en90107002.m25.full.zip
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\1231513325jtun_sav10en90108007.m25.full.zip
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\1231597865jtun_sav10en90109003.m25.full.zip
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\1231685369jtun_sav10en90110003.m25.full.zip
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\1231772066jtun_sav10en90111004.m25.full.zip
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\1231882339jtun_sav10en90112003.m25.full.zip
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\automatic$20liveupdate_3.0.0.160_english_livetri.zip
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\avenge$20microdefs25$20savcorp10_microdefsb.curdefs_symalllanguages_livetri.zip
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\avenge$20microdefs25$20savcorp10_microdefsb.dec_symalllanguages_livetri.zip
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\avenge$20microdefs25$20savcorp10_microdefsb.error_symalllanguages_livetri.zip
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\avenge$20microdefs25$20savcorp10_microdefsb.old_symalllanguages_livetri.zip
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\minitri.flg
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Log.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Product.Inventory.LastGood.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Product.Inventory.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Settings.LiveUpdate
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP0.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP0.sys
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP1.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP1.sys
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP10.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP10.sys
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP11.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP11.sys
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP12.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP12.sys
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP13.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP14.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP15.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP16.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP17.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP18.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP19.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP2.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP2.sys
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP20.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP21.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP22.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP23.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP24.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP25.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP26.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP27.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP28.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP29.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP3.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP3.sys
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP30.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP31.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP32.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP33.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP34.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP35.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP36.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP37.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP38.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP39.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP4.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP4.sys
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP40.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP41.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP42.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP43.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP44.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP45.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP46.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP47.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp\AP48.exe
c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\APTemp

hello chiquitine29

voici le rapport de combofix
ComboFix 09-01-16.03 - f_devits 2009-01-17 16:45:42.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.540 [GMT 1:00]
Lancé depuis: c:\documents and settings\f_devits\Desktop\killbagle.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated)
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\f_devits\Application Data\drivers\downld
c:\documents and settings\f_devits\Application Data\drivers\downld\2065328.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2065515.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2065546.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2087640.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2088078.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2088515.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2099265.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2101781.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2150750.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2151125.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2151187.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2161843.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2162875.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2163265.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2163968.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2164593.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2165000.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2181750.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2182171.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2182437.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2186531.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2189328.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2218234.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2218500.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\2218562.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\268062.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\283562.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\283593.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\292515.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\310359.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\310859.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\311109.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\320093.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\321828.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\358421.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\358843.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\358875.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\371515.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\372656.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\373062.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\373687.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\374296.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\374703.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\390625.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\391046.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\391312.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\395109.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\397156.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\513828.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\514093.exe
c:\documents and settings\f_devits\Application Data\drivers\downld\514156.exe
c:\documents and settings\f_devits\Application Data\drivers\srosa2.sys
c:\documents and settings\f_devits\Application Data\drivers\winupgro.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_srosa

((((((((((((((((((((((((((((( Fichiers créés du 2008-12-17 au 2009-01-17 ))))))))))))))))))))))))))))))))))))
.

2009-01-17 16:09 . 2009-01-17 16:09 <DIR> d-------- C:\_OTMoveIt
2009-01-17 15:55 . 2009-01-17 16:46 <DIR> d--h----- c:\documents and settings\f_devits\Application Data\drivers
2009-01-17 14:39 . 2009-01-17 14:39 250 --a------ c:\windows\gmer.ini
2009-01-17 09:41 . 2009-01-17 15:33 <DIR> d-------- c:\program files\FindyKill
2009-01-16 12:33 . 2009-01-16 12:33 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-16 12:33 . 2009-01-16 12:33 <DIR> d-------- c:\documents and settings\f_devits\Application Data\Malwarebytes
2009-01-16 12:33 . 2009-01-16 12:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-16 12:33 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-16 12:33 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-16 11:52 . 2009-01-17 14:57 <DIR> d-------- c:\program files\Trend Micro
2009-01-11 16:51 . 2009-01-11 16:51 <DIR> d-------- c:\documents and settings\f_devits\Application Data\Nokia
2009-01-11 16:51 . 2009-01-11 16:51 <DIR> d-------- c:\documents and settings\f_devits\Application Data\Datalayer
2009-01-07 15:35 . 2009-01-07 15:36 <DIR> d-a------ C:\Devis
2008-12-23 15:22 . 2008-12-23 15:22 <DIR> d-------- c:\windows\Sun
2008-12-23 15:21 . 2008-12-23 15:21 <DIR> d-------- c:\program files\Java
2008-12-23 15:21 . 2008-12-23 15:21 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-23 15:21 . 2008-12-23 15:21 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-12-22 18:43 . 2008-12-22 18:43 <DIR> d-------- c:\documents and settings\f_devits\Application Data\AVS4YOU
2008-12-22 18:43 . 2008-12-22 18:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\AVS4YOU
2008-12-22 18:41 . 2007-02-27 18:36 1,700,352 --a------ c:\windows\system32\GdiPlus.dll
2008-12-22 18:41 . 2007-02-27 18:36 974,848 --a------ c:\windows\system32\mfc70.dll
2008-12-22 18:41 . 2007-02-27 18:36 487,424 --a------ c:\windows\system32\msvcp70.dll
2008-12-22 11:05 . 2009-01-05 13:11 9 --a------ C:\lmtiviewbinportnumber.ini
2008-12-22 11:05 . 2009-01-05 13:11 9 --a------ C:\lmtiviewalarmportnumber.ini
2008-12-19 18:18 . 2008-12-19 18:18 <DIR> d-------- c:\windows\system32\scripting
2008-12-19 18:18 . 2008-12-19 18:18 <DIR> d-------- c:\windows\system32\en
2008-12-19 18:18 . 2008-12-19 18:18 <DIR> d-------- c:\windows\system32\bits
2008-12-19 18:18 . 2008-12-19 18:18 <DIR> d-------- c:\windows\l2schemas
2008-12-19 18:16 . 2008-12-19 18:16 <DIR> d-------- c:\windows\ServicePackFiles
2008-12-19 14:54 . 2008-12-19 14:54 <DIR> d-------- c:\program files\MSXML 4.0
2008-12-19 06:07 . 2008-04-14 01:12 4,274,816 --------- c:\windows\system32\nv4_disp.dll
2008-12-19 06:06 . 2008-04-14 01:11 1,888,992 --------- c:\windows\system32\ati3duag.dll
2008-12-18 18:47 . 2009-01-11 16:51 <DIR> d-------- c:\documents and settings\f_devits\Phone Browser
2008-12-18 18:47 . 2008-12-18 18:47 <DIR> d-------- c:\documents and settings\f_devits\Application Data\PC Suite
2008-12-18 18:46 . 2008-12-18 18:47 <DIR> d-------- c:\program files\Nokia
2008-12-18 18:46 . 2008-12-18 18:46 <DIR> d-------- c:\program files\Common Files\PCSuite
2008-12-18 18:46 . 2008-12-18 18:46 <DIR> d-------- c:\program files\Common Files\Nokia

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-17 15:09 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-16 14:26 --------- d-----w c:\program files\Windows Media Connect 2
2009-01-16 13:22 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-15 16:30 --------- d-----w c:\program files\eMule
2009-01-14 15:54 --------- d-----w c:\program files\Symantec AntiVirus
2009-01-04 20:11 --------- d-----w c:\program files\Google
2008-12-15 20:35 --------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2008-12-12 20:41 --------- d-----w c:\documents and settings\f_devits\Application Data\Media Player Classic
2008-12-12 19:13 --------- d-----w c:\program files\Ahead
2008-12-12 19:10 --------- d-----w c:\program files\Common Files\Ahead
2008-12-12 19:10 --------- d-----w c:\documents and settings\All Users\Application Data\Ahead
2008-12-12 18:20 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-12 18:17 --------- d-----w c:\program files\SeaMAC V4
2008-12-12 18:17 --------- d-----w c:\program files\Nortel
2008-12-12 18:16 --------- d-----w c:\program files\Nortel Networks
2008-12-12 18:14 --------- d-----w c:\program files\K-Lite Codec Pack
2008-12-12 13:36 --------- d-----w c:\program files\Common Files\Adobe
2008-12-12 13:34 --------- d-----w c:\program files\QuickTime
2008-12-12 13:34 --------- d-----w c:\program files\PDFCreator
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-10 17:00 --------- d-----w c:\program files\Microsoft Works
2008-12-10 16:55 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-12-10 16:21 --------- d-----w c:\program files\Symantec
2008-12-10 16:21 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-10 16:17 --------- d-----w c:\program files\HPQ
2008-12-10 16:17 --------- d-----w c:\program files\Hewlett-Packard
2008-12-10 16:17 --------- d-----w c:\documents and settings\Administrator\Application Data\hpqLog
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-04-20 847872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-05-03 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-05-03 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-05-03 138008]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-05-02 163840]
"AccelerometerSysTrayApplet"="c:\windows\system32\AccelerometerSt.exe" [2007-01-24 124928]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-09-27 125168]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]
"LmtSysMonitor"="c:\hw lmt\tray\bin\ilmt_tray.exe" [2007-10-08 53248]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 167936]
"DataLayer"="c:\program files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 1106944]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-23 136600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-02-06 561213]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-09-10 525664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-183583537-3401663046-353351459-3168\Scripts\Logon\[u]0/u\[u]0/u]
"Script"=\\flcsrv02\NETLOGON\login.bat

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\HW LMT\\server\\lmtserver\\bin\\lmt_server.exe"=
"c:\\HW LMT\\uninstall\\jre\\jre_win\\bin\\javaw.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Nortel Networks\\BTS Tools\\Til coam\\v17a301\\tidle32.exe"=
"c:\\Program Files\\Nortel Networks\\BTS Tools\\Til coam\\v17a301\\til_coam98.exe"=
"c:\\HW LMT\\client\\lmt_client.exe"=
"c:\\HW LMT\\adaptor\\serveradaptor\\NodeB\\lib\\SFTPServer.exe"=
"c:\\HW LMT\\uninstall\\jre\\jre_win\\bin\\java.exe"=
"c:\\Program Files\\Nortel Networks\\BTS Tools\\Til coam\\v16a304\\tidle32.exe"=
"c:\\Program Files\\Nortel Networks\\BTS Tools\\Til coam\\v16a304\\til_coam98.exe"=

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-12-10 99376]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2007-01-23 36608]
S3 HP24X;HP PC Card Smart Card Reader;c:\windows\system32\drivers\HP24X.sys [2007-07-17 35072]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2006-09-27 116464]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe

.
------- Examen supplémentaire -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-17 16:52:34
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\scardsvr.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\igfxsrvc.exe
c:\hw lmt\server\lmtserver\bin\lmt_server.exe
c:\hw lmt\uninstall\jre\jre_win\bin\javaw.exe
c:\progra~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
c:\progra~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
.
**************************************************************************
.
Heure de fin: 2009-01-17 16:58:28 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-01-17 15:58:25

Avant-CF: 82,940,928,000 bytes free
Après-CF: 82,923,823,104 bytes free

228 --- E O F --- 2009-01-14 08:53:05
BàT
fabnok

- le rapport de dirlook
DirLook.exe v2.0 by jpshortstuff
Log created at 16:32 on 17/01/2009
==================================[b]
Contents of "C:\allu\Crack"
[/b]
[b][color=blue]---FOLDERS---[/b][/color]

(none found)

[b][color=blue]---FILES---[/b][/color]

(none found)

==================================[b]
Contents of "C:\Documents and Settings\f_devits\Application Data\drivers"
[/b]
[b][color=blue]---FOLDERS---[/b][/color]

[b]downld[/b] (Created on 17/01/2009 at 14:55) d-----

[b][color=blue]---FILES---[/b][/color]

[b]srosa2.sys[/b] (7168 bytes - created on 17/01/2009 at 14:58, modified on 17/01/2009 at 15:15) --a---
[b]winupgro.exe[/b] (847880 bytes - created on 17/01/2009 at 14:58, modified on 15/09/2006 at 04:07) ------

==================================
[b][color=blue]=EOF=[/b][/color]

Ok merci verni29

en espérant pouvoir en sortir .
je te dit merci quand même

@+

salut chiquitine29 merci pour l'aide
voici le rapport
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\allu\Crack\AVSVideoConverter.exe moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\profiles moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Dolmatines\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Dolmatines\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Dolmatines moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cats\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cats\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cats moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cartoon\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cartoon\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets\Cartoon moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Pets moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Wedding\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Wedding\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Wedding moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Halloween\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Halloween\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Halloween moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas 2\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas 2\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas 2 moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Christmas moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Bithday\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Bithday\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday\Bithday moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Holiday moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Travel\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Travel\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Travel moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Summer\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Summer\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Summer moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Street Racing\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Street Racing\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Street Racing moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Spring\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Spring\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Spring moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Winter\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Winter\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Winter moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Summer\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Summer\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Summer moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Spring\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Spring\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Spring moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Autumn\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Autumn\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Seasons - Autumn moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Loving Hearts\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Loving Hearts\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Loving Hearts moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Love\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Love\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Love moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Kids\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Kids\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Kids moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Jeans Style\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Jeans Style\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Jeans Style moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Football\advanced\layers moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Football\advanced moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album\Football moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles\Album moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\DVDMenuStyles moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6\data moved successfully.
C:\Program Files\AVS4YOU\AVSVideoConverter6 moved successfully.
C:\Program Files\AVS4YOU\AVSSoftwareNavigator moved successfully.
C:\Program Files\AVS4YOU moved successfully.
C:\Program Files\Common Files\AVSMedia\Registration moved successfully.
C:\Program Files\Common Files\AVSMedia\MobileUploader moved successfully.
C:\Program Files\Common Files\AVSMedia\BurnerService moved successfully.
C:\Program Files\Common Files\AVSMedia\ActiveX\RMBin\tools moved successfully.
C:\Program Files\Common Files\AVSMedia\ActiveX\RMBin\plugins moved successfully.
C:\Program Files\Common Files\AVSMedia\ActiveX\RMBin\codecs moved successfully.
C:\Program Files\Common Files\AVSMedia\ActiveX\RMBin\audiences moved successfully.
C:\Program Files\Common Files\AVSMedia\ActiveX\RMBin moved successfully.
C:\Program Files\Common Files\AVSMedia\ActiveX moved successfully.
C:\Program Files\Common Files\AVSMedia moved successfully.
C:\Program Files\Common Files\Symantec Shared\ccApp.exe moved successfully.
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe moved successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_2dc.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01172009_160942

Files moved on Reboot...
File C:\WINDOWS\temp\Perflib_Perfdata_2dc.dat not found!
bàt fabnok

voici le rapport verni29

----------------- FindyKill V4.713 ------------------

* User : f_devits - FLCLXP27WW
* Executed from : C:\Program Files\FindyKill
* Update on 17/01/09 by Chiquitine29
* Start at 15:26:59 the 2009-01-17
* Windows XP - Internet Explorer 7.0.5730.13

((((((((((((((( *** deleting *** ))))))))))))))))))

--------------- [ Active Processes ] ----------------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

--------------- [ Infected files / folders ] ----------------

»»»» Supression files in C:

Deleted ! - "C:\Muestras"
Deleted ! - C:\InfoSat.txt

»»»» Supression files in C:\WINDOWS

»»»» Supression files in C:\WINDOWS\Prefetch

Deleted ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-30FB4C58.pf

»»»» Supression files in C:\WINDOWS\system32

»»»» Supression files in C:\WINDOWS\system32\drivers

»»»» Supression files in C:\Documents and Settings\f_devits\Application Data

Deleted ! - "C:\Documents and Settings\f_devits\Application Data\drivers\srosa2.sys"
Deleted ! - "C:\Documents and Settings\f_devits\Application Data\drivers\winupgro.exe"
Deleted ! - "C:\Documents and Settings\f_devits\Application Data\drivers\downld"
Deleted ! - "C:\Documents and Settings\f_devits\Application Data\drivers"

»»»» Supression files in C:\DOCUME~1\f_devits\LOCALS~1\Temp

»»»» Supression files in C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5

Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_1[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_1[4].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_2[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_3[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[4].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[5].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[6].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_2[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_3[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_3[4].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_3[5].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64[4].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_2[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_3[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_3[4].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_3[5].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[4].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[5].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[6].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_3[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_3[4].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_2[2].jpg

--------------- [ Registry / Infected keys ] ----------------

Deleted ! - HKEY_CURRENT_USER\Software\bisoft
Deleted ! - HKEY_USERS\S-1-5-21-183583537-3401663046-353351459-3168\Software\Local AppWizard-Generated Applications\winupgro

--------------- [ States / Restarting of services ] ----------------

+- Safe boot mode restored !

+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

EapHost - Type of startup = 2

Ip6Fw - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2

--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Fixed Drive

+- deleting files :

Not deleted !! - C:\autorun.inf

--------------- [ Registry / Mountpoint2 ] ----------------

-> Not found !

--------------- [ Searching Other Infections ] ----------------

Références de comparaison Bagle MD5 :

d8a9e541edae327d4fd34bcd80d34eac C:\Documents and Settings\f_devits\Application Data\drivers\winupgro.exe
d8a9e541edae327d4fd34bcd80d34eac C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b

Suspect ! - 1b1a6af3581681d8b9cb689c532922ca C:\allu\Crack\AVSVideoConverter.exe
Suspect ! - 5950bace7502e0cf14f8236fdbb039c7 C:\Program Files\AVS4YOU\AVSSoftwareNavigator\AVS4YOUSoftwareNavigator.exe
Suspect ! - 4ce59db357385381c20ab44465e5a3ca C:\Program Files\AVS4YOU\AVSVideoConverter6\AVSVideoConverter.exe
Suspect ! - 17edef0b1b14d618ccbd9a8f89f02a36 C:\Program Files\AVS4YOU\Registration.exe
Suspect ! - 96011d5a12161242d8c4eeba20e1fe0b C:\Program Files\Common Files\AVSMedia\BurnerService\AVSVideoBurner.exe
Suspect ! - 5e533484167ecc8a976e7ca93ee57caf C:\Program Files\Common Files\AVSMedia\MobileUploader\AVSMobileUploader.exe
Suspect ! - d8a9e541edae327d4fd34bcd80d34eac C:\Program Files\Common Files\Symantec Shared\ccApp.exe
Suspect ! - d8a9e541edae327d4fd34bcd80d34eac C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

--------------- [ Searching Cracks / Keygen ] ----------------

---------------- ! End of report ! ------------------

voici le rapport vern29

----------------- FindyKill V4.713 ------------------

* User : f_devits - FLCLXP27WW
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 17/01/09 par Chiquitine29
* Recherche effectuée à 15:10:26 le 2009-01-17
* Windows XP - Internet Explorer 7.0.5730.13

((((((((((((((((( *** Recherche *** ))))))))))))))))))

--------------- [ Processus actifs ] ----------------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\AccelerometerSt.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\HW LMT\tray\bin\ilmt_tray.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\HW LMT\server\lmtserver\bin\lmt_server.exe
C:\WINDOWS\system32\ctfmon.exe
C:\HW LMT\uninstall\jre\jre_win\bin\javaw.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\f_devits\Application Data\drivers\winupgro.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

--------------- [ Processus infectieux stoppés ] ----------------

"C:\Documents and Settings\f_devits\Application Data\drivers\winupgro.exe" (876)

--------------- [ Fichiers/Dossiers infectieux ] ----------------

»»»» Presence des fichiers dans C:

Found ! [2009-01-17 11:43] - "C:\Muestras"
Found ! [2009-01-17 13:21] - C:\InfoSat.txt

»»»» Presence des fichiers dans C:\WINDOWS

»»»» Presence des fichiers dans C:\WINDOWS\Prefetch

Found ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-30FB4C58.pf

»»»» Presence des fichiers dans C:\WINDOWS\system32

»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers

»»»» Presence des fichiers dans C:\Documents and Settings\f_devits\Application Data

Found ! [2009-01-17 14:54] - "C:\Documents and Settings\f_devits\Application Data\drivers"
Found ! [2009-01-17 14:54] - "C:\Documents and Settings\f_devits\Application Data\drivers\srosa2.sys"
Found ! [2006-09-15 05:07] - "C:\Documents and Settings\f_devits\Application Data\drivers\winupgro.exe"
Found ! [2009-01-17 14:57] - "C:\Documents and Settings\f_devits\Application Data\drivers\downld"

»»»» Presence des fichiers dans C:\DOCUME~1\f_devits\LOCALS~1\Temp

--------------- [ Registre / Startup ] ----------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
PcSync=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
IMJPMIG8.1="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
PHIME2002ASync=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
IgfxTray=C:\WINDOWS\system32\igfxtray.exe
HotKeysCmds=C:\WINDOWS\system32\hkcmd.exe
Persistence=C:\WINDOWS\system32\igfxpers.exe
QlbCtrl=%ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
AccelerometerSysTrayApplet=C:\WINDOWS\system32\AccelerometerSt.exe
ccApp="C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
vptray=C:\PROGRA~1\SYMANT~1\VPTray.exe
SoundMAXPnP=C:\Program Files\Analog Devices\Core\smax4pnp.exe
LmtSysMonitor="C:\HW LMT\tray\bin\ilmt_tray.exe"
PCSuiteTrayApplication=C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
DataLayer=C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
Installed=1
NoChange=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1
<NO NAME>=

[HKEY_CURRENT_USER\software\local appwizard-generated applications\ccApp]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\GoogleToolbarNotifier]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]

--------------- [ Registre / Clés infectieuses ] ----------------

Found ! - HKEY_USERS\S-1-5-21-183583537-3401663046-353351459-3168\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-183583537-3401663046-353351459-3168\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_CURRENT_USER\Software\bisoft

/!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1

--------------- [ Etat / Services ] ----------------

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot

/!\ Mode sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal

/!\ Mode sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network

/!\ Mode sans echec non fonctionnel !!

+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

/!\ Ndisuio - Type de démarrage = 4

EapHost - Type de démarrage = 2

/!\ Ip6Fw - Type de démarrage = 4

/!\ SharedAccess - Type de démarrage = 4

/!\ wuauserv - Type de démarrage = 4

/!\ wscsvc - Type de démarrage = 4

--------------- [ Recherche dans supports amovibles] ----------------

+- Informations :

C: - Fixed Drive

+- Contenu de l'autorun : C:\autorun.inf

+- presence des fichiers :

Found ! [2009-01-17 08:31][d--------] - C:\autorun.inf

--------------- [ Registre / Mountpoint2 ] ----------------

-> Not found !

------------------- ! Fin du rapport ! --------------------

bàt

verni29

voicidéja le rapport gmer
GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-01-17 14:54:21
Windows 5.1.2600 Service Pack 3

---- System - GMER 1.0.14 ----

SSDT 864AEAD0 ZwConnectPort
SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xA9827350]
SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xA9827580]

---- Devices - GMER 1.0.14 ----

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 eabfiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

---- EOF - GMER 1.0.14 ----
la suite arrive
bàt

berni29

voici déja le lien https://www.cjoint.com/?btoLJPRaVK

je fait le reste et poste

A+

verni29
en mode sans echec je n'y arrive pas ,sous windoxs c'est ok je l'ai passer plusieur fois comme tu le verra dans le rapport,suite a ça j'ai reouvert internet explorer et le fameux programme "NTSB investigator flight...." est revenu
voici le rapport

Sat Jan 17 11:43:35 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Por favor, envienos una muestra del fichero
C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b
a "virus@satinfo.es". Gracias.
C:\DOCUMENTS AND SETTINGS\F_DEVITS\APPLICATION DATA\DRIVERS\WINUPGRO.EXE --> Bagle Acceso Denegado.

Sat Jan 17 11:46:50 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Por favor, envienos una muestra del fichero
C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b
a "virus@satinfo.es". Gracias.
C:\DOCUMENTS AND SETTINGS\F_DEVITS\APPLICATION DATA\DRIVERS\WINUPGRO.EXE --> Bagle Renombrado a .VIR
C:\DOCUMENTS AND SETTINGS\F_DEVITS\APPLICATION DATA\DRIVERS\SROSA2.SYS --> Eliminado Bagle(rootkit)
C:\DOCUMENTS AND SETTINGS\F_DEVITS\APPLICATION DATA\DRIVERS\DOWNLD\440546.EXE --> Eliminado Bagle

Sat Jan 17 11:47:32 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\DOCUMENTS AND SETTINGS\F_DEVITS\APPLICATION DATA\DRIVERS\DOWNLD\453828.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\F_DEVITS\APPLICATION DATA\DRIVERS\DOWNLD\575750.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\F_DEVITS\APPLICATION DATA\DRIVERS\DOWNLD\579390.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\F_DEVITS\APPLICATION DATA\DRIVERS\DOWNLD\591656.EXE --> Eliminado Bagle

Sat Jan 17 11:47:42 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Jan 17 11:47:52 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Jan 17 11:47:53 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Sat Jan 17 11:48:05 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Jan 17 11:48:07 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Sat Jan 17 11:48:15 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Jan 17 11:48:17 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Sat Jan 17 11:48:31 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Jan 17 11:48:32 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Sat Jan 17 11:48:43 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Jan 17 11:48:45 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Sat Jan 17 11:48:54 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Jan 17 11:48:56 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Sat Jan 17 11:49:06 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Jan 17 11:49:08 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Sat Jan 17 11:49:17 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Jan 17 11:49:19 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Sat Jan 17 11:49:53 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Jan 17 11:49:54 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Sat Jan 17 11:50:42 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\Documents and Settings\f_devits\Application Data\Drivers\WINUPGRO.EXE.VIR --> Eliminado
Eliminada Carpeta "%AppData%\Drivers"
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Jan 17 11:50:44 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Nº Total de Directorios: 12703
Nº Total de Ficheros: 79067
Nº de Ficheros Analizados: 14151
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sat Jan 17 12:04:11 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Nº Total de Directorios: 12703
Nº Total de Ficheros: 79067
Nº de Ficheros Analizados: 14151
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sat Jan 17 12:18:50 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):

Sat Jan 17 12:18:52 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Nº Total de Directorios: 12702
Nº Total de Ficheros: 79066
Nº de Ficheros Analizados: 14151
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sat Jan 17 12:43:27 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Eliminada Carpeta "%AppData%\Drivers"

Sat Jan 17 12:43:35 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Nº Total de Directorios: 12703
Nº Total de Ficheros: 79068
Nº de Ficheros Analizados: 14151
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sat Jan 17 13:01:05 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Eliminada Carpeta "%AppData%\Drivers"

Sat Jan 17 13:01:06 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Nº Total de Directorios: 12703
Nº Total de Ficheros: 79067
Nº de Ficheros Analizados: 14151
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sat Jan 17 13:16:18 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
Eliminada Carpeta "%AppData%\Drivers"

Sat Jan 17 13:16:19 2009
EliBagle v12.11b (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Nº Total de Directorios: 12703
Nº Total de Ficheros: 79070
Nº de Ficheros Analizados: 14151
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0
Jespère que l'ont pourra dépatouiller ce truc :-)

bàt

A+
fab

verni29
le crack vecteru est déja supprimé dès le départ (quand j'ai remarqué qu'il était infecté)
voici le rapport de findykill

----------------- FindyKill V4.713 ------------------

* User : f_devits - FLCLXP27WW
* Executed from : C:\Program Files\FindyKill
* Update on 17/01/09 by Chiquitine29
* Start at 10:25:23 the 2009-01-17
* Windows XP - Internet Explorer 7.0.5730.13

((((((((((((((( *** deleting *** ))))))))))))))))))

--------------- [ Active Processes ] ----------------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

--------------- [ Infected files / folders ] ----------------

»»»» Supression files in C:

»»»» Supression files in C:\WINDOWS

»»»» Supression files in C:\WINDOWS\Prefetch

»»»» Supression files in C:\WINDOWS\system32

»»»» Supression files in C:\WINDOWS\system32\drivers

»»»» Supression files in C:\Documents and Settings\f_devits\Application Data

Deleted ! - "C:\Documents and Settings\f_devits\Application Data\drivers\downld"
Deleted ! - "C:\Documents and Settings\f_devits\Application Data\drivers"

»»»» Supression files in C:\DOCUME~1\f_devits\LOCALS~1\Temp

»»»» Supression files in C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5

Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_1[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_1[4].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_2[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ED03HIB7\b64_3[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[4].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[5].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64[6].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_2[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_3[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_3[4].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\LVF08PF7\b64_3[5].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64[4].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_2[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_3[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_3[4].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\SS59L4OI\b64_3[5].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[4].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[5].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_1[6].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_3[3].jpg
Deleted ! - C:\Documents and Settings\f_devits\Local Settings\Temporary Internet Files\Content.IE5\ZEWYNEN3\b64_3[4].jpg

--------------- [ Registry / Infected keys ] ----------------

Deleted ! - HKEY_CURRENT_USER\Software\bisoft

--------------- [ States / Restarting of services ] ----------------

+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

EapHost - Type of startup = 2

Ip6Fw - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2

--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Fixed Drive

+- deleting files :

Not deleted !! - C:\autorun.inf

--------------- [ Registry / Mountpoint2 ] ----------------

-> Not found !

--------------- [ Searching Other Infections ] ----------------

Suspect ! - 1b1a6af3581681d8b9cb689c532922ca C:\allu\Crack\AVSVideoConverter.exe
Suspect ! - 5950bace7502e0cf14f8236fdbb039c7 C:\Program Files\AVS4YOU\AVSSoftwareNavigator\AVS4YOUSoftwareNavigator.exe
Suspect ! - 4ce59db357385381c20ab44465e5a3ca C:\Program Files\AVS4YOU\AVSVideoConverter6\AVSVideoConverter.exe
Suspect ! - 17edef0b1b14d618ccbd9a8f89f02a36 C:\Program Files\AVS4YOU\Registration.exe
Suspect ! - 96011d5a12161242d8c4eeba20e1fe0b C:\Program Files\Common Files\AVSMedia\BurnerService\AVSVideoBurner.exe
Suspect ! - 5e533484167ecc8a976e7ca93ee57caf C:\Program Files\Common Files\AVSMedia\MobileUploader\AVSMobileUploader.exe
Suspect ! - d8a9e541edae327d4fd34bcd80d34eac C:\Program Files\Common Files\Symantec Shared\ccApp.exe
Suspect ! - d8a9e541edae327d4fd34bcd80d34eac C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

--------------- [ Searching Cracks / Keygen ] ----------------

---------------- ! End of report ! ------------------
Après le scan de findykill lors de la reconnection vers internet explorer je remarque toujours ce programme que je ne connais pas "NTSB investigator flight recorder (blak box) analyser"
j'ai fait une saisie d'écran mais ne sais commen la poster
J'ai aussi remarquer que "C:\Documents and Settings\f_devits\Application Data\drivers\winupgro.exe" était toujour présent

BàT
A+